diff --git a/luci-app-adguardhome/.official_channel b/luci-app-adguardhome/.official_channel new file mode 100644 index 000000000..d7025695e --- /dev/null +++ b/luci-app-adguardhome/.official_channel @@ -0,0 +1 @@ +release diff --git a/luci-app-adguardhome/.official_json_version b/luci-app-adguardhome/.official_json_version new file mode 100644 index 000000000..0abf5391a --- /dev/null +++ b/luci-app-adguardhome/.official_json_version @@ -0,0 +1 @@ +26.268.33051~dd3d1cb diff --git a/luci-app-adguardhome/.prepare.sh b/luci-app-adguardhome/.prepare.sh new file mode 100755 index 000000000..92a72fb1f --- /dev/null +++ b/luci-app-adguardhome/.prepare.sh @@ -0,0 +1,19 @@ +PKG_NAME="$1" +CURDIR="$2" +PKG_BUILD_DIR="$3" + +if [ -d "$CURDIR/.git" ]; then + config="$CURDIR/.git/config" +else + config="$(sed "s|^gitdir:\s*|$CURDIR/|;s|$|/config|" "$CURDIR/.git")" +fi +if grep -q -E "url.*gitcode\.(com|net)" "$config"; then + for d in htdocs patches po root; do + rm -rf "$PKG_BUILD_DIR"/$d + done + mkdir -p "$PKG_BUILD_DIR"/htdocs/luci-static/resources/view + touch "$PKG_BUILD_DIR"/htdocs/luci-static/resources/view/$PKG_NAME.js + mkdir -p "$PKG_BUILD_DIR"/root/usr/share/luci/menu.d + touch "$PKG_BUILD_DIR"/root/usr/share/luci/menu.d/$PKG_NAME.json +fi +exit 0 diff --git a/luci-app-adguardhome/.upstream_meta b/luci-app-adguardhome/.upstream_meta new file mode 100644 index 000000000..cfffae49d --- /dev/null +++ b/luci-app-adguardhome/.upstream_meta @@ -0,0 +1,2 @@ +c3d5b719f5337ceefa8b5b1f6c1d7b96965a3812 +e192c5983e50169ed984d48b094798869a0a780b diff --git a/luci-app-adguardhome/LICENSE b/luci-app-adguardhome/LICENSE index b09cd7856..261eeb9e9 100644 --- a/luci-app-adguardhome/LICENSE +++ b/luci-app-adguardhome/LICENSE @@ -1,4 +1,4 @@ -Apache License + Apache License Version 2.0, January 2004 http://www.apache.org/licenses/ diff --git a/luci-app-adguardhome/Makefile b/luci-app-adguardhome/Makefile old mode 100755 new mode 100644 index 0ff9b510c..ec35f246d --- a/luci-app-adguardhome/Makefile +++ b/luci-app-adguardhome/Makefile @@ -1,14 +1,33 @@ -# Copyright 2024- Douglas Orend -# This is free software, licensed under the Apache License, Version 2.0 +# SPDX-License-Identifier: GPL-2.0-only include $(TOPDIR)/rules.mk -PKG_LICENSE:=Apache-2.0 +LUCI_NAME:=luci-app-adguardhome +LUCI_MAINTAINER:=Jackie264 +PKG_LICENSE:=GPL-2.0-only +PKG_CPE_ID:=cpe:/a:Jackie264:luci-app-adguardhome -LUCI_TITLE:=LuCI support for AdguardHome -LUCI_DEPENDS:=+adguardhome +luci-base +curl +LUCI_TITLE:=LuCI support for AdGuard Home +LUCI_DEPENDS:=+luci-base +LUCI_PKGARCH:=all +USERID:=adguardhome=853:adguardhome=853 -PKG_MAINTAINER:=Douglas Orend +PKG_UNPACK:=$(CURDIR)/.prepare.sh $(PKG_NAME) $(CURDIR) $(PKG_BUILD_DIR) + +define Package/luci-app-adguardhome/conffiles +/etc/adguardhome/adguardhome.yaml +/etc/config/adguardhome +endef + +define Package/luci-app-adguardhome/prerm +#!/bin/sh +[ -n "$${IPKG_INSTROOT}" ] || { + rm -f /tmp/luci-indexcache.* + rm -rf /tmp/luci-modulecache/ + /etc/init.d/rpcd reload 2>/dev/null +} +exit 0 +endef include $(TOPDIR)/feeds/luci/luci.mk diff --git a/luci-app-adguardhome/README.md b/luci-app-adguardhome/README.md index d7bf4af4e..47e20c610 100644 --- a/luci-app-adguardhome/README.md +++ b/luci-app-adguardhome/README.md @@ -1,13 +1,48 @@ -# LuCI App AdGuardHome - -**NOTE:** Original Source found for LUCI app [here](https://github.com/openwrt/luci/tree/3253c2644215a1ea8136199044e06ad5e4fd9de9/applications/luci-app-adguardhome) by Duncan Hill (). - -## Screenshots - -### Configuration Tab -![MAC Filter Tab](https://github.com/kiddin9/luci-app-adguardhome/blob/main/.github/images/config.png?raw=true) - -### Status Tab -![Status Tab](https://github.com/kiddin9/luci-app-adguardhome/blob/main/.github/images/status.png?raw=true) +## luci-app-adguardhome +#### (Modified version based on the official source code) +### Overview of changes +- Migrate from lua to luci standard js +- Add a global switch +- Add the UI interface to create/modify AGH password function +- Add UI interface to modify AGH management binding ip:port function +- You can choose AGH as dnsmasq upstream, redirect 53 port, switch dnsmasq 53 port or do nothing +- Update the kernel to choose the Latest/Beta version, download from AGH mirror station/AGH github station +- When updating the kernel, you can choose the Latest/Beta version, and to download from AGH mirror station/AGH github station. +- Dynamically obtain ***WAN*** interface passed to nft rules + +### Default behaviors +> [!TIP] +> Use the following rules to exclude inbound traffic from **WAN** to avoid exposing the router to !!️ **Public Parser**!!️ +> +> This function is only effective in "Redirect" mode. +> ``` +> iifname { __WAN_EXCLUDES__ } return +> ``` +> +> The rest of the `53` port traffic that matches the `target is local` will be redirected to the listening port of **AdGuard Home** +> ``` +> fib daddr type local udp dport 53 redirect to :__AGH_PORT__ +> fib daddr type local tcp dport 53 redirect to :__AGH_PORT__ +> ``` + +> [!CAUTION] +> *Only suitable for the OpenWRT official version, and questions generated by third parties will not be answered* +> +> *Only `nftables` is supported, the one is still using `iptables` may have problems* +> +> *The device name can be viewed through `ip a` / `ifconfig`* + +### Attribution +#### Reference +- [OpenWRT official luci](https://github.com/openwrt/luci/tree/master/applications/luci-app-adguardhome) +- [OpenWRT official packages](https://github.com/openwrt/packages/tree/master/net/adguardhome) + +#### Acknowledgment +Inspired by +- [@w9315273 nft version](https://github.com/w9315273/luci-app-adguardhome) +- [@rufengsuixing](https://github.com/rufengsuixing/luci-app-adguardhome) + +#### Notice +If the author of the original code has any objections, please contact me to deal with it. diff --git a/luci-app-adguardhome/SECURITY.md b/luci-app-adguardhome/SECURITY.md new file mode 100644 index 000000000..034e84803 --- /dev/null +++ b/luci-app-adguardhome/SECURITY.md @@ -0,0 +1,21 @@ +# Security Policy + +## Supported Versions + +Use this section to tell people about which versions of your project are +currently being supported with security updates. + +| Version | Supported | +| ------- | ------------------ | +| 5.1.x | :white_check_mark: | +| 5.0.x | :x: | +| 4.0.x | :white_check_mark: | +| < 4.0 | :x: | + +## Reporting a Vulnerability + +Use this section to tell people how to report a vulnerability. + +Tell them where to go, how often they can expect to get an update on a +reported vulnerability, what to expect if the vulnerability is accepted or +declined, etc. diff --git a/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js b/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js index 5e5d3695d..12fc3ab4f 100644 --- a/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js +++ b/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js @@ -1,16 +1,82 @@ 'use strict'; -'require rpc'; + +'require dom'; 'require form'; -'require view'; +'require fs'; 'require poll'; +'require rpc'; +'require uci'; +'require view'; const DEFAULT_CONFIG_FILE = '/etc/adguardhome/adguardhome.yaml'; const DEFAULT_WORK_DIR = '/var/lib/adguardhome'; const DEFAULT_USER = 'adguardhome'; const DEFAULT_GROUP = DEFAULT_USER; +const DEFAULT_GOGC = '0'; +const DEFAULT_GOMAXPROCS = '0'; +const DEFAULT_GOMEMLIMIT = '0'; + const PATH_REGEX = new RegExp('^/etc(/[^/]+)?/?$'); +const POLL_INTERVAL = 5; + +const RUNNING_SPAN = `${_('Running')}`; +const NOT_RUNNING_SPAN = `${_('Not running')}`; + +const STORAGE_KEY = 'luci-app-adguardhome'; +const STORAGE_KEY_CORE = 'luci-app-adguardhome_core_update'; + +function getServiceInfo(name) { + const fn = rpc.declare({ + object: 'service', + method: 'list', + params: ['name'], + expect: { [name]: { instances: { [name]: {} }}}, + }); + return () => fn(name); +} + +const getAGHServiceInfo = getServiceInfo('adguardhome'); + +async function getStatus() { + try { + const res = await getAGHServiceInfo(); + const isRunning = res?.instances?.adguardhome?.running; + return isRunning ?? false; + } catch (e) { + console.error(e); + return false; + } +} + +function getStatusValue(isRunning) { + return isRunning ? RUNNING_SPAN : NOT_RUNNING_SPAN; +} + +async function getVersion() { + try { + const res = await fs.exec('/usr/bin/AdGuardHome', ['--version']); + const version = res.stdout + ? (res.stdout.match(/version\s+(.*)/) || [null, res.stdout.trim()])[1] + : ''; + return version; + } catch (e) { + console.error(e); + return ''; + } +} + +function updateStatus(node) { + const output = node?.querySelector('output'); + return output + ? async () => { + const isRunning = await getStatus(); + dom.content(output, getStatusValue(isRunning)); + } + : () => {}; +} + function validateConfigFile(_unused, value) { if (value == null || value === '') { return true; @@ -37,122 +103,518 @@ function validateWorkDir(_unused, value) { return true; } -function renderStatus(status, agh_config) { - var spanTemp = '%s %s'; - var renderHTML; - if (status.running) { - var button = String.format(' %s', - agh_config.web_url, _('Open Web Interface')); - renderHTML = spanTemp.format('green', _('adguardhome'), _('RUNNING')) + button; - } else { - renderHTML = spanTemp.format('red', _('adguardhome'), _('NOT RUNNING')); - } - - return renderHTML; -} - return view.extend({ - load_adguardhome_config: rpc.declare({ - object: 'luci.adguardhome', - method: 'get_config' - }), - load_adguardhome_status: rpc.declare({ - object: 'luci.adguardhome', - method: 'get_status' - }), - load: function () { + load() { return Promise.all([ - this.load_adguardhome_status(), - this.load_adguardhome_config() + getStatus(), + getVersion(), + uci.load('adguardhome').then(() => { + const sections = uci.sections('adguardhome', 'adguardhome'); + const sec = sections.length > 0 ? sections[0] : {}; + const configFile = sec.config_file || DEFAULT_CONFIG_FILE; + return fs.read(configFile).catch(() => null); + }) ]); }, - render: function (data) { - var status = data[0] || {}; - var agh_config = data[1] || {}; - // A basic configuration form; the luci.adguardhome script that - // powers the other UI pages needs a username and password to - // communicate with the AdguardHome REST API. - var s, o; - var m = new form.Map('adguardhome', _('AdGuard Home Configuration'), - _('默认用户名admin 密码admin') + + async render([isRunning, version, yamlContent]) { + // If there is a version number, it means that the kernel exists. If there is no version number, it does not exist. + const coreExists = Boolean(version); + let dnsPort = '53'; + if (yamlContent) { + const portMatches = yamlContent.match(/port:\s*(\d+)/g); + if (portMatches && portMatches.length >= 2) { + const actualPort = portMatches[1].match(/\d+/); + if (actualPort) { + dnsPort = actualPort[0]; + } + } + } + + // 💡 Dynamic security value: UI rendering requires httpport to generate jump links + const sections = uci.sections('adguardhome', 'adguardhome'); + const savedHttpPort = (sections.length > 0 && sections[0].httpport) ? sections[0].httpport : '3008'; + + const map = new form.Map('adguardhome', _('AdGuard Home')); + + const statusSect = map.section(form.TypedSection, 'status'); + statusSect.anonymous = true; + statusSect.cfgsections = () => ['status_section']; + + const versionOpt = statusSect.option(form.DummyValue, '_version', _('Version')); + versionOpt.cfgvalue = () => version || `${_('Not installed')}`; + versionOpt.rawhtml = true; + + const statusOpt = statusSect.option(form.DummyValue, '_status', _('Service Status')); + statusOpt.rawhtml = true; + statusOpt.cfgvalue = () => getStatusValue(isRunning); + + const mainSect = map.section(form.TypedSection, 'adguardhome'); + mainSect.anonymous = true; + + mainSect.tab('general', _('General Settings')); + mainSect.tab( + 'jail', + _('File System Access'), + _('Files and directories that AdGuard Home should have read-only or read-write access to.'), + ); + mainSect.tab('dns_redirect', _('Services Settings')); + mainSect.tab( + 'core_update', + _('Core Update'), + _('Settings and operations for updating the AdGuardHome core binary.') + ); + mainSect.tab( + 'advanced', + _('Advanced Settings'), + _('Go environment variables that tune garbage collector and memory management.') + + ' ' + _('Modify at your own risk.'), ); - s = m.section(form.TypedSection); - s.anonymous = true; - - s.render = function () { - setTimeout(function() { - poll.add(function () { - var view = document.getElementById('service_status'); - view.innerHTML = renderStatus(status, agh_config); - }); - }, 0); - - return E('div', { class: 'cbi-section', id: 'status_bar' }, [ - E('p', { id: 'service_status' }, _('Collecting data...')) - ]); + // ==== Move here: global switch ==== + const enabledOpt = mainSect.taboption( + 'general', + form.Flag, + 'enabled', + _('Enable') + ); + enabledOpt.default = '0'; + enabledOpt.rmempty = false; + // If the kernel does not exist, additional warning prompts will guide users to turn on the service to download automatically. + if (!coreExists) { + enabledOpt.description = `${_('Core binary not found. Enable the service to trigger an automatic download.')}`; } - - s = m.section(form.NamedSection, 'config', 'adguardhome', _('General settings')); - o = s.option(form.Flag, 'enabled', _('Enable')); - o.default = o.disabled; - o.rmempty = false; - o = s.option(form.Value, 'config_file', _('Configuration file')); - o.datatype = 'string'; - o.placeholder = DEFAULT_CONFIG_FILE; - o.validate = validateConfigFile; + const configFileOpt = mainSect.taboption( + 'general', + form.Value, + 'config_file', + _('Configuration file'), + _('Configuration file must be stored in its own directory, and not in \'/etc\'.') + + '
' + _('Parent directory will be owned by the service user.') + + '
' + _('If empty, defaults to') + ` '${DEFAULT_CONFIG_FILE}'.`, + ); + configFileOpt.placeholder = DEFAULT_CONFIG_FILE; + configFileOpt.validate = validateConfigFile; - o = s.option(form.Value, 'work_dir', _('Work Dir')); - o.datatype = 'string'; - o.placeholder = DEFAULT_WORK_DIR; - o.validate = validateWorkDir; + const workDirOpt = mainSect.taboption( + 'general', + form.Value, + 'work_dir', + _('Working directory'), + _('Directory where filters, logs, and statistics are stored.') + + '
' + _('Will be owned by the service user.') + + '
' + _('If empty, defaults to') + ` '${DEFAULT_WORK_DIR}'.`, + ); + workDirOpt.placeholder = DEFAULT_WORK_DIR; + workDirOpt.validate = validateWorkDir; - o = s.option(form.Value, 'user', _('Service user'), _('User the service runs under.')); - o.datatype = 'string'; - o.placeholder = DEFAULT_USER; + const userOpt = mainSect.taboption( + 'general', + form.Value, + 'user', + _('Service user'), + _('User the service runs under.') + ' ' + _('If empty, defaults to') + + ` '${DEFAULT_USER}'.`, + ); + userOpt.placeholder = DEFAULT_USER; - o = s.option(form.Value, 'group', _('Service group'), _('Group the service runs under.')); - o.datatype = 'string'; - o.placeholder = DEFAULT_GROUP; + const groupOpt = mainSect.taboption( + 'general', + form.Value, + 'group', + _('Service group'), + _('Group the service runs under.') + ' ' + _('If empty, defaults to') + + ` '${DEFAULT_GROUP}'.`, - // 添加重定向模式选择 - o = s.option(form.ListValue, 'redirect', _('Redirect'), _('AdGuardHome redirect mode')); - o.value('none', _('none')); - o.value('dnsmasq-upstream', _('Run as dnsmasq upstream server')); - o.value('redirect', _('Redirect 53 port to AdGuardHome')); - o.value('exchange', _('Use port 53 replace dnsmasq')); - o.default = 'none'; + ); + groupOpt.placeholder = DEFAULT_GROUP; - o = s.option(form.Value, 'web_username', _('Username for AdGuard Home'), _('The username you configured when you set up AdGuard Home')); - o.default = 'admin'; + const verboseOpt = mainSect.taboption( + 'general', + form.Flag, + 'verbose', + _('Verbose logging'), + ); + verboseOpt.default = '0'; - o = s.option(form.Value, 'web_password', _('Password for AdGuard Home'), _('The password you configured when you set up AdGuard Home')); - o.password = true; - o.default = 'admin'; + const advSettingsOpt = mainSect.taboption( + 'general', + form.Flag, + 'advanced_settings', + _('Advanced Settings'), + ); + advSettingsOpt.default = '0'; + advSettingsOpt.rmempty = false; + advSettingsOpt.load = () => sessionStorage.getItem(STORAGE_KEY) || '0'; + advSettingsOpt.remove = () => {}; + advSettingsOpt.write = (_, value) => sessionStorage.setItem(STORAGE_KEY, value); - var ChangePassword = form.Button.extend({ - set_passwd: rpc.declare({ - object: 'luci.adguardhome', - method: 'set_passwd', - params: [ 'username', 'hash' ], - }), - onclick: function() { - var username = document.getElementById("widget.cbid.adguardhome.config.web_username").value; - var password = document.getElementById("widget.cbid.adguardhome.config.web_password").value; - var hash = TwinBcrypt.hashSync(password); - return Promise.all([ this.set_passwd( username, hash ) ]); - }, + // ==== New: The switch of Core Update on General tab ==== + const coreUpdateToggleOpt = mainSect.taboption( + 'general', + form.Flag, + 'enable_core_update', + _('Core Update'), + _('Show the tab and settings for updating the AdGuardHome core binary.') + ); + coreUpdateToggleOpt.default = '0'; + coreUpdateToggleOpt.rmempty = false; + coreUpdateToggleOpt.load = () => sessionStorage.getItem(STORAGE_KEY_CORE) || '0'; + coreUpdateToggleOpt.remove = () => {}; + coreUpdateToggleOpt.write = (_, value) => sessionStorage.setItem(STORAGE_KEY_CORE, value); + // ========================================== + + mainSect.taboption('jail', form.DynamicList, 'jail_mount', _('Read-only access')); + mainSect.taboption('jail', form.DynamicList, 'jail_mount_rw', _('Read-write access')); + + const gcOpt = mainSect.taboption( + 'advanced', + form.Value, + 'gc', + 'GOGC', + _('Tunes the garbage collector\'s aggressiveness by setting the percentage of heap ' + + 'growth allowed before the next collection cycle triggers.') + '
' + + _('If empty, defaults to') + ' ' + _('unset and 100') + '.', + 'https://go.dev/doc/gc-guide#GOGC' + ); + gcOpt.datatype = 'uinteger'; + gcOpt.depends('advanced_settings', '1'); + gcOpt.placeholder = DEFAULT_GOGC; + gcOpt.retain = true; + + const maxProcsOpt = mainSect.taboption( + 'advanced', + form.Value, + 'maxprocs', + 'GOMAXPROCS', + _('The maximum number of operating system threads that can execute user-level Go code' + + ' simultaneously.') + '
' + + _('If empty, defaults to') + ' ' + _('unset and matching the number of CPUs') + '.', + ); + maxProcsOpt.datatype = 'uinteger'; + maxProcsOpt.depends('advanced_settings', '1'); + maxProcsOpt.placeholder = DEFAULT_GOMAXPROCS; + maxProcsOpt.retain = true; + + const memLimitOpt = mainSect.taboption( + 'advanced', + form.Value, + 'memlimit', + 'GOMEMLIMIT', + _('A soft memory cap for the Go runtime, allowing the garbage collector to run more ' + + 'frequently as usage approaches the limit to prevent Out-of-Memory (OOM) kills.') + + '
' + + _('If empty, defaults to') + ' ' + _('unset') + '.', + ); + memLimitOpt.datatype = 'uinteger'; + memLimitOpt.depends('advanced_settings', '1'); + memLimitOpt.placeholder = DEFAULT_GOMEMLIMIT; + memLimitOpt.retain = true; + + // 💡 1. Extract the real listening address and port directly from YAML + let realHttpAddress = '0.0.0.0:3008'; + if (yamlContent) { + // Match the address: field below http: in YAML + const addrMatch = yamlContent.match(/address:\s*([^\s]+)/); + if (addrMatch && addrMatch[1]) { + realHttpAddress = addrMatch[1]; + } + } + + // 💡 2. Analyze the real IP and port used by the jump button + let linkIp = window.location.hostname; + let linkPort = '3008'; + const addrParts = realHttpAddress.split(':'); + if (addrParts.length >= 2) { + linkPort = addrParts.pop(); + let ipPart = addrParts.join(':').replace(/\[|\]/g, ''); + // If the binding is a full zero address, the IP accessed by the current router will be returned. + if (ipPart !== '0.0.0.0' && ipPart !== '') { + linkIp = ipPart; + } + } + + // 💡 3. Upgrade the original httpport to http_address + const isServiceEnabled = sections.length > 0 && sections[0].enabled === '1'; + const disabledHint = _('Service is disabled. Please go to "General Settings" to enable it.'); + + // 💡 4. WebUI button HTML to construct intelligent state + const webuiBtnHtml = isServiceEnabled + ? `${_('Open AdGuardHome WebUI')}` + : ` + ${_('Open AdGuardHome WebUI')} + `; + + // 💡 5. Rendering components + const httpAddressOpt = mainSect.taboption( + 'dns_redirect', + form.Value, + 'http_address', + _('WebUI listener (address:port)'), + _('Bind to specific interface:port (e.g., 0.0.0.0:3008). Leave as 0.0.0.0 to listen on all interfaces.') + + `
${webuiBtnHtml}` + ); + httpAddressOpt.placeholder = '0.0.0.0:3008'; + httpAddressOpt.default = '0.0.0.0:3008'; + httpAddressOpt.datatype = 'hostport'; + httpAddressOpt.rmempty = false; + + // 🎯 Overwrite the default reading UCI behavior and forcibly echo the real value in YAML + httpAddressOpt.cfgvalue = function(section_id) { + return realHttpAddress; + }; + + // ==== Add the password modification function below the WebUI port ==== + const isPasswordEmpty = yamlContent ? /password:[ \t]*(\r?\n|$)/.test(yamlContent) : false; + const hashPassOpt = mainSect.taboption( + 'dns_redirect', + form.Value, + 'hashpass', + _('Change password'), + _('Enter the password here. Click the Load calculate Module button below and go on.') + + '
' + ); + hashPassOpt.default = ''; + hashPassOpt.datatype = 'string'; + hashPassOpt.password = true; + hashPassOpt.rmempty = true; + hashPassOpt.placeholder = isPasswordEmpty ? _('Please create a new password.') : ''; + hashPassOpt.cfgvalue = function(section_id) { + return ''; + }; + + const redirectOpt = mainSect.taboption( + 'dns_redirect', + form.ListValue, + 'redirect', + `${dnsPort} ` + _('Redirect'), + _('AdGuardHome redirect mode') + ); + redirectOpt.value('none', _('No redirect')); + redirectOpt.value('dnsmasq-upstream', _('As the upstream server of dnsmasq')); + redirectOpt.value('redirect', _('Redirect port 53 to AdGuardHome')); + redirectOpt.value('exchange', _('Use port 53 to replace dnsmasq')); + redirectOpt.default = 'none'; + redirectOpt.rmempty = false; + // ========================================== + + // ======== Core Update Control content ======== + const coreVersionOpt = mainSect.taboption( + 'core_update', + form.ListValue, + 'core_version', + _('Core Branch'), + _('Select the branch for the core binary update.') + ); + coreVersionOpt.value('latest', _('Latest Version')); + coreVersionOpt.value('beta', _('Beta Version')); + coreVersionOpt.default = 'latest'; + coreVersionOpt.depends('enable_core_update', '1'); + coreVersionOpt.retain = true; + + const coreUrlOpt = mainSect.taboption( + 'core_update', + form.ListValue, + 'update_url', + _('Update URL'), + _('Select the download link for the core update.') + ); + coreUrlOpt.value('https://static.adtidy.org/adguardhome/release/AdGuardHome_linux_${Arch}.tar.gz', _('Official Mirror (AdTidy - Recommended)')); + coreUrlOpt.value('https://github.com/AdguardTeam/AdGuardHome/releases/download/${Cloud_Version}/AdGuardHome_linux_${Arch}.tar.gz', _('GitHub Releases (Original)')); + coreUrlOpt.default = 'https://static.adtidy.org/adguardhome/release/AdGuardHome_linux_${Arch}.tar.gz'; + coreUrlOpt.rmempty = false; + coreUrlOpt.depends('enable_core_update', '1'); + coreUrlOpt.retain = true; + + const updateActionOpt = mainSect.taboption( + 'core_update', + form.DummyValue, + '_update_action', + _('Action') + ); + updateActionOpt.rawhtml = true; + updateActionOpt.cfgvalue = () => ` +
+ + +
+ + `; + updateActionOpt.depends('enable_core_update', '1'); + // ========================================== + + const rendered = await map.render(); + + const statusNode = map.findElement('data-field', statusOpt.cbid('status_section')); + poll.add(updateStatus(statusNode), POLL_INTERVAL); + + // ========== Update the status and polling logic ========= + let updatePollId = null; + + function startLogPolling() { + if (updatePollId) clearInterval(updatePollId); + const pollAction = () => { + const btnU = document.getElementById('btn-agh-update'); + const btnF = document.getElementById('btn-agh-force'); + const logC = document.getElementById('agh-update-log-container'); + const logT = document.getElementById('agh-update-log'); + + if (btnU) btnU.disabled = true; + if (btnF) btnF.style.display = 'inline-block'; + if (logC) logC.style.display = 'block'; + + fs.read('/tmp/AdGuardHome_update.log').then((txt) => { + if (txt && logT) { + logT.value = txt; + logT.scrollTop = logT.scrollHeight; + } + }).catch(() => {}); + + Promise.all([ + fs.stat('/var/run/update_core').catch(() => null), + fs.stat('/var/run/update_core_done').catch(() => null), + fs.stat('/var/run/update_core_error').catch(() => null) + ]).then(([isCore, isDone, isError]) => { + if (isDone) { + clearInterval(updatePollId); + fs.remove('/var/run/update_core_done').catch(() => {}); + if (btnU) { + btnU.disabled = false; + btnU.textContent = _('Updated'); + } + } else if (isError) { + clearInterval(updatePollId); + if (btnU) { + btnU.disabled = false; + btnU.textContent = _('Failed'); + } + } else if (!isCore && !isDone && !isError) { + clearInterval(updatePollId); + if (btnU) { + btnU.disabled = false; + btnU.textContent = _('Already up-to-date'); + } + } + }); + }; + + pollAction(); + updatePollId = setInterval(pollAction, 1500); + } + + function applyUpdate(isForce) { + const btnU = document.getElementById('btn-agh-update'); + const logC = document.getElementById('agh-update-log-container'); + const logT = document.getElementById('agh-update-log'); + if (btnU) { + btnU.textContent = _('Checking...'); + btnU.disabled = true; + } + + if (logC) logC.style.display = 'block'; + if (logT) logT.value = _('Checking and preparing...\n'); + + map.save().then(() => { + const arg = isForce ? 'force' : ''; + fs.exec('/usr/share/AdGuardHome/update_core.sh', [arg]).catch((err) => { + console.error('Failed to trigger update script:', err); + }); + startLogPolling(); + }).catch((err) => { + console.error('Config save failed:', err); + if (btnU) { + btnU.textContent = _('Save Failed'); + btnU.disabled = false; + } + }); + } + + rendered.addEventListener('click', (e) => { + if (e.target && e.target.id === 'btn-agh-update') { + e.preventDefault(); + applyUpdate(false); + } else if (e.target && e.target.id === 'btn-agh-force') { + e.preventDefault(); + applyUpdate(true); + } + // ==== Handle front-end hash encryption logic ==== + else if (e.target && e.target.id === 'btn-agh-calc-hash') { + e.preventDefault(); + const btn = e.target; + + // Dynamically find the password input box on the page (matching elements with the suffix .hashpass) + const inputs = rendered.querySelectorAll('input[type="text"], input[type="password"]'); + let passInput = null; + for (const el of inputs) { + if (el.id && el.id.endsWith('.hashpass')) { + passInput = el; + break; + } + } + + if (!passInput) return; + + // 1. If JS has not been loaded, it will be loaded dynamically. + if (typeof window.TwinBcrypt === 'undefined') { + btn.disabled = true; + btn.textContent = _('Loading...'); + + const script = document.createElement('script'); + script.src = L.resource('view/adguardhome/twin-bcrypt.min.js'); + script.type = 'text/javascript'; + + script.onload = () => { + btn.textContent = _('Click here to Calculate'); + btn.disabled = false; + }; + script.onerror = () => { + btn.textContent = _(' ... Load Error ... '); + btn.disabled = false; + }; + document.head.appendChild(script); + } + // 2. If JS has been loaded, the calculation will be executed. + else { + if (passInput.value) { + // Prevent repeated hashing of hashed strings (starting with $2a$ or $2y$) + if (passInput.value.startsWith('$2a$') || passInput.value.startsWith('$2y$')) { + btn.textContent = _('Calculation already DONE !'); + return; + } + + const hash = window.TwinBcrypt.hashSync(passInput.value); + passInput.value = hash; + + // Manually trigger native input and change events + passInput.dispatchEvent(new Event('input', { bubbles: true })); + passInput.dispatchEvent(new Event('change', { bubbles: true })); + + btn.textContent = _(' ... Click Save/Apply ↘️ ... '); + } else { + btn.textContent = _(' ... Nothing inputted yet ... '); + } + } + } + // ========================================== }); - o = s.option(ChangePassword, 'change_password', _('Change Password')); - var BCryptInclude = form.DummyValue.extend({ - renderWidget: function(section_id, option_index, cfgvalue) { - return E('script', { 'type':'text/javascript', 'src':'/luci-static/resources/view/twin-bcrypt.min.js' }); + Promise.all([ + fs.stat('/var/run/update_core').catch(() => null), + fs.stat('/var/run/update_core_error').catch(() => null) + ]).then(([isCore, isError]) => { + if (isCore || isError) { + const btnU = document.getElementById('btn-agh-update'); + if (btnU) btnU.textContent = _('Checking...'); + startLogPolling(); } }); - o = s.option(BCryptInclude, 'misc'); + // ========================================== - return m.render(); + return rendered; }, -}) +}); diff --git a/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/logs.js b/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/logs.js deleted file mode 100644 index 21d043771..000000000 --- a/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/logs.js +++ /dev/null @@ -1,44 +0,0 @@ -'use strict'; -'require dom'; -'require fs'; -'require poll'; -'require ui'; -'require view'; - -return view.extend({ - load: function() { - return Promise.all([ - L.resolveDefault(fs.stat('/sbin/logread'), null), - L.resolveDefault(fs.stat('/usr/sbin/logread'), null) - ]).then(function(stat) { - var logger = stat[0] ? stat[0].path : stat[1] ? stat[1].path : null; - - return fs.exec_direct(logger, [ '-e', 'AdGuardHome' ]).catch(function(err) { - ui.addNotification(null, E('p', {}, _('Unable to load log data: ' + err.message))); - return ''; - }); - }); - }, - - render: function(logdata) { - var loglines = logdata.trim().split(/\n/).reverse().slice(0, 50); - - return E([], [ - E('h2', {}, [_('System Log (AdGuard Home)')]), - E('div', {}, [_('Showing last 50 lines')]), - E('div', { 'id': 'content_syslog' }, [ - E('textarea', { - 'id': 'syslog', - 'style': 'font-size:12px', - 'readonly': 'readonly', - 'wrap': 'off', - 'rows': loglines.length + 1 - }, [ loglines.join('\n') ]) - ]) - ]); - }, - - handleSave: null, - handleSaveApply: null, - handleReset: null -}); diff --git a/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/status.js b/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/status.js deleted file mode 100644 index ef0450163..000000000 --- a/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/status.js +++ /dev/null @@ -1,171 +0,0 @@ -'use strict'; -'require rpc'; -'require view'; - -return view.extend({ - load_adguardhome_config: rpc.declare({ - object: 'luci.adguardhome', - method: 'get_config' - }), - load_adguardhome_status: rpc.declare({ - object: 'luci.adguardhome', - method: 'get_status' - }), - load_adguardhome_statistics: rpc.declare({ - object: 'luci.adguardhome', - method: 'get_statistics' - }), - - generic_failure: function(message) { - return E('div', {'class': 'error'}, [_('RPC call failure: '), message]) - }, - render_list: function ( agh_list ) { - var table = E('ul', {}); - for (var i = 0; i < agh_list.length; i++) { - table.appendChild(E('li', {}, agh_list[i])); - } - return table; - }, - render_status_table: function (status, agh_config) { - if (status.error) { - return this.generic_failure(status.error) - } - // Take a hint from the base LuCI module for the Overview page, - // declare the fields and use a loop to build the tabular status view. - // Written out as key/value pairs, but it's just an iterable of elements. - const weburl = agh_config.web_url; - const listen_addresses = L.isObject(status.dns_addresses) ? this.render_list(status.dns_addresses) : _('Not found'); - const bootstrap_dns = L.isObject(agh_config.dns_bootstrap_dns) ? this.render_list(agh_config.dns_bootstrap_dns) : _('Not found'); - const upstream_dns = L.isObject(agh_config.dns_upstream_dns) ? this.render_list(agh_config.dns_upstream_dns) : _('Not found'); - const fields = [ - _('Running'), status.running ? _('Yes') : _('No'), - _('Protection enabled'), status.protection_enabled ? _('Yes') : _('No'), - _('Statistics period (days)'), agh_config.statistics_interval, - _('Web interface'), E('button', { 'class': "cbi-button cbi-button-button" }, E('a', { 'href': weburl, 'target': '_blank' }, weburl)), - _('DNS listen port'), status.dns_port, - _('DNS listen addresses'), listen_addresses, - _('Bootstrap DNS addresses'), bootstrap_dns, - _('Upstream DNS addresses'), upstream_dns, - _('Version'), status.version, - ]; - - var table = E('table', { 'class': 'table', 'id': 'status' }); - for (var i = 0; i < fields.length; i += 2) { - table.appendChild(E('tr', { 'class': 'tr' }, [ - E('td', { 'class': 'td left', 'width': '33%', 'vertical-align': 'text-top' }, [fields[i]]), - E('td', { 'class': 'td left' }, [(fields[i + 1] != null) ? fields[i + 1] : _('Not found')]) - ])); - } - return table; - }, - render_statistics_table: function (statistics) { - // High level statistics - if (statistics.error) { - return this.generic_failure(statistics.error) - } - const fields = [ - _('DNS queries'), statistics.num_dns_queries, - _('DNS blocks'), statistics.num_blocked_filtering, - _('DNS replacements (safesearch)'), statistics.num_replaced_safesearch, - _('DNS replacements (malware/phishing)'), statistics.num_replaced_safebrowsing, - _('Average processing time (seconds)'), statistics.avg_processing_time, - ]; - - var table = E('table', { 'class': 'table', 'id': 'statistics' }); - for (var i = 0; i < fields.length; i += 2) { - table.appendChild( - E('tr', { 'class': 'tr' }, [ - E('td', { 'class': 'td left', 'width': '33%' }, [fields[i]]), - E('td', { 'class': 'td left' }, [(fields[i + 1] != null) ? fields[i + 1] : _('Not found')]) - ])); - } - return table; - }, - render_top_table: function(table_id, objects) { - var table = E('table', { 'class': 'table', 'id': table_id }); - for (var i = 0; i < objects.length; i++) { - table.appendChild( - E('tr', { 'class': 'tr' }, [ - E('td', { 'class': 'td left', 'width': '33%' }, Object.keys(objects[i])[0]), - E('td', { 'class': 'td left' }, Object.values(objects[i])[0]) - ]) - ); - } - return table; - }, - render_top_queries_table: function (statistics) { - // Top 5 queried domains table view - if (statistics.error) { - return this.generic_failure(statistics.error) - } - if (typeof statistics.top_queried_domains === 'undefined') { return ""; } - const top_queries = statistics.top_queried_domains.slice(0, 5); - return this.render_top_table('top_queries', top_queries) - }, - render_top_blocked_table: function (statistics) { - // Top 5 blocked domains table view - if (statistics.error) { - return this.generic_failure(statistics.error) - } - if (typeof statistics.top_blocked_domains === 'undefined') { return ""; } - const top_blocked = statistics.top_blocked_domains.slice(0, 5); - return this.render_top_table('top_blocked', top_blocked) - }, - // Core LuCI functions from here on. - load: function () { - return Promise.all([ - this.load_adguardhome_status(), - this.load_adguardhome_statistics(), - this.load_adguardhome_config() - ]); - }, - render: function (data) { - // data[0] should be load_adguardhome_status() result - var status = data[0] || {}; - // data[1] should be load_adguardhome_statistics() result - var statistics = data[1] || {}; - // data[2] should be load_adguardhome_config() result - var agh_config = data[2] || {}; - - // status.auth_error is only filled in when the config fetch failed - // to get the credentials. That stops all activity, since the user must - // first configure the username and password. Don't even bother trying - // to make REST API calls without credentials. - if (status.auth_error) { - return E('div', { 'class': 'cbi-map', 'id': 'map' }, [ - E('div', { 'class': 'cbi-section' }, [ - E('div', { 'class': 'left' }, [ - E('h2', _('AdGuard Home Status - Error')), - E('div', { 'class': 'error' }, status.auth_error), - E('div', { 'class': 'info' }, _('Please open the Configuration section, and provide the credentials.')) - ]) - ]), - ]); - } - - // Render all the status tables as one big block. - return E('div', { 'class': 'cbi-map', 'id': 'map' }, [ - E('div', { 'class': 'cbi-section' }, [ - E('div', { 'class': 'left' }, [ - E('h2', _('AdGuard Home Status')), - this.render_status_table(status, agh_config) - ]), - E('div', { 'class': 'left' }, [ - E('h3', _('AdGuard Home Statistics')), - this.render_statistics_table(statistics) - ]), - E('div', { 'class': 'left' }, [ - E('h3', _('Top Queried Domains')), - this.render_top_queries_table(statistics) - ]), - E('div', { 'class': 'left' }, [ - E('h3', _('Top Blocked Domains')), - this.render_top_blocked_table(statistics) - ]) - ]), - ]); - }, - handleSave: null, - handleSaveApply: null, - handleReset: null -}) diff --git a/luci-app-adguardhome/htdocs/luci-static/resources/view/twin-bcrypt.min.js b/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/twin-bcrypt.min.js similarity index 99% rename from luci-app-adguardhome/htdocs/luci-static/resources/view/twin-bcrypt.min.js rename to luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/twin-bcrypt.min.js index 6284357c6..3a0326804 100644 --- a/luci-app-adguardhome/htdocs/luci-static/resources/view/twin-bcrypt.min.js +++ b/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/twin-bcrypt.min.js @@ -4,4 +4,4 @@ * Licence: BSD-3-Clause */ !function(r,n){"use strict";function e(r){return y[g]=t.apply(n,r),g++}function t(r){var e=[].slice.call(arguments,1);return function(){"function"==typeof r?r.apply(n,e):new Function(""+r)()}}function o(r){if(m)setTimeout(t(o,r),0);else{var n=y[r];if(n){m=!0;try{n()}finally{a(r),m=!1}}}}function a(r){delete y[r]}function i(){p=function(){var r=e(arguments);return process.nextTick(t(o,r)),r}}function u(){if(r.postMessage&&!r.importScripts){var n=!0,e=r.onmessage;return r.onmessage=function(){n=!1},r.postMessage("","*"),r.onmessage=e,n}}function f(){var n="setImmediate$"+Math.random()+"$",t=function(e){e.source===r&&"string"==typeof e.data&&0===e.data.indexOf(n)&&o(+e.data.slice(n.length))};r.addEventListener?r.addEventListener("message",t,!1):r.attachEvent("onmessage",t),p=function(){var t=e(arguments);return r.postMessage(n+t,"*"),t}}function c(){var r=new MessageChannel;r.port1.onmessage=function(r){var n=r.data;o(n)},p=function(){var n=e(arguments);return r.port2.postMessage(n),n}}function s(){var r=v.documentElement;p=function(){var n=e(arguments),t=v.createElement("script");return t.onreadystatechange=function(){o(n),t.onreadystatechange=null,r.removeChild(t),t=null},r.appendChild(t),n}}function l(){p=function(){var r=e(arguments);return setTimeout(t(o,r),0),r}}if(!r.setImmediate){var p,g=1,y={},m=!1,v=r.document,d=Object.getPrototypeOf&&Object.getPrototypeOf(r);d=d&&d.setTimeout?d:r,"[object process]"==={}.toString.call(r.process)?i():u()?f():r.MessageChannel?c():v&&"onreadystatechange"in v.createElement("script")?s():l(),d.setImmediate=p,d.clearImmediate=a}}(new Function("return this")()),function(r){"object"==typeof exports?r(exports,require("crypto")):r(self.TwinBcrypt={},self.crypto||self.msCrypto)}(function(r,n){"use strict";function e(r){for(var n=unescape(encodeURIComponent(r)),e=n.length,t=new Array(e),o=0;e>o;o++)t[o]=n.charCodeAt(o);return t}function t(r){for(var n=r.length,e=new Array(n),t=0;n>t;t++)e[t]=r.charCodeAt(t);return e}function o(r,n){for(var e,t,o=0,a="";n>o;){if(e=255&r[o++],a+=B[e>>2],e=(3&e)<<4,o>=n){a+=B[e];break}if(t=255&r[o++],e|=t>>4,a+=B[e],e=(15&t)<<2,o>=n){a+=B[e];break}t=255&r[o++],e|=t>>6,a+=B[e],a+=B[63&t]}return a}function a(r){for(var n,e,t=new Array(16),o=0,a=0;;){if(n=D[r.charCodeAt(o++)-46],e=D[r.charCodeAt(o++)-46],t[a++]=255&(n<<2|e>>4),22===o)break;n=e<<4,e=D[r.charCodeAt(o++)-46],t[a++]=255&(n|e>>2),n=e<<6,e=D[r.charCodeAt(o++)-46],t[a++]=255&(n|e)}return t}function i(r){for(var n=r.length,e=new Array(72),t=0,o=0;72>o;)e[o++]=r[t++],t===n&&(t=0);return e}function u(r,n,e){for(var t=0,o=e>>2;tt;)r[n++]=e[t++]<<24|e[t++]<<16|e[t++]<<8|e[t++]}function c(r){function n(n){for(var e=r,t=G>>2,o=t|O,f=n>>2,c=e[f]^e[t],s=e[1|f];o>t;)s^=(e[c>>>24]+e[a|c>>>16&255]^e[i|c>>>8&255])+e[u|255&c]^e[++t],c^=(e[s>>>24]+e[a|s>>>16&255]^e[i|s>>>8&255])+e[u|255&s]^e[++t];e[f]=s^e[S>>2],e[1|f]=c}function e(n){var e;for(r[L>>2]=0,r[L+4>>2]=0,e=0;M>e;e++)r[G>>2|e]^=r[(n>>2)+e];var t,o,f,c,s,l=r;for(e=0;M>e;e+=2){for(t=G>>2,o=t|O,f=L>>2,c=l[f]^l[t],s=l[1|f];o>t;)s^=(l[c>>>24]+l[a|c>>>16&255]^l[i|c>>>8&255])+l[u|255&c]^l[++t],c^=(l[s>>>24]+l[a|s>>>16&255]^l[i|s>>>8&255])+l[u|255&s]^l[++t];l[f]=s^l[S>>2],l[1|f]=c,r[G>>2|e]=l[f],r[G>>2|e+1]=c}for(e=0;T>e;e+=2){for(t=G>>2,o=t|O,f=L>>2,c=l[f]^l[t],s=l[1|f];o>t;)s^=(l[c>>>24]+l[a|c>>>16&255]^l[i|c>>>8&255])+l[u|255&c]^l[++t],c^=(l[s>>>24]+l[a|s>>>16&255]^l[i|s>>>8&255])+l[u|255&s]^l[++t];l[f]=s^l[S>>2],l[1|f]=c,r[e]=l[f],r[1|e]=c}}function t(r,n,t){for(var o=0;t>=o&&!(r>n);o++)e(R),e(j),r++;return r}var o=k>>2,a=o+256|0,i=a+256|0,u=i+256|0;return{encrypt:n,expandLoop:t}}function s(stdlib, foreign, heap) {"use asm";var HEAP32=new stdlib.Uint32Array(heap);var BLOWFISH_NUM_ROUNDS=16;var S_offset=0x0000;var S1_offset=0x0400;var S2_offset=0x0800;var S3_offset=0x0C00;var P_offset=0x1000;var P_last_offset=0x1044;var crypt_ciphertext_offset=0x1048;var LR_offset=0x01060;var password_offset=0x1068;var salt_offset=0x10b0;var P_LEN=18;var S_LEN=1024;function encrypt(offset) {offset=offset|0;var i=0;var n=0;var L=0;var R=0;var imax=0;imax=P_offset|BLOWFISH_NUM_ROUNDS<<2;L=HEAP32[offset>>2]|0;R=HEAP32[offset+4>>2]|0;L=L^HEAP32[P_offset>>2];for (i=P_offset; (i|0)<(imax|0);) {i=(i+4)>>>0;R=R^(((HEAP32[(L>>>22)>>2]>>>0) +(HEAP32[(S1_offset|(L>>>14&0x3ff))>>2]>>>0) ^(HEAP32[(S2_offset|(L>>>6&0x3ff))>>2])) +(HEAP32[(S3_offset|(L<<2&0x3ff))>>2]>>>0))^HEAP32[i>>2];i=(i+4)>>>0;L=L^(((HEAP32[(R>>>22)>>2]>>>0) +(HEAP32[(S1_offset|(R>>>14&0x3ff))>>2]>>>0) ^(HEAP32[(S2_offset|(R>>>6&0x3ff))>>2])) +(HEAP32[(S3_offset|(R<<2&0x3ff))>>2]>>>0))^HEAP32[i>>2];}HEAP32[offset>>2]=R^HEAP32[P_last_offset>>2];HEAP32[(offset+4)>>2]=L;}function expandKey(offset) {offset=offset|0;var i=0;var off=0;off=P_offset|0;for (i=0; (i|0)<(P_LEN|0); i=(i+1)|0) {HEAP32[off>>2]=HEAP32[off>>2]^HEAP32[offset>>2];offset=(offset+4)|0;off=(off+4)|0;}HEAP32[LR_offset>>2]=0;HEAP32[LR_offset+4>>2]=0;off=P_offset;for (i=0; (i|0)<(P_LEN|0); i=(i+2)|0) {encrypt(LR_offset);HEAP32[off>>2]=HEAP32[LR_offset>>2];HEAP32[off+4>>2]=HEAP32[LR_offset+4>>2];off=(off+8)|0;}off=S_offset;for (i=0; (i|0)<(S_LEN|0); i=(i+2)|0) {encrypt(LR_offset);HEAP32[off>>2]=HEAP32[LR_offset>>2];HEAP32[off+4>>2]=HEAP32[LR_offset+4>>2];off=(off+8)|0;}}function expandLoop(i, counterEnd, maxIterations) {i=i|0;counterEnd=counterEnd|0;maxIterations=maxIterations|0;var j=0;for (j=0; (j|0) <= (maxIterations|0); j=(j+1)|0) {if ((i>>>0)>(counterEnd>>>0)) break;expandKey(password_offset);expandKey(salt_offset);i=(i+1)>>>0;}return i|0;}return {encrypt: encrypt,expandLoop: expandLoop};} -function l(r,n,e,t){var o,a,i,u=L>>2,f=u+1;for(t[u]=0,t[f]=0,a=0,o=0;M>o;o++)i=n[a++]<<24|n[a++]<<16|n[a++]<<8|n[a++],t[G>>2|o]^=i;for(a=0,o=0;M>o;o+=2)i=r[a++]<<24|r[a++]<<16|r[a++]<<8|r[a++],a&=65295,t[u]^=i,i=r[a++]<<24|r[a++]<<16|r[a++]<<8|r[a++],a&=65295,t[f]^=i,e.encrypt(L),t[G>>2|o]=t[u],t[G>>2|o+1]=t[f];var c=k>>2;for(o=0;T>o;o+=2)i=r[a++]<<24|r[a++]<<16|r[a++]<<8|r[a++],a&=65295,t[u]^=i,i=r[a++]<<24|r[a++]<<16|r[a++]<<8|r[a++],a&=65295,t[f]^=i,e.encrypt(L),t[c|o]=t[u],t[c|o+1]=t[f]}function p(r,n,e,t,o,a,i){for(var u=e;t>=u;){if(u=r.expandLoop(u,t,o),a){var f=a(u/(t+1));if(f===!1)return}if(u>t){if(i)return void setImmediate(g.bind(null,r,n,i));return}if(i)return void setImmediate(p.bind(null,r,n,u,t,o,a,i))}}function g(r,n,e){u(n,x,F);var t;for(t=0;64>t;t++)r.encrypt(F+0),r.encrypt(F+8),r.encrypt(F+16);var o,a=0,i=x.length,f=new Array(4*i);for(t=0;i>t;t++)o=n[(F>>2)+t],f[a++]=o>>24,f[a++]=o>>16&255,f[a++]=o>>8&255,f[a++]=255&o;return e&&e(f),f}function y(r,n){return r+o(n,23)}function m(n,o,m,v){var d,h=o.substr(0,29),w=+o.substr(4,2),A=o.substr(7,22);if("string"==typeof n)d=r.encodingMode===r.ENCODING_UTF8?e(n):t(n);else if(Array.isArray(n))d=n.map(function(r){return 255&r});else{if(!(n instanceof Uint8Array))throw new Error("Incorrect arguments");d=Array.prototype.slice.call(n)}d.push(0);var b,E,N=a(A,C),O=31>w?1<>2,N),f(b,R>>2,d),l(N,d,E,b),v?void p(E,b,0,M,T,m,function(r){v(y(h,r))}):(p(E,b,0,M,T,m),y(h,g(E,b)))}function v(r){if(!b)throw new Error("No cryptographically secure pseudorandom number generator available.");if(null==r&&(r=N),r=0|+r,isNaN(r)||4>r||r>31)throw new Error("Invalid cost parameter.");var n="$2y$";return 10>r&&(n+="0"),n+=r+"$",n+=o(b(C),C)}function d(r,n,e){if(n&&"number"!=typeof n){if("string"!=typeof n||!z.test(n))throw new Error("Invalid salt")}else n=v(n);return m(r,n,e)}function h(r,n,e,t){if(arguments.length<2)throw new Error("Incorrect arguments");if(2===arguments.length?(t=n,n=e=null):3===arguments.length&&(t=e,e=null,"function"==typeof n&&(e=n,n=null)),n&&"number"!=typeof n){if("string"!=typeof n||!z.test(n))throw new Error("Invalid salt")}else n=v(n);if(!t||"function"!=typeof t)throw new Error("No callback function was given.");m(r,n,e,t)}function w(r,n){if("string"!=typeof n||!Z.test(n))throw new Error("Incorrect arguments");var e=n.substr(0,n.length-31),t=d(r,e);return t===n}function A(r,n,e,t){if("string"!=typeof n||!Z.test(n))throw new Error("Incorrect arguments");if(t||(t=e,e=null),!t||"function"!=typeof t)throw new Error("No callback function was given.");var o=n.substr(0,n.length-31);h(r,o,e,function(r){t(r===n)})}var b,E="undefined"!=typeof InstallTrigger,I=E;n&&(b=n.randomBytes,n.getRandomValues&&(b=function(r){var e=new Uint8Array(r);return n.getRandomValues(e)}));var C=16,N=10,O=16,$=[608135816,2242054355,320440878,57701188,2752067618,698298832,137296536,3964562569,1160258022,953160567,3193202383,887688300,3232508343,3380367581,1065670069,3041331479,2450970073,2306472731],U=[3509652390,2564797868,805139163,3491422135,3101798381,1780907670,3128725573,4046225305,614570311,3012652279,134345442,2240740374,1667834072,1901547113,2757295779,4103290238,227898511,1921955416,1904987480,2182433518,2069144605,3260701109,2620446009,720527379,3318853667,677414384,3393288472,3101374703,2390351024,1614419982,1822297739,2954791486,3608508353,3174124327,2024746970,1432378464,3864339955,2857741204,1464375394,1676153920,1439316330,715854006,3033291828,289532110,2706671279,2087905683,3018724369,1668267050,732546397,1947742710,3462151702,2609353502,2950085171,1814351708,2050118529,680887927,999245976,1800124847,3300911131,1713906067,1641548236,4213287313,1216130144,1575780402,4018429277,3917837745,3693486850,3949271944,596196993,3549867205,258830323,2213823033,772490370,2760122372,1774776394,2652871518,566650946,4142492826,1728879713,2882767088,1783734482,3629395816,2517608232,2874225571,1861159788,326777828,3124490320,2130389656,2716951837,967770486,1724537150,2185432712,2364442137,1164943284,2105845187,998989502,3765401048,2244026483,1075463327,1455516326,1322494562,910128902,469688178,1117454909,936433444,3490320968,3675253459,1240580251,122909385,2157517691,634681816,4142456567,3825094682,3061402683,2540495037,79693498,3249098678,1084186820,1583128258,426386531,1761308591,1047286709,322548459,995290223,1845252383,2603652396,3431023940,2942221577,3202600964,3727903485,1712269319,422464435,3234572375,1170764815,3523960633,3117677531,1434042557,442511882,3600875718,1076654713,1738483198,4213154764,2393238008,3677496056,1014306527,4251020053,793779912,2902807211,842905082,4246964064,1395751752,1040244610,2656851899,3396308128,445077038,3742853595,3577915638,679411651,2892444358,2354009459,1767581616,3150600392,3791627101,3102740896,284835224,4246832056,1258075500,768725851,2589189241,3069724005,3532540348,1274779536,3789419226,2764799539,1660621633,3471099624,4011903706,913787905,3497959166,737222580,2514213453,2928710040,3937242737,1804850592,3499020752,2949064160,2386320175,2390070455,2415321851,4061277028,2290661394,2416832540,1336762016,1754252060,3520065937,3014181293,791618072,3188594551,3933548030,2332172193,3852520463,3043980520,413987798,3465142937,3030929376,4245938359,2093235073,3534596313,375366246,2157278981,2479649556,555357303,3870105701,2008414854,3344188149,4221384143,3956125452,2067696032,3594591187,2921233993,2428461,544322398,577241275,1471733935,610547355,4027169054,1432588573,1507829418,2025931657,3646575487,545086370,48609733,2200306550,1653985193,298326376,1316178497,3007786442,2064951626,458293330,2589141269,3591329599,3164325604,727753846,2179363840,146436021,1461446943,4069977195,705550613,3059967265,3887724982,4281599278,3313849956,1404054877,2845806497,146425753,1854211946,1266315497,3048417604,3681880366,3289982499,290971e4,1235738493,2632868024,2414719590,3970600049,1771706367,1449415276,3266420449,422970021,1963543593,2690192192,3826793022,1062508698,1531092325,1804592342,2583117782,2714934279,4024971509,1294809318,4028980673,1289560198,2221992742,1669523910,35572830,157838143,1052438473,1016535060,1802137761,1753167236,1386275462,3080475397,2857371447,1040679964,2145300060,2390574316,1461121720,2956646967,4031777805,4028374788,33600511,2920084762,1018524850,629373528,3691585981,3515945977,2091462646,2486323059,586499841,988145025,935516892,3367335476,2599673255,2839830854,265290510,3972581182,2759138881,3795373465,1005194799,847297441,406762289,1314163512,1332590856,1866599683,4127851711,750260880,613907577,1450815602,3165620655,3734664991,3650291728,3012275730,3704569646,1427272223,778793252,1343938022,2676280711,2052605720,1946737175,3164576444,3914038668,3967478842,3682934266,1661551462,3294938066,4011595847,840292616,3712170807,616741398,312560963,711312465,1351876610,322626781,1910503582,271666773,2175563734,1594956187,70604529,3617834859,1007753275,1495573769,4069517037,2549218298,2663038764,504708206,2263041392,3941167025,2249088522,1514023603,1998579484,1312622330,694541497,2582060303,2151582166,1382467621,776784248,2618340202,3323268794,2497899128,2784771155,503983604,4076293799,907881277,423175695,432175456,1378068232,4145222326,3954048622,3938656102,3820766613,2793130115,2977904593,26017576,3274890735,3194772133,1700274565,1756076034,4006520079,3677328699,720338349,1533947780,354530856,688349552,3973924725,1637815568,332179504,3949051286,53804574,2852348879,3044236432,1282449977,3583942155,3416972820,4006381244,1617046695,2628476075,3002303598,1686838959,431878346,2686675385,1700445008,1080580658,1009431731,832498133,3223435511,2605976345,2271191193,2516031870,1648197032,4164389018,2548247927,300782431,375919233,238389289,3353747414,2531188641,2019080857,1475708069,455242339,2609103871,448939670,3451063019,1395535956,2413381860,1841049896,1491858159,885456874,4264095073,4001119347,1565136089,3898914787,1108368660,540939232,1173283510,2745871338,3681308437,4207628240,3343053890,4016749493,1699691293,1103962373,3625875870,2256883143,3830138730,1031889488,3479347698,1535977030,4236805024,3251091107,2132092099,1774941330,1199868427,1452454533,157007616,2904115357,342012276,595725824,1480756522,206960106,497939518,591360097,863170706,2375253569,3596610801,1814182875,2094937945,3421402208,1082520231,3463918190,2785509508,435703966,3908032597,1641649973,2842273706,3305899714,1510255612,2148256476,2655287854,3276092548,4258621189,236887753,3681803219,274041037,1734335097,3815195456,3317970021,1899903192,1026095262,4050517792,356393447,2410691914,3873677099,3682840055,3913112168,2491498743,4132185628,2489919796,1091903735,1979897079,3170134830,3567386728,3557303409,857797738,1136121015,1342202287,507115054,2535736646,337727348,3213592640,1301675037,2528481711,1895095763,1721773893,3216771564,62756741,2142006736,835421444,2531993523,1442658625,3659876326,2882144922,676362277,1392781812,170690266,3921047035,1759253602,3611846912,1745797284,664899054,1329594018,3901205900,3045908486,2062866102,2865634940,3543621612,3464012697,1080764994,553557557,3656615353,3996768171,991055499,499776247,1265440854,648242737,3940784050,980351604,3713745714,1749149687,3396870395,4211799374,3640570775,1161844396,3125318951,1431517754,545492359,4268468663,3499529547,1437099964,2702547544,3433638243,2581715763,2787789398,1060185593,1593081372,2418618748,4260947970,69676912,2159744348,86519011,2512459080,3838209314,1220612927,3339683548,133810670,1090789135,1078426020,1569222167,845107691,3583754449,4072456591,1091646820,628848692,1613405280,3757631651,526609435,236106946,48312990,2942717905,3402727701,1797494240,859738849,992217954,4005476642,2243076622,3870952857,3732016268,765654824,3490871365,2511836413,1685915746,3888969200,1414112111,2273134842,3281911079,4080962846,172450625,2569994100,980381355,4109958455,2819808352,2716589560,2568741196,3681446669,3329971472,1835478071,660984891,3704678404,4045999559,3422617507,3040415634,1762651403,1719377915,3470491036,2693910283,3642056355,3138596744,1364962596,2073328063,1983633131,926494387,3423689081,2150032023,4096667949,1749200295,3328846651,309677260,2016342300,1779581495,3079819751,111262694,1274766160,443224088,298511866,1025883608,3806446537,1145181785,168956806,3641502830,3584813610,1689216846,3666258015,3200248200,1692713982,2646376535,4042768518,1618508792,1610833997,3523052358,4130873264,2001055236,3610705100,2202168115,4028541809,2961195399,1006657119,2006996926,3186142756,1430667929,3210227297,1314452623,4074634658,4101304120,2273951170,1399257539,3367210612,3027628629,1190975929,2062231137,2333990788,2221543033,2438960610,1181637006,548689776,2362791313,3372408396,3104550113,3145860560,296247880,1970579870,3078560182,3769228297,1714227617,3291629107,3898220290,166772364,1251581989,493813264,448347421,195405023,2709975567,677966185,3703036547,1463355134,2715995803,1338867538,1343315457,2802222074,2684532164,233230375,2599980071,2000651841,3277868038,1638401717,4028070440,3237316320,6314154,819756386,300326615,590932579,1405279636,3267499572,3150704214,2428286686,3959192993,3461946742,1862657033,1266418056,963775037,2089974820,2263052895,1917689273,448879540,3550394620,3981727096,150775221,3627908307,1303187396,508620638,2975983352,2726630617,1817252668,1876281319,1457606340,908771278,3720792119,3617206836,2455994898,1729034894,1080033504,976866871,3556439503,2881648439,1522871579,1555064734,1336096578,3548522304,2579274686,3574697629,3205460757,3593280638,3338716283,3079412587,564236357,2993598910,1781952180,1464380207,3163844217,3332601554,1699332808,1393555694,1183702653,3581086237,1288719814,691649499,2847557200,2895455976,3193889540,2717570544,1781354906,1676643554,2592534050,3230253752,1126444790,2770207658,2633158820,2210423226,2615765581,2414155088,3127139286,673620729,2805611233,1269405062,4015350505,3341807571,4149409754,1057255273,2012875353,2162469141,2276492801,2601117357,993977747,3918593370,2654263191,753973209,36408145,2530585658,25011837,3520020182,2088578344,530523599,2918365339,1524020338,1518925132,3760827505,3759777254,1202760957,3985898139,3906192525,674977740,4174734889,2031300136,2019492241,3983892565,4153806404,3822280332,352677332,2297720250,60907813,90501309,3286998549,1016092578,2535922412,2839152426,457141659,509813237,4120667899,652014361,1966332200,2975202805,55981186,2327461051,676427537,3255491064,2882294119,3433927263,1307055953,942726286,933058658,2468411793,3933900994,4215176142,1361170020,2001714738,2830558078,3274259782,1222529897,1679025792,2729314320,3714953764,1770335741,151462246,3013232138,1682292957,1483529935,471910574,1539241949,458788160,3436315007,1807016891,3718408830,978976581,1043663428,3165965781,1927990952,4200891579,2372276910,3208408903,3533431907,1412390302,2931980059,4132332400,1947078029,3881505623,4168226417,2941484381,1077988104,1320477388,886195818,18198404,3786409e3,2509781533,112762804,3463356488,1866414978,891333506,18488651,661792760,1628790961,3885187036,3141171499,876946877,2693282273,1372485963,791857591,2686433993,3759982718,3167212022,3472953795,2716379847,445679433,3561995674,3504004811,3574258232,54117162,3331405415,2381918588,3769707343,4154350007,1140177722,4074052095,668550556,3214352940,367459370,261225585,2610173221,4209349473,3468074219,3265815641,314222801,3066103646,3808782860,282218597,3406013506,3773591054,379116347,1285071038,846784868,2669647154,3771962079,3550491691,2305946142,453669953,1268987020,3317592352,3279303384,3744833421,2610507566,3859509063,266596637,3847019092,517658769,3462560207,3443424879,370717030,4247526661,2224018117,4143653529,4112773975,2788324899,2477274417,1456262402,2901442914,1517677493,1846949527,2295493580,3734397586,2176403920,1280348187,1908823572,3871786941,846861322,1172426758,3287448474,3383383037,1655181056,3139813346,901632758,1897031941,2986607138,3066810236,3447102507,1393639104,373351379,950779232,625454576,3124240540,4148612726,2007998917,544563296,2244738638,2330496472,2058025392,1291430526,424198748,50039436,29584100,3605783033,2429876329,2791104160,1057563949,3255363231,3075367218,3463963227,1469046755,985887462],M=$.length,T=U.length,x=[1332899944,1700884034,1701343084,1684370003,1668446532,1869963892],k=0,G=4096,S=4164,F=4168,L=4192,R=4200,j=4272,B="./ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789",D=[0,1,54,55,56,57,58,59,60,61,62,63,-1,-1,-1,-1,-1,-1,-1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,-1,-1,-1,-1,-1,-1,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,-1,-1,-1,-1,-1],z=/^\$2[ay]\$(0[4-9]|[12][0-9]|3[01])\$[.\/A-Za-z0-9]{21}[.Oeu]/,Z=/^\$2[ay]\$(0[4-9]|[12][0-9]|3[01])\$[.\/A-Za-z0-9]{21}[.Oeu][.\/A-Za-z0-9]{30}[.CGKOSWaeimquy26]$/;r.genSalt=v,r.hashSync=d,r.hash=h,r.compareSync=w,r.compare=A,r.ENCODING_UTF8=0,r.ENCODING_RAW=1,r.encodingMode=r.ENCODING_UTF8,r.cryptoRNG=!!b,r.randomBytes=b,r.defaultCost=N,r.version="2.2.0"}); \ No newline at end of file +function l(r,n,e,t){var o,a,i,u=L>>2,f=u+1;for(t[u]=0,t[f]=0,a=0,o=0;M>o;o++)i=n[a++]<<24|n[a++]<<16|n[a++]<<8|n[a++],t[G>>2|o]^=i;for(a=0,o=0;M>o;o+=2)i=r[a++]<<24|r[a++]<<16|r[a++]<<8|r[a++],a&=65295,t[u]^=i,i=r[a++]<<24|r[a++]<<16|r[a++]<<8|r[a++],a&=65295,t[f]^=i,e.encrypt(L),t[G>>2|o]=t[u],t[G>>2|o+1]=t[f];var c=k>>2;for(o=0;T>o;o+=2)i=r[a++]<<24|r[a++]<<16|r[a++]<<8|r[a++],a&=65295,t[u]^=i,i=r[a++]<<24|r[a++]<<16|r[a++]<<8|r[a++],a&=65295,t[f]^=i,e.encrypt(L),t[c|o]=t[u],t[c|o+1]=t[f]}function p(r,n,e,t,o,a,i){for(var u=e;t>=u;){if(u=r.expandLoop(u,t,o),a){var f=a(u/(t+1));if(f===!1)return}if(u>t){if(i)return void setImmediate(g.bind(null,r,n,i));return}if(i)return void setImmediate(p.bind(null,r,n,u,t,o,a,i))}}function g(r,n,e){u(n,x,F);var t;for(t=0;64>t;t++)r.encrypt(F+0),r.encrypt(F+8),r.encrypt(F+16);var o,a=0,i=x.length,f=new Array(4*i);for(t=0;i>t;t++)o=n[(F>>2)+t],f[a++]=o>>24,f[a++]=o>>16&255,f[a++]=o>>8&255,f[a++]=255&o;return e&&e(f),f}function y(r,n){return r+o(n,23)}function m(n,o,m,v){var d,h=o.substr(0,29),w=+o.substr(4,2),A=o.substr(7,22);if("string"==typeof n)d=r.encodingMode===r.ENCODING_UTF8?e(n):t(n);else if(Array.isArray(n))d=n.map(function(r){return 255&r});else{if(!(n instanceof Uint8Array))throw new Error("Incorrect arguments");d=Array.prototype.slice.call(n)}d.push(0);var b,E,N=a(A,C),O=31>w?1<>2,N),f(b,R>>2,d),l(N,d,E,b),v?void p(E,b,0,M,T,m,function(r){v(y(h,r))}):(p(E,b,0,M,T,m),y(h,g(E,b)))}function v(r){if(!b)throw new Error("No cryptographically secure pseudorandom number generator available.");if(null==r&&(r=N),r=0|+r,isNaN(r)||4>r||r>31)throw new Error("Invalid cost parameter.");var n="$2y$";return 10>r&&(n+="0"),n+=r+"$",n+=o(b(C),C)}function d(r,n,e){if(n&&"number"!=typeof n){if("string"!=typeof n||!z.test(n))throw new Error("Invalid salt")}else n=v(n);return m(r,n,e)}function h(r,n,e,t){if(arguments.length<2)throw new Error("Incorrect arguments");if(2===arguments.length?(t=n,n=e=null):3===arguments.length&&(t=e,e=null,"function"==typeof n&&(e=n,n=null)),n&&"number"!=typeof n){if("string"!=typeof n||!z.test(n))throw new Error("Invalid salt")}else n=v(n);if(!t||"function"!=typeof t)throw new Error("No callback function was given.");m(r,n,e,t)}function w(r,n){if("string"!=typeof n||!Z.test(n))throw new Error("Incorrect arguments");var e=n.substr(0,n.length-31),t=d(r,e);return t===n}function A(r,n,e,t){if("string"!=typeof n||!Z.test(n))throw new Error("Incorrect arguments");if(t||(t=e,e=null),!t||"function"!=typeof t)throw new Error("No callback function was given.");var o=n.substr(0,n.length-31);h(r,o,e,function(r){t(r===n)})}var b,E="undefined"!=typeof InstallTrigger,I=E;n&&(b=n.randomBytes,n.getRandomValues&&(b=function(r){var e=new Uint8Array(r);return n.getRandomValues(e)}));var C=16,N=10,O=16,$=[608135816,2242054355,320440878,57701188,2752067618,698298832,137296536,3964562569,1160258022,953160567,3193202383,887688300,3232508343,3380367581,1065670069,3041331479,2450970073,2306472731],U=[3509652390,2564797868,805139163,3491422135,3101798381,1780907670,3128725573,4046225305,614570311,3012652279,134345442,2240740374,1667834072,1901547113,2757295779,4103290238,227898511,1921955416,1904987480,2182433518,2069144605,3260701109,2620446009,720527379,3318853667,677414384,3393288472,3101374703,2390351024,1614419982,1822297739,2954791486,3608508353,3174124327,2024746970,1432378464,3864339955,2857741204,1464375394,1676153920,1439316330,715854006,3033291828,289532110,2706671279,2087905683,3018724369,1668267050,732546397,1947742710,3462151702,2609353502,2950085171,1814351708,2050118529,680887927,999245976,1800124847,3300911131,1713906067,1641548236,4213287313,1216130144,1575780402,4018429277,3917837745,3693486850,3949271944,596196993,3549867205,258830323,2213823033,772490370,2760122372,1774776394,2652871518,566650946,4142492826,1728879713,2882767088,1783734482,3629395816,2517608232,2874225571,1861159788,326777828,3124490320,2130389656,2716951837,967770486,1724537150,2185432712,2364442137,1164943284,2105845187,998989502,3765401048,2244026483,1075463327,1455516326,1322494562,910128902,469688178,1117454909,936433444,3490320968,3675253459,1240580251,122909385,2157517691,634681816,4142456567,3825094682,3061402683,2540495037,79693498,3249098678,1084186820,1583128258,426386531,1761308591,1047286709,322548459,995290223,1845252383,2603652396,3431023940,2942221577,3202600964,3727903485,1712269319,422464435,3234572375,1170764815,3523960633,3117677531,1434042557,442511882,3600875718,1076654713,1738483198,4213154764,2393238008,3677496056,1014306527,4251020053,793779912,2902807211,842905082,4246964064,1395751752,1040244610,2656851899,3396308128,445077038,3742853595,3577915638,679411651,2892444358,2354009459,1767581616,3150600392,3791627101,3102740896,284835224,4246832056,1258075500,768725851,2589189241,3069724005,3532540348,1274779536,3789419226,2764799539,1660621633,3471099624,4011903706,913787905,3497959166,737222580,2514213453,2928710040,3937242737,1804850592,3499020752,2949064160,2386320175,2390070455,2415321851,4061277028,2290661394,2416832540,1336762016,1754252060,3520065937,3014181293,791618072,3188594551,3933548030,2332172193,3852520463,3043980520,413987798,3465142937,3030929376,4245938359,2093235073,3534596313,375366246,2157278981,2479649556,555357303,3870105701,2008414854,3344188149,4221384143,3956125452,2067696032,3594591187,2921233993,2428461,544322398,577241275,1471733935,610547355,4027169054,1432588573,1507829418,2025931657,3646575487,545086370,48609733,2200306550,1653985193,298326376,1316178497,3007786442,2064951626,458293330,2589141269,3591329599,3164325604,727753846,2179363840,146436021,1461446943,4069977195,705550613,3059967265,3887724982,4281599278,3313849956,1404054877,2845806497,146425753,1854211946,1266315497,3048417604,3681880366,3289982499,290971e4,1235738493,2632868024,2414719590,3970600049,1771706367,1449415276,3266420449,422970021,1963543593,2690192192,3826793022,1062508698,1531092325,1804592342,2583117782,2714934279,4024971509,1294809318,4028980673,1289560198,2221992742,1669523910,35572830,157838143,1052438473,1016535060,1802137761,1753167236,1386275462,3080475397,2857371447,1040679964,2145300060,2390574316,1461121720,2956646967,4031777805,4028374788,33600511,2920084762,1018524850,629373528,3691585981,3515945977,2091462646,2486323059,586499841,988145025,935516892,3367335476,2599673255,2839830854,265290510,3972581182,2759138881,3795373465,1005194799,847297441,406762289,1314163512,1332590856,1866599683,4127851711,750260880,613907577,1450815602,3165620655,3734664991,3650291728,3012275730,3704569646,1427272223,778793252,1343938022,2676280711,2052605720,1946737175,3164576444,3914038668,3967478842,3682934266,1661551462,3294938066,4011595847,840292616,3712170807,616741398,312560963,711312465,1351876610,322626781,1910503582,271666773,2175563734,1594956187,70604529,3617834859,1007753275,1495573769,4069517037,2549218298,2663038764,504708206,2263041392,3941167025,2249088522,1514023603,1998579484,1312622330,694541497,2582060303,2151582166,1382467621,776784248,2618340202,3323268794,2497899128,2784771155,503983604,4076293799,907881277,423175695,432175456,1378068232,4145222326,3954048622,3938656102,3820766613,2793130115,2977904593,26017576,3274890735,3194772133,1700274565,1756076034,4006520079,3677328699,720338349,1533947780,354530856,688349552,3973924725,1637815568,332179504,3949051286,53804574,2852348879,3044236432,1282449977,3583942155,3416972820,4006381244,1617046695,2628476075,3002303598,1686838959,431878346,2686675385,1700445008,1080580658,1009431731,832498133,3223435511,2605976345,2271191193,2516031870,1648197032,4164389018,2548247927,300782431,375919233,238389289,3353747414,2531188641,2019080857,1475708069,455242339,2609103871,448939670,3451063019,1395535956,2413381860,1841049896,1491858159,885456874,4264095073,4001119347,1565136089,3898914787,1108368660,540939232,1173283510,2745871338,3681308437,4207628240,3343053890,4016749493,1699691293,1103962373,3625875870,2256883143,3830138730,1031889488,3479347698,1535977030,4236805024,3251091107,2132092099,1774941330,1199868427,1452454533,157007616,2904115357,342012276,595725824,1480756522,206960106,497939518,591360097,863170706,2375253569,3596610801,1814182875,2094937945,3421402208,1082520231,3463918190,2785509508,435703966,3908032597,1641649973,2842273706,3305899714,1510255612,2148256476,2655287854,3276092548,4258621189,236887753,3681803219,274041037,1734335097,3815195456,3317970021,1899903192,1026095262,4050517792,356393447,2410691914,3873677099,3682840055,3913112168,2491498743,4132185628,2489919796,1091903735,1979897079,3170134830,3567386728,3557303409,857797738,1136121015,1342202287,507115054,2535736646,337727348,3213592640,1301675037,2528481711,1895095763,1721773893,3216771564,62756741,2142006736,835421444,2531993523,1442658625,3659876326,2882144922,676362277,1392781812,170690266,3921047035,1759253602,3611846912,1745797284,664899054,1329594018,3901205900,3045908486,2062866102,2865634940,3543621612,3464012697,1080764994,553557557,3656615353,3996768171,991055499,499776247,1265440854,648242737,3940784050,980351604,3713745714,1749149687,3396870395,4211799374,3640570775,1161844396,3125318951,1431517754,545492359,4268468663,3499529547,1437099964,2702547544,3433638243,2581715763,2787789398,1060185593,1593081372,2418618748,4260947970,69676912,2159744348,86519011,2512459080,3838209314,1220612927,3339683548,133810670,1090789135,1078426020,1569222167,845107691,3583754449,4072456591,1091646820,628848692,1613405280,3757631651,526609435,236106946,48312990,2942717905,3402727701,1797494240,859738849,992217954,4005476642,2243076622,3870952857,3732016268,765654824,3490871365,2511836413,1685915746,3888969200,1414112111,2273134842,3281911079,4080962846,172450625,2569994100,980381355,4109958455,2819808352,2716589560,2568741196,3681446669,3329971472,1835478071,660984891,3704678404,4045999559,3422617507,3040415634,1762651403,1719377915,3470491036,2693910283,3642056355,3138596744,1364962596,2073328063,1983633131,926494387,3423689081,2150032023,4096667949,1749200295,3328846651,309677260,2016342300,1779581495,3079819751,111262694,1274766160,443224088,298511866,1025883608,3806446537,1145181785,168956806,3641502830,3584813610,1689216846,3666258015,3200248200,1692713982,2646376535,4042768518,1618508792,1610833997,3523052358,4130873264,2001055236,3610705100,2202168115,4028541809,2961195399,1006657119,2006996926,3186142756,1430667929,3210227297,1314452623,4074634658,4101304120,2273951170,1399257539,3367210612,3027628629,1190975929,2062231137,2333990788,2221543033,2438960610,1181637006,548689776,2362791313,3372408396,3104550113,3145860560,296247880,1970579870,3078560182,3769228297,1714227617,3291629107,3898220290,166772364,1251581989,493813264,448347421,195405023,2709975567,677966185,3703036547,1463355134,2715995803,1338867538,1343315457,2802222074,2684532164,233230375,2599980071,2000651841,3277868038,1638401717,4028070440,3237316320,6314154,819756386,300326615,590932579,1405279636,3267499572,3150704214,2428286686,3959192993,3461946742,1862657033,1266418056,963775037,2089974820,2263052895,1917689273,448879540,3550394620,3981727096,150775221,3627908307,1303187396,508620638,2975983352,2726630617,1817252668,1876281319,1457606340,908771278,3720792119,3617206836,2455994898,1729034894,1080033504,976866871,3556439503,2881648439,1522871579,1555064734,1336096578,3548522304,2579274686,3574697629,3205460757,3593280638,3338716283,3079412587,564236357,2993598910,1781952180,1464380207,3163844217,3332601554,1699332808,1393555694,1183702653,3581086237,1288719814,691649499,2847557200,2895455976,3193889540,2717570544,1781354906,1676643554,2592534050,3230253752,1126444790,2770207658,2633158820,2210423226,2615765581,2414155088,3127139286,673620729,2805611233,1269405062,4015350505,3341807571,4149409754,1057255273,2012875353,2162469141,2276492801,2601117357,993977747,3918593370,2654263191,753973209,36408145,2530585658,25011837,3520020182,2088578344,530523599,2918365339,1524020338,1518925132,3760827505,3759777254,1202760957,3985898139,3906192525,674977740,4174734889,2031300136,2019492241,3983892565,4153806404,3822280332,352677332,2297720250,60907813,90501309,3286998549,1016092578,2535922412,2839152426,457141659,509813237,4120667899,652014361,1966332200,2975202805,55981186,2327461051,676427537,3255491064,2882294119,3433927263,1307055953,942726286,933058658,2468411793,3933900994,4215176142,1361170020,2001714738,2830558078,3274259782,1222529897,1679025792,2729314320,3714953764,1770335741,151462246,3013232138,1682292957,1483529935,471910574,1539241949,458788160,3436315007,1807016891,3718408830,978976581,1043663428,3165965781,1927990952,4200891579,2372276910,3208408903,3533431907,1412390302,2931980059,4132332400,1947078029,3881505623,4168226417,2941484381,1077988104,1320477388,886195818,18198404,3786409e3,2509781533,112762804,3463356488,1866414978,891333506,18488651,661792760,1628790961,3885187036,3141171499,876946877,2693282273,1372485963,791857591,2686433993,3759982718,3167212022,3472953795,2716379847,445679433,3561995674,3504004811,3574258232,54117162,3331405415,2381918588,3769707343,4154350007,1140177722,4074052095,668550556,3214352940,367459370,261225585,2610173221,4209349473,3468074219,3265815641,314222801,3066103646,3808782860,282218597,3406013506,3773591054,379116347,1285071038,846784868,2669647154,3771962079,3550491691,2305946142,453669953,1268987020,3317592352,3279303384,3744833421,2610507566,3859509063,266596637,3847019092,517658769,3462560207,3443424879,370717030,4247526661,2224018117,4143653529,4112773975,2788324899,2477274417,1456262402,2901442914,1517677493,1846949527,2295493580,3734397586,2176403920,1280348187,1908823572,3871786941,846861322,1172426758,3287448474,3383383037,1655181056,3139813346,901632758,1897031941,2986607138,3066810236,3447102507,1393639104,373351379,950779232,625454576,3124240540,4148612726,2007998917,544563296,2244738638,2330496472,2058025392,1291430526,424198748,50039436,29584100,3605783033,2429876329,2791104160,1057563949,3255363231,3075367218,3463963227,1469046755,985887462],M=$.length,T=U.length,x=[1332899944,1700884034,1701343084,1684370003,1668446532,1869963892],k=0,G=4096,S=4164,F=4168,L=4192,R=4200,j=4272,B="./ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789",D=[0,1,54,55,56,57,58,59,60,61,62,63,-1,-1,-1,-1,-1,-1,-1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,-1,-1,-1,-1,-1,-1,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,-1,-1,-1,-1,-1],z=/^\$2[ay]\$(0[4-9]|[12][0-9]|3[01])\$[.\/A-Za-z0-9]{21}[.Oeu]/,Z=/^\$2[ay]\$(0[4-9]|[12][0-9]|3[01])\$[.\/A-Za-z0-9]{21}[.Oeu][.\/A-Za-z0-9]{30}[.CGKOSWaeimquy26]$/;r.genSalt=v,r.hashSync=d,r.hash=h,r.compareSync=w,r.compare=A,r.ENCODING_UTF8=0,r.ENCODING_RAW=1,r.encodingMode=r.ENCODING_UTF8,r.cryptoRNG=!!b,r.randomBytes=b,r.defaultCost=N,r.version="2.2.0"}); diff --git a/luci-app-adguardhome/patches/00_makefile.patch b/luci-app-adguardhome/patches/00_makefile.patch new file mode 100644 index 000000000..4f8e8afec --- /dev/null +++ b/luci-app-adguardhome/patches/00_makefile.patch @@ -0,0 +1,51 @@ +From b65bfa5784b2cbec97740c96fa69d799f3203df0 Mon Sep 17 00:00:00 2001 +From: Jackie264 <125248570+Jackie264@users.noreply.github.com> +Date: Fri, 26 Jun 2026 06:50:26 +0800 +Subject: [PATCH] Modify Makefile for luci-app-adguardhome + +Updated maintainer information and added package configuration. +--- + Makefile | 26 ++++++++++++++++++++++---- + 1 file changed, 22 insertions(+), 4 deletions(-) + +diff --git a/Makefile b/Makefile +index a48c04d..ec35f24 100644 +--- a/Makefile ++++ b/Makefile +@@ -3,14 +3,32 @@ + include $(TOPDIR)/rules.mk + + LUCI_NAME:=luci-app-adguardhome +-LUCI_MAINTAINER:=George Sapkin ++LUCI_MAINTAINER:=Jackie264 + PKG_LICENSE:=GPL-2.0-only ++PKG_CPE_ID:=cpe:/a:Jackie264:luci-app-adguardhome + + LUCI_TITLE:=LuCI support for AdGuard Home +-LUCI_DEPENDS:=+adguardhome +luci-base +-LUCI_EXTRA_DEPENDS:=adguardhome (>=0.107.73-r3) ++LUCI_DEPENDS:=+luci-base + LUCI_PKGARCH:=all ++USERID:=adguardhome=853:adguardhome=853 + +-include ../../luci.mk ++PKG_UNPACK:=$(CURDIR)/.prepare.sh $(PKG_NAME) $(CURDIR) $(PKG_BUILD_DIR) ++ ++define Package/luci-app-adguardhome/conffiles ++/etc/adguardhome/adguardhome.yaml ++/etc/config/adguardhome ++endef ++ ++define Package/luci-app-adguardhome/prerm ++#!/bin/sh ++[ -n "$${IPKG_INSTROOT}" ] || { ++ rm -f /tmp/luci-indexcache.* ++ rm -rf /tmp/luci-modulecache/ ++ /etc/init.d/rpcd reload 2>/dev/null ++} ++exit 0 ++endef ++ ++include $(TOPDIR)/feeds/luci/luci.mk + + # call BuildPackage - OpenWrt buildroot signature diff --git a/luci-app-adguardhome/patches/01_init.patch b/luci-app-adguardhome/patches/01_init.patch new file mode 100644 index 000000000..3830cd0fe --- /dev/null +++ b/luci-app-adguardhome/patches/01_init.patch @@ -0,0 +1,254 @@ +From 2cfa7fa8e6b2c20824bdb81a3d7449c9757ae793 Mon Sep 17 00:00:00 2001 +From: Jackie264 <125248570+Jackie264@users.noreply.github.com> +Date: Sat, 6 Jun 2026 23:21:32 +0800 +Subject: [PATCH] Enhance AdGuardHome init script with new features + +Add extra commands and improve cron handling in AdGuardHome init script. +--- + root/etc/init.d/adguardhome | 164 +++++++++++++++++++++++++++++++++++- + 1 file changed, 162 insertions(+), 2 deletions(-) + +diff --git a/root/etc/init.d/adguardhome b/root/etc/init.d/adguardhome +index 4712913..1383834 100755 +--- a/root/etc/init.d/adguardhome ++++ b/root/etc/init.d/adguardhome +@@ -3,6 +3,7 @@ + # SPDX-License-Identifier: GPL-2.0-only + # + # shellcheck disable=SC3043 # ash supports local ++. /usr/share/AdGuardHome/helper.sh + + # matches dnsmasq + START=19 +@@ -12,22 +13,87 @@ STOP=89 + PROG=/usr/bin/AdGuardHome + USE_PROCD=1 + ++EXTRA_COMMANDS="do_redirect force_reload isrunning" ++EXTRA_HELP="\ ++\tdo_redirect \t0 or 1\n\ ++\tforce_reload\n\ ++\tisrunning" ++ ++CONTROL_SCRIPT="/usr/share/AdGuardHome/control.sh" ++CRON_FILE=/etc/crontabs/root ++ ++get_tz() { ++ SET_TZ="" ++ local zonename ++ zonename="$(uci get system.@system[0].zonename 2>/dev/null)" ++ if [ -n "$zonename" ]; then ++ SET_TZ="$zonename" ++ return ++ fi ++ for tzfile in /etc/TZ /var/etc/TZ; do ++ [ -e "$tzfile" ] && tz="$(cat "$tzfile" 2>/dev/null)" && break ++ done ++ [ -n "$tz" ] && SET_TZ=$tz && return ++} ++ ++do_crontab() { ++ local enabled="$1" ++ local crontab="$2" ++ local findstr default cronenable cronreload=0 ++ ++ findstr="/usr/share/AdGuardHome/update_core.sh" ++ default="30 3 * * * /usr/share/AdGuardHome/update_core.sh 2>&1" ++ [ "$enabled" = "0" ] || [ "${crontab//autoupdate/}" = "$crontab" ] && cronenable=0 || cronenable=1 ++ crontab_editor ++ ++ [ "$cronreload" -gt 0 ] && /etc/init.d/cron restart ++} ++ ++crontab_editor() { ++ local line ++ line="$(grep "$findstr" $CRON_FILE 2>/dev/null)" ++ if [ "${line:0:1}" != "#" ]; then ++ if [ "$cronenable" -eq 1 ]; then ++ if [ -z "$line" ]; then ++ echo "$default" >> $CRON_FILE ++ cronreload=$((cronreload+1)) ++ fi ++ elif [ -n "$line" ]; then ++ sed -i "\,$findstr,d" $CRON_FILE ++ echo "#$line" >> $CRON_FILE ++ cronreload=$((cronreload+1)) ++ fi ++ else ++ if [ "$cronenable" -eq 1 ]; then ++ sed -i "\,$findstr,d" $CRON_FILE ++ echo "${line:1}" >> $CRON_FILE ++ cronreload=$((cronreload+1)) ++ fi ++ fi ++} ++ + boot() { + ADGUARDHOME_BOOT=1 + start "$@" + } + + start_service() { ++ mkdir -p /var/etc ++ [ ! -f /var/etc/adguardhome.nft ] && touch /var/etc/adguardhome.nft ++ chmod 644 /var/etc/adguardhome.nft ++ + if [ -n "$ADGUARDHOME_BOOT" ]; then + # Do not start yet, wait for triggers + return 0 + fi + ++ rm -f /var/run/AdGserverdis 2>/dev/null + config_load 'adguardhome' + + local config_name='config' + local config_file config group user verbose work_dir workdir + local gc maxprocs memlimit ++ local enabled hashpass crontab redirect + + uci_validate_section 'adguardhome' 'adguardhome' "$config_name" \ + 'gc:uinteger:0' \ +@@ -41,12 +107,46 @@ start_service() { + 'user:string:adguardhome' \ + 'verbose:bool:0' \ + 'workdir:string' \ +- 'work_dir:string:/var/lib/adguardhome' ++ 'work_dir:string:/var/lib/adguardhome' \ ++ 'enabled:bool:0' \ ++ 'hashpass:string' \ ++ 'crontab:string' \ ++ 'redirect:string:none' \ ++ 'http_address:string' + + # Compatibility with older configs + [ -n "$config" ] && config_file="$config" + [ -n "$workdir" ] && work_dir="$workdir" + ++ # Handle hashpass clear text issuance and back brush removal ++ if [ -n "$hashpass" ]; then ++ config_editor "users.password" "$hashpass" "$config_file" ++ uci set adguardhome."$config_name".hashpass="" ++ uci commit adguardhome ++ fi ++ ++ # Synchronize the front-end incing WebUI listening address to YAML ++ if [ -n "$http_address" ]; then ++ config_editor "http.address" "$http_address" "$config_file" ++ uci set adguardhome."$config_name".http_address="" ++ uci commit adguardhome ++ fi ++ ++ # Isse the plan task change ++ do_crontab "$enabled" "$crontab" ++ ++ # If it is not enabled, the linkage cleans up the redirection firewall rules and exits safely. ++ if [ "$enabled" = 0 ]; then ++ $CONTROL_SCRIPT 0 ++ return 0 ++ fi ++ ++ if [ "$user" = "adguardhome" ] && ! grep -q "^adguardhome:" /etc/passwd; then ++ echo "luci-app: User 'adguardhome' is missing, injecting UID 853 into system files..." >&2 ++ grep -q "^adguardhome:" /etc/group || echo "adguardhome:x:853:" >> /etc/group ++ echo "adguardhome:x:853:853:adguardhome:/var/run/adguardhome:/bin/false" >> /etc/passwd ++ fi ++ + local config_dir + config_dir=$(dirname "$config_file") + if [ "$config_dir" = '/etc' ]; then +@@ -59,6 +159,13 @@ start_service() { + mkdir -m 0700 -p "$work_dir" + chown -R "$user":"$group" "$work_dir" + ++ # Silently downgrade and call the kernel download script when the kernel is missing. ++ if [ ! -f "$PROG" ]; then ++ $CONTROL_SCRIPT 0 ++ /usr/share/AdGuardHome/update_core.sh >/tmp/AdGuardHome_update.log 2>&1 & ++ return 0 ++ fi ++ + procd_open_instance adguardhome + + procd_set_param command "$PROG" +@@ -67,12 +174,17 @@ start_service() { + [ "$maxprocs" -le 0 ] || procd_append_param env GOMAXPROCS="$maxprocs" + [ "$memlimit" -le 0 ] || procd_append_param env GOMEMLIMIT="$memlimit" + ++ local SET_TZ ++ get_tz ++ [ -n "$SET_TZ" ] && procd_append_param env TZ="$SET_TZ" ++ + procd_append_param command --config "$config_file" + procd_append_param command --logfile syslog +- procd_append_param command --no-check-update ++ # procd_append_param command --no-check-update + [ "$verbose" = 1 ] && procd_append_param command --verbose + procd_append_param command --work-dir "$work_dir" + ++ procd_set_param file /etc/config/adguardhome "$config_file" + procd_set_param stdout 1 + procd_set_param stderr 1 + procd_set_param user "$user" +@@ -91,10 +203,58 @@ start_service() { + + procd_add_jail_mount '/etc/hosts' + procd_add_jail_mount '/etc/ssl/certs' ++ [ -f /etc/TZ ] && procd_add_jail_mount '/etc/TZ' ++ + config_list_foreach "$config_name" jail_mount procd_add_jail_mount + config_list_foreach "$config_name" jail_mount_rw procd_add_jail_mount_rw + + procd_close_instance ++ ++ # After the main process is successfully submitted for start-up, it begins to intervene asynchronously and take over the control. ++ if [ -f "$config_file" ]; then ++ ($CONTROL_SCRIPT 1) & ++ else ++ $CONTROL_SCRIPT 0 ++ if [ "$redirect" != "none" ]; then ++ procd_open_instance "waitconfig" ++ procd_set_param command "/usr/share/AdGuardHome/watchconfig.sh" ++ procd_close_instance ++ fi ++ fi ++ ++ (sleep 10 && [ -z "$(pgrep -f "$(basename "$PROG")")" ] && logger -t adguardhome "no process in 10s cancel redirect" && $CONTROL_SCRIPT 0 ) & ++} ++ ++stop_service() { ++ config_load 'adguardhome' ++ local config_name='config' ++ local crontab ++ config_get crontab "$config_name" crontab "" ++ ++ $CONTROL_SCRIPT 0 ++ do_crontab 0 "$crontab" ++ touch /var/run/AdGserverdis ++} ++ ++do_redirect() { ++ $CONTROL_SCRIPT "$1" ++} ++ ++_isrunning() { ++ [ ! -f "$PROG" ] && return 2 ++ pgrep -f "$(basename "$PROG")" >/dev/null 2>&1 && return 0 ++ return 1 ++} ++ ++isrunning() { ++ _isrunning ++ local r=$? ++ [ "$r" = "0" ] && echo "running" || ([ "$r" = "1" ] && echo "not run" || echo "no bin") ++ return $r ++} ++ ++force_reload() { ++ _isrunning && procd_send_signal adguardhome || start + } + + service_triggers() { + +reload_service() { + restart +} diff --git a/luci-app-adguardhome/patches/02_acl.patch b/luci-app-adguardhome/patches/02_acl.patch new file mode 100644 index 000000000..5786392cb --- /dev/null +++ b/luci-app-adguardhome/patches/02_acl.patch @@ -0,0 +1,54 @@ +From 883995b0d027fcd32fb9ba4ff24d607e9c176ee2 Mon Sep 17 00:00:00 2001 +From: Jackie264 <125248570+Jackie264@users.noreply.github.com> +Date: Thu, 28 May 2026 10:14:54 +0800 +Subject: [PATCH] Update luci-app-adguardhome.json + +--- + .../rpcd/acl.d/luci-app-adguardhome.json | 36 +++++++++++-------- + 1 file changed, 21 insertions(+), 15 deletions(-) + +diff --git a/root/usr/share/rpcd/acl.d/luci-app-adguardhome.json b/root/usr/share/rpcd/acl.d/luci-app-adguardhome.json +index 748778a..33ba1fd 100644 +--- a/root/usr/share/rpcd/acl.d/luci-app-adguardhome.json ++++ b/root/usr/share/rpcd/acl.d/luci-app-adguardhome.json +@@ -1,17 +1,25 @@ + { +- "luci-app-adguardhome": { +- "description": "Grant permissions for the AdGuard Home LuCI app", +- "read": { +- "file": { +- "/usr/bin/AdGuardHome --version": [ "exec" ] +- }, +- "ubus": { +- "service": [ "list" ] +- }, +- "uci": [ "adguardhome" ] +- }, +- "write": { +- "uci": [ "adguardhome" ] +- } +- } ++ "luci-app-adguardhome": { ++ "description": "Grant permissions for the AdGuard Home LuCI app", ++ "read": { ++ "file": { ++ "/tmp/AdGuardHome_update.log": [ "read" ], ++ "/var/run/update_core": [ "stat" ], ++ "/var/run/update_core_error": [ "stat" ], ++ "/var/run/AdGredir": [ "read" ], ++ "/var/run/AdGserverdis": [ "read" ], ++ "/usr/bin/AdGuardHome --version": [ "exec" ] ++ }, ++ "ubus": { ++ "service": [ "list" ] ++ }, ++ "uci": [ "adguardhome" ] ++ }, ++ "write": { ++ "file": { ++ "/usr/share/AdGuardHome/update_core.sh": [ "exec" ] ++ }, ++ "uci": [ "adguardhome" ] ++ } ++ } + } diff --git a/luci-app-adguardhome/patches/03_config_js.patch b/luci-app-adguardhome/patches/03_config_js.patch new file mode 100644 index 000000000..465075fb8 --- /dev/null +++ b/luci-app-adguardhome/patches/03_config_js.patch @@ -0,0 +1,456 @@ +From fc3e12a5860b5da4230293d7e6dc4f3b24b32b23 Mon Sep 17 00:00:00 2001 +From: Jackie264 <125248570+Jackie264@users.noreply.github.com> +Date: Sat, 4 Jul 2026 14:19:51 +0800 +Subject: [PATCH] Enhance AdGuard Home config with core update options + +Updated service status indicators and added core update functionality. +--- + .../resources/view/adguardhome/config.js | 369 +++++++++++++++++- + 1 file changed, 364 insertions(+), 5 deletions(-) + +diff --git a/htdocs/luci-static/resources/view/adguardhome/config.js b/htdocs/luci-static/resources/view/adguardhome/config.js +index 6dc2d45..12fc3ab 100644 +--- a/htdocs/luci-static/resources/view/adguardhome/config.js ++++ b/htdocs/luci-static/resources/view/adguardhome/config.js +@@ -5,6 +5,7 @@ + 'require fs'; + 'require poll'; + 'require rpc'; ++'require uci'; + 'require view'; + + const DEFAULT_CONFIG_FILE = '/etc/adguardhome/adguardhome.yaml'; +@@ -20,10 +21,11 @@ const PATH_REGEX = new RegExp('^/etc(/[^/]+)?/?$'); + + const POLL_INTERVAL = 5; + +-const RUNNING_SPAN = `${_('Running')}`; +-const NOT_RUNNING_SPAN = `${_('Not running')}`; ++const RUNNING_SPAN = `${_('Running')}`; ++const NOT_RUNNING_SPAN = `${_('Not running')}`; + + const STORAGE_KEY = 'luci-app-adguardhome'; ++const STORAGE_KEY_CORE = 'luci-app-adguardhome_core_update'; + + function getServiceInfo(name) { + const fn = rpc.declare({ +@@ -61,7 +63,7 @@ async function getVersion() { + return version; + } catch (e) { + console.error(e); +- return 'unknown version'; ++ return ''; + } + } + +@@ -106,10 +108,33 @@ return view.extend({ + return Promise.all([ + getStatus(), + getVersion(), ++ uci.load('adguardhome').then(() => { ++ const sections = uci.sections('adguardhome', 'adguardhome'); ++ const sec = sections.length > 0 ? sections[0] : {}; ++ const configFile = sec.config_file || DEFAULT_CONFIG_FILE; ++ return fs.read(configFile).catch(() => null); ++ }) + ]); + }, + +- async render([isRunning, version]) { ++ async render([isRunning, version, yamlContent]) { ++ // If there is a version number, it means that the kernel exists. If there is no version number, it does not exist. ++ const coreExists = Boolean(version); ++ let dnsPort = '53'; ++ if (yamlContent) { ++ const portMatches = yamlContent.match(/port:\s*(\d+)/g); ++ if (portMatches && portMatches.length >= 2) { ++ const actualPort = portMatches[1].match(/\d+/); ++ if (actualPort) { ++ dnsPort = actualPort[0]; ++ } ++ } ++ } ++ ++ // 💡 Dynamic security value: UI rendering requires httpport to generate jump links ++ const sections = uci.sections('adguardhome', 'adguardhome'); ++ const savedHttpPort = (sections.length > 0 && sections[0].httpport) ? sections[0].httpport : '3008'; ++ + const map = new form.Map('adguardhome', _('AdGuard Home')); + + const statusSect = map.section(form.TypedSection, 'status'); +@@ -117,7 +142,8 @@ return view.extend({ + statusSect.cfgsections = () => ['status_section']; + + const versionOpt = statusSect.option(form.DummyValue, '_version', _('Version')); +- versionOpt.cfgvalue = () => version; ++ versionOpt.cfgvalue = () => version || `${_('Not installed')}`; ++ versionOpt.rawhtml = true; + + const statusOpt = statusSect.option(form.DummyValue, '_status', _('Service Status')); + statusOpt.rawhtml = true; +@@ -132,6 +158,12 @@ return view.extend({ + _('File System Access'), + _('Files and directories that AdGuard Home should have read-only or read-write access to.'), + ); ++ mainSect.tab('dns_redirect', _('Services Settings')); ++ mainSect.tab( ++ 'core_update', ++ _('Core Update'), ++ _('Settings and operations for updating the AdGuardHome core binary.') ++ ); + mainSect.tab( + 'advanced', + _('Advanced Settings'), +@@ -139,6 +171,20 @@ return view.extend({ + ' ' + _('Modify at your own risk.'), + ); + ++ // ==== Move here: global switch ==== ++ const enabledOpt = mainSect.taboption( ++ 'general', ++ form.Flag, ++ 'enabled', ++ _('Enable') ++ ); ++ enabledOpt.default = '0'; ++ enabledOpt.rmempty = false; ++ // If the kernel does not exist, additional warning prompts will guide users to turn on the service to download automatically. ++ if (!coreExists) { ++ enabledOpt.description = `${_('Core binary not found. Enable the service to trigger an automatic download.')}`; ++ } ++ + const configFileOpt = mainSect.taboption( + 'general', + form.Value, +@@ -204,6 +250,21 @@ return view.extend({ + advSettingsOpt.remove = () => {}; + advSettingsOpt.write = (_, value) => sessionStorage.setItem(STORAGE_KEY, value); + ++ // ==== New: The switch of Core Update on General tab ==== ++ const coreUpdateToggleOpt = mainSect.taboption( ++ 'general', ++ form.Flag, ++ 'enable_core_update', ++ _('Core Update'), ++ _('Show the tab and settings for updating the AdGuardHome core binary.') ++ ); ++ coreUpdateToggleOpt.default = '0'; ++ coreUpdateToggleOpt.rmempty = false; ++ coreUpdateToggleOpt.load = () => sessionStorage.getItem(STORAGE_KEY_CORE) || '0'; ++ coreUpdateToggleOpt.remove = () => {}; ++ coreUpdateToggleOpt.write = (_, value) => sessionStorage.setItem(STORAGE_KEY_CORE, value); ++ // ========================================== ++ + mainSect.taboption('jail', form.DynamicList, 'jail_mount', _('Read-only access')); + mainSect.taboption('jail', form.DynamicList, 'jail_mount_rw', _('Read-write access')); + +@@ -251,11 +312,309 @@ return view.extend({ + memLimitOpt.placeholder = DEFAULT_GOMEMLIMIT; + memLimitOpt.retain = true; + ++ // 💡 1. Extract the real listening address and port directly from YAML ++ let realHttpAddress = '0.0.0.0:3008'; ++ if (yamlContent) { ++ // Match the address: field below http: in YAML ++ const addrMatch = yamlContent.match(/address:\s*([^\s]+)/); ++ if (addrMatch && addrMatch[1]) { ++ realHttpAddress = addrMatch[1]; ++ } ++ } ++ ++ // 💡 2. Analyze the real IP and port used by the jump button ++ let linkIp = window.location.hostname; ++ let linkPort = '3008'; ++ const addrParts = realHttpAddress.split(':'); ++ if (addrParts.length >= 2) { ++ linkPort = addrParts.pop(); ++ let ipPart = addrParts.join(':').replace(/\[|\]/g, ''); ++ // If the binding is a full zero address, the IP accessed by the current router will be returned. ++ if (ipPart !== '0.0.0.0' && ipPart !== '') { ++ linkIp = ipPart; ++ } ++ } ++ ++ // 💡 3. Upgrade the original httpport to http_address ++ const isServiceEnabled = sections.length > 0 && sections[0].enabled === '1'; ++ const disabledHint = _('Service is disabled. Please go to "General Settings" to enable it.'); ++ ++ // 💡 4. WebUI button HTML to construct intelligent state ++ const webuiBtnHtml = isServiceEnabled ++ ? `${_('Open AdGuardHome WebUI')}` ++ : ` ++ ${_('Open AdGuardHome WebUI')} ++ `; ++ ++ // 💡 5. Rendering components ++ const httpAddressOpt = mainSect.taboption( ++ 'dns_redirect', ++ form.Value, ++ 'http_address', ++ _('WebUI listener (address:port)'), ++ _('Bind to specific interface:port (e.g., 0.0.0.0:3008). Leave as 0.0.0.0 to listen on all interfaces.') + ++ `
${webuiBtnHtml}` ++ ); ++ httpAddressOpt.placeholder = '0.0.0.0:3008'; ++ httpAddressOpt.default = '0.0.0.0:3008'; ++ httpAddressOpt.datatype = 'hostport'; ++ httpAddressOpt.rmempty = false; ++ ++ // 🎯 Overwrite the default reading UCI behavior and forcibly echo the real value in YAML ++ httpAddressOpt.cfgvalue = function(section_id) { ++ return realHttpAddress; ++ }; ++ ++ // ==== Add the password modification function below the WebUI port ==== ++ const isPasswordEmpty = yamlContent ? /password:[ \t]*(\r?\n|$)/.test(yamlContent) : false; ++ const hashPassOpt = mainSect.taboption( ++ 'dns_redirect', ++ form.Value, ++ 'hashpass', ++ _('Change password'), ++ _('Enter the password here. Click the Load calculate Module button below and go on.') + ++ '
' ++ ); ++ hashPassOpt.default = ''; ++ hashPassOpt.datatype = 'string'; ++ hashPassOpt.password = true; ++ hashPassOpt.rmempty = true; ++ hashPassOpt.placeholder = isPasswordEmpty ? _('Please create a new password.') : ''; ++ hashPassOpt.cfgvalue = function(section_id) { ++ return ''; ++ }; ++ ++ const redirectOpt = mainSect.taboption( ++ 'dns_redirect', ++ form.ListValue, ++ 'redirect', ++ `${dnsPort} ` + _('Redirect'), ++ _('AdGuardHome redirect mode') ++ ); ++ redirectOpt.value('none', _('No redirect')); ++ redirectOpt.value('dnsmasq-upstream', _('As the upstream server of dnsmasq')); ++ redirectOpt.value('redirect', _('Redirect port 53 to AdGuardHome')); ++ redirectOpt.value('exchange', _('Use port 53 to replace dnsmasq')); ++ redirectOpt.default = 'none'; ++ redirectOpt.rmempty = false; ++ // ========================================== ++ ++ // ======== Core Update Control content ======== ++ const coreVersionOpt = mainSect.taboption( ++ 'core_update', ++ form.ListValue, ++ 'core_version', ++ _('Core Branch'), ++ _('Select the branch for the core binary update.') ++ ); ++ coreVersionOpt.value('latest', _('Latest Version')); ++ coreVersionOpt.value('beta', _('Beta Version')); ++ coreVersionOpt.default = 'latest'; ++ coreVersionOpt.depends('enable_core_update', '1'); ++ coreVersionOpt.retain = true; ++ ++ const coreUrlOpt = mainSect.taboption( ++ 'core_update', ++ form.ListValue, ++ 'update_url', ++ _('Update URL'), ++ _('Select the download link for the core update.') ++ ); ++ coreUrlOpt.value('https://static.adtidy.org/adguardhome/release/AdGuardHome_linux_${Arch}.tar.gz', _('Official Mirror (AdTidy - Recommended)')); ++ coreUrlOpt.value('https://github.com/AdguardTeam/AdGuardHome/releases/download/${Cloud_Version}/AdGuardHome_linux_${Arch}.tar.gz', _('GitHub Releases (Original)')); ++ coreUrlOpt.default = 'https://static.adtidy.org/adguardhome/release/AdGuardHome_linux_${Arch}.tar.gz'; ++ coreUrlOpt.rmempty = false; ++ coreUrlOpt.depends('enable_core_update', '1'); ++ coreUrlOpt.retain = true; ++ ++ const updateActionOpt = mainSect.taboption( ++ 'core_update', ++ form.DummyValue, ++ '_update_action', ++ _('Action') ++ ); ++ updateActionOpt.rawhtml = true; ++ updateActionOpt.cfgvalue = () => ` ++
++ ++ ++
++ ++ `; ++ updateActionOpt.depends('enable_core_update', '1'); ++ // ========================================== ++ + const rendered = await map.render(); + + const statusNode = map.findElement('data-field', statusOpt.cbid('status_section')); + poll.add(updateStatus(statusNode), POLL_INTERVAL); + ++ // ========== Update the status and polling logic ========= ++ let updatePollId = null; ++ ++ function startLogPolling() { ++ if (updatePollId) clearInterval(updatePollId); ++ const pollAction = () => { ++ const btnU = document.getElementById('btn-agh-update'); ++ const btnF = document.getElementById('btn-agh-force'); ++ const logC = document.getElementById('agh-update-log-container'); ++ const logT = document.getElementById('agh-update-log'); ++ ++ if (btnU) btnU.disabled = true; ++ if (btnF) btnF.style.display = 'inline-block'; ++ if (logC) logC.style.display = 'block'; ++ ++ fs.read('/tmp/AdGuardHome_update.log').then((txt) => { ++ if (txt && logT) { ++ logT.value = txt; ++ logT.scrollTop = logT.scrollHeight; ++ } ++ }).catch(() => {}); ++ ++ Promise.all([ ++ fs.stat('/var/run/update_core').catch(() => null), ++ fs.stat('/var/run/update_core_done').catch(() => null), ++ fs.stat('/var/run/update_core_error').catch(() => null) ++ ]).then(([isCore, isDone, isError]) => { ++ if (isDone) { ++ clearInterval(updatePollId); ++ fs.remove('/var/run/update_core_done').catch(() => {}); ++ if (btnU) { ++ btnU.disabled = false; ++ btnU.textContent = _('Updated'); ++ } ++ } else if (isError) { ++ clearInterval(updatePollId); ++ if (btnU) { ++ btnU.disabled = false; ++ btnU.textContent = _('Failed'); ++ } ++ } else if (!isCore && !isDone && !isError) { ++ clearInterval(updatePollId); ++ if (btnU) { ++ btnU.disabled = false; ++ btnU.textContent = _('Already up-to-date'); ++ } ++ } ++ }); ++ }; ++ ++ pollAction(); ++ updatePollId = setInterval(pollAction, 1500); ++ } ++ ++ function applyUpdate(isForce) { ++ const btnU = document.getElementById('btn-agh-update'); ++ const logC = document.getElementById('agh-update-log-container'); ++ const logT = document.getElementById('agh-update-log'); ++ if (btnU) { ++ btnU.textContent = _('Checking...'); ++ btnU.disabled = true; ++ } ++ ++ if (logC) logC.style.display = 'block'; ++ if (logT) logT.value = _('Checking and preparing...\n'); ++ ++ map.save().then(() => { ++ const arg = isForce ? 'force' : ''; ++ fs.exec('/usr/share/AdGuardHome/update_core.sh', [arg]).catch((err) => { ++ console.error('Failed to trigger update script:', err); ++ }); ++ startLogPolling(); ++ }).catch((err) => { ++ console.error('Config save failed:', err); ++ if (btnU) { ++ btnU.textContent = _('Save Failed'); ++ btnU.disabled = false; ++ } ++ }); ++ } ++ ++ rendered.addEventListener('click', (e) => { ++ if (e.target && e.target.id === 'btn-agh-update') { ++ e.preventDefault(); ++ applyUpdate(false); ++ } else if (e.target && e.target.id === 'btn-agh-force') { ++ e.preventDefault(); ++ applyUpdate(true); ++ } ++ // ==== Handle front-end hash encryption logic ==== ++ else if (e.target && e.target.id === 'btn-agh-calc-hash') { ++ e.preventDefault(); ++ const btn = e.target; ++ ++ // Dynamically find the password input box on the page (matching elements with the suffix .hashpass) ++ const inputs = rendered.querySelectorAll('input[type="text"], input[type="password"]'); ++ let passInput = null; ++ for (const el of inputs) { ++ if (el.id && el.id.endsWith('.hashpass')) { ++ passInput = el; ++ break; ++ } ++ } ++ ++ if (!passInput) return; ++ ++ // 1. If JS has not been loaded, it will be loaded dynamically. ++ if (typeof window.TwinBcrypt === 'undefined') { ++ btn.disabled = true; ++ btn.textContent = _('Loading...'); ++ ++ const script = document.createElement('script'); ++ script.src = L.resource('view/adguardhome/twin-bcrypt.min.js'); ++ script.type = 'text/javascript'; ++ ++ script.onload = () => { ++ btn.textContent = _('Click here to Calculate'); ++ btn.disabled = false; ++ }; ++ script.onerror = () => { ++ btn.textContent = _(' ... Load Error ... '); ++ btn.disabled = false; ++ }; ++ document.head.appendChild(script); ++ } ++ // 2. If JS has been loaded, the calculation will be executed. ++ else { ++ if (passInput.value) { ++ // Prevent repeated hashing of hashed strings (starting with $2a$ or $2y$) ++ if (passInput.value.startsWith('$2a$') || passInput.value.startsWith('$2y$')) { ++ btn.textContent = _('Calculation already DONE !'); ++ return; ++ } ++ ++ const hash = window.TwinBcrypt.hashSync(passInput.value); ++ passInput.value = hash; ++ ++ // Manually trigger native input and change events ++ passInput.dispatchEvent(new Event('input', { bubbles: true })); ++ passInput.dispatchEvent(new Event('change', { bubbles: true })); ++ ++ btn.textContent = _(' ... Click Save/Apply ↘️ ... '); ++ } else { ++ btn.textContent = _(' ... Nothing inputted yet ... '); ++ } ++ } ++ } ++ // ========================================== ++ }); ++ ++ Promise.all([ ++ fs.stat('/var/run/update_core').catch(() => null), ++ fs.stat('/var/run/update_core_error').catch(() => null) ++ ]).then(([isCore, isError]) => { ++ if (isCore || isError) { ++ const btnU = document.getElementById('btn-agh-update'); ++ if (btnU) btnU.textContent = _('Checking...'); ++ startLogPolling(); ++ } ++ }); ++ // ========================================== ++ + return rendered; + }, + }); diff --git a/luci-app-adguardhome/patches/04_etc_config.patch b/luci-app-adguardhome/patches/04_etc_config.patch new file mode 100644 index 000000000..51eaa8138 --- /dev/null +++ b/luci-app-adguardhome/patches/04_etc_config.patch @@ -0,0 +1,24 @@ +From 04b0fc3af8ce6b1277143093f1038493bfb3a3cd Mon Sep 17 00:00:00 2001 +From: Jackie264 <125248570+Jackie264@users.noreply.github.com> +Date: Mon, 1 Jun 2026 16:02:48 +0800 +Subject: [PATCH] Add configuration options for AdGuard Home + +--- + root/etc/config/adguardhome | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/root/etc/config/adguardhome b/root/etc/config/adguardhome +index 92d86e1..598f316 100644 +--- a/root/etc/config/adguardhome ++++ b/root/etc/config/adguardhome +@@ -7,6 +7,10 @@ config adguardhome 'config' + option user 'adguardhome' + option group 'adguardhome' + option verbose '0' ++ option enabled '0' ++ option redirect 'none' ++ option core_version 'latest' ++ option update_url 'https://static.adtidy.org/adguardhome/release/AdGuardHome_linux_${Arch}.tar.gz' + + # Files and directories that AdGuard Home has read-only access to + # list jail_mount '/etc/ssl/adguardhome.crt' diff --git a/luci-app-adguardhome/patches/05_nft_tpl.patch b/luci-app-adguardhome/patches/05_nft_tpl.patch new file mode 100644 index 000000000..ba42fbfb9 --- /dev/null +++ b/luci-app-adguardhome/patches/05_nft_tpl.patch @@ -0,0 +1,26 @@ +From c8fd7d003099e858306ad6801ad10cc158bab461 Mon Sep 17 00:00:00 2001 +From: Jackie264 <125248570+Jackie264@users.noreply.github.com> +Date: Fri, 29 May 2026 07:46:16 +0800 +Subject: [PATCH] Create adguardhome.nft.tpl + +--- + root/usr/share/AdGuardHome/adguardhome.nft.tpl | 10 ++++++++++ + 1 file changed, 10 insertions(+) + create mode 100644 root/usr/share/AdGuardHome/adguardhome.nft.tpl + +diff --git a/root/usr/share/AdGuardHome/adguardhome.nft.tpl b/root/usr/share/AdGuardHome/adguardhome.nft.tpl +new file mode 100644 +index 0000000..d11a9dd +--- /dev/null ++++ b/root/usr/share/AdGuardHome/adguardhome.nft.tpl +@@ -0,0 +1,10 @@ ++table inet adguardhome { ++ chain prerouting { ++ type nat hook prerouting priority dstnat; policy accept; ++ ++ iifname { __WAN_EXCLUDES__ } return ++ ++ fib daddr type local udp dport 53 redirect to :__AGH_PORT__ ++ fib daddr type local tcp dport 53 redirect to :__AGH_PORT__ ++ } ++} diff --git a/luci-app-adguardhome/patches/06_nft.patch b/luci-app-adguardhome/patches/06_nft.patch new file mode 100644 index 000000000..3c196aa1d --- /dev/null +++ b/luci-app-adguardhome/patches/06_nft.patch @@ -0,0 +1,17 @@ +From 9510be3c2646f7c1a7701072a1eb3e9fb77f6431 Mon Sep 17 00:00:00 2001 +From: Jackie264 <125248570+Jackie264@users.noreply.github.com> +Date: Fri, 29 May 2026 07:33:01 +0800 +Subject: [PATCH] Create 99-adguardhome.nft + +--- + root/etc/nftables.d/99-adguardhome.nft | 1 + + 1 file changed, 1 insertion(+) + create mode 100644 root/etc/nftables.d/99-adguardhome.nft + +diff --git a/root/etc/nftables.d/99-adguardhome.nft b/root/etc/nftables.d/99-adguardhome.nft +new file mode 100644 +index 0000000..78819ad +--- /dev/null ++++ b/root/etc/nftables.d/99-adguardhome.nft +@@ -0,0 +1 @@ ++include "/var/etc/adguardhome.nft" diff --git a/luci-app-adguardhome/patches/07_update_core.patch b/luci-app-adguardhome/patches/07_update_core.patch new file mode 100644 index 000000000..681fb7cc7 --- /dev/null +++ b/luci-app-adguardhome/patches/07_update_core.patch @@ -0,0 +1,231 @@ +From 7a73fb81100d86127e9c27ad8f14af28e6bc66e3 Mon Sep 17 00:00:00 2001 +From: Jackie264 <125248570+Jackie264@users.noreply.github.com> +Date: Thu, 28 May 2026 14:23:18 +0800 +Subject: [PATCH] Create update_core.sh + +--- + root/usr/share/AdGuardHome/update_core.sh | 215 ++++++++++++++++++++++ + 1 file changed, 215 insertions(+) + create mode 100644 root/usr/share/AdGuardHome/update_core.sh + +diff --git a/root/usr/share/AdGuardHome/update_core.sh b/root/usr/share/AdGuardHome/update_core.sh +new file mode 100644 +index 0000000..bd80165 +--- /dev/null ++++ b/root/usr/share/AdGuardHome/update_core.sh +@@ -0,0 +1,215 @@ ++#!/bin/sh ++ ++# === Core security: self-background operation mechanism === ++if [ "$1" != "bg_run" ]; then ++ rm -f /var/run/update_core* /tmp/AdGuardHome_update.log ++ touch /var/run/update_core ++ /usr/share/AdGuardHome/update_core.sh bg_run "$1" /tmp/AdGuardHome_update.log 2>&1 & ++ exit 0 ++fi ++ ++shift ++# ========================================================== ++ ++PATH="/usr/sbin:/usr/bin:/sbin:/bin" ++binpath="/usr/bin/AdGuardHome" ++update_mode=$1 ++ ++core_version=$(uci get adguardhome.config.core_version 2>/dev/null || true) ++update_url=$(uci get adguardhome.config.update_url 2>/dev/null || true) ++ ++case "${core_version}" in ++beta) ++ core_api_url=https://api.github.com/repos/AdguardTeam/AdGuardHome/releases ++ ;; ++*) ++ core_api_url=https://api.github.com/repos/AdguardTeam/AdGuardHome/releases/latest ++ ;; ++esac ++ ++EXIT(){ ++ rm -rf /var/run/update_core /tmp/AdGuardHome_Update 2>/dev/null ++ if [ "$1" != "0" ]; then ++ touch /var/run/update_core_error ++ fi ++ exit $1 ++} ++ ++trap "EXIT 1" SIGTERM SIGINT ++ ++rm -rf /var/run/update_core_error /var/run/update_core_done 2>/dev/null ++touch /var/run/update_core ++ ++Check_Task(){ ++ running_tasks="$(ps w | grep -v grep | grep 'AdGuardHome' | grep 'update_core' | wc -l)" ++ case $1 in ++ force) ++ echo "Force update requested" ++ echo "Killing ${running_tasks} running tasks ..." ++ ps w | grep -v grep | grep -v $$ | grep 'AdGuardHome' | grep 'update_core' | awk '{print $1}' | xargs kill -9 2>/dev/null ++ ;; ++ *) ++ [ "${running_tasks}" -gt 2 ] && echo -e "There are ${running_tasks} update tasks already running. Please wait or stop them manually." && EXIT 2 ++ ;; ++ esac ++} ++ ++Check_Downloader() { ++ if command -v curl >/dev/null 2>&1; then ++ PKG="curl" ++ return ++ fi ++ ++ if command -v wget >/dev/null 2>&1; then ++ PKG="wget" ++ return ++ fi ++ ++ echo "Neither curl nor wget is installed, cannot check updates!" >&2 ++ EXIT 1 ++} ++ ++Check_Updates(){ ++ Check_Downloader ++ case "${PKG}" in ++ curl) ++ Downloader="curl -L -k -o" ++ _Downloader="curl -s" ++ ;; ++ wget) ++ Downloader="wget --no-check-certificate -T 5 -O" ++ _Downloader="wget -q -O -" ++ ;; ++ esac ++ echo "[${PKG}] Checking for updates ..." ++ Cloud_Version="$(${_Downloader} ${core_api_url} 2>/dev/null | grep 'tag_name' | egrep -o "v[0-9].+[0-9.]" | awk 'NR==1')" ++ if [ -z "${Cloud_Version}" ]; then ++ echo "Failed to check updates, please check network." >&2 ++ EXIT 1 ++ fi ++ ++ if [ -f "${binpath}" ]; then ++ Current_Version="$(${binpath} --version 2>/dev/null | egrep -o "v[0-9].+[0-9]" | sed -r 's/(.*), c(.*)/\1/')" ++ else ++ Current_Version="unknown" ++ fi ++ [ -z "${Current_Version}" ] && Current_Version="unknown" ++ ++ echo "Binary path: ${binpath%/*}" ++ echo "Current version: ${Current_Version}" ++ echo "Latest version: ${Cloud_Version}" ++ ++ if [ ! "${Cloud_Version}" = "${Current_Version}" ] || [ "$1" = force ]; then ++ Update_Core || EXIT 1 ++ else ++ echo "Already up to date." ++ EXIT 0 ++ fi ++ EXIT 0 ++} ++ ++Update_Core(){ ++ rm -rf "/tmp/AdGuardHome_Update" > /dev/null 2>&1 ++ mkdir -p "/tmp/AdGuardHome_Update" || { echo "Unable to create a temporary directory"; EXIT 1; } ++ ++ GET_Arch ++ eval link="${update_url}" ++ echo "Download link: ${link}" ++ echo "File name: ${link##*/}" ++ echo "Downloading AdGuardHome core ..." ++ ++ if ! $Downloader "/tmp/AdGuardHome_Update/${link##*/}" "${link}"; then ++ echo "Download failed." ++ rm -rf "/tmp/AdGuardHome_Update" ++ EXIT 1 ++ fi ++ ++ if [ "${link##*.}" = "gz" ]; then ++ echo "Extracting AdGuardHome ..." ++ if ! tar -zxf "/tmp/AdGuardHome_Update/${link##*/}" -C "/tmp/AdGuardHome_Update/"; then ++ echo "Extraction failed!" ++ rm -rf "/tmp/AdGuardHome_Update" ++ EXIT 1 ++ fi ++ if [ ! -e "/tmp/AdGuardHome_Update/AdGuardHome/AdGuardHome" ]; then ++ echo "Extraction failed: binary not found!" ++ rm -rf "/tmp/AdGuardHome_Update" ++ EXIT 1 ++ fi ++ downloadbin="/tmp/AdGuardHome_Update/AdGuardHome/AdGuardHome" ++ else ++ downloadbin="/tmp/AdGuardHome_Update/${link##*/}" ++ fi ++ ++ chmod +x "${downloadbin}" 2>/dev/null || true ++ echo "Core size: $(awk 'BEGIN{printf "%.2fMB\n",'$((`ls -l $downloadbin | awk '{print $5}'`))'/1000000}')" ++ ++ /etc/init.d/AdGuardHome stop > /dev/null 2>&1 ++ echo "Moving AdGuardHome binary to ${binpath%/*} ..." ++ ++ if ! mv -f "${downloadbin}" "${binpath}"; then ++ echo -e "The core movement failed! \nIt may be caused by insufficient space." ++ rm -rf "/tmp/AdGuardHome_Update" ++ EXIT 1 ++ fi ++ ++ rm -rf /tmp/AdGuardHome_Update ++ chmod +x ${binpath} ++ echo "Restarting AdGuardHome service ..." ++ /etc/init.d/adguardhome restart > /dev/null 2>&1 ++ ++ echo "AdGuardHome core updated successfully!" ++ touch /var/run/update_core_done ++ EXIT 0 ++} ++ ++GET_Arch() { ++ Archt="$(uname -m)" ++ case "${Archt}" in ++ i386|i686) ++ Arch="i386" ++ ;; ++ x86_64|amd64) ++ Arch="amd64" ++ ;; ++ mipsel|mipsel*) ++ Arch="mipsle_softfloat" ++ ;; ++ mips|mips*) ++ Arch="mips_softfloat" ++ ;; ++ mips64el) ++ Arch="mips64le_softfloat" ++ ;; ++ mips64) ++ Arch="mips64_softfloat" ++ ;; ++ armv5*|armv5l|armv5tel) ++ Arch="armv5" ++ ;; ++ armv6*|armv6l) ++ Arch="armv6" ++ ;; ++ armv7*|armv7l) ++ Arch="armv7" ++ ;; ++ arm|armhf) ++ Arch="armv7" ++ ;; ++ aarch64) ++ Arch="arm64" ++ ;; ++ *) ++ echo "Unsupported architecture: [${Archt}]" ++ EXIT 1 ++ esac ++ echo "Detected architecture: ${Arch}" ++} ++ ++ ++main(){ ++ Check_Task ${update_mode} ++ Check_Updates ${update_mode} ++} ++ ++main diff --git a/luci-app-adguardhome/patches/08_control.patch b/luci-app-adguardhome/patches/08_control.patch new file mode 100644 index 000000000..f774b0930 --- /dev/null +++ b/luci-app-adguardhome/patches/08_control.patch @@ -0,0 +1,239 @@ +From 0e2440feea5f51d187189aae41d45d15102773bc Mon Sep 17 00:00:00 2001 +From: Jackie264 <125248570+Jackie264@users.noreply.github.com> +Date: Sun, 31 May 2026 09:38:02 +0800 +Subject: [PATCH] Create control.sh + +--- + root/usr/share/AdGuardHome/control.sh | 223 ++++++++++++++++++++++++++ + 1 file changed, 223 insertions(+) + create mode 100644 root/usr/share/AdGuardHome/control.sh + +diff --git a/root/usr/share/AdGuardHome/control.sh b/root/usr/share/AdGuardHome/control.sh +new file mode 100644 +index 0000000..1686183 +--- /dev/null ++++ b/root/usr/share/AdGuardHome/control.sh +@@ -0,0 +1,223 @@ ++#!/bin/sh ++# /usr/share/AdGuardHome/control.sh ++. /usr/share/AdGuardHome/helper.sh ++ ++ENABLED="$1" ++CONFIGURATION="adguardhome" ++NFT_RULES_TPL="/usr/share/AdGuardHome/adguardhome.nft.tpl" ++NFT_RULES_FILE="/var/etc/adguardhome.nft" ++NFT_TABLE="adguardhome" ++ ++set_nft_redirect() { ++ local port="$1" ++ [ -z "$port" ] && return 1 ++ [ ! -f "$NFT_RULES_TPL" ] && return 1 ++ ++ local wan_section_name ++ wan_section_name=$(uci show firewall | awk -F'.' '/\.name='\''wan'\''$/ {print $2}') ++ local WAN_IFS="" ++ if [ -n "$wan_section_name" ]; then ++ WAN_IFS=$(uci get firewall.$wan_section_name.network 2>/dev/null | xargs) ++ fi ++ ++ local WAN_NFT_SET="" ++ for IF in $WAN_IFS; do ++ WAN_NFT_SET="${WAN_NFT_SET} \"$IF\"," ++ done ++ WAN_NFT_SET=$(echo "$WAN_NFT_SET" | sed 's/,$//') ++ ++ sed -e "s/__WAN_EXCLUDES__/${WAN_NFT_SET}/g" -e "s/__AGH_PORT__/${port}/g" "$NFT_RULES_TPL" > "$NFT_RULES_FILE" ++ ++ nft delete table inet "$NFT_TABLE" 2>/dev/null ++ fw4 reload ++ logger -t adguardhome "nft table $NFT_TABLE applied on port $port, WAN excludes: $WAN_NFT_SET" ++} ++ ++clear_nft_redirect() { ++ # 优化：只有当表存在时才清理和重载防火墙，避免无意义的性能开销 ++ if nft list table inet "$NFT_TABLE" >/dev/null 2>&1; then ++ [ -f "$NFT_RULES_FILE" ] && > "$NFT_RULES_FILE" ++ nft delete table inet "$NFT_TABLE" 2>/dev/null ++ fw4 reload ++ logger -t adguardhome "nft table $NFT_TABLE cleared" ++ fi ++} ++ ++set_forward_dnsmasq() { ++ local PORT="$1" ++ local addr="127.0.0.1#$PORT" ++ local OLD_SERVER ++ OLD_SERVER="$(uci get dhcp.@dnsmasq[0].server 2>/dev/null)" ++ echo "$OLD_SERVER" | grep -q "^$addr" && return 0 ++ ++ uci delete dhcp.@dnsmasq[0].server 2>/dev/null ++ uci add_list dhcp.@dnsmasq[0].server="$addr" ++ uci delete dhcp.@dnsmasq[0].resolvfile 2>/dev/null ++ uci set dhcp.@dnsmasq[0].noresolv=1 ++ uci commit dhcp ++ /etc/init.d/dnsmasq restart >/dev/null 2>&1 ++} ++ ++stop_forward_dnsmasq() { ++ local OLD_PORT="$1" ++ local addr="127.0.0.1#$OLD_PORT" ++ local OLD_SERVER ++ OLD_SERVER="$(uci get dhcp.@dnsmasq[0].server 2>/dev/null)" ++ echo "$OLD_SERVER" | grep -q "^$addr" || return 0 ++ ++ uci del_list dhcp.@dnsmasq[0].server="$addr" 2>/dev/null ++ local addrlist ++ addrlist="$(uci get dhcp.@dnsmasq[0].server 2>/dev/null)" ++ if [ -z "$addrlist" ]; then ++ local resolvfile="/tmp/resolv.conf.d/resolv.conf.auto" ++ [ ! -f "$resolvfile" ] && resolvfile="/tmp/resolv.conf.auto" ++ uci set dhcp.@dnsmasq[0].resolvfile="$resolvfile" 2>/dev/null ++ uci delete dhcp.@dnsmasq[0].noresolv 2>/dev/null ++ fi ++ uci commit dhcp ++ /etc/init.d/dnsmasq restart >/dev/null 2>&1 ++} ++ ++agh_reload() { ++ ubus call service event '{"type":"config.change","data":{"package":"adguardhome"}}' >/dev/null 2>&1 ++} ++ ++rm_port53() { ++ local configpath ++ configpath=$(uci -q get adguardhome.config.config_file) ++ [ -z "$configpath" ] && configpath="/etc/adguardhome/adguardhome.yaml" ++ ++ local adguardhome_PORT dnsmasq_port ++ adguardhome_PORT=$(config_editor "dns.port" "" "$configpath" "1") ++ dnsmasq_port=$(uci get dhcp.@dnsmasq[0].port 2>/dev/null) ++ [ -z "$dnsmasq_port" ] && dnsmasq_port="53" ++ ++ if [ "$dnsmasq_port" = "$adguardhome_PORT" ]; then ++ [ "$dnsmasq_port" = "53" ] && dnsmasq_port="1745" ++ elif [ "$dnsmasq_port" = "53" ]; then ++ return ++ fi ++ ++ config_editor "dns.port" "$dnsmasq_port" "$configpath" ++ uci set dhcp.@dnsmasq[0].port="53" ++ uci commit dhcp ++ ++ /etc/init.d/dnsmasq restart ++ agh_reload ++} ++ ++use_port53() { ++ local configpath ++ configpath=$(uci -q get adguardhome.config.config_file) ++ [ -z "$configpath" ] && configpath="/etc/adguardhome/adguardhome.yaml" ++ ++ local adguardhome_PORT dnsmasq_port ++ adguardhome_PORT=$(config_editor "dns.port" "" "$configpath" "1") ++ dnsmasq_port=$(uci get dhcp.@dnsmasq[0].port 2>/dev/null) ++ [ -z "$dnsmasq_port" ] && dnsmasq_port="53" ++ ++ if [ "$dnsmasq_port" = "$adguardhome_PORT" ]; then ++ [ "$dnsmasq_port" = "53" ] && adguardhome_PORT="1745" ++ elif [ "$adguardhome_PORT" = "53" ]; then ++ return ++ fi ++ ++ config_editor "dns.port" "53" "$configpath" ++ uci set dhcp.@dnsmasq[0].port="$adguardhome_PORT" ++ uci commit dhcp ++ /etc/init.d/dnsmasq restart ++ agh_reload ++} ++ ++mark_redirect_flag() { ++ local enabled="$1" redirect="$2" agh_port="$3" ++ local configpath flag=0 ++ configpath=$(uci -q get adguardhome.config.config_file) ++ [ -z "$configpath" ] && configpath="/etc/adguardhome/adguardhome.yaml" ++ ++ if [ "$enabled" = "1" ] && [ "$redirect" != "none" ]; then ++ flag=1 ++ if [ "$redirect" = "redirect" ]; then ++ nft list table inet "$NFT_TABLE" >/dev/null 2>&1 || flag=0 ++ elif [ "$redirect" = "dnsmasq-upstream" ]; then ++ local s ++ s="$(uci -q get dhcp.@dnsmasq[0].server | tr '\n' ' ')" ++ printf '%s\n' "$s" | grep -q -E "(^|[[:space:]])127\.0\.0\.1#${agh_port}([[:space:]]|$)" || flag=0 ++ elif [ "$redirect" = "exchange" ]; then ++ local cfgp dport ++ cfgp="$(config_editor "dns.port" "" "$configpath" "1")" ++ dport="$(uci -q get dhcp.@dnsmasq[0].port)" ++ if [ "$cfgp" != "53" ] || [ "$dport" = "53" ] ; then flag=0; fi ++ fi ++ fi ++ echo -n "$flag" > /var/run/AdGredir ++} ++ ++_do_redirect() { ++ local enabled="$1" ++ local configpath ++ configpath=$(uci -q get adguardhome.config.config_file) ++ [ -z "$configpath" ] && configpath="/etc/adguardhome/adguardhome.yaml" ++ ++ local adguardhome_PORT redirect old_redirect old_port old_enabled ++ adguardhome_PORT="$(config_editor "dns.port" "" "$configpath" "1")" ++ [ -z "$adguardhome_PORT" ] && adguardhome_PORT="0" ++ ++ redirect=$(uci -q get adguardhome.config.redirect || echo "none") ++ ++ # 【核心修复】：从内存文件中读取旧状态，彻底放弃污染 UCI ++ if [ -f /var/run/adguardhome.state ]; then ++ . /var/run/adguardhome.state ++ else ++ old_redirect="none" ++ old_port="0" ++ old_enabled="0" ++ fi ++ ++ uci get dhcp.@dnsmasq[0].port >/dev/null 2>&1 || uci set dhcp.@dnsmasq[0].port="53" ++ uci commit dhcp ++ ++ if [ "$old_enabled" = "1" ] && [ "$old_redirect" = "exchange" ]; then ++ adguardhome_PORT="$(uci get dhcp.@dnsmasq[0].port 2>/dev/null)" ++ fi ++ ++ if [ "$old_redirect" != "$redirect" ] || [ "$old_port" != "$adguardhome_PORT" ] || { [ "$old_enabled" = "1" ] && [ "$enabled" = "0" ]; }; then ++ if [ "$old_redirect" != "none" ]; then ++ if [ "$old_redirect" = "redirect" ] && [ "$old_port" != "0" ]; then ++ clear_nft_redirect ++ elif [ "$old_redirect" = "dnsmasq-upstream" ]; then ++ stop_forward_dnsmasq "$old_port" ++ elif [ "$old_redirect" = "exchange" ]; then ++ rm_port53 ++ fi ++ fi ++ elif [ "$old_enabled" = "1" ] && [ "$enabled" = "1" ]; then ++ if [ "$old_redirect" = "redirect" ] && [ "$old_port" != "0" ]; then ++ clear_nft_redirect ++ fi ++ fi ++ ++ # 【核心修复】：将当前状态覆盖写入内存文件，轻量、疾速、安全！ ++ cat < /var/run/adguardhome.state ++old_redirect="$redirect" ++old_port="$adguardhome_PORT" ++old_enabled="$enabled" ++EOF ++ ++ if [ "$enabled" = "0" ] || [ "$adguardhome_PORT" = "0" ]; then ++ echo -n "0" > /var/run/AdGredir ++ return 1 ++ fi ++ ++ if [ "$redirect" = "redirect" ]; then ++ set_nft_redirect "$adguardhome_PORT" ++ elif [ "$redirect" = "dnsmasq-upstream" ]; then ++ set_forward_dnsmasq "$adguardhome_PORT" ++ elif [ "$redirect" = "exchange" ] && [ "$(uci get dhcp.@dnsmasq[0].port 2>/dev/null)" = "53" ]; then ++ use_port53 ++ fi ++ ++ mark_redirect_flag "$enabled" "$redirect" "$adguardhome_PORT" ++} ++ ++_do_redirect "$ENABLED" diff --git a/luci-app-adguardhome/patches/09_watchconfig.patch b/luci-app-adguardhome/patches/09_watchconfig.patch new file mode 100644 index 000000000..bed80b07b --- /dev/null +++ b/luci-app-adguardhome/patches/09_watchconfig.patch @@ -0,0 +1,34 @@ +From b1391765b484c6f50feba7f09bdf50d3aa443356 Mon Sep 17 00:00:00 2001 +From: Jackie264 <125248570+Jackie264@users.noreply.github.com> +Date: Fri, 29 May 2026 14:27:56 +0800 +Subject: [PATCH] Add watchconfig.sh to monitor AdGuardHome config + +--- + root/usr/share/AdGuardHome/watchconfig.sh | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + create mode 100644 root/usr/share/AdGuardHome/watchconfig.sh + +diff --git a/root/usr/share/AdGuardHome/watchconfig.sh b/root/usr/share/AdGuardHome/watchconfig.sh +new file mode 100644 +index 0000000..c7267bf +--- /dev/null ++++ b/root/usr/share/AdGuardHome/watchconfig.sh +@@ -0,0 +1,18 @@ ++#!/bin/sh ++# /usr/share/AdGuardHome/watchconfig.sh ++ ++PATH="/usr/sbin:/usr/bin:/sbin:/bin" ++ ++configpath=$(uci -q get adguardhome.config.config_file) ++[ -z "$configpath" ] && configpath="/etc/adguardhome/adguardhome.yaml" ++ ++while : ++do ++ sleep 10 ++ if [ -f "$configpath" ]; then ++ /etc/init.d/adguardhome do_redirect 1 ++ break ++ fi ++done ++ ++exit 0 diff --git a/luci-app-adguardhome/patches/10_yaml_helper.patch b/luci-app-adguardhome/patches/10_yaml_helper.patch new file mode 100644 index 000000000..e1390a628 --- /dev/null +++ b/luci-app-adguardhome/patches/10_yaml_helper.patch @@ -0,0 +1,38 @@ +From 864c042e5cdbe61922f917d1785bf7342b3fc90d Mon Sep 17 00:00:00 2001 +From: Jackie264 <125248570+Jackie264@users.noreply.github.com> +Date: Sun, 31 May 2026 08:25:55 +0800 +Subject: [PATCH] Create helper.sh for YAML reading and writing + +Added a helper script for YAML configuration management. +--- + root/usr/share/AdGuardHome/helper.sh | 21 +++++++++++++++++++++ + 1 file changed, 21 insertions(+) + create mode 100644 root/usr/share/AdGuardHome/helper.sh + +diff --git a/root/usr/share/AdGuardHome/helper.sh b/root/usr/share/AdGuardHome/helper.sh +new file mode 100644 +index 0000000..35f0198 +--- /dev/null ++++ b/root/usr/share/AdGuardHome/helper.sh +@@ -0,0 +1,21 @@ ++#!/bin/sh ++# Auxiliary functions specially used for reading and writing YAML ++config_editor() { ++ awk -v yaml="$1" -v value="$2" -v file="$3" -v ro="$4" ' ++ BEGIN{split(yaml,part,"\.");s="";i=1;l=length(part);} ++ { ++ if (match($0,s""part[i]":")) { ++ if (i==l) { ++ split($0,t,": "); ++ if (ro==""){ ++ system("sed -i '\''"FNR"c\\" t[1] ": " value "'\'' " file " >/dev/null 2>&1"); ++ } else { ++ print(t[2]); ++ } ++ exit; ++ } ++ s=s"[- ]{2}"; ++ i++; ++ } ++ }' "$3" ++} diff --git a/luci-app-adguardhome/patches/11_AGH_yaml.patch b/luci-app-adguardhome/patches/11_AGH_yaml.patch new file mode 100644 index 000000000..68812a0bf --- /dev/null +++ b/luci-app-adguardhome/patches/11_AGH_yaml.patch @@ -0,0 +1,324 @@ +From 2cc00f18ce38e8c39af30ce5381f229e3c742adf Mon Sep 17 00:00:00 2001 +From: Jackie264 <125248570+Jackie264@users.noreply.github.com> +Date: Sat, 30 May 2026 17:40:57 +0800 +Subject: [PATCH] Add initial configuration for AdGuard Home + +--- + root/etc/adguardhome/adguardhome.yaml | 308 ++++++++++++++++++++++++++ + 1 file changed, 308 insertions(+) + create mode 100644 root/etc/adguardhome/adguardhome.yaml + +diff --git a/root/etc/adguardhome/adguardhome.yaml b/root/etc/adguardhome/adguardhome.yaml +new file mode 100644 +index 0000000..f7a1a94 +--- /dev/null ++++ b/root/etc/adguardhome/adguardhome.yaml +@@ -0,0 +1,308 @@ ++http: ++ pprof: ++ port: 6060 ++ enabled: false ++ doh: ++ routes: ++ - GET /dns-query ++ - POST /dns-query ++ - GET /dns-query/{ClientID} ++ - POST /dns-query/{ClientID} ++ insecure_enabled: false ++ address: 0.0.0.0:3008 ++ session_ttl: 30d ++users: ++ - name: root ++ password: ++auth_attempts: 5 ++block_auth_min: 15 ++http_proxy: "" ++language: "" ++theme: auto ++dns: ++ bind_hosts: ++ - 0.0.0.0 ++ port: 1745 ++ anonymize_client_ip: false ++ ratelimit: 0 ++ ratelimit_subnet_len_ipv4: 24 ++ ratelimit_subnet_len_ipv6: 56 ++ ratelimit_whitelist: [] ++ refuse_any: true ++ upstream_dns: ++ - '#https://dns10.quad9.net/dns-query' ++ - 223.5.5.5 ++ - 2400:3200::1 ++ - https://dns.alidns.com/dns-query ++ upstream_dns_file: "" ++ bootstrap_dns: ++ - 119.29.29.29 ++ - 114.114.114.114 ++ fallback_dns: ++ - 119.29.29.29 ++ - 113.31.119.88 ++ - 2400:7fc0:849e:200:62fd:1de3:1c90:1 ++ upstream_mode: parallel ++ fastest_timeout: 1s ++ allowed_clients: [] ++ disallowed_clients: [] ++ blocked_hosts: ++ - version.bind ++ - id.server ++ - hostname.bind ++ trusted_proxies: ++ - 127.0.0.0/8 ++ - ::1/128 ++ cache_enabled: true ++ cache_size: 4194304 ++ cache_ttl_min: 0 ++ cache_ttl_max: 0 ++ cache_optimistic: true ++ cache_optimistic_answer_ttl: 30s ++ cache_optimistic_max_age: 12h ++ bogus_nxdomain: [] ++ aaaa_disabled: false ++ enable_dnssec: true ++ edns_client_subnet: ++ custom_ip: "" ++ enabled: true ++ use_custom: false ++ max_goroutines: 300 ++ handle_ddr: true ++ ipset: [] ++ ipset_file: "" ++ bootstrap_prefer_ipv6: false ++ upstream_timeout: 10s ++ private_networks: [] ++ use_private_ptr_resolvers: true ++ local_ptr_upstreams: ++ - 127.0.0.1:1745 ++ use_dns64: false ++ dns64_prefixes: [] ++ serve_http3: false ++ use_http3_upstreams: false ++ serve_plain_dns: true ++ hostsfile_enabled: true ++ pending_requests: ++ enabled: true ++tls: ++ enabled: false ++ server_name: "" ++ force_https: false ++ port_https: 443 ++ port_dns_over_tls: 853 ++ port_dns_over_quic: 853 ++ port_dnscrypt: 0 ++ dnscrypt_config_file: "" ++ certificate_chain: "" ++ private_key: "" ++ certificate_path: "" ++ private_key_path: "" ++ strict_sni_check: false ++querylog: ++ dir_path: "" ++ ignored: ++ - orirainbow.cc^ ++ - orirainwe.edu.kg^ ++ - coriseay.edu.kg^ ++ - google.com^ ++ interval: 7d ++ size_memory: 1000 ++ enabled: true ++ ignored_enabled: true ++ file_enabled: true ++statistics: ++ dir_path: "" ++ ignored: ++ - orirainbow.cc^ ++ - orirainwe.edu.kg^ ++ - coriseay.edu.kg^ ++ - google.com^ ++ interval: 7d ++ enabled: true ++ ignored_enabled: true ++filters: ++ - enabled: true ++ url: https://adguardteam.github.io/HostlistsRegistry/assets/filter_1.txt ++ name: AdGuard DNS filter ++ id: 1 ++ - enabled: false ++ url: https://adguardteam.github.io/HostlistsRegistry/assets/filter_2.txt ++ name: AdAway Default Blocklist ++ id: 2 ++whitelist_filters: [] ++user_rules: ++ - '@@||ntfy.sh^' ++ - '@@||pubnub.com^' ++ - '@@||clarity.ms^$important' ++ - '@@||sh-gsg.com^$important' ++ - '@@||sh-mtgc.com^$important' ++ - '@@||taobao.com^$important' ++ - '@@||tmall.com^$important' ++ - '@@||jd.com^important' ++ - '@@||flyme.cn^$important' ++ - '@@||meizu.com^$important' ++ - '@@||flydigi.com^' ++ - '@@||pv.sohu.com^$important' ++ - '@@||trafficmanager.net^' ++ - '||yify.foo^' ++ - '||www.668cbb.com/static/adScript.js' ++ - '||topnewsfeeds.net^' ++ - '||nbryb.com^' ++ - '||superbdolly.com^' ++ - '||salutationcheerlessdemote.com^' ++ - '||buildingdoodlesquare.com^' ++ - '||colonistnobilityheroic.com^' ++ - '#解除 小米 及其所有子域名的封锁；' ++ - '@@||mi.com^' ++ - '@@||mi.cn^' ++ - '@@||xiaomi.com^' ++ - '@@||miui.com^' ++ - '@@||xiaomi.net^' ++ - '@@||xiaomi-mipdx.cn.miaozhen.com^' ++ - '@@||xiaomi-dtv.m.cn.miaozhen.com^' ++ - '@@||miwifi.com^' ++ - '@@||tracker.ai.xiaomi.com^$important' ++ - '@@||tracking.miui.com^$important' ++ - '#解除 Apple 及其所有子域名的封锁；' ++ - '@@||apple.com^' ++ - '@@||apple.com.cn^' ++ - '@@||icloud.com^' ++ - '@@||icloud.com.cn^' ++ - '#解除 cloudflare 及其所有子域名的封锁；' ++ - '@@||static.cloudflareinsights.com^$important' ++ - '@@||cloudflare.com^' ++ - '@@||cloudflare-cn.com^' ++ - '@@||argotunnel.com^' ++ - '#解除 microsoft 及其所有子域名的封锁；' ++ - '@@||microsoft.com^$important' ++ - '@@||windows.com^$important' ++ - '@@||microsoftonline.com^$important' ++ - '@@||windowsupdate.com^$important' ++ - '@@||office.com^$important' ++ - '@@||live.com^$important' ++ - '@@||skype.com^$important' ++ - '@@||msn.com^$important' ++ - '@@||bing.com^$important' ++ - '@@||msftconnecttest.com^$important' ++ - '@@||res.public.onecdn.static.microsoft^$important' ++ - '@@||inference.location.live.net^$important' ++ - '@@||static.edge.microsoftapp.net^$important' ++ - '@@||ipv6.msftconnecttest.com^$important' ++ - '@@||sentry.io^$important' ++ - '@@||metrics1.data.hicloud.com^$important' ++ - '@@||otheve.beacon.qq.com^$important' ++ - '@@||app-measurement.com^$important' ++ - '@@||tmdb.org^' ++ - '@@||themoviedb.org^' ++ - /googleads.$~script,domain=~googleads.github.io ++ - /pagead/lvz? ++ - '||google.com/pagead/' ++ - '||static.doubleclick.net^$domain=youtube.com' ++ - '||youtube.com/get_midroll_' ++ - '||5hz.org^' ++ - '||evewan.com^' ++ - '||stgowan.com^' ++ - '||51gowan.com^' ++ - '||www.66s6.net/d/js/acmsd/thea5.js' ++ - '||www.66s6.net/d/js/acmsd/thea6.js' ++ - '||sogowan.com^' ++ - '||52xkdy.com^' ++ - '||ttzj666.com^' ++ - '||888dyy.cc^' ++ - '||qisaoba.com^' ++ - '||euqq.cn^' ++ - '||wkyaoye.com^' ++ - '||qisaoba.com^' ++ - '@||adobe.io^' ++ - '@||adobestats.io' ++ - '@||adobe.com^' ++ - '@||gocart-web-prod-ue1-alb-1461435473.us-east-1.elb.amazonaws.com' ++ - '@@||dig.bdurl.net^$important' ++ - '@@||android.bugly.qq.com^$important' ++ - '@@||yun-hl.3g.qq.com^$important' ++ - '@@||collector.github.com^$important' ++ - '@@||geolocation.onetrust.com^$important' ++ - '@@||google-analytics.com^$important' ++ - '@@||client-upload.cn-shanghai.log.aliyuncs.com^$important' ++ - '@@||twingate.com^' ++ - '@@||syncthing.net^' ++ - '@@||loggw-ex.alipay.com^$important' ++ - '@@||hdfans.org^' ++ - '@@||1ptba.com^' ++ - '@@||ptcafe.club^' ++ - '||nbpicture.xyz^' ++ - "" ++dhcp: ++ enabled: false ++ interface_name: "" ++ local_domain_name: lan ++ dhcpv4: ++ gateway_ip: "" ++ subnet_mask: "" ++ range_start: "" ++ range_end: "" ++ lease_duration: 86400 ++ icmp_timeout_msec: 1000 ++ options: [] ++ dhcpv6: ++ range_start: "" ++ lease_duration: 86400 ++ ra_slaac_only: false ++ ra_allow_slaac: false ++filtering: ++ blocking_ipv4: "" ++ blocking_ipv6: "" ++ blocked_services: ++ schedule: ++ time_zone: UTC ++ ids: [] ++ protection_disabled_until: null ++ safe_search: ++ enabled: false ++ bing: true ++ duckduckgo: true ++ ecosia: true ++ google: true ++ pixabay: true ++ yandex: true ++ youtube: true ++ blocking_mode: default ++ parental_block_host: family-block.dns.adguard.com ++ safebrowsing_block_host: standard-block.dns.adguard.com ++ rewrites: [] ++ safe_fs_patterns: ++ - /var/lib/adguardhome/userfilters/* ++ safebrowsing_cache_size: 1048576 ++ safesearch_cache_size: 1048576 ++ parental_cache_size: 1048576 ++ cache_time: 30 ++ filters_update_interval: 24 ++ blocked_response_ttl: 10 ++ filtering_enabled: true ++ rewrites_enabled: true ++ parental_enabled: false ++ safebrowsing_enabled: false ++ protection_enabled: true ++clients: ++ runtime_sources: ++ whois: true ++ arp: true ++ rdns: true ++ dhcp: true ++ hosts: true ++ persistent: [] ++log: ++ enabled: true ++ file: "" ++ max_backups: 0 ++ max_size: 100 ++ max_age: 3 ++ compress: false ++ local_time: false ++ verbose: false ++os: ++ group: "" ++ user: "" ++ rlimit_nofile: 0 ++schema_version: 34 diff --git a/luci-app-adguardhome/patches/12_twin-bcrypt.patch b/luci-app-adguardhome/patches/12_twin-bcrypt.patch new file mode 100644 index 000000000..43a0574fe --- /dev/null +++ b/luci-app-adguardhome/patches/12_twin-bcrypt.patch @@ -0,0 +1,23 @@ +From bc9e4fac2e0be80730df3aa345acf3dc2b7784d0 Mon Sep 17 00:00:00 2001 +From: Jackie264 <125248570+Jackie264@users.noreply.github.com> +Date: Sun, 31 May 2026 20:27:21 +0800 +Subject: [PATCH] Create twin-bcrypt.min.js + +--- + .../resources/view/adguardhome/twin-bcrypt.min.js | 7 +++++++ + 1 file changed, 7 insertions(+) + create mode 100644 htdocs/luci-static/resources/view/adguardhome/twin-bcrypt.min.js + +diff --git a/htdocs/luci-static/resources/view/adguardhome/twin-bcrypt.min.js b/htdocs/luci-static/resources/view/adguardhome/twin-bcrypt.min.js +new file mode 100644 +index 0000000..3a03268 +--- /dev/null ++++ b/htdocs/luci-static/resources/view/adguardhome/twin-bcrypt.min.js +@@ -0,0 +1,7 @@ ++/* @license ++ * Twin-Bcrypt 2.2.0 ++ * https://github.com/fpirsch/twin-bcrypt ++ * Licence: BSD-3-Clause ++ */ ++!function(r,n){"use strict";function e(r){return y[g]=t.apply(n,r),g++}function t(r){var e=[].slice.call(arguments,1);return function(){"function"==typeof r?r.apply(n,e):new Function(""+r)()}}function o(r){if(m)setTimeout(t(o,r),0);else{var n=y[r];if(n){m=!0;try{n()}finally{a(r),m=!1}}}}function a(r){delete y[r]}function i(){p=function(){var r=e(arguments);return process.nextTick(t(o,r)),r}}function u(){if(r.postMessage&&!r.importScripts){var n=!0,e=r.onmessage;return r.onmessage=function(){n=!1},r.postMessage("","*"),r.onmessage=e,n}}function f(){var n="setImmediate$"+Math.random()+"$",t=function(e){e.source===r&&"string"==typeof e.data&&0===e.data.indexOf(n)&&o(+e.data.slice(n.length))};r.addEventListener?r.addEventListener("message",t,!1):r.attachEvent("onmessage",t),p=function(){var t=e(arguments);return r.postMessage(n+t,"*"),t}}function c(){var r=new MessageChannel;r.port1.onmessage=function(r){var n=r.data;o(n)},p=function(){var n=e(arguments);return r.port2.postMessage(n),n}}function s(){var r=v.documentElement;p=function(){var n=e(arguments),t=v.createElement("script");return t.onreadystatechange=function(){o(n),t.onreadystatechange=null,r.removeChild(t),t=null},r.appendChild(t),n}}function l(){p=function(){var r=e(arguments);return setTimeout(t(o,r),0),r}}if(!r.setImmediate){var p,g=1,y={},m=!1,v=r.document,d=Object.getPrototypeOf&&Object.getPrototypeOf(r);d=d&&d.setTimeout?d:r,"[object process]"==={}.toString.call(r.process)?i():u()?f():r.MessageChannel?c():v&&"onreadystatechange"in v.createElement("script")?s():l(),d.setImmediate=p,d.clearImmediate=a}}(new Function("return this")()),function(r){"object"==typeof exports?r(exports,require("crypto")):r(self.TwinBcrypt={},self.crypto||self.msCrypto)}(function(r,n){"use strict";function e(r){for(var n=unescape(encodeURIComponent(r)),e=n.length,t=new Array(e),o=0;e>o;o++)t[o]=n.charCodeAt(o);return t}function t(r){for(var n=r.length,e=new Array(n),t=0;n>t;t++)e[t]=r.charCodeAt(t);return e}function o(r,n){for(var e,t,o=0,a="";n>o;){if(e=255&r[o++],a+=B[e>>2],e=(3&e)<<4,o>=n){a+=B[e];break}if(t=255&r[o++],e|=t>>4,a+=B[e],e=(15&t)<<2,o>=n){a+=B[e];break}t=255&r[o++],e|=t>>6,a+=B[e],a+=B[63&t]}return a}function a(r){for(var n,e,t=new Array(16),o=0,a=0;;){if(n=D[r.charCodeAt(o++)-46],e=D[r.charCodeAt(o++)-46],t[a++]=255&(n<<2|e>>4),22===o)break;n=e<<4,e=D[r.charCodeAt(o++)-46],t[a++]=255&(n|e>>2),n=e<<6,e=D[r.charCodeAt(o++)-46],t[a++]=255&(n|e)}return t}function i(r){for(var n=r.length,e=new Array(72),t=0,o=0;72>o;)e[o++]=r[t++],t===n&&(t=0);return e}function u(r,n,e){for(var t=0,o=e>>2;tt;)r[n++]=e[t++]<<24|e[t++]<<16|e[t++]<<8|e[t++]}function c(r){function n(n){for(var e=r,t=G>>2,o=t|O,f=n>>2,c=e[f]^e[t],s=e[1|f];o>t;)s^=(e[c>>>24]+e[a|c>>>16&255]^e[i|c>>>8&255])+e[u|255&c]^e[++t],c^=(e[s>>>24]+e[a|s>>>16&255]^e[i|s>>>8&255])+e[u|255&s]^e[++t];e[f]=s^e[S>>2],e[1|f]=c}function e(n){var e;for(r[L>>2]=0,r[L+4>>2]=0,e=0;M>e;e++)r[G>>2|e]^=r[(n>>2)+e];var t,o,f,c,s,l=r;for(e=0;M>e;e+=2){for(t=G>>2,o=t|O,f=L>>2,c=l[f]^l[t],s=l[1|f];o>t;)s^=(l[c>>>24]+l[a|c>>>16&255]^l[i|c>>>8&255])+l[u|255&c]^l[++t],c^=(l[s>>>24]+l[a|s>>>16&255]^l[i|s>>>8&255])+l[u|255&s]^l[++t];l[f]=s^l[S>>2],l[1|f]=c,r[G>>2|e]=l[f],r[G>>2|e+1]=c}for(e=0;T>e;e+=2){for(t=G>>2,o=t|O,f=L>>2,c=l[f]^l[t],s=l[1|f];o>t;)s^=(l[c>>>24]+l[a|c>>>16&255]^l[i|c>>>8&255])+l[u|255&c]^l[++t],c^=(l[s>>>24]+l[a|s>>>16&255]^l[i|s>>>8&255])+l[u|255&s]^l[++t];l[f]=s^l[S>>2],l[1|f]=c,r[e]=l[f],r[1|e]=c}}function t(r,n,t){for(var o=0;t>=o&&!(r>n);o++)e(R),e(j),r++;return r}var o=k>>2,a=o+256|0,i=a+256|0,u=i+256|0;return{encrypt:n,expandLoop:t}}function s(stdlib, foreign, heap) {"use asm";var HEAP32=new stdlib.Uint32Array(heap);var BLOWFISH_NUM_ROUNDS=16;var S_offset=0x0000;var S1_offset=0x0400;var S2_offset=0x0800;var S3_offset=0x0C00;var P_offset=0x1000;var P_last_offset=0x1044;var crypt_ciphertext_offset=0x1048;var LR_offset=0x01060;var password_offset=0x1068;var salt_offset=0x10b0;var P_LEN=18;var S_LEN=1024;function encrypt(offset) {offset=offset|0;var i=0;var n=0;var L=0;var R=0;var imax=0;imax=P_offset|BLOWFISH_NUM_ROUNDS<<2;L=HEAP32[offset>>2]|0;R=HEAP32[offset+4>>2]|0;L=L^HEAP32[P_offset>>2];for (i=P_offset; (i|0)<(imax|0);) {i=(i+4)>>>0;R=R^(((HEAP32[(L>>>22)>>2]>>>0) +(HEAP32[(S1_offset|(L>>>14&0x3ff))>>2]>>>0) ^(HEAP32[(S2_offset|(L>>>6&0x3ff))>>2])) +(HEAP32[(S3_offset|(L<<2&0x3ff))>>2]>>>0))^HEAP32[i>>2];i=(i+4)>>>0;L=L^(((HEAP32[(R>>>22)>>2]>>>0) +(HEAP32[(S1_offset|(R>>>14&0x3ff))>>2]>>>0) ^(HEAP32[(S2_offset|(R>>>6&0x3ff))>>2])) +(HEAP32[(S3_offset|(R<<2&0x3ff))>>2]>>>0))^HEAP32[i>>2];}HEAP32[offset>>2]=R^HEAP32[P_last_offset>>2];HEAP32[(offset+4)>>2]=L;}function expandKey(offset) {offset=offset|0;var i=0;var off=0;off=P_offset|0;for (i=0; (i|0)<(P_LEN|0); i=(i+1)|0) {HEAP32[off>>2]=HEAP32[off>>2]^HEAP32[offset>>2];offset=(offset+4)|0;off=(off+4)|0;}HEAP32[LR_offset>>2]=0;HEAP32[LR_offset+4>>2]=0;off=P_offset;for (i=0; (i|0)<(P_LEN|0); i=(i+2)|0) {encrypt(LR_offset);HEAP32[off>>2]=HEAP32[LR_offset>>2];HEAP32[off+4>>2]=HEAP32[LR_offset+4>>2];off=(off+8)|0;}off=S_offset;for (i=0; (i|0)<(S_LEN|0); i=(i+2)|0) {encrypt(LR_offset);HEAP32[off>>2]=HEAP32[LR_offset>>2];HEAP32[off+4>>2]=HEAP32[LR_offset+4>>2];off=(off+8)|0;}}function expandLoop(i, counterEnd, maxIterations) {i=i|0;counterEnd=counterEnd|0;maxIterations=maxIterations|0;var j=0;for (j=0; (j|0) <= (maxIterations|0); j=(j+1)|0) {if ((i>>>0)>(counterEnd>>>0)) break;expandKey(password_offset);expandKey(salt_offset);i=(i+1)>>>0;}return i|0;}return {encrypt: encrypt,expandLoop: expandLoop};} ++function l(r,n,e,t){var o,a,i,u=L>>2,f=u+1;for(t[u]=0,t[f]=0,a=0,o=0;M>o;o++)i=n[a++]<<24|n[a++]<<16|n[a++]<<8|n[a++],t[G>>2|o]^=i;for(a=0,o=0;M>o;o+=2)i=r[a++]<<24|r[a++]<<16|r[a++]<<8|r[a++],a&=65295,t[u]^=i,i=r[a++]<<24|r[a++]<<16|r[a++]<<8|r[a++],a&=65295,t[f]^=i,e.encrypt(L),t[G>>2|o]=t[u],t[G>>2|o+1]=t[f];var c=k>>2;for(o=0;T>o;o+=2)i=r[a++]<<24|r[a++]<<16|r[a++]<<8|r[a++],a&=65295,t[u]^=i,i=r[a++]<<24|r[a++]<<16|r[a++]<<8|r[a++],a&=65295,t[f]^=i,e.encrypt(L),t[c|o]=t[u],t[c|o+1]=t[f]}function p(r,n,e,t,o,a,i){for(var u=e;t>=u;){if(u=r.expandLoop(u,t,o),a){var f=a(u/(t+1));if(f===!1)return}if(u>t){if(i)return void setImmediate(g.bind(null,r,n,i));return}if(i)return void setImmediate(p.bind(null,r,n,u,t,o,a,i))}}function g(r,n,e){u(n,x,F);var t;for(t=0;64>t;t++)r.encrypt(F+0),r.encrypt(F+8),r.encrypt(F+16);var o,a=0,i=x.length,f=new Array(4*i);for(t=0;i>t;t++)o=n[(F>>2)+t],f[a++]=o>>24,f[a++]=o>>16&255,f[a++]=o>>8&255,f[a++]=255&o;return e&&e(f),f}function y(r,n){return r+o(n,23)}function m(n,o,m,v){var d,h=o.substr(0,29),w=+o.substr(4,2),A=o.substr(7,22);if("string"==typeof n)d=r.encodingMode===r.ENCODING_UTF8?e(n):t(n);else if(Array.isArray(n))d=n.map(function(r){return 255&r});else{if(!(n instanceof Uint8Array))throw new Error("Incorrect arguments");d=Array.prototype.slice.call(n)}d.push(0);var b,E,N=a(A,C),O=31>w?1<>2,N),f(b,R>>2,d),l(N,d,E,b),v?void p(E,b,0,M,T,m,function(r){v(y(h,r))}):(p(E,b,0,M,T,m),y(h,g(E,b)))}function v(r){if(!b)throw new Error("No cryptographically secure pseudorandom number generator available.");if(null==r&&(r=N),r=0|+r,isNaN(r)||4>r||r>31)throw new Error("Invalid cost parameter.");var n="$2y$";return 10>r&&(n+="0"),n+=r+"$",n+=o(b(C),C)}function d(r,n,e){if(n&&"number"!=typeof n){if("string"!=typeof n||!z.test(n))throw new Error("Invalid salt")}else n=v(n);return m(r,n,e)}function h(r,n,e,t){if(arguments.length<2)throw new Error("Incorrect arguments");if(2===arguments.length?(t=n,n=e=null):3===arguments.length&&(t=e,e=null,"function"==typeof n&&(e=n,n=null)),n&&"number"!=typeof n){if("string"!=typeof n||!z.test(n))throw new Error("Invalid salt")}else n=v(n);if(!t||"function"!=typeof t)throw new Error("No callback function was given.");m(r,n,e,t)}function w(r,n){if("string"!=typeof n||!Z.test(n))throw new Error("Incorrect arguments");var e=n.substr(0,n.length-31),t=d(r,e);return t===n}function A(r,n,e,t){if("string"!=typeof n||!Z.test(n))throw new Error("Incorrect arguments");if(t||(t=e,e=null),!t||"function"!=typeof t)throw new Error("No callback function was given.");var o=n.substr(0,n.length-31);h(r,o,e,function(r){t(r===n)})}var b,E="undefined"!=typeof InstallTrigger,I=E;n&&(b=n.randomBytes,n.getRandomValues&&(b=function(r){var e=new Uint8Array(r);return n.getRandomValues(e)}));var C=16,N=10,O=16,$=[608135816,2242054355,320440878,57701188,2752067618,698298832,137296536,3964562569,1160258022,953160567,3193202383,887688300,3232508343,3380367581,1065670069,3041331479,2450970073,2306472731],U=[3509652390,2564797868,805139163,3491422135,3101798381,1780907670,3128725573,4046225305,614570311,3012652279,134345442,2240740374,1667834072,1901547113,2757295779,4103290238,227898511,1921955416,1904987480,2182433518,2069144605,3260701109,2620446009,720527379,3318853667,677414384,3393288472,3101374703,2390351024,1614419982,1822297739,2954791486,3608508353,3174124327,2024746970,1432378464,3864339955,2857741204,1464375394,1676153920,1439316330,715854006,3033291828,289532110,2706671279,2087905683,3018724369,1668267050,732546397,1947742710,3462151702,2609353502,2950085171,1814351708,2050118529,680887927,999245976,1800124847,3300911131,1713906067,1641548236,4213287313,1216130144,1575780402,4018429277,3917837745,3693486850,3949271944,596196993,3549867205,258830323,2213823033,772490370,2760122372,1774776394,2652871518,566650946,4142492826,1728879713,2882767088,1783734482,3629395816,2517608232,2874225571,1861159788,326777828,3124490320,2130389656,2716951837,967770486,1724537150,2185432712,2364442137,1164943284,2105845187,998989502,3765401048,2244026483,1075463327,1455516326,1322494562,910128902,469688178,1117454909,936433444,3490320968,3675253459,1240580251,122909385,2157517691,634681816,4142456567,3825094682,3061402683,2540495037,79693498,3249098678,1084186820,1583128258,426386531,1761308591,1047286709,322548459,995290223,1845252383,2603652396,3431023940,2942221577,3202600964,3727903485,1712269319,422464435,3234572375,1170764815,3523960633,3117677531,1434042557,442511882,3600875718,1076654713,1738483198,4213154764,2393238008,3677496056,1014306527,4251020053,793779912,2902807211,842905082,4246964064,1395751752,1040244610,2656851899,3396308128,445077038,3742853595,3577915638,679411651,2892444358,2354009459,1767581616,3150600392,3791627101,3102740896,284835224,4246832056,1258075500,768725851,2589189241,3069724005,3532540348,1274779536,3789419226,2764799539,1660621633,3471099624,4011903706,913787905,3497959166,737222580,2514213453,2928710040,3937242737,1804850592,3499020752,2949064160,2386320175,2390070455,2415321851,4061277028,2290661394,2416832540,1336762016,1754252060,3520065937,3014181293,791618072,3188594551,3933548030,2332172193,3852520463,3043980520,413987798,3465142937,3030929376,4245938359,2093235073,3534596313,375366246,2157278981,2479649556,555357303,3870105701,2008414854,3344188149,4221384143,3956125452,2067696032,3594591187,2921233993,2428461,544322398,577241275,1471733935,610547355,4027169054,1432588573,1507829418,2025931657,3646575487,545086370,48609733,2200306550,1653985193,298326376,1316178497,3007786442,2064951626,458293330,2589141269,3591329599,3164325604,727753846,2179363840,146436021,1461446943,4069977195,705550613,3059967265,3887724982,4281599278,3313849956,1404054877,2845806497,146425753,1854211946,1266315497,3048417604,3681880366,3289982499,290971e4,1235738493,2632868024,2414719590,3970600049,1771706367,1449415276,3266420449,422970021,1963543593,2690192192,3826793022,1062508698,1531092325,1804592342,2583117782,2714934279,4024971509,1294809318,4028980673,1289560198,2221992742,1669523910,35572830,157838143,1052438473,1016535060,1802137761,1753167236,1386275462,3080475397,2857371447,1040679964,2145300060,2390574316,1461121720,2956646967,4031777805,4028374788,33600511,2920084762,1018524850,629373528,3691585981,3515945977,2091462646,2486323059,586499841,988145025,935516892,3367335476,2599673255,2839830854,265290510,3972581182,2759138881,3795373465,1005194799,847297441,406762289,1314163512,1332590856,1866599683,4127851711,750260880,613907577,1450815602,3165620655,3734664991,3650291728,3012275730,3704569646,1427272223,778793252,1343938022,2676280711,2052605720,1946737175,3164576444,3914038668,3967478842,3682934266,1661551462,3294938066,4011595847,840292616,3712170807,616741398,312560963,711312465,1351876610,322626781,1910503582,271666773,2175563734,1594956187,70604529,3617834859,1007753275,1495573769,4069517037,2549218298,2663038764,504708206,2263041392,3941167025,2249088522,1514023603,1998579484,1312622330,694541497,2582060303,2151582166,1382467621,776784248,2618340202,3323268794,2497899128,2784771155,503983604,4076293799,907881277,423175695,432175456,1378068232,4145222326,3954048622,3938656102,3820766613,2793130115,2977904593,26017576,3274890735,3194772133,1700274565,1756076034,4006520079,3677328699,720338349,1533947780,354530856,688349552,3973924725,1637815568,332179504,3949051286,53804574,2852348879,3044236432,1282449977,3583942155,3416972820,4006381244,1617046695,2628476075,3002303598,1686838959,431878346,2686675385,1700445008,1080580658,1009431731,832498133,3223435511,2605976345,2271191193,2516031870,1648197032,4164389018,2548247927,300782431,375919233,238389289,3353747414,2531188641,2019080857,1475708069,455242339,2609103871,448939670,3451063019,1395535956,2413381860,1841049896,1491858159,885456874,4264095073,4001119347,1565136089,3898914787,1108368660,540939232,1173283510,2745871338,3681308437,4207628240,3343053890,4016749493,1699691293,1103962373,3625875870,2256883143,3830138730,1031889488,3479347698,1535977030,4236805024,3251091107,2132092099,1774941330,1199868427,1452454533,157007616,2904115357,342012276,595725824,1480756522,206960106,497939518,591360097,863170706,2375253569,3596610801,1814182875,2094937945,3421402208,1082520231,3463918190,2785509508,435703966,3908032597,1641649973,2842273706,3305899714,1510255612,2148256476,2655287854,3276092548,4258621189,236887753,3681803219,274041037,1734335097,3815195456,3317970021,1899903192,1026095262,4050517792,356393447,2410691914,3873677099,3682840055,3913112168,2491498743,4132185628,2489919796,1091903735,1979897079,3170134830,3567386728,3557303409,857797738,1136121015,1342202287,507115054,2535736646,337727348,3213592640,1301675037,2528481711,1895095763,1721773893,3216771564,62756741,2142006736,835421444,2531993523,1442658625,3659876326,2882144922,676362277,1392781812,170690266,3921047035,1759253602,3611846912,1745797284,664899054,1329594018,3901205900,3045908486,2062866102,2865634940,3543621612,3464012697,1080764994,553557557,3656615353,3996768171,991055499,499776247,1265440854,648242737,3940784050,980351604,3713745714,1749149687,3396870395,4211799374,3640570775,1161844396,3125318951,1431517754,545492359,4268468663,3499529547,1437099964,2702547544,3433638243,2581715763,2787789398,1060185593,1593081372,2418618748,4260947970,69676912,2159744348,86519011,2512459080,3838209314,1220612927,3339683548,133810670,1090789135,1078426020,1569222167,845107691,3583754449,4072456591,1091646820,628848692,1613405280,3757631651,526609435,236106946,48312990,2942717905,3402727701,1797494240,859738849,992217954,4005476642,2243076622,3870952857,3732016268,765654824,3490871365,2511836413,1685915746,3888969200,1414112111,2273134842,3281911079,4080962846,172450625,2569994100,980381355,4109958455,2819808352,2716589560,2568741196,3681446669,3329971472,1835478071,660984891,3704678404,4045999559,3422617507,3040415634,1762651403,1719377915,3470491036,2693910283,3642056355,3138596744,1364962596,2073328063,1983633131,926494387,3423689081,2150032023,4096667949,1749200295,3328846651,309677260,2016342300,1779581495,3079819751,111262694,1274766160,443224088,298511866,1025883608,3806446537,1145181785,168956806,3641502830,3584813610,1689216846,3666258015,3200248200,1692713982,2646376535,4042768518,1618508792,1610833997,3523052358,4130873264,2001055236,3610705100,2202168115,4028541809,2961195399,1006657119,2006996926,3186142756,1430667929,3210227297,1314452623,4074634658,4101304120,2273951170,1399257539,3367210612,3027628629,1190975929,2062231137,2333990788,2221543033,2438960610,1181637006,548689776,2362791313,3372408396,3104550113,3145860560,296247880,1970579870,3078560182,3769228297,1714227617,3291629107,3898220290,166772364,1251581989,493813264,448347421,195405023,2709975567,677966185,3703036547,1463355134,2715995803,1338867538,1343315457,2802222074,2684532164,233230375,2599980071,2000651841,3277868038,1638401717,4028070440,3237316320,6314154,819756386,300326615,590932579,1405279636,3267499572,3150704214,2428286686,3959192993,3461946742,1862657033,1266418056,963775037,2089974820,2263052895,1917689273,448879540,3550394620,3981727096,150775221,3627908307,1303187396,508620638,2975983352,2726630617,1817252668,1876281319,1457606340,908771278,3720792119,3617206836,2455994898,1729034894,1080033504,976866871,3556439503,2881648439,1522871579,1555064734,1336096578,3548522304,2579274686,3574697629,3205460757,3593280638,3338716283,3079412587,564236357,2993598910,1781952180,1464380207,3163844217,3332601554,1699332808,1393555694,1183702653,3581086237,1288719814,691649499,2847557200,2895455976,3193889540,2717570544,1781354906,1676643554,2592534050,3230253752,1126444790,2770207658,2633158820,2210423226,2615765581,2414155088,3127139286,673620729,2805611233,1269405062,4015350505,3341807571,4149409754,1057255273,2012875353,2162469141,2276492801,2601117357,993977747,3918593370,2654263191,753973209,36408145,2530585658,25011837,3520020182,2088578344,530523599,2918365339,1524020338,1518925132,3760827505,3759777254,1202760957,3985898139,3906192525,674977740,4174734889,2031300136,2019492241,3983892565,4153806404,3822280332,352677332,2297720250,60907813,90501309,3286998549,1016092578,2535922412,2839152426,457141659,509813237,4120667899,652014361,1966332200,2975202805,55981186,2327461051,676427537,3255491064,2882294119,3433927263,1307055953,942726286,933058658,2468411793,3933900994,4215176142,1361170020,2001714738,2830558078,3274259782,1222529897,1679025792,2729314320,3714953764,1770335741,151462246,3013232138,1682292957,1483529935,471910574,1539241949,458788160,3436315007,1807016891,3718408830,978976581,1043663428,3165965781,1927990952,4200891579,2372276910,3208408903,3533431907,1412390302,2931980059,4132332400,1947078029,3881505623,4168226417,2941484381,1077988104,1320477388,886195818,18198404,3786409e3,2509781533,112762804,3463356488,1866414978,891333506,18488651,661792760,1628790961,3885187036,3141171499,876946877,2693282273,1372485963,791857591,2686433993,3759982718,3167212022,3472953795,2716379847,445679433,3561995674,3504004811,3574258232,54117162,3331405415,2381918588,3769707343,4154350007,1140177722,4074052095,668550556,3214352940,367459370,261225585,2610173221,4209349473,3468074219,3265815641,314222801,3066103646,3808782860,282218597,3406013506,3773591054,379116347,1285071038,846784868,2669647154,3771962079,3550491691,2305946142,453669953,1268987020,3317592352,3279303384,3744833421,2610507566,3859509063,266596637,3847019092,517658769,3462560207,3443424879,370717030,4247526661,2224018117,4143653529,4112773975,2788324899,2477274417,1456262402,2901442914,1517677493,1846949527,2295493580,3734397586,2176403920,1280348187,1908823572,3871786941,846861322,1172426758,3287448474,3383383037,1655181056,3139813346,901632758,1897031941,2986607138,3066810236,3447102507,1393639104,373351379,950779232,625454576,3124240540,4148612726,2007998917,544563296,2244738638,2330496472,2058025392,1291430526,424198748,50039436,29584100,3605783033,2429876329,2791104160,1057563949,3255363231,3075367218,3463963227,1469046755,985887462],M=$.length,T=U.length,x=[1332899944,1700884034,1701343084,1684370003,1668446532,1869963892],k=0,G=4096,S=4164,F=4168,L=4192,R=4200,j=4272,B="./ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789",D=[0,1,54,55,56,57,58,59,60,61,62,63,-1,-1,-1,-1,-1,-1,-1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,-1,-1,-1,-1,-1,-1,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,-1,-1,-1,-1,-1],z=/^\$2[ay]\$(0[4-9]|[12][0-9]|3[01])\$[.\/A-Za-z0-9]{21}[.Oeu]/,Z=/^\$2[ay]\$(0[4-9]|[12][0-9]|3[01])\$[.\/A-Za-z0-9]{21}[.Oeu][.\/A-Za-z0-9]{30}[.CGKOSWaeimquy26]$/;r.genSalt=v,r.hashSync=d,r.hash=h,r.compareSync=w,r.compare=A,r.ENCODING_UTF8=0,r.ENCODING_RAW=1,r.encodingMode=r.ENCODING_UTF8,r.cryptoRNG=!!b,r.randomBytes=b,r.defaultCost=N,r.version="2.2.0"}); diff --git a/luci-app-adguardhome/patches/prepare.patch b/luci-app-adguardhome/patches/prepare.patch new file mode 100644 index 000000000..bdfeef816 --- /dev/null +++ b/luci-app-adguardhome/patches/prepare.patch @@ -0,0 +1,36 @@ +From 0b024c2ebe6be105c3535f82e55a51e57dd947bb Mon Sep 17 00:00:00 2001 +From: Jackie264 <125248570+Jackie264@users.noreply.github.com> +Date: Sun, 7 Jun 2026 15:32:44 +0800 +Subject: [PATCH] Add .prepare.sh script for package preparation + +The script prepares the package build directory by checking for a Git repository and creating necessary directories and files based on the package name. +--- + .prepare.sh | 19 +++++++++++++++++++ + 1 file changed, 19 insertions(+) + create mode 100644 .prepare.sh + +diff --git a/.prepare.sh b/.prepare.sh +new file mode 100644 +index 0000000..92a72fb +--- /dev/null ++++ b/.prepare.sh +@@ -0,0 +1,19 @@ ++PKG_NAME="$1" ++CURDIR="$2" ++PKG_BUILD_DIR="$3" ++ ++if [ -d "$CURDIR/.git" ]; then ++ config="$CURDIR/.git/config" ++else ++ config="$(sed "s|^gitdir:\s*|$CURDIR/|;s|$|/config|" "$CURDIR/.git")" ++fi ++if grep -q -E "url.*gitcode\.(com|net)" "$config"; then ++ for d in htdocs patches po root; do ++ rm -rf "$PKG_BUILD_DIR"/$d ++ done ++ mkdir -p "$PKG_BUILD_DIR"/htdocs/luci-static/resources/view ++ touch "$PKG_BUILD_DIR"/htdocs/luci-static/resources/view/$PKG_NAME.js ++ mkdir -p "$PKG_BUILD_DIR"/root/usr/share/luci/menu.d ++ touch "$PKG_BUILD_DIR"/root/usr/share/luci/menu.d/$PKG_NAME.json ++fi ++exit 0 diff --git a/luci-app-adguardhome/po/cs/adguardhome.po b/luci-app-adguardhome/po/cs/adguardhome.po new file mode 100644 index 000000000..f03deb820 --- /dev/null +++ b/luci-app-adguardhome/po/cs/adguardhome.po @@ -0,0 +1,181 @@ +msgid "" +msgstr "" +"Content-Type: text/plain; charset=UTF-8\n" +"Language: cs\n" +"Content-Transfer-Encoding: 8bit\n" +"Last-Translator: Martin Olmer \n" +"Language-Team: Czech \n" +"Plural-Forms: nplurals=3; plural=((n==1) ? 0 : (n>=2 && n<=4) ? 1 : 2);\n" +"PO-Revision-Date: 2026-08-27 18:20+0000\n" +"X-Generator: Weblate 2026.9.dev0\n" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:244 +msgid "" +"A soft memory cap for the Go runtime, allowing the garbage collector to run " +"more frequently as usage approaches the limit to prevent Out-of-Memory (OOM) " +"kills." +msgstr "" +"Překročitelný strop paměti pro běhové prostředí Go, umožňující častější " +"spouštění úklidu použité paměti, tak jak se využití blíží limitu, aby se " +"zabránilo vynucenému ukončování v docházející paměti (OOM)." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:113 +#: applications/luci-app-adguardhome/root/usr/share/luci/menu.d/luci-app-adguardhome.json:3 +msgid "AdGuard Home" +msgstr "AdGuard Home" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:137 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:199 +msgid "Advanced Settings" +msgstr "Pokročilá nastavení" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:146 +msgid "Configuration file" +msgstr "Soubor s nastaveními" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:89 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:147 +msgid "" +"Configuration file must be stored in its own directory, and not in '/etc'." +msgstr "" +"Je třeba, aby soubor s nastavením byl uložen ve své vlastní složce a ne " +"přímo v „/etc“." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:159 +msgid "Directory where filters, logs, and statistics are stored." +msgstr "Složka ve které jsou ukládány filtry, záznamy událostí a statistiky." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:132 +msgid "File System Access" +msgstr "Přístup k souborovému systému" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:133 +msgid "" +"Files and directories that AdGuard Home should have read-only or read-write " +"access to." +msgstr "" +"Soubory a složky, ke kterým by AdGuard Home měl mít přístup pouze pro čtení " +"nebo pro čtení i zápis." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:129 +msgid "General Settings" +msgstr "Obecná nastavení" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:138 +msgid "" +"Go environment variables that tune garbage collector and memory management." +msgstr "" +"Proměnné prostředí pro jazyk Go, které upravují chování automatického " +"uvolňování použité paměti a její správu." + +#: applications/luci-app-adguardhome/root/usr/share/rpcd/acl.d/luci-app-adguardhome.json:3 +msgid "Grant permissions for the AdGuard Home LuCI app" +msgstr "Udělit oprávnění pro LuCI aplikace AdGuard Home" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:181 +msgid "Group the service runs under." +msgstr "Skupina, pod kterou služba běží." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:149 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:161 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:171 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:181 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:217 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:232 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:247 +msgid "If empty, defaults to" +msgstr "Pokud nevyplněno, bude použito výchozí" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:139 +msgid "Modify at your own risk." +msgstr "Měňte na své vlastní riziko." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:24 +msgid "Not running" +msgstr "Nespuštěné" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:148 +msgid "Parent directory will be owned by the service user." +msgstr "Nadřazená složka bude vlastněna uživatelem, pod kterým služba běží." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:83 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:99 +msgid "Path must be absolute." +msgstr "Je třeba, aby popis umístění byl absolutní." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:86 +msgid "Path must not end with a slash." +msgstr "Je třeba, aby popis umístění nekončil lomítkem." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:207 +msgid "Read-only access" +msgstr "Přístup pouze pro čtení" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:208 +msgid "Read-write access" +msgstr "Přístup pro čtení a zápis" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:23 +msgid "Running" +msgstr "Spuštěné" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:122 +msgid "Service Status" +msgstr "Stav služby" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:180 +msgid "Service group" +msgstr "Skupina služby" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:170 +msgid "Service user" +msgstr "Uživatel služby" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:230 +msgid "" +"The maximum number of operating system threads that can execute user-level " +"Go code simultaneously." +msgstr "" +"Nejvyšší umožněný počet vláken operačního systému které mohou souběžně " +"vykonávat kód v Go na uživatelské úrovni." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:215 +msgid "" +"Tunes the garbage collector's aggressiveness by setting the percentage of " +"heap growth allowed before the next collection cycle triggers." +msgstr "" +"Upravuje agresivnost úklidu použité paměti nastavením procenta růstu " +"„haldy“, dovoleného než bude spuštěn další cyklus úklidu." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:171 +msgid "User the service runs under." +msgstr "Uživatel, pod kterým služba běží." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:191 +msgid "Verbose logging" +msgstr "Podrobné zaznamenávání událostí" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:119 +msgid "Version" +msgstr "Verze" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:160 +msgid "Will be owned by the service user." +msgstr "Bude vlastněno uživatelem, pod kterým služba běží." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:158 +msgid "Working directory" +msgstr "Pracovní složka" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:247 +msgid "unset" +msgstr "zrušit nastavení" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:217 +msgid "unset and 100" +msgstr "zrušit nastavení a 100" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:232 +msgid "unset and matching the number of CPUs" +msgstr "zrušit nastavení a odpovídající počtu jader procesoru" diff --git a/luci-app-adguardhome/po/de/adguardhome.po b/luci-app-adguardhome/po/de/adguardhome.po new file mode 100644 index 000000000..9529ba323 --- /dev/null +++ b/luci-app-adguardhome/po/de/adguardhome.po @@ -0,0 +1,168 @@ +msgid "" +msgstr "" +"Content-Type: text/plain; charset=UTF-8\n" +"Language: de\n" +"Content-Transfer-Encoding: 8bit\n" +"Last-Translator: Pavel Borecki \n" +"Language-Team: German \n" +"Plural-Forms: nplurals=2; plural=n != 1;\n" +"PO-Revision-Date: 2026-09-23 19:35+0000\n" +"X-Generator: Weblate 2026.10.dev0\n" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:244 +msgid "" +"A soft memory cap for the Go runtime, allowing the garbage collector to run " +"more frequently as usage approaches the limit to prevent Out-of-Memory (OOM) " +"kills." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:113 +#: applications/luci-app-adguardhome/root/usr/share/luci/menu.d/luci-app-adguardhome.json:3 +msgid "AdGuard Home" +msgstr "AdGuard Home" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:137 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:199 +msgid "Advanced Settings" +msgstr "Erweiterte Einstellungen" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:146 +msgid "Configuration file" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:89 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:147 +msgid "" +"Configuration file must be stored in its own directory, and not in '/etc'." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:159 +msgid "Directory where filters, logs, and statistics are stored." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:132 +msgid "File System Access" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:133 +msgid "" +"Files and directories that AdGuard Home should have read-only or read-write " +"access to." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:129 +msgid "General Settings" +msgstr "Allgemeine Einstellungen" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:138 +msgid "" +"Go environment variables that tune garbage collector and memory management." +msgstr "" + +#: applications/luci-app-adguardhome/root/usr/share/rpcd/acl.d/luci-app-adguardhome.json:3 +msgid "Grant permissions for the AdGuard Home LuCI app" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:181 +msgid "Group the service runs under." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:149 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:161 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:171 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:181 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:217 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:232 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:247 +msgid "If empty, defaults to" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:139 +msgid "Modify at your own risk." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:24 +msgid "Not running" +msgstr "Angehalten" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:148 +msgid "Parent directory will be owned by the service user." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:83 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:99 +msgid "Path must be absolute." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:86 +msgid "Path must not end with a slash." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:207 +msgid "Read-only access" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:208 +msgid "Read-write access" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:23 +msgid "Running" +msgstr "Läuft" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:122 +msgid "Service Status" +msgstr "Dienststatus" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:180 +msgid "Service group" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:170 +msgid "Service user" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:230 +msgid "" +"The maximum number of operating system threads that can execute user-level " +"Go code simultaneously." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:215 +msgid "" +"Tunes the garbage collector's aggressiveness by setting the percentage of " +"heap growth allowed before the next collection cycle triggers." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:171 +msgid "User the service runs under." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:191 +msgid "Verbose logging" +msgstr "Ausführliche Protokollierung" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:119 +msgid "Version" +msgstr "Version" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:160 +msgid "Will be owned by the service user." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:158 +msgid "Working directory" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:247 +msgid "unset" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:217 +msgid "unset and 100" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:232 +msgid "unset and matching the number of CPUs" +msgstr "" diff --git a/luci-app-adguardhome/po/es/adguardhome.po b/luci-app-adguardhome/po/es/adguardhome.po new file mode 100644 index 000000000..bfbb38ffd --- /dev/null +++ b/luci-app-adguardhome/po/es/adguardhome.po @@ -0,0 +1,188 @@ +msgid "" +msgstr "" +"Project-Id-Version: PACKAGE VERSION\n" +"Report-Msgid-Bugs-To: \n" +"POT-Creation-Date: 2026-08-23 22:27+0200\n" +"PO-Revision-Date: 2026-09-23 19:06+0000\n" +"Last-Translator: Franco Castillo \n" +"Language-Team: Spanish \n" +"Language: es\n" +"MIME-Version: 1.0\n" +"Content-Type: text/plain; charset=UTF-8\n" +"Content-Transfer-Encoding: 8bit\n" +"Plural-Forms: nplurals=2; plural=n != 1;\n" +"X-Generator: Weblate 2026.10.dev0\n" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:244 +msgid "" +"A soft memory cap for the Go runtime, allowing the garbage collector to run " +"more frequently as usage approaches the limit to prevent Out-of-Memory (OOM) " +"kills." +msgstr "" +"Un límite de memoria flexible para el entorno de ejecución de Go, que " +"permite que el recolector de basura se ejecute con mayor frecuencia a medida " +"que el uso se acerca al límite para evitar bloqueos por falta de memoria " +"(OOM, por sus siglas en inglés)." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:113 +#: applications/luci-app-adguardhome/root/usr/share/luci/menu.d/luci-app-adguardhome.json:3 +msgid "AdGuard Home" +msgstr "AdGuard Home" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:137 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:199 +msgid "Advanced Settings" +msgstr "Configuración avanzada" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:146 +msgid "Configuration file" +msgstr "Archivo de configuración" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:89 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:147 +msgid "" +"Configuration file must be stored in its own directory, and not in '/etc'." +msgstr "" +"El archivo de configuración debe almacenarse en su propio directorio, y no " +"en «/etc»." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:159 +msgid "Directory where filters, logs, and statistics are stored." +msgstr "" +"Directorio donde se almacenan los filtros, los registros y las estadísticas." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:132 +msgid "File System Access" +msgstr "Acceso al sistema de archivos" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:133 +msgid "" +"Files and directories that AdGuard Home should have read-only or read-write " +"access to." +msgstr "" +"Archivos y directorios a los que AdGuard Home debería tener acceso de solo " +"lectura o de lectura y escritura." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:129 +msgid "General Settings" +msgstr "Configuración general" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:138 +msgid "" +"Go environment variables that tune garbage collector and memory management." +msgstr "" +"Variables de entorno de Go que ajustan el recolector de basura y la gestión " +"de memoria." + +#: applications/luci-app-adguardhome/root/usr/share/rpcd/acl.d/luci-app-adguardhome.json:3 +msgid "Grant permissions for the AdGuard Home LuCI app" +msgstr "Otorgar permisos para la aplicación LuCI AdGuard Home" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:181 +msgid "Group the service runs under." +msgstr "Grupo al que pertenece el servicio." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:149 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:161 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:171 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:181 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:217 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:232 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:247 +msgid "If empty, defaults to" +msgstr "Si está vacío, por defecto es" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:139 +msgid "Modify at your own risk." +msgstr "Modifique bajo su propia responsabilidad." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:24 +msgid "Not running" +msgstr "No se está ejecutando" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:148 +msgid "Parent directory will be owned by the service user." +msgstr "El directorio principal pertenecerá al usuario del servicio." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:83 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:99 +msgid "Path must be absolute." +msgstr "La ruta debe ser absoluta." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:86 +msgid "Path must not end with a slash." +msgstr "La ruta no debe terminar con una barra diagonal." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:207 +msgid "Read-only access" +msgstr "Acceso de solo lectura" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:208 +msgid "Read-write access" +msgstr "Acceso de lectura y escritura" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:23 +msgid "Running" +msgstr "Ejecutándose" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:122 +msgid "Service Status" +msgstr "Estado del servicio" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:180 +msgid "Service group" +msgstr "Grupo del servicio" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:170 +msgid "Service user" +msgstr "Usuario del servicio" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:230 +msgid "" +"The maximum number of operating system threads that can execute user-level " +"Go code simultaneously." +msgstr "" +"El número máximo de subprocesos del sistema operativo que pueden ejecutar " +"código Go a nivel de usuario simultáneamente." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:215 +msgid "" +"Tunes the garbage collector's aggressiveness by setting the percentage of " +"heap growth allowed before the next collection cycle triggers." +msgstr "" +"Permite ajustar la agresividad del recolector de basura estableciendo el " +"porcentaje de crecimiento de la pila permitido antes de que se active el " +"siguiente ciclo de recolección." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:171 +msgid "User the service runs under." +msgstr "Usuario bajo el cual se ejecuta el servicio." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:191 +msgid "Verbose logging" +msgstr "Registro detallado" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:119 +msgid "Version" +msgstr "Versión" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:160 +msgid "Will be owned by the service user." +msgstr "Será propiedad del usuario del servicio." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:158 +msgid "Working directory" +msgstr "Directorio de trabajo" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:247 +msgid "unset" +msgstr "no establecido" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:217 +msgid "unset and 100" +msgstr "no establecido y 100" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:232 +msgid "unset and matching the number of CPUs" +msgstr "no configurado y que coincide con el número de CPUs" diff --git a/luci-app-adguardhome/po/ga/adguardhome.po b/luci-app-adguardhome/po/ga/adguardhome.po new file mode 100644 index 000000000..77c379926 --- /dev/null +++ b/luci-app-adguardhome/po/ga/adguardhome.po @@ -0,0 +1,183 @@ +msgid "" +msgstr "" +"Content-Type: text/plain; charset=UTF-8\n" +"Language: ga\n" +"Content-Transfer-Encoding: 8bit\n" +"Last-Translator: Aindriú Mac Giolla Eoin \n" +"Language-Team: Irish \n" +"Plural-Forms: nplurals=5; plural=n==1 ? 0 : n==2 ? 1 : (n>2 && n<7) ? 2 :(n>" +"6 && n<11) ? 3 : 4;\n" +"PO-Revision-Date: 2026-09-02 17:28+0000\n" +"X-Generator: Weblate 2026.9.dev0\n" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:244 +msgid "" +"A soft memory cap for the Go runtime, allowing the garbage collector to run " +"more frequently as usage approaches the limit to prevent Out-of-Memory (OOM) " +"kills." +msgstr "" +"Teorainn bhog chuimhne don am rite Go, rud a ligeann don bhailitheoir " +"truflais rith níos minice de réir mar a thagann an úsáid i dtreo na teorann " +"chun maruithe As Cuimhne (OOM) a chosc." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:113 +#: applications/luci-app-adguardhome/root/usr/share/luci/menu.d/luci-app-adguardhome.json:3 +msgid "AdGuard Home" +msgstr "AdGuard Home" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:137 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:199 +msgid "Advanced Settings" +msgstr "Socruithe Ardleibhéil" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:146 +msgid "Configuration file" +msgstr "Comhad cumraíochta" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:89 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:147 +msgid "" +"Configuration file must be stored in its own directory, and not in '/etc'." +msgstr "" +"Ní mór an comhad cumraíochta a stóráil ina eolaire féin, agus ní i '/etc'." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:159 +msgid "Directory where filters, logs, and statistics are stored." +msgstr "Eolaire ina stóráiltear scagairí, logaí agus staitisticí." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:132 +msgid "File System Access" +msgstr "Rochtain ar an gCóras Comhad" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:133 +msgid "" +"Files and directories that AdGuard Home should have read-only or read-write " +"access to." +msgstr "" +"Comhaid agus eolairí ar cheart go mbeadh rochtain léite amháin nó rochtana " +"léite-scríofa ag AdGuard Home orthu." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:129 +msgid "General Settings" +msgstr "Socruithe Ginearálta" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:138 +msgid "" +"Go environment variables that tune garbage collector and memory management." +msgstr "" +"Athróga timpeallachta Téigh a choigeartaíonn bailitheoir truflais agus " +"bainistíocht cuimhne." + +#: applications/luci-app-adguardhome/root/usr/share/rpcd/acl.d/luci-app-adguardhome.json:3 +msgid "Grant permissions for the AdGuard Home LuCI app" +msgstr "Deonaigh ceadanna don aip AdGuard Home LuCI" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:181 +msgid "Group the service runs under." +msgstr "Grúpa faoina ritheann an tseirbhís." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:149 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:161 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:171 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:181 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:217 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:232 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:247 +msgid "If empty, defaults to" +msgstr "Más folamh, réamhshocraítear é go" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:139 +msgid "Modify at your own risk." +msgstr "Déan modhnú ar do phriacal féin." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:24 +msgid "Not running" +msgstr "Gan rith" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:148 +msgid "Parent directory will be owned by the service user." +msgstr "" +"Beidh eolaire na dtuismitheoirí faoi úinéireacht úsáideoir na seirbhíse." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:83 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:99 +msgid "Path must be absolute." +msgstr "Caithfidh an cosán a bheith absalóideach." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:86 +msgid "Path must not end with a slash." +msgstr "Ní mór don chosán a bheith críochnaithe le slais." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:207 +msgid "Read-only access" +msgstr "Rochtain léite amháin" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:208 +msgid "Read-write access" +msgstr "Rochtain léite-scríofa" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:23 +msgid "Running" +msgstr "Ag rith" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:122 +msgid "Service Status" +msgstr "Stádas Seirbhíse" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:180 +msgid "Service group" +msgstr "Grúpa seirbhíse" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:170 +msgid "Service user" +msgstr "Úsáideoir seirbhíse" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:230 +msgid "" +"The maximum number of operating system threads that can execute user-level " +"Go code simultaneously." +msgstr "" +"An líon uasta snáitheanna córais oibriúcháin ar féidir leo cód Go ar " +"leibhéal an úsáideora a fhorghníomhú ag an am céanna." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:215 +msgid "" +"Tunes the garbage collector's aggressiveness by setting the percentage of " +"heap growth allowed before the next collection cycle triggers." +msgstr "" +"Coigeartaíonn sé ionsaitheacht an bhailitheora bruscair tríd an gcéatadán " +"fáis carn a cheadaítear sula dtosaíonn an chéad timthriall bailiúcháin eile " +"a shocrú." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:171 +msgid "User the service runs under." +msgstr "An t-úsáideoir a ritheann an tseirbhís faoi." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:191 +msgid "Verbose logging" +msgstr "Logáil fhaclach" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:119 +msgid "Version" +msgstr "Leagan" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:160 +msgid "Will be owned by the service user." +msgstr "Beidh sé faoi úinéireacht an úsáideora seirbhíse." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:158 +msgid "Working directory" +msgstr "Eolaire oibre" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:247 +msgid "unset" +msgstr "díchumasaigh" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:217 +msgid "unset and 100" +msgstr "díchumasaigh agus 100" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:232 +msgid "unset and matching the number of CPUs" +msgstr "díchumasaigh agus ag teacht le líon na LAPanna" diff --git a/luci-app-adguardhome/po/ko/adguardhome.po b/luci-app-adguardhome/po/ko/adguardhome.po new file mode 100644 index 000000000..74d1b9340 --- /dev/null +++ b/luci-app-adguardhome/po/ko/adguardhome.po @@ -0,0 +1,178 @@ +msgid "" +msgstr "" +"Content-Type: text/plain; charset=UTF-8\n" +"Language: ko\n" +"Content-Transfer-Encoding: 8bit\n" +"Last-Translator: Hyeonjeong Lee \n" +"Language-Team: Korean \n" +"Plural-Forms: nplurals=1; plural=0;\n" +"PO-Revision-Date: 2026-09-15 21:51+0000\n" +"X-Generator: Weblate 2026.10.dev0\n" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:244 +msgid "" +"A soft memory cap for the Go runtime, allowing the garbage collector to run " +"more frequently as usage approaches the limit to prevent Out-of-Memory (OOM) " +"kills." +msgstr "" +"Go 런타임의 소프트 메모리 상한선입니다. 사용량이 한계에 가까워질수록 쓰레기 " +"수집기가 더 자주 작동하여 메모리 부족 (OOM)으로 인한 강제 종료를 방지합니다." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:113 +#: applications/luci-app-adguardhome/root/usr/share/luci/menu.d/luci-app-adguardhome.json:3 +msgid "AdGuard Home" +msgstr "AdGuard Home" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:137 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:199 +msgid "Advanced Settings" +msgstr "고급 설정" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:146 +msgid "Configuration file" +msgstr "설정 파일" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:89 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:147 +msgid "" +"Configuration file must be stored in its own directory, and not in '/etc'." +msgstr "설정 파일은 '/etc'가 아닌 전용 디렉터리에 저장해야 합니다." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:159 +msgid "Directory where filters, logs, and statistics are stored." +msgstr "필터, 로그, 통계가 저장되는 디렉터리입니다." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:132 +msgid "File System Access" +msgstr "파일 시스템 접근" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:133 +msgid "" +"Files and directories that AdGuard Home should have read-only or read-write " +"access to." +msgstr "" +"AdGuard Home에서 읽기 전용 또는 읽기/쓰기 권한을 가져야 하는 파일 및 디렉터리" +"입니다." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:129 +msgid "General Settings" +msgstr "일반 설정" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:138 +msgid "" +"Go environment variables that tune garbage collector and memory management." +msgstr "" +"쓰레기 수집기(Garbage Collector) 및 메모리 관리를 조정하는 Go 환경 변수입니" +"다." + +#: applications/luci-app-adguardhome/root/usr/share/rpcd/acl.d/luci-app-adguardhome.json:3 +msgid "Grant permissions for the AdGuard Home LuCI app" +msgstr "AdGuard Home LuCI 앱에 권한 부여" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:181 +msgid "Group the service runs under." +msgstr "서비스를 실행할 그룹입니다." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:149 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:161 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:171 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:181 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:217 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:232 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:247 +msgid "If empty, defaults to" +msgstr "미입력 시 기본값:" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:139 +msgid "Modify at your own risk." +msgstr "수정 시 책임은 사용자에게 있습니다." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:24 +msgid "Not running" +msgstr "중지됨" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:148 +msgid "Parent directory will be owned by the service user." +msgstr "상위 디렉터리는 서비스 사용자의 소유로 설정됩니다." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:83 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:99 +msgid "Path must be absolute." +msgstr "절대 경로여야 합니다." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:86 +msgid "Path must not end with a slash." +msgstr "경로가 슬래시(/)로 끝나서는 안 됩니다." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:207 +msgid "Read-only access" +msgstr "읽기 전용 접근" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:208 +msgid "Read-write access" +msgstr "읽기/쓰기 접근" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:23 +msgid "Running" +msgstr "실행 중" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:122 +msgid "Service Status" +msgstr "서비스 상태" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:180 +msgid "Service group" +msgstr "서비스 그룹" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:170 +msgid "Service user" +msgstr "서비스 사용자" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:230 +msgid "" +"The maximum number of operating system threads that can execute user-level " +"Go code simultaneously." +msgstr "" +"사용자 수준의 Go 코드를 동시에 실행할 수 있는 운영 체제 스레드의 최대 개수입" +"니다." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:215 +msgid "" +"Tunes the garbage collector's aggressiveness by setting the percentage of " +"heap growth allowed before the next collection cycle triggers." +msgstr "" +"다음 수집 주기가 실행되기 전에 허용되는 힙 메모리 증가율(%)을 설정하여 쓰레" +"기 수집기의 작동 빈도(Aggressiveness)를 조정합니다." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:171 +msgid "User the service runs under." +msgstr "서비스를 실행할 사용자입니다." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:191 +msgid "Verbose logging" +msgstr "상세 로그 기록" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:119 +msgid "Version" +msgstr "버전" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:160 +msgid "Will be owned by the service user." +msgstr "서비스 사용자의 소유로 설정됩니다." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:158 +msgid "Working directory" +msgstr "작업 디렉터리" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:247 +msgid "unset" +msgstr "설정 안 함" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:217 +msgid "unset and 100" +msgstr "미설정 (100)" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:232 +msgid "unset and matching the number of CPUs" +msgstr "미설정 (CPU 코어 수와 일치)" diff --git a/luci-app-adguardhome/po/lo/adguardhome.po b/luci-app-adguardhome/po/lo/adguardhome.po new file mode 100644 index 000000000..bd1248f03 --- /dev/null +++ b/luci-app-adguardhome/po/lo/adguardhome.po @@ -0,0 +1,168 @@ +msgid "" +msgstr "" +"Content-Type: text/plain; charset=UTF-8\n" +"Language: lo\n" +"Content-Transfer-Encoding: 8bit\n" +"Last-Translator: Martin Olmer \n" +"Language-Team: Lao \n" +"Plural-Forms: nplurals=1; plural=0;\n" +"PO-Revision-Date: 2026-08-28 18:08+0000\n" +"X-Generator: Weblate 2026.9.dev0\n" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:244 +msgid "" +"A soft memory cap for the Go runtime, allowing the garbage collector to run " +"more frequently as usage approaches the limit to prevent Out-of-Memory (OOM) " +"kills." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:113 +#: applications/luci-app-adguardhome/root/usr/share/luci/menu.d/luci-app-adguardhome.json:3 +msgid "AdGuard Home" +msgstr "AdGuard Home" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:137 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:199 +msgid "Advanced Settings" +msgstr "ການຕັ້ງຄ່າຂັ້ນສູງ" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:146 +msgid "Configuration file" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:89 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:147 +msgid "" +"Configuration file must be stored in its own directory, and not in '/etc'." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:159 +msgid "Directory where filters, logs, and statistics are stored." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:132 +msgid "File System Access" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:133 +msgid "" +"Files and directories that AdGuard Home should have read-only or read-write " +"access to." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:129 +msgid "General Settings" +msgstr "ການຕັ້ງຄ່າທົ່ວໄປ" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:138 +msgid "" +"Go environment variables that tune garbage collector and memory management." +msgstr "" + +#: applications/luci-app-adguardhome/root/usr/share/rpcd/acl.d/luci-app-adguardhome.json:3 +msgid "Grant permissions for the AdGuard Home LuCI app" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:181 +msgid "Group the service runs under." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:149 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:161 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:171 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:181 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:217 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:232 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:247 +msgid "If empty, defaults to" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:139 +msgid "Modify at your own risk." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:24 +msgid "Not running" +msgstr "ບໍ່ເຮັດວຽກ" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:148 +msgid "Parent directory will be owned by the service user." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:83 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:99 +msgid "Path must be absolute." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:86 +msgid "Path must not end with a slash." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:207 +msgid "Read-only access" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:208 +msgid "Read-write access" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:23 +msgid "Running" +msgstr "ກຳລັງເຮັດວຽກ" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:122 +msgid "Service Status" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:180 +msgid "Service group" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:170 +msgid "Service user" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:230 +msgid "" +"The maximum number of operating system threads that can execute user-level " +"Go code simultaneously." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:215 +msgid "" +"Tunes the garbage collector's aggressiveness by setting the percentage of " +"heap growth allowed before the next collection cycle triggers." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:171 +msgid "User the service runs under." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:191 +msgid "Verbose logging" +msgstr "ການບັນທຶກລັອກແບບລະອຽດ" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:119 +msgid "Version" +msgstr "ເວີຊັນ" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:160 +msgid "Will be owned by the service user." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:158 +msgid "Working directory" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:247 +msgid "unset" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:217 +msgid "unset and 100" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:232 +msgid "unset and matching the number of CPUs" +msgstr "" diff --git a/luci-app-adguardhome/po/lt/adguardhome.po b/luci-app-adguardhome/po/lt/adguardhome.po new file mode 100644 index 000000000..737eabaf1 --- /dev/null +++ b/luci-app-adguardhome/po/lt/adguardhome.po @@ -0,0 +1,169 @@ +msgid "" +msgstr "" +"Content-Type: text/plain; charset=UTF-8\n" +"Language: lt\n" +"Content-Transfer-Encoding: 8bit\n" +"Last-Translator: Martin Olmer \n" +"Language-Team: Lithuanian \n" +"Plural-Forms: nplurals=3; plural=(n%10==1 && n%100!=11 ? 0 : n%10>=2 && " +"(n%100<10 || n%100>=20) ? 1 : 2);\n" +"PO-Revision-Date: 2026-08-28 12:25+0000\n" +"X-Generator: Weblate 2026.9.dev0\n" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:244 +msgid "" +"A soft memory cap for the Go runtime, allowing the garbage collector to run " +"more frequently as usage approaches the limit to prevent Out-of-Memory (OOM) " +"kills." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:113 +#: applications/luci-app-adguardhome/root/usr/share/luci/menu.d/luci-app-adguardhome.json:3 +msgid "AdGuard Home" +msgstr "AdGuard Home" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:137 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:199 +msgid "Advanced Settings" +msgstr "Pažangūs nustatymai" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:146 +msgid "Configuration file" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:89 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:147 +msgid "" +"Configuration file must be stored in its own directory, and not in '/etc'." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:159 +msgid "Directory where filters, logs, and statistics are stored." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:132 +msgid "File System Access" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:133 +msgid "" +"Files and directories that AdGuard Home should have read-only or read-write " +"access to." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:129 +msgid "General Settings" +msgstr "Bendri nustatymai" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:138 +msgid "" +"Go environment variables that tune garbage collector and memory management." +msgstr "" + +#: applications/luci-app-adguardhome/root/usr/share/rpcd/acl.d/luci-app-adguardhome.json:3 +msgid "Grant permissions for the AdGuard Home LuCI app" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:181 +msgid "Group the service runs under." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:149 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:161 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:171 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:181 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:217 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:232 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:247 +msgid "If empty, defaults to" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:139 +msgid "Modify at your own risk." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:24 +msgid "Not running" +msgstr "Nevykdomas/-a" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:148 +msgid "Parent directory will be owned by the service user." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:83 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:99 +msgid "Path must be absolute." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:86 +msgid "Path must not end with a slash." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:207 +msgid "Read-only access" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:208 +msgid "Read-write access" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:23 +msgid "Running" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:122 +msgid "Service Status" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:180 +msgid "Service group" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:170 +msgid "Service user" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:230 +msgid "" +"The maximum number of operating system threads that can execute user-level " +"Go code simultaneously." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:215 +msgid "" +"Tunes the garbage collector's aggressiveness by setting the percentage of " +"heap growth allowed before the next collection cycle triggers." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:171 +msgid "User the service runs under." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:191 +msgid "Verbose logging" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:119 +msgid "Version" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:160 +msgid "Will be owned by the service user." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:158 +msgid "Working directory" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:247 +msgid "unset" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:217 +msgid "unset and 100" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:232 +msgid "unset and matching the number of CPUs" +msgstr "" diff --git a/luci-app-adguardhome/po/pl/adguardhome.po b/luci-app-adguardhome/po/pl/adguardhome.po new file mode 100644 index 000000000..95313f31e --- /dev/null +++ b/luci-app-adguardhome/po/pl/adguardhome.po @@ -0,0 +1,183 @@ +msgid "" +msgstr "" +"Content-Type: text/plain; charset=UTF-8\n" +"Language: pl\n" +"Content-Transfer-Encoding: 8bit\n" +"Last-Translator: Matthaiks \n" +"Language-Team: Polish \n" +"Plural-Forms: nplurals=3; plural=(n==1 ? 0 : n%10>=2 && n%10<=4 && (n%100<10 " +"|| n%100>=20) ? 1 : 2);\n" +"PO-Revision-Date: 2026-08-24 16:48+0000\n" +"X-Generator: Weblate 2026.9.dev0\n" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:244 +msgid "" +"A soft memory cap for the Go runtime, allowing the garbage collector to run " +"more frequently as usage approaches the limit to prevent Out-of-Memory (OOM) " +"kills." +msgstr "" +"Miękki limit pamięci dla środowiska wykonawczego Go, umożliwiający modułowi " +"zbierającemu nieużytki częstsze uruchamianie się, gdy wykorzystanie pamięci " +"zbliża się do limitu, zapobiegając w ten sposób wyłączeniom z powodu braku " +"pamięci (OOM)." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:113 +#: applications/luci-app-adguardhome/root/usr/share/luci/menu.d/luci-app-adguardhome.json:3 +msgid "AdGuard Home" +msgstr "AdGuard Home" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:137 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:199 +msgid "Advanced Settings" +msgstr "Ustawienia zaawansowane" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:146 +msgid "Configuration file" +msgstr "Plik konfiguracyjny" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:89 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:147 +msgid "" +"Configuration file must be stored in its own directory, and not in '/etc'." +msgstr "" +"Plik konfiguracyjny musi być zapisany w osobnym katalogu, a nie w '/etc'." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:159 +msgid "Directory where filters, logs, and statistics are stored." +msgstr "Katalog, w którym przechowywane są filtry, dzienniki i statystyki." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:132 +msgid "File System Access" +msgstr "Dostęp do systemu plików" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:133 +msgid "" +"Files and directories that AdGuard Home should have read-only or read-write " +"access to." +msgstr "" +"Pliki i katalogi, do których AdGuard Home powinien mieć dostęp tylko do " +"odczytu lub do odczytu i zapisu." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:129 +msgid "General Settings" +msgstr "Ustawienia główne" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:138 +msgid "" +"Go environment variables that tune garbage collector and memory management." +msgstr "" +"Zmienne środowiskowe Go, które dostrajają moduł zbierający nieużytki i " +"zarządzanie pamięcią." + +#: applications/luci-app-adguardhome/root/usr/share/rpcd/acl.d/luci-app-adguardhome.json:3 +msgid "Grant permissions for the AdGuard Home LuCI app" +msgstr "Udziel uprawnień aplikacji LuCI AdGuard Home" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:181 +msgid "Group the service runs under." +msgstr "Grupa, w ramach której działa usługa." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:149 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:161 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:171 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:181 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:217 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:232 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:247 +msgid "If empty, defaults to" +msgstr "Jeśli puste, domyślnie" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:139 +msgid "Modify at your own risk." +msgstr "Dokonujesz zmian na własne ryzyko." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:24 +msgid "Not running" +msgstr "Nieuruchomione" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:148 +msgid "Parent directory will be owned by the service user." +msgstr "Właścicielem katalogu nadrzędnego będzie użytkownik usługi." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:83 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:99 +msgid "Path must be absolute." +msgstr "Ścieżka musi być bezwzględna." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:86 +msgid "Path must not end with a slash." +msgstr "Ścieżka nie może kończyć się ukośnikiem." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:207 +msgid "Read-only access" +msgstr "Dostęp tylko do odczytu" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:208 +msgid "Read-write access" +msgstr "Dostęp do odczytu i zapisu" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:23 +msgid "Running" +msgstr "Uruchomione" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:122 +msgid "Service Status" +msgstr "Status usługi" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:180 +msgid "Service group" +msgstr "Grupa usługi" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:170 +msgid "Service user" +msgstr "Użytkownik usługi" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:230 +msgid "" +"The maximum number of operating system threads that can execute user-level " +"Go code simultaneously." +msgstr "" +"Maksymalna liczba wątków systemu operacyjnego, które mogą jednocześnie " +"wykonywać kod Go na poziomie użytkownika." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:215 +msgid "" +"Tunes the garbage collector's aggressiveness by setting the percentage of " +"heap growth allowed before the next collection cycle triggers." +msgstr "" +"Dostosowuje agresywność modułu zbierającego nieużytki poprzez ustawienie " +"procentowego wzrostu stosu dozwolonego przed wyzwoleniem następnego cyklu " +"zbierania nieużytków." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:171 +msgid "User the service runs under." +msgstr "Użytkownik, w ramach którego działa usługa." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:191 +msgid "Verbose logging" +msgstr "Szczegółowe rejestrowanie" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:119 +msgid "Version" +msgstr "Wersja" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:160 +msgid "Will be owned by the service user." +msgstr "Będzie własnością użytkownika usługi." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:158 +msgid "Working directory" +msgstr "Katalog roboczy" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:247 +msgid "unset" +msgstr "nieustawione" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:217 +msgid "unset and 100" +msgstr "nieustawione i 100" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:232 +msgid "unset and matching the number of CPUs" +msgstr "nieustawione i dopasowanie liczby procesorów" diff --git a/luci-app-adguardhome/po/ru/adguardhome.po b/luci-app-adguardhome/po/ru/adguardhome.po new file mode 100644 index 000000000..6ac73e7a2 --- /dev/null +++ b/luci-app-adguardhome/po/ru/adguardhome.po @@ -0,0 +1,182 @@ +msgid "" +msgstr "" +"Content-Type: text/plain; charset=UTF-8\n" +"Language: ru\n" +"Content-Transfer-Encoding: 8bit\n" +"Last-Translator: SnIPeRSnIPeR " +"\n" +"Language-Team: Russian \n" +"Plural-Forms: nplurals=3; plural=(n%10==1 && n%100!=11 ? 0 : n%10>=2 && " +"n%10<=4 && (n%100<10 || n%100>=20) ? 1 : 2);\n" +"PO-Revision-Date: 2026-08-28 22:28+0000\n" +"X-Generator: Weblate 2026.9.dev0\n" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:244 +msgid "" +"A soft memory cap for the Go runtime, allowing the garbage collector to run " +"more frequently as usage approaches the limit to prevent Out-of-Memory (OOM) " +"kills." +msgstr "" +"Мягкое ограничение памяти для среды выполнения Go, позволяющее сборщику " +"мусора запускаться чаще по мере приближения к лимиту, чтобы предотвратить " +"принудительное завершение процесса из-за нехватки памяти (OOM)." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:113 +#: applications/luci-app-adguardhome/root/usr/share/luci/menu.d/luci-app-adguardhome.json:3 +msgid "AdGuard Home" +msgstr "AdGuard Home" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:137 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:199 +msgid "Advanced Settings" +msgstr "Расширенные настройки" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:146 +msgid "Configuration file" +msgstr "Файл конфигурации" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:89 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:147 +msgid "" +"Configuration file must be stored in its own directory, and not in '/etc'." +msgstr "" +"Файл конфигурации должен храниться в собственном каталоге, а не в '/etc'." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:159 +msgid "Directory where filters, logs, and statistics are stored." +msgstr "Каталог, в котором хранятся фильтры, журналы и статистика." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:132 +msgid "File System Access" +msgstr "Доступ к файловой системе" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:133 +msgid "" +"Files and directories that AdGuard Home should have read-only or read-write " +"access to." +msgstr "" +"Файлы и каталоги, к которым AdGuard Home должен иметь доступ только для " +"чтения или для чтения и записи." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:129 +msgid "General Settings" +msgstr "Основные настройки" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:138 +msgid "" +"Go environment variables that tune garbage collector and memory management." +msgstr "" +"Переменные окружения Go, которые настраивают сборщик мусора и управление " +"памятью." + +#: applications/luci-app-adguardhome/root/usr/share/rpcd/acl.d/luci-app-adguardhome.json:3 +msgid "Grant permissions for the AdGuard Home LuCI app" +msgstr "Предоставить разрешения для приложения AdGuard Home в LuCI" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:181 +msgid "Group the service runs under." +msgstr "Группа, под которой работает служба." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:149 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:161 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:171 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:181 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:217 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:232 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:247 +msgid "If empty, defaults to" +msgstr "Если пусто, по умолчанию используется" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:139 +msgid "Modify at your own risk." +msgstr "Изменяйте на свой страх и риск." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:24 +msgid "Not running" +msgstr "Не запущено" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:148 +msgid "Parent directory will be owned by the service user." +msgstr "Родительский каталог будет принадлежать пользователю службы." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:83 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:99 +msgid "Path must be absolute." +msgstr "Путь должен быть абсолютным." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:86 +msgid "Path must not end with a slash." +msgstr "Путь не должен заканчиваться косой чертой." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:207 +msgid "Read-only access" +msgstr "Доступ только для чтения" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:208 +msgid "Read-write access" +msgstr "Доступ для чтения и записи" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:23 +msgid "Running" +msgstr "Запущено" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:122 +msgid "Service Status" +msgstr "Состояние службы" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:180 +msgid "Service group" +msgstr "Группа службы" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:170 +msgid "Service user" +msgstr "Пользователь службы" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:230 +msgid "" +"The maximum number of operating system threads that can execute user-level " +"Go code simultaneously." +msgstr "" +"Максимальное количество потоков операционной системы, которые могут " +"одновременно выполнять код Go на уровне пользователя." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:215 +msgid "" +"Tunes the garbage collector's aggressiveness by setting the percentage of " +"heap growth allowed before the next collection cycle triggers." +msgstr "" +"Настраивает агрессивность сборщика мусора, задавая процент роста кучи, " +"допустимый до запуска следующего цикла сборки." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:171 +msgid "User the service runs under." +msgstr "Пользователь, под которым работает служба." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:191 +msgid "Verbose logging" +msgstr "Подробное ведение журнала" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:119 +msgid "Version" +msgstr "Версия" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:160 +msgid "Will be owned by the service user." +msgstr "Будет принадлежать пользователю службы." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:158 +msgid "Working directory" +msgstr "Рабочий каталог" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:247 +msgid "unset" +msgstr "не задано" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:217 +msgid "unset and 100" +msgstr "не задано и 100" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:232 +msgid "unset and matching the number of CPUs" +msgstr "не задано и соответствует количеству процессоров" diff --git a/luci-app-adguardhome/po/sv/adguardhome.po b/luci-app-adguardhome/po/sv/adguardhome.po new file mode 100644 index 000000000..6d15ef89d --- /dev/null +++ b/luci-app-adguardhome/po/sv/adguardhome.po @@ -0,0 +1,177 @@ +msgid "" +msgstr "" +"Content-Type: text/plain; charset=UTF-8\n" +"Language: sv\n" +"Content-Transfer-Encoding: 8bit\n" +"Last-Translator: Daniel Nylander \n" +"Language-Team: Swedish \n" +"Plural-Forms: nplurals=2; plural=n != 1;\n" +"PO-Revision-Date: 2026-09-16 17:45+0000\n" +"X-Generator: Weblate 2026.10.dev0\n" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:244 +msgid "" +"A soft memory cap for the Go runtime, allowing the garbage collector to run " +"more frequently as usage approaches the limit to prevent Out-of-Memory (OOM) " +"kills." +msgstr "" +"En mjuk minnesgräns för Go-körmiljön som låter skräpsamlaren köras oftare " +"när användningen närmar sig gränsen, för att förhindra att processer " +"avslutas på grund av minnesbrist (OOM)." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:113 +#: applications/luci-app-adguardhome/root/usr/share/luci/menu.d/luci-app-adguardhome.json:3 +msgid "AdGuard Home" +msgstr "AdGuard Home" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:137 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:199 +msgid "Advanced Settings" +msgstr "Avancerade inställningar" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:146 +msgid "Configuration file" +msgstr "Konfigurationsfil" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:89 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:147 +msgid "" +"Configuration file must be stored in its own directory, and not in '/etc'." +msgstr "Konfigurationsfilen måste lagras i en egen katalog, inte i ”/etc”." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:159 +msgid "Directory where filters, logs, and statistics are stored." +msgstr "Katalog där filter, loggar och statistik lagras." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:132 +msgid "File System Access" +msgstr "Åtkomst till filsystemet" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:133 +msgid "" +"Files and directories that AdGuard Home should have read-only or read-write " +"access to." +msgstr "" +"Filer och kataloger som AdGuard Home ska ha skrivskyddad eller läs- och " +"skrivåtkomst till." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:129 +msgid "General Settings" +msgstr "Allmänna inställningar" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:138 +msgid "" +"Go environment variables that tune garbage collector and memory management." +msgstr "Go-miljövariabler som justerar skräpsamlaren och minneshanteringen." + +#: applications/luci-app-adguardhome/root/usr/share/rpcd/acl.d/luci-app-adguardhome.json:3 +msgid "Grant permissions for the AdGuard Home LuCI app" +msgstr "Bevilja behörigheter för AdGuard Home-appen i LuCI" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:181 +msgid "Group the service runs under." +msgstr "Gruppen som tjänsten körs under." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:149 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:161 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:171 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:181 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:217 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:232 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:247 +msgid "If empty, defaults to" +msgstr "Om den är tom används standardvärdet" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:139 +msgid "Modify at your own risk." +msgstr "Ändra på egen risk." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:24 +msgid "Not running" +msgstr "Körs inte" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:148 +msgid "Parent directory will be owned by the service user." +msgstr "Den överordnade katalogen ägs av tjänstanvändaren." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:83 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:99 +msgid "Path must be absolute." +msgstr "Sökvägen måste vara absolut." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:86 +msgid "Path must not end with a slash." +msgstr "Sökvägen får inte sluta med ett snedstreck." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:207 +msgid "Read-only access" +msgstr "Skrivskyddad åtkomst" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:208 +msgid "Read-write access" +msgstr "Läs- och skrivåtkomst" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:23 +msgid "Running" +msgstr "Körs" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:122 +msgid "Service Status" +msgstr "Status för tjänsten" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:180 +msgid "Service group" +msgstr "Tjänstegrupp" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:170 +msgid "Service user" +msgstr "Tjänstanvändare" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:230 +msgid "" +"The maximum number of operating system threads that can execute user-level " +"Go code simultaneously." +msgstr "" +"Det högsta antalet operativsystemtrådar som kan köra Go-kod på användarnivå " +"samtidigt." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:215 +msgid "" +"Tunes the garbage collector's aggressiveness by setting the percentage of " +"heap growth allowed before the next collection cycle triggers." +msgstr "" +"Justerar skräpsamlarens aggressivitet genom att ange hur stor procentuell " +"heapökning som tillåts innan nästa insamlingscykel startar." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:171 +msgid "User the service runs under." +msgstr "Användaren som tjänsten körs under." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:191 +msgid "Verbose logging" +msgstr "Detaljerad loggning" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:119 +msgid "Version" +msgstr "Version" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:160 +msgid "Will be owned by the service user." +msgstr "Ägs av tjänstanvändaren." + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:158 +msgid "Working directory" +msgstr "Arbetskatalog" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:247 +msgid "unset" +msgstr "inte inställt" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:217 +msgid "unset and 100" +msgstr "inte inställt och 100" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:232 +msgid "unset and matching the number of CPUs" +msgstr "inte inställt och samma antal som antalet processorer" diff --git a/luci-app-adguardhome/po/templates/adguardhome.pot b/luci-app-adguardhome/po/templates/adguardhome.pot new file mode 100644 index 000000000..2120d2646 --- /dev/null +++ b/luci-app-adguardhome/po/templates/adguardhome.pot @@ -0,0 +1,159 @@ +msgid "" +msgstr "Content-Type: text/plain; charset=UTF-8" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:244 +msgid "" +"A soft memory cap for the Go runtime, allowing the garbage collector to run " +"more frequently as usage approaches the limit to prevent Out-of-Memory (OOM) " +"kills." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:113 +#: applications/luci-app-adguardhome/root/usr/share/luci/menu.d/luci-app-adguardhome.json:3 +msgid "AdGuard Home" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:137 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:199 +msgid "Advanced Settings" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:146 +msgid "Configuration file" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:89 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:147 +msgid "" +"Configuration file must be stored in its own directory, and not in '/etc'." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:159 +msgid "Directory where filters, logs, and statistics are stored." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:132 +msgid "File System Access" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:133 +msgid "" +"Files and directories that AdGuard Home should have read-only or read-write " +"access to." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:129 +msgid "General Settings" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:138 +msgid "" +"Go environment variables that tune garbage collector and memory management." +msgstr "" + +#: applications/luci-app-adguardhome/root/usr/share/rpcd/acl.d/luci-app-adguardhome.json:3 +msgid "Grant permissions for the AdGuard Home LuCI app" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:181 +msgid "Group the service runs under." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:149 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:161 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:171 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:181 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:217 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:232 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:247 +msgid "If empty, defaults to" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:139 +msgid "Modify at your own risk." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:24 +msgid "Not running" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:148 +msgid "Parent directory will be owned by the service user." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:83 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:99 +msgid "Path must be absolute." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:86 +msgid "Path must not end with a slash." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:207 +msgid "Read-only access" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:208 +msgid "Read-write access" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:23 +msgid "Running" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:122 +msgid "Service Status" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:180 +msgid "Service group" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:170 +msgid "Service user" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:230 +msgid "" +"The maximum number of operating system threads that can execute user-level " +"Go code simultaneously." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:215 +msgid "" +"Tunes the garbage collector's aggressiveness by setting the percentage of " +"heap growth allowed before the next collection cycle triggers." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:171 +msgid "User the service runs under." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:191 +msgid "Verbose logging" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:119 +msgid "Version" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:160 +msgid "Will be owned by the service user." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:158 +msgid "Working directory" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:247 +msgid "unset" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:217 +msgid "unset and 100" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:232 +msgid "unset and matching the number of CPUs" +msgstr "" diff --git a/luci-app-adguardhome/po/tr/adguardhome.po b/luci-app-adguardhome/po/tr/adguardhome.po new file mode 100644 index 000000000..e7b219d09 --- /dev/null +++ b/luci-app-adguardhome/po/tr/adguardhome.po @@ -0,0 +1,168 @@ +msgid "" +msgstr "" +"Content-Type: text/plain; charset=UTF-8\n" +"Language: tr\n" +"Content-Transfer-Encoding: 8bit\n" +"Last-Translator: Martin Olmer \n" +"Language-Team: Turkish \n" +"Plural-Forms: nplurals=2; plural=n != 1;\n" +"PO-Revision-Date: 2026-08-31 19:11+0000\n" +"X-Generator: Weblate 2026.9.dev0\n" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:244 +msgid "" +"A soft memory cap for the Go runtime, allowing the garbage collector to run " +"more frequently as usage approaches the limit to prevent Out-of-Memory (OOM) " +"kills." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:113 +#: applications/luci-app-adguardhome/root/usr/share/luci/menu.d/luci-app-adguardhome.json:3 +msgid "AdGuard Home" +msgstr "AdGuard Home" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:137 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:199 +msgid "Advanced Settings" +msgstr "Gelişmiş Ayarlar" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:146 +msgid "Configuration file" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:89 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:147 +msgid "" +"Configuration file must be stored in its own directory, and not in '/etc'." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:159 +msgid "Directory where filters, logs, and statistics are stored." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:132 +msgid "File System Access" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:133 +msgid "" +"Files and directories that AdGuard Home should have read-only or read-write " +"access to." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:129 +msgid "General Settings" +msgstr "Genel Ayarlar" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:138 +msgid "" +"Go environment variables that tune garbage collector and memory management." +msgstr "" + +#: applications/luci-app-adguardhome/root/usr/share/rpcd/acl.d/luci-app-adguardhome.json:3 +msgid "Grant permissions for the AdGuard Home LuCI app" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:181 +msgid "Group the service runs under." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:149 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:161 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:171 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:181 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:217 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:232 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:247 +msgid "If empty, defaults to" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:139 +msgid "Modify at your own risk." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:24 +msgid "Not running" +msgstr "Çalışmıyor" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:148 +msgid "Parent directory will be owned by the service user." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:83 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:99 +msgid "Path must be absolute." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:86 +msgid "Path must not end with a slash." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:207 +msgid "Read-only access" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:208 +msgid "Read-write access" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:23 +msgid "Running" +msgstr "Çalışıyor" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:122 +msgid "Service Status" +msgstr "Hizmet Durumu" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:180 +msgid "Service group" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:170 +msgid "Service user" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:230 +msgid "" +"The maximum number of operating system threads that can execute user-level " +"Go code simultaneously." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:215 +msgid "" +"Tunes the garbage collector's aggressiveness by setting the percentage of " +"heap growth allowed before the next collection cycle triggers." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:171 +msgid "User the service runs under." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:191 +msgid "Verbose logging" +msgstr "Ayrıntılı günlük kaydı" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:119 +msgid "Version" +msgstr "Sürüm" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:160 +msgid "Will be owned by the service user." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:158 +msgid "Working directory" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:247 +msgid "unset" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:217 +msgid "unset and 100" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:232 +msgid "unset and matching the number of CPUs" +msgstr "" diff --git a/luci-app-adguardhome/po/uk/adguardhome.po b/luci-app-adguardhome/po/uk/adguardhome.po new file mode 100644 index 000000000..7e308efd5 --- /dev/null +++ b/luci-app-adguardhome/po/uk/adguardhome.po @@ -0,0 +1,169 @@ +msgid "" +msgstr "" +"Content-Type: text/plain; charset=UTF-8\n" +"Language: uk\n" +"Content-Transfer-Encoding: 8bit\n" +"Last-Translator: Martin Olmer \n" +"Language-Team: Ukrainian \n" +"Plural-Forms: nplurals=3; plural=(n%10==1 && n%100!=11 ? 0 : n%10>=2 && " +"n%10<=4 && (n%100<10 || n%100>=20) ? 1 : 2);\n" +"PO-Revision-Date: 2026-08-31 06:59+0000\n" +"X-Generator: Weblate 2026.9.dev0\n" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:244 +msgid "" +"A soft memory cap for the Go runtime, allowing the garbage collector to run " +"more frequently as usage approaches the limit to prevent Out-of-Memory (OOM) " +"kills." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:113 +#: applications/luci-app-adguardhome/root/usr/share/luci/menu.d/luci-app-adguardhome.json:3 +msgid "AdGuard Home" +msgstr "AdGuard Home" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:137 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:199 +msgid "Advanced Settings" +msgstr "Розширені налаштування" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:146 +msgid "Configuration file" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:89 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:147 +msgid "" +"Configuration file must be stored in its own directory, and not in '/etc'." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:159 +msgid "Directory where filters, logs, and statistics are stored." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:132 +msgid "File System Access" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:133 +msgid "" +"Files and directories that AdGuard Home should have read-only or read-write " +"access to." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:129 +msgid "General Settings" +msgstr "Загальні налаштування" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:138 +msgid "" +"Go environment variables that tune garbage collector and memory management." +msgstr "" + +#: applications/luci-app-adguardhome/root/usr/share/rpcd/acl.d/luci-app-adguardhome.json:3 +msgid "Grant permissions for the AdGuard Home LuCI app" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:181 +msgid "Group the service runs under." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:149 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:161 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:171 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:181 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:217 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:232 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:247 +msgid "If empty, defaults to" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:139 +msgid "Modify at your own risk." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:24 +msgid "Not running" +msgstr "Не працює" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:148 +msgid "Parent directory will be owned by the service user." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:83 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:99 +msgid "Path must be absolute." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:86 +msgid "Path must not end with a slash." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:207 +msgid "Read-only access" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:208 +msgid "Read-write access" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:23 +msgid "Running" +msgstr "Запущено" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:122 +msgid "Service Status" +msgstr "Стан служби" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:180 +msgid "Service group" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:170 +msgid "Service user" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:230 +msgid "" +"The maximum number of operating system threads that can execute user-level " +"Go code simultaneously." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:215 +msgid "" +"Tunes the garbage collector's aggressiveness by setting the percentage of " +"heap growth allowed before the next collection cycle triggers." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:171 +msgid "User the service runs under." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:191 +msgid "Verbose logging" +msgstr "Докладне журналювання" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:119 +msgid "Version" +msgstr "Версія" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:160 +msgid "Will be owned by the service user." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:158 +msgid "Working directory" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:247 +msgid "unset" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:217 +msgid "unset and 100" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:232 +msgid "unset and matching the number of CPUs" +msgstr "" diff --git a/luci-app-adguardhome/po/zh_Hans/adguardhome.po b/luci-app-adguardhome/po/zh_Hans/adguardhome.po index deaa0907b..a00b550da 100644 --- a/luci-app-adguardhome/po/zh_Hans/adguardhome.po +++ b/luci-app-adguardhome/po/zh_Hans/adguardhome.po @@ -1,179 +1,173 @@ msgid "" msgstr "" "Content-Type: text/plain; charset=UTF-8\n" -"Project-Id-Version: PACKAGE VERSION\n" -"Last-Translator: Automatically generated\n" -"Language-Team: none\n" -"Language: zh\n" -"MIME-Version: 1.0\n" +"Language: zh_Hans\n" "Content-Transfer-Encoding: 8bit\n" +"Last-Translator: Hosted Weblate user 54392 " +"\n" +"Language-Team: Chinese (Simplified Han script) \n" +"Plural-Forms: nplurals=1; plural=0;\n" +"PO-Revision-Date: 2026-08-31 06:44+0000\n" +"X-Generator: Weblate 2026.9.dev0\n" -msgid "AdGuard Home" +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:244 +msgid "" +"A soft memory cap for the Go runtime, allowing the garbage collector to run " +"more frequently as usage approaches the limit to prevent Out-of-Memory (OOM) " +"kills." msgstr "" +"Go 运行时的软性内存限制，允许垃圾收集器在内存占用接近限制时更频繁地运行防止内" +"存耗尽终止程序。" -msgid "AdGuard Home Configuration" -msgstr "配置" +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:113 +#: applications/luci-app-adguardhome/root/usr/share/luci/menu.d/luci-app-adguardhome.json:3 +msgid "AdGuard Home" +msgstr "AdGuard Home" -msgid "AdGuard Home Statistics" -msgstr "统计" +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:137 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:199 +msgid "Advanced Settings" +msgstr "高级设置" -msgid "AdGuard Home Status" -msgstr "状态" +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:146 +msgid "Configuration file" +msgstr "配置文件" -msgid "AdGuard Home Status - Error" -msgstr "状态 - 错误" +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:89 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:147 +msgid "" +"Configuration file must be stored in its own directory, and not in '/etc'." +msgstr "配置文件必须存储在自己的目录中，不能在 '/etc' 中。" -msgid "Average processing time (seconds)" -msgstr "平均处理时间（秒）" +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:159 +msgid "Directory where filters, logs, and statistics are stored." +msgstr "存储过滤器、日志和统计数据的目录。" -msgid "Bootstrap DNS addresses" -msgstr "Bootstrap DNS 地址" +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:132 +msgid "File System Access" +msgstr "文件系统访问" -msgid "Configuration" -msgstr "配置" +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:133 +msgid "" +"Files and directories that AdGuard Home should have read-only or read-write " +"access to." +msgstr "AdGuard Home 应该有只读或读写权限的文件和目录。" -msgid "DNS blocks" -msgstr "DNS 拦截" +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:129 +msgid "General Settings" +msgstr "通用设置" -msgid "DNS listen addresses" -msgstr "DNS 监听地址" - -msgid "DNS listen port" -msgstr "DNS 监听端口" - -msgid "DNS queries" -msgstr "DNS 查询" - -msgid "DNS replacements (malware/phishing)" -msgstr "DNS 替换（恶意软件/钓鱼）" - -msgid "DNS replacements (safesearch)" -msgstr "DNS 替换（安全搜索）" - -msgid "General settings" -msgstr "常规设置" +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:138 +msgid "" +"Go environment variables that tune garbage collector and memory management." +msgstr "调节垃圾收集器和内存管理的 Go 环境变量。" +#: applications/luci-app-adguardhome/root/usr/share/rpcd/acl.d/luci-app-adguardhome.json:3 msgid "Grant permissions for the AdGuard Home LuCI app" -msgstr "授予 AdGuard Home LuCI 应用权限" +msgstr "授予 AdGuard Home LuCI 应用的权限" -msgid "Logs" -msgstr "日志" +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:181 +msgid "Group the service runs under." +msgstr "服务运行在什么组下面。" -msgid "No" -msgstr "否" +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:149 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:161 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:171 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:181 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:217 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:232 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:247 +msgid "If empty, defaults to" +msgstr "如为空，默认为" -msgid "Not found" -msgstr "未找到" +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:139 +msgid "Modify at your own risk." +msgstr "修改风险自负。" -msgid "Password for AdGuard Home" -msgstr "密码" +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:24 +msgid "Not running" +msgstr "未在运行" -msgid "Please open the Configuration section, and provide the credentials." -msgstr "请打开配置部分，并提供凭证。" +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:148 +msgid "Parent directory will be owned by the service user." +msgstr "主目录将被服务用户所拥有。" -msgid "Protection enabled" -msgstr "保护已启用" +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:83 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:99 +msgid "Path must be absolute." +msgstr "必须是绝对路径。" -msgid "RPC call failure:" -msgstr "RPC 调用失败：" +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:86 +msgid "Path must not end with a slash." +msgstr "路径不能用 / 结束。" +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:207 +msgid "Read-only access" +msgstr "只读权限" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:208 +msgid "Read-write access" +msgstr "读写权限" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:23 msgid "Running" msgstr "运行中" -msgid "Showing last 50 lines" -msgstr "显示最近的50行" +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:122 +msgid "Service Status" +msgstr "服务状态" -msgid "Statistics period (days)" -msgstr "统计周期（天）" +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:180 +msgid "Service group" +msgstr "服务组" -msgid "Status" -msgstr "状态" - -msgid "System Log (AdGuard Home)" -msgstr "系统日志" - -msgid "The password you configured when you set up AdGuard Home" -msgstr "您在设置 AdGuard Home 时配置的密码" - -msgid "The username you configured when you set up AdGuard Home" -msgstr "您在设置 AdGuard Home 时配置的用户名" +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:170 +msgid "Service user" +msgstr "服务用户" +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:230 msgid "" -"This application requires the username and password that were configured " -"when you set up AdGuard Home, as the REST API for AdGuard Home is password " -"protected. The password cannot be read from the YAML configuration file for " -"AdGuard Home, as it is encrypted in that store. The credentials supplied " -"here will be stored unencrypted in /etc/config/adguardhome on your device." +"The maximum number of operating system threads that can execute user-level " +"Go code simultaneously." +msgstr "可同时执行用户级 Go 代码的操作系统线程的最大数量。" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:215 +msgid "" +"Tunes the garbage collector's aggressiveness by setting the percentage of " +"heap growth allowed before the next collection cycle triggers." msgstr "" -"此应用程序需要您在设置 AdGuard Home 时配置的用户名和密码，因为 AdGuard Home 的 REST API 受密码保护。" -"密码无法从 AdGuard Home 的 YAML 配置文件中读取，因为它在存储中是加密的。" -"此处提供的凭证将以未加密的形式存储在设备上的 /etc/config/adguardhome 中。" +"通过设置下个垃圾收集周期触发前允许的堆的百分比增速来调节垃圾收集器的激进程" +"度。" -msgid "Top Blocked Domains" -msgstr "最常被拦截的域名" +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:171 +msgid "User the service runs under." +msgstr "服务运行在什么用户下面。" -msgid "Top Queried Domains" -msgstr "最常查询的域名" - -msgid "Unable to load log data:" -msgstr "无法加载日志数据：" - -msgid "Upstream DNS addresses" -msgstr "上游 DNS 地址" - -msgid "Username for AdGuard Home" -msgstr "用户名" +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:191 +msgid "Verbose logging" +msgstr "详细日志记录" +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:119 msgid "Version" msgstr "版本" -msgid "Web interface" -msgstr "AdGuardHome 管理界面" +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:160 +msgid "Will be owned by the service user." +msgstr "将被服务用户所拥有。" -msgid "Yes" -msgstr "是" - -msgid "RUNNING" -msgstr "运行中" - -msgid "NOT RUNNING" -msgstr "未运行" - -msgid "Collecting data..." -msgstr "获取数据中..." - -msgid "Enable" -msgstr "启用" - -msgid "Redirect" -msgstr "重定向" - -msgid "none" -msgstr "无" - -msgid "Run as dnsmasq upstream server" -msgstr "作为dnsmasq的上游服务器" - -msgid "Redirect 53 port to AdGuardHome" -msgstr "重定向53端口到AdGuardHome" - -msgid "Use port 53 replace dnsmasq" -msgstr "使用53端口替换dnsmasq" - -msgid "AdGuardHome redirect mode" -msgstr "重定向模式" - -msgid "Change Password" -msgstr "修改密码" - -msgid "Work Dir" +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:158 +msgid "Working directory" msgstr "工作目录" -msgid "Service user" -msgstr "以此用户权限运行" +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:247 +msgid "unset" +msgstr "取消设置" -msgid "Service group" -msgstr "以此用户组权限运行" +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:217 +msgid "unset and 100" +msgstr "取消设置和 100" -msgid "Configuration file" -msgstr "配置文件" +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:232 +msgid "unset and matching the number of CPUs" +msgstr "取消设置并匹配 CPU 数目" diff --git a/luci-app-adguardhome/po/zh_Hant/adguardhome.po b/luci-app-adguardhome/po/zh_Hant/adguardhome.po new file mode 100644 index 000000000..902dc225e --- /dev/null +++ b/luci-app-adguardhome/po/zh_Hant/adguardhome.po @@ -0,0 +1,168 @@ +msgid "" +msgstr "" +"Content-Type: text/plain; charset=UTF-8\n" +"Language: zh_Hant\n" +"Content-Transfer-Encoding: 8bit\n" +"Last-Translator: 為什麼不加空格 \n" +"Language-Team: Chinese (Traditional Han script) \n" +"Plural-Forms: nplurals=1; plural=0;\n" +"PO-Revision-Date: 2026-09-02 20:59+0000\n" +"X-Generator: Weblate 2026.9.dev0\n" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:244 +msgid "" +"A soft memory cap for the Go runtime, allowing the garbage collector to run " +"more frequently as usage approaches the limit to prevent Out-of-Memory (OOM) " +"kills." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:113 +#: applications/luci-app-adguardhome/root/usr/share/luci/menu.d/luci-app-adguardhome.json:3 +msgid "AdGuard Home" +msgstr "AdGuard Home" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:137 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:199 +msgid "Advanced Settings" +msgstr "進階設定" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:146 +msgid "Configuration file" +msgstr "配置檔案" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:89 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:147 +msgid "" +"Configuration file must be stored in its own directory, and not in '/etc'." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:159 +msgid "Directory where filters, logs, and statistics are stored." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:132 +msgid "File System Access" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:133 +msgid "" +"Files and directories that AdGuard Home should have read-only or read-write " +"access to." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:129 +msgid "General Settings" +msgstr "一般設定" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:138 +msgid "" +"Go environment variables that tune garbage collector and memory management." +msgstr "" + +#: applications/luci-app-adguardhome/root/usr/share/rpcd/acl.d/luci-app-adguardhome.json:3 +msgid "Grant permissions for the AdGuard Home LuCI app" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:181 +msgid "Group the service runs under." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:149 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:161 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:171 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:181 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:217 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:232 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:247 +msgid "If empty, defaults to" +msgstr "如果為空，預設為" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:139 +msgid "Modify at your own risk." +msgstr "修改風險自負。" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:24 +msgid "Not running" +msgstr "未執行" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:148 +msgid "Parent directory will be owned by the service user." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:83 +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:99 +msgid "Path must be absolute." +msgstr "必須為絕對路徑。" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:86 +msgid "Path must not end with a slash." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:207 +msgid "Read-only access" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:208 +msgid "Read-write access" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:23 +msgid "Running" +msgstr "執行中" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:122 +msgid "Service Status" +msgstr "服務狀態" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:180 +msgid "Service group" +msgstr "服務群組" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:170 +msgid "Service user" +msgstr "服務使用者" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:230 +msgid "" +"The maximum number of operating system threads that can execute user-level " +"Go code simultaneously." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:215 +msgid "" +"Tunes the garbage collector's aggressiveness by setting the percentage of " +"heap growth allowed before the next collection cycle triggers." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:171 +msgid "User the service runs under." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:191 +msgid "Verbose logging" +msgstr "詳細記錄" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:119 +msgid "Version" +msgstr "版本" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:160 +msgid "Will be owned by the service user." +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:158 +msgid "Working directory" +msgstr "工作目錄" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:247 +msgid "unset" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:217 +msgid "unset and 100" +msgstr "" + +#: applications/luci-app-adguardhome/htdocs/luci-static/resources/view/adguardhome/config.js:232 +msgid "unset and matching the number of CPUs" +msgstr "" diff --git a/luci-app-adguardhome/root/etc/adguardhome/adguardhome.yaml b/luci-app-adguardhome/root/etc/adguardhome/adguardhome.yaml index e5c0a5097..a32a4d07a 100644 --- a/luci-app-adguardhome/root/etc/adguardhome/adguardhome.yaml +++ b/luci-app-adguardhome/root/etc/adguardhome/adguardhome.yaml @@ -2,11 +2,18 @@ http: pprof: port: 6060 enabled: false - address: 0.0.0.0:3000 - session_ttl: 720h + doh: + routes: + - GET /dns-query + - POST /dns-query + - GET /dns-query/{ClientID} + - POST /dns-query/{ClientID} + insecure_enabled: false + address: 0.0.0.0:3008 + session_ttl: 30d users: - - name: admin - password: $2y$10$.ujnc.Bphsaz4Z.SbOoMiux2z8DxpJUaIrD5gcITed.vKx.qrZSfC + - name: root + password: auth_attempts: 5 block_auth_min: 15 http_proxy: "" @@ -15,22 +22,26 @@ theme: auto dns: bind_hosts: - 0.0.0.0 - port: 5333 + port: 1745 anonymize_client_ip: false - ratelimit: 20 + ratelimit: 0 ratelimit_subnet_len_ipv4: 24 ratelimit_subnet_len_ipv6: 56 ratelimit_whitelist: [] refuse_any: true upstream_dns: - - https://dns10.quad9.net/dns-query + - '#https://dns10.quad9.net/dns-query' + - 223.5.5.5 + - 2400:3200::1 + - https://dns.alidns.com/dns-query upstream_dns_file: "" bootstrap_dns: - - 9.9.9.10 - - 149.112.112.10 - - 2620:fe::10 - - 2620:fe::fe:10 - fallback_dns: [] + - 119.29.29.29 + - 114.114.114.114 + fallback_dns: + - 119.29.29.29 + - 113.31.119.88 + - 2400:7fc0:849e:200:62fd:1de3:1c90:1 upstream_mode: parallel fastest_timeout: 1s allowed_clients: [] @@ -42,16 +53,19 @@ dns: trusted_proxies: - 127.0.0.0/8 - ::1/128 + cache_enabled: true cache_size: 4194304 cache_ttl_min: 0 cache_ttl_max: 0 - cache_optimistic: false + cache_optimistic: true + cache_optimistic_answer_ttl: 30s + cache_optimistic_max_age: 12h bogus_nxdomain: [] aaaa_disabled: false - enable_dnssec: false + enable_dnssec: true edns_client_subnet: custom_ip: "" - enabled: false + enabled: true use_custom: false max_goroutines: 300 handle_ddr: true @@ -61,13 +75,16 @@ dns: upstream_timeout: 10s private_networks: [] use_private_ptr_resolvers: true - local_ptr_upstreams: [] + local_ptr_upstreams: + - 127.0.0.1:1745 use_dns64: false dns64_prefixes: [] serve_http3: false use_http3_upstreams: false serve_plain_dns: true hostsfile_enabled: true + pending_requests: + enabled: true tls: enabled: false server_name: "" @@ -77,7 +94,6 @@ tls: port_dns_over_quic: 853 port_dnscrypt: 0 dnscrypt_config_file: "" - allow_unencrypted_doh: false certificate_chain: "" private_key: "" certificate_path: "" @@ -85,16 +101,26 @@ tls: strict_sni_check: false querylog: dir_path: "" - ignored: [] - interval: 2160h + ignored: + - orirainbow.cc^ + - orirainwe.edu.kg^ + - coriseay.edu.kg^ + - google.com^ + interval: 7d size_memory: 1000 enabled: true + ignored_enabled: true file_enabled: true statistics: dir_path: "" - ignored: [] - interval: 24h + ignored: + - orirainbow.cc^ + - orirainwe.edu.kg^ + - coriseay.edu.kg^ + - google.com^ + interval: 7d enabled: true + ignored_enabled: true filters: - enabled: true url: https://adguardteam.github.io/HostlistsRegistry/assets/filter_1.txt @@ -105,7 +131,108 @@ filters: name: AdAway Default Blocklist id: 2 whitelist_filters: [] -user_rules: [] +user_rules: + - '@@||ntfy.sh^' + - '@@||pubnub.com^' + - '@@||clarity.ms^$important' + - '@@||sh-gsg.com^$important' + - '@@||sh-mtgc.com^$important' + - '@@||taobao.com^$important' + - '@@||tmall.com^$important' + - '@@||jd.com^important' + - '@@||flyme.cn^$important' + - '@@||meizu.com^$important' + - '@@||flydigi.com^' + - '@@||pv.sohu.com^$important' + - '@@||trafficmanager.net^' + - '||yify.foo^' + - '||www.668cbb.com/static/adScript.js' + - '||topnewsfeeds.net^' + - '||nbryb.com^' + - '||superbdolly.com^' + - '||salutationcheerlessdemote.com^' + - '||buildingdoodlesquare.com^' + - '||colonistnobilityheroic.com^' + - '#解除 小米 及其所有子域名的封锁；' + - '@@||mi.com^' + - '@@||mi.cn^' + - '@@||xiaomi.com^' + - '@@||miui.com^' + - '@@||xiaomi.net^' + - '@@||xiaomi-mipdx.cn.miaozhen.com^' + - '@@||xiaomi-dtv.m.cn.miaozhen.com^' + - '@@||miwifi.com^' + - '@@||tracker.ai.xiaomi.com^$important' + - '@@||tracking.miui.com^$important' + - '#解除 Apple 及其所有子域名的封锁；' + - '@@||apple.com^' + - '@@||apple.com.cn^' + - '@@||icloud.com^' + - '@@||icloud.com.cn^' + - '#解除 cloudflare 及其所有子域名的封锁；' + - '@@||static.cloudflareinsights.com^$important' + - '@@||cloudflare.com^' + - '@@||cloudflare-cn.com^' + - '@@||argotunnel.com^' + - '#解除 microsoft 及其所有子域名的封锁；' + - '@@||microsoft.com^$important' + - '@@||windows.com^$important' + - '@@||microsoftonline.com^$important' + - '@@||windowsupdate.com^$important' + - '@@||office.com^$important' + - '@@||live.com^$important' + - '@@||skype.com^$important' + - '@@||msn.com^$important' + - '@@||bing.com^$important' + - '@@||msftconnecttest.com^$important' + - '@@||res.public.onecdn.static.microsoft^$important' + - '@@||inference.location.live.net^$important' + - '@@||static.edge.microsoftapp.net^$important' + - '@@||ipv6.msftconnecttest.com^$important' + - '@@||sentry.io^$important' + - '@@||metrics1.data.hicloud.com^$important' + - '@@||otheve.beacon.qq.com^$important' + - '@@||app-measurement.com^$important' + - '@@||tmdb.org^' + - '@@||themoviedb.org^' + - /googleads.$~script,domain=~googleads.github.io + - /pagead/lvz? + - '||google.com/pagead/' + - '||static.doubleclick.net^$domain=youtube.com' + - '||youtube.com/get_midroll_' + - '||5hz.org^' + - '||evewan.com^' + - '||stgowan.com^' + - '||51gowan.com^' + - '||www.66s6.net/d/js/acmsd/thea5.js' + - '||www.66s6.net/d/js/acmsd/thea6.js' + - '||sogowan.com^' + - '||52xkdy.com^' + - '||ttzj666.com^' + - '||888dyy.cc^' + - '||qisaoba.com^' + - '||euqq.cn^' + - '||wkyaoye.com^' + - '||qisaoba.com^' + - '@||adobe.io^' + - '@||adobestats.io' + - '@||adobe.com^' + - '@||gocart-web-prod-ue1-alb-1461435473.us-east-1.elb.amazonaws.com' + - '@@||dig.bdurl.net^$important' + - '@@||android.bugly.qq.com^$important' + - '@@||yun-hl.3g.qq.com^$important' + - '@@||collector.github.com^$important' + - '@@||geolocation.onetrust.com^$important' + - '@@||google-analytics.com^$important' + - '@@||client-upload.cn-shanghai.log.aliyuncs.com^$important' + - '@@||twingate.com^' + - '@@||syncthing.net^' + - '@@||loggw-ex.alipay.com^$important' + - '@@||hdfans.org^' + - '@@||1ptba.com^' + - '@@||ptcafe.club^' + - '||nbpicture.xyz^' + - "" dhcp: enabled: false interface_name: "" @@ -145,7 +272,7 @@ filtering: safebrowsing_block_host: standard-block.dns.adguard.com rewrites: [] safe_fs_patterns: - - /tmp/lib/adguardhome/userfilters/* + - /var/lib/adguardhome/userfilters/* safebrowsing_cache_size: 1048576 safesearch_cache_size: 1048576 parental_cache_size: 1048576 @@ -153,6 +280,7 @@ filtering: filters_update_interval: 24 blocked_response_ttl: 10 filtering_enabled: true + rewrites_enabled: true parental_enabled: false safebrowsing_enabled: false protection_enabled: true @@ -177,4 +305,4 @@ os: group: "" user: "" rlimit_nofile: 0 -schema_version: 29 +schema_version: 34 diff --git a/luci-app-adguardhome/root/etc/capabilities/adguardhome.json b/luci-app-adguardhome/root/etc/capabilities/adguardhome.json new file mode 100644 index 000000000..3586a4ae9 --- /dev/null +++ b/luci-app-adguardhome/root/etc/capabilities/adguardhome.json @@ -0,0 +1,22 @@ +{ + "bounding": [ + "CAP_NET_BIND_SERVICE", + "CAP_NET_RAW" + ], + "effective": [ + "CAP_NET_BIND_SERVICE", + "CAP_NET_RAW" + ], + "ambient": [ + "CAP_NET_BIND_SERVICE", + "CAP_NET_RAW" + ], + "permitted": [ + "CAP_NET_BIND_SERVICE", + "CAP_NET_RAW" + ], + "inheritable": [ + "CAP_NET_BIND_SERVICE", + "CAP_NET_RAW" + ] +} diff --git a/luci-app-adguardhome/root/etc/config/adguardhome b/luci-app-adguardhome/root/etc/config/adguardhome new file mode 100644 index 000000000..598f3166f --- /dev/null +++ b/luci-app-adguardhome/root/etc/config/adguardhome @@ -0,0 +1,33 @@ + +config adguardhome 'config' + # All paths must be readable by the configured user + option config_file '/etc/adguardhome/adguardhome.yaml' + # Where to store persistent data by AdGuard Home + option work_dir '/var/lib/adguardhome' + option user 'adguardhome' + option group 'adguardhome' + option verbose '0' + option enabled '0' + option redirect 'none' + option core_version 'latest' + option update_url 'https://static.adtidy.org/adguardhome/release/AdGuardHome_linux_${Arch}.tar.gz' + + # Files and directories that AdGuard Home has read-only access to + # list jail_mount '/etc/ssl/adguardhome.crt' + # list jail_mount '/etc/ssl/adguardhome.key' + + # Files and directories that AdGuard Home has read-write access to + # list jail_mount_rw '/path/to/dir' + + # Advanced options. Modify at your own risk. + + # More info: https://go.dev/doc/gc-guide#GOGC + option gc '0' + + # Max number of OS threads to use + # 0 to match the number of CPUs (default) + # >0 to explicitly specify concurrency + option maxprocs '0' + + # Soft memory limit in MB, 0 to disable + option memlimit '0' diff --git a/luci-app-adguardhome/root/etc/init.d/adguardhome b/luci-app-adguardhome/root/etc/init.d/adguardhome index 3ac88c37a..642258581 100755 --- a/luci-app-adguardhome/root/etc/init.d/adguardhome +++ b/luci-app-adguardhome/root/etc/init.d/adguardhome @@ -1,136 +1,101 @@ #!/bin/sh /etc/rc.common +# +# SPDX-License-Identifier: GPL-2.0-only +# +# shellcheck disable=SC3043 # ash supports local +. /usr/share/AdGuardHome/helper.sh -# Start after network (19 matches dnsmasq) +# matches dnsmasq START=19 -# Stop before network stops +# stops before networking stops STOP=89 PROG=/usr/bin/AdGuardHome USE_PROCD=1 +EXTRA_COMMANDS="do_redirect force_reload isrunning" +EXTRA_HELP="\ +\tdo_redirect \t0 or 1\n\ +\tforce_reload\n\ +\tisrunning" + +CONTROL_SCRIPT="/usr/share/AdGuardHome/control.sh" +CRON_FILE=/etc/crontabs/root + +get_tz() { + SET_TZ="" + local zonename + zonename="$(uci get system.@system[0].zonename 2>/dev/null)" + if [ -n "$zonename" ]; then + SET_TZ="$zonename" + return + fi + for tzfile in /etc/TZ /var/etc/TZ; do + [ -e "$tzfile" ] && tz="$(cat "$tzfile" 2>/dev/null)" && break + done + [ -n "$tz" ] && SET_TZ=$tz && return +} + +do_crontab() { + local enabled="$1" + local crontab="$2" + local findstr default cronenable cronreload=0 + + findstr="/usr/share/AdGuardHome/update_core.sh" + default="30 3 * * * /usr/share/AdGuardHome/update_core.sh 2>&1" + [ "$enabled" = "0" ] || [ "${crontab//autoupdate/}" = "$crontab" ] && cronenable=0 || cronenable=1 + crontab_editor + + [ "$cronreload" -gt 0 ] && /etc/init.d/cron restart +} + +crontab_editor() { + local line + line="$(grep "$findstr" $CRON_FILE 2>/dev/null)" + if [ "${line:0:1}" != "#" ]; then + if [ "$cronenable" -eq 1 ]; then + if [ -z "$line" ]; then + echo "$default" >> $CRON_FILE + cronreload=$((cronreload+1)) + fi + elif [ -n "$line" ]; then + sed -i "\,$findstr,d" $CRON_FILE + echo "#$line" >> $CRON_FILE + cronreload=$((cronreload+1)) + fi + else + if [ "$cronenable" -eq 1 ]; then + sed -i "\,$findstr,d" $CRON_FILE + echo "${line:1}" >> $CRON_FILE + cronreload=$((cronreload+1)) + fi + fi +} + boot() { ADGUARDHOME_BOOT=1 start "$@" } -# Configure DNS to use port 53 -use_port53() { - local dns_port="$1" - local adguard_port="$2" - local config_file="$3" - - [ "$dns_port" != "53" ] && return - - # Update AdGuardHome config - sed -i '/dns:/,/^[^ ]/{ /[[:space:]]*port:/ s/port:[[:space:]]*[0-9]\+/port: 53/ }' "$config_file" - - # Update dnsmasq config - uci set "dhcp.@dnsmasq[0].port=$adguard_port" - uci commit dhcp - /etc/init.d/dnsmasq restart -} - -# Restore original port configuration -rm_port53() { - local current_port="$1" - local new_port="$2" - local config_file="$3" - - [ "$current_port" != "53" ] && return - - # Update AdGuardHome config - sed -i '/dns:/,/^[^ ]/{ /[[:space:]]*port:/ s/port:[[:space:]]*[0-9]\+/port: '"$new_port"'/ }' "$config_file" - - # Restore dnsmasq config - uci -q set "dhcp.@dnsmasq[0].port=53" - uci commit dhcp - /etc/init.d/dnsmasq restart -} - -# Set up firewall redirect rules -set_redirect() { - local dest_port="$1" - local section - - # Add new redirect section - section=$(uci add firewall redirect) - [ -z "$section" ] && return - [ "$(uci -q get "firewall.$section.dest_port")" = "$dest_port" ] && return - - # Configure redirect rules - uci -q set "firewall.$section.target=DNAT" - uci -q set "firewall.$section.name=AdGuard Home" - uci -q set "firewall.$section.src=lan" - uci -q set "firewall.$section.src_dport=53" - uci -q set "firewall.$section.dest_port=$dest_port" - - # Apply changes - uci commit firewall - /etc/init.d/firewall reload - echo "Firewall rules updated." -} - -# Clear all AdGuard Home redirect rules -clear_redirect() { - local redirects - redirects=$(uci show firewall | grep "AdGuard Home" | cut -d'.' -f1-2) - [ -z "$redirects" ] && return - - for redirect in $redirects; do - uci -q delete "$redirect" - echo "Deleted redirect rule: $redirect" - done - - uci commit firewall - /etc/init.d/firewall reload - echo "Firewall rules updated." -} - -# Configure dnsmasq to forward requests to AdGuard Home -set_forward_dnsmasq() { - local port="$1" - local current_server="$2" - local addr="127.0.0.1#$port" - - echo "$current_server" | grep -q "^$addr" && return - - uci -q add_list dhcp.@dnsmasq[0].server="$addr" - uci -q delete "dhcp.@dnsmasq[0].resolvfile" - uci set "dhcp.@dnsmasq[0].noresolv=1" - uci commit dhcp - /etc/init.d/dnsmasq restart -} - -# Stop forwarding requests to AdGuard Home -stop_forward_dnsmasq() { - local port="$1" - local current_server="$2" - local addr="127.0.0.1#$port" - - echo "$current_server" | grep -q "^$addr" || return - - uci -q delete "dhcp.@dnsmasq[0].server" - uci -q delete "dhcp.@dnsmasq[0].noresolv" - uci commit dhcp - /etc/init.d/dnsmasq restart -} - -# Start AdGuard Home service start_service() { + mkdir -p /var/etc + [ ! -f /var/etc/adguardhome.nft ] && touch /var/etc/adguardhome.nft + chmod 644 /var/etc/adguardhome.nft + if [ -n "$ADGUARDHOME_BOOT" ]; then # Do not start yet, wait for triggers return 0 fi + rm -f /var/run/AdGserverdis 2>/dev/null config_load 'adguardhome' local config_name='config' local config_file config group user verbose work_dir workdir - local gc maxprocs memlimit redirect enabled + local gc maxprocs memlimit + local enabled hashpass crontab redirect uci_validate_section 'adguardhome' 'adguardhome' "$config_name" \ - 'enabled:bool:0' \ - 'redirect:string:none' \ 'gc:uinteger:0' \ 'group:string:adguardhome' \ 'config:string' \ @@ -142,13 +107,45 @@ start_service() { 'user:string:adguardhome' \ 'verbose:bool:0' \ 'workdir:string' \ - 'work_dir:string:/var/lib/adguardhome' + 'work_dir:string:/var/lib/adguardhome' \ + 'enabled:bool:0' \ + 'hashpass:string' \ + 'crontab:string' \ + 'redirect:string:none' \ + 'http_address:string' # Compatibility with older configs [ -n "$config" ] && config_file="$config" [ -n "$workdir" ] && work_dir="$workdir" - [ "$enabled" -eq 0 ] && return 1 + # Handle hashpass clear text issuance and back brush removal + if [ -n "$hashpass" ]; then + config_editor "users.password" "$hashpass" "$config_file" + uci set adguardhome."$config_name".hashpass="" + uci commit adguardhome + fi + + # Synchronize the front-end incing WebUI listening address to YAML + if [ -n "$http_address" ]; then + config_editor "http.address" "$http_address" "$config_file" + uci set adguardhome."$config_name".http_address="" + uci commit adguardhome + fi + + # Isse the plan task change + do_crontab "$enabled" "$crontab" + + # If it is not enabled, the linkage cleans up the redirection firewall rules and exits safely. + if [ "$enabled" = 0 ]; then + $CONTROL_SCRIPT 0 + return 0 + fi + + if [ "$user" = "adguardhome" ] && ! grep -q "^adguardhome:" /etc/passwd; then + echo "luci-app: User 'adguardhome' is missing, injecting UID 853 into system files..." >&2 + grep -q "^adguardhome:" /etc/group || echo "adguardhome:x:853:" >> /etc/group + echo "adguardhome:x:853:853:adguardhome:/var/run/adguardhome:/bin/false" >> /etc/passwd + fi local config_dir config_dir=$(dirname "$config_file") @@ -161,26 +158,15 @@ start_service() { mkdir -m 0700 -p "$work_dir" chown -R "$user":"$group" "$work_dir" - - # Get ports configuration - local AdGuardHome_PORT=$(awk '/dns:/{f=1} f&&/port:/{split($0,a,": *");print a[2];exit}' "$config_file") - local dnsmasq_port=$(uci -q get dhcp.@dnsmasq[0].port) - local DNSMASQ_SERVER=$(uci -q get dhcp.@dnsmasq[0].server) - # Configure redirect mode - case "$redirect" in - "redirect") - set_redirect "$AdGuardHome_PORT" - ;; - "dnsmasq-upstream") - set_forward_dnsmasq "$AdGuardHome_PORT" "$DNSMASQ_SERVER" - ;; - "exchange") - use_port53 "$dnsmasq_port" "$AdGuardHome_PORT" "$config_file" - ;; - esac + # Silently downgrade and call the kernel download script when the kernel is missing. + if [ ! -f "$PROG" ]; then + $CONTROL_SCRIPT 0 + /usr/share/AdGuardHome/update_core.sh >/tmp/AdGuardHome_update.log 2>&1 & + return 0 + fi - procd_open_instance adguardhome + procd_open_instance adguardhome procd_set_param command "$PROG" @@ -188,12 +174,17 @@ start_service() { [ "$maxprocs" -le 0 ] || procd_append_param env GOMAXPROCS="$maxprocs" [ "$memlimit" -le 0 ] || procd_append_param env GOMEMLIMIT="$memlimit" + local SET_TZ + get_tz + [ -n "$SET_TZ" ] && procd_append_param env TZ="$SET_TZ" + procd_append_param command --config "$config_file" procd_append_param command --logfile syslog - procd_append_param command --no-check-update + # procd_append_param command --no-check-update [ "$verbose" = 1 ] && procd_append_param command --verbose procd_append_param command --work-dir "$work_dir" + procd_set_param file /etc/config/adguardhome "$config_file" procd_set_param stdout 1 procd_set_param stderr 1 procd_set_param user "$user" @@ -212,47 +203,70 @@ start_service() { procd_add_jail_mount '/etc/hosts' procd_add_jail_mount '/etc/ssl/certs' + [ -f /etc/TZ ] && procd_add_jail_mount '/etc/TZ' + config_list_foreach "$config_name" jail_mount procd_add_jail_mount config_list_foreach "$config_name" jail_mount_rw procd_add_jail_mount_rw procd_close_instance -} -# Stop AdGuard Home service -stop_service() { - if [ -n "$ADGUARDHOME_BOOT" ]; then - # Do not start yet, wait for triggers - return 0 + # After the main process is successfully submitted for start-up, it begins to intervene asynchronously and take over the control. + if [ -f "$config_file" ]; then + ($CONTROL_SCRIPT 1) & + else + $CONTROL_SCRIPT 0 + if [ "$redirect" != "none" ]; then + procd_open_instance "waitconfig" + procd_set_param command "/usr/share/AdGuardHome/watchconfig.sh" + procd_close_instance + fi fi - local config_file='/etc/adguardhome/adguardhome.yaml' + (sleep 10 && [ -z "$(pgrep -f "$(basename "$PROG")")" ] && logger -t adguardhome "no process in 10s cancel redirect" && $CONTROL_SCRIPT 0 ) & +} +stop_service() { config_load 'adguardhome' - - # Get ports configuration - local AdGuardHome_PORT=$(awk '/dns:/{f=1} f&&/port:/{split($0,a,": *");print a[2];exit}' "$config_file") - local dnsmasq_port=$(uci -q get dhcp.@dnsmasq[0].port) - local DNSMASQ_SERVER=$(uci -q get dhcp.@dnsmasq[0].server) - - # Clean up configurations - rm_port53 "$AdGuardHome_PORT" "$dnsmasq_port" "$config_file" - clear_redirect - stop_forward_dnsmasq "$AdGuardHome_PORT" "$DNSMASQ_SERVER" + local config_name='config' + local crontab + config_get crontab "$config_name" crontab "" + + $CONTROL_SCRIPT 0 + do_crontab 0 "$crontab" + touch /var/run/AdGserverdis } -# Reload service -reload_service() { - restart +do_redirect() { + $CONTROL_SCRIPT "$1" +} + +_isrunning() { + [ ! -f "$PROG" ] && return 2 + pgrep -f "$(basename "$PROG")" >/dev/null 2>&1 && return 0 + return 1 +} + +isrunning() { + _isrunning + local r=$? + [ "$r" = "0" ] && echo "running" || ([ "$r" = "1" ] && echo "not run" || echo "no bin") + return $r +} + +force_reload() { + _isrunning && procd_send_signal adguardhome || start } -# Service triggers service_triggers() { - procd_add_reload_trigger adguardhome - - # Add interface trigger during boot - if [ -n "$ADGUARDHOME_BOOT" ]; then - # Wait for interfaces to be up before starting AdGuard Home - # Prevents issues like https://github.com/openwrt/packages/issues/21868 - procd_add_raw_trigger 'interface.*.up' 5000 /etc/init.d/adguardhome restart - fi + procd_add_reload_trigger adguardhome + + if [ -n "$ADGUARDHOME_BOOT" ]; then + # Wait for interfaces to be up before starting AdGuard Home for real. + # Prevents issues like https://github.com/openwrt/packages/issues/21868. + procd_add_raw_trigger 'interface.*.up' 5000 /etc/init.d/adguardhome restart + fi +} + +reload_service() { + restart } diff --git a/luci-app-adguardhome/root/etc/nftables.d/99-adguardhome.nft b/luci-app-adguardhome/root/etc/nftables.d/99-adguardhome.nft new file mode 100644 index 000000000..78819ad81 --- /dev/null +++ b/luci-app-adguardhome/root/etc/nftables.d/99-adguardhome.nft @@ -0,0 +1 @@ +include "/var/etc/adguardhome.nft" diff --git a/luci-app-adguardhome/root/etc/sysctl.d/50-adguardhome.conf b/luci-app-adguardhome/root/etc/sysctl.d/50-adguardhome.conf new file mode 100644 index 000000000..dfc1698af --- /dev/null +++ b/luci-app-adguardhome/root/etc/sysctl.d/50-adguardhome.conf @@ -0,0 +1,3 @@ +# quic-go expects larger UDP send/receive buffers +net.core.rmem_max = 7500000 +net.core.wmem_max = 7500000 diff --git a/luci-app-adguardhome/root/etc/uci-defaults/adguardhome b/luci-app-adguardhome/root/etc/uci-defaults/adguardhome new file mode 100755 index 000000000..e33c9f089 --- /dev/null +++ b/luci-app-adguardhome/root/etc/uci-defaults/adguardhome @@ -0,0 +1,113 @@ +#!/bin/sh +# +# SPDX-License-Identifier: GPL-2.0-only + +# Migrate old config format only +OLD_CONFIG_FILE=$(uci -q get adguardhome.config.config) +OLD_CONFIG_FILE=${OLD_CONFIG_FILE:-/etc/adguardhome.yaml} +OLD_CONFIG_NEW_OPT_FILE=$(uci -q get adguardhome.config.config_file) +NEW_CONFIG_DIR=/etc/adguardhome +NEW_CONFIG_FILE="$NEW_CONFIG_DIR/adguardhome.yaml" + +start_service() { + if ! /etc/init.d/adguardhome running; then + /etc/init.d/adguardhome start + fi +} + +stop_service() { + if /etc/init.d/adguardhome running; then + /etc/init.d/adguardhome stop + fi +} + +if [ -f "$OLD_CONFIG_NEW_OPT_FILE" ] && [ "$OLD_CONFIG_NEW_OPT_FILE" != "$NEW_CONFIG_FILE" ]; then + echo "Old AdGuard Home config found in '$OLD_CONFIG_NEW_OPT_FILE'" + + USER=$(uci -q get adguardhome.config.user) + USER=${USER:-adguardhome} + + echo "AdGuard Home config is stored in a non-default path." + echo "Ensure configured service user '$USER' can access it." + +elif [ -f "$OLD_CONFIG_FILE" ] && [ "$OLD_CONFIG_FILE" != "$NEW_CONFIG_FILE" ]; then + echo "Old AdGuard Home config found in '$OLD_CONFIG_FILE'" + OLD_CONFIG_DIR=$(dirname "$OLD_CONFIG_FILE") + + USER=$(uci -q get adguardhome.config.user) + USER=${USER:-adguardhome} + GROUP=$(uci -q get adguardhome.config.group) + GROUP=${GROUP:-adguardhome} + + CUR_CONFIG_FILE="$OLD_CONFIG_FILE" + if [ "$OLD_CONFIG_DIR" = "/etc" ]; then + echo "AdGuard Home config must be stored in its own directory. Migrating..." + stop_service + + echo "Using $USER:$GROUP for file ownership." + + [ -d "$NEW_CONFIG_DIR" ] || mkdir -m 0700 -p "$NEW_CONFIG_DIR" + mv "$OLD_CONFIG_FILE" "$NEW_CONFIG_FILE" + chown -R "$USER":"$GROUP" "$NEW_CONFIG_DIR" + CUR_CONFIG_FILE="$NEW_CONFIG_FILE" + + echo "Config migrated to '$NEW_CONFIG_FILE'" + + else + echo "AdGuard Home config is stored in a non-default path." + echo "Ensure configured service user '$USER' can access it." + fi + + uci set adguardhome.config.config_file="$CUR_CONFIG_FILE" + uci -q delete adguardhome.config.config + + # Use awk to split match on :, remove double quotes and trim leading and + # trailing spaces + cert_path=$(grep certificate_path: "$CUR_CONFIG_FILE" \ + | awk -F':' '{gsub(/"/, "", $2); gsub(/^ +| +$/, "", $2); print $2}') + if [ -n "$cert_path" ]; then + echo "Found custom 'certificate_path' pointing to '$cert_path'." \ + + "Ensure configured service user '$USER' can access it." + + stop_service + + if ! uci -q show adguardhome.config.jail_mount | grep -q "$cert_path"; then + uci add_list adguardhome.config.jail_mount="$cert_path" + fi + fi + + private_key_path=$(grep private_key_path: "$CUR_CONFIG_FILE" \ + | awk -F':' '{gsub(/"/, "", $2); gsub(/^ +| +$/, "", $2); print $2}') + if [ -n "$private_key_path" ]; then + echo "Found custom 'private_key_path' pointing to '$private_key_path'." \ + + "Ensure configured service user '$USER' can access it." + + stop_service + + if ! uci -q show adguardhome.config.jail_mount | grep -q "$private_key_path"; then + uci add_list adguardhome.config.jail_mount="$private_key_path" + fi + fi + + uci commit adguardhome + start_service + +elif [ -z "$OLD_CONFIG_NEW_OPT_FILE" ] && [ "$OLD_CONFIG_FILE" != "$NEW_CONFIG_FILE" ]; then + echo "Old AdGuard Home config not found in '$OLD_CONFIG_FILE'" + stop_service + + # Service script will create the new config directory + uci set adguardhome.config.config_file="$NEW_CONFIG_FILE" + uci -q delete adguardhome.config.config + echo "Config path changed to '$NEW_CONFIG_FILE'" + + uci commit adguardhome + start_service + +else + echo "AdGuard Home config is in its default path '$NEW_CONFIG_FILE'" +fi + +reload_service() { + restart +} diff --git a/luci-app-adguardhome/root/usr/libexec/rpcd/luci.adguardhome b/luci-app-adguardhome/root/usr/libexec/rpcd/luci.adguardhome deleted file mode 100755 index 71f6004c0..000000000 --- a/luci-app-adguardhome/root/usr/libexec/rpcd/luci.adguardhome +++ /dev/null @@ -1,153 +0,0 @@ -#!/bin/sh -. /usr/share/libubox/jshn.sh - -############################################################################################ -# Functions to parse AdGuardHome YAML file: -############################################################################################ -parse_yaml() { - local prefix=$2 - local s='[[:space:]]*' w='[a-zA-Z0-9_]*' fs=$(echo @|tr @ '\034') - sed -ne "s|,$s\]$s\$|]|" \ - -e ":1;s|^\($s\)\($w\)$s:$s\[$s\(.*\)$s,$s\(.*\)$s\]|\1\2: [\3]\n\1 - \4|;t1" \ - -e "s|^\($s\)\($w\)$s:$s\[$s\(.*\)$s\]|\1\2:\n\1 - \3|;p" $1 | \ - sed -ne "s|,$s}$s\$|}|" \ - -e ":1;s|^\($s\)-$s{$s\(.*\)$s,$s\($w\)$s:$s\(.*\)$s}|\1- {\2}\n\1 \3: \4|;t1" \ - -e "s|^\($s\)-$s{$s\(.*\)$s}|\1-\n\1 \2|;p" | \ - sed -ne "s|^\($s\):|\1|" \ - -e "s|^\($s\)-$s[\"']\(.*\)[\"']$s\$|\1$fs$fs\2|p" \ - -e "s|^\($s\)-$s\(.*\)$s\$|\1$fs$fs\2|p" \ - -e "s|^\($s\)\($w\)$s:$s[\"']\(.*\)[\"']$s\$|\1$fs\2$fs\3|p" \ - -e "s|^\($s\)\($w\)$s:$s\(.*\)$s\$|\1$fs\2$fs\3|p" | \ - awk -F$fs '{ - indent = length($1)/2; - vname[indent] = $2; - for (i in vname) {if (i > indent) {delete vname[i]; idx[i]=0}} - if(length($2)== 0){ vname[indent]= ++idx[indent] }; - if (length($3) > 0) { - vn=""; for (i=0; i /dev/null) - check_if_empty "Username not found in uci adguardhome" ${AGH_USER} || exit 1 - AGH_PASS=$(uci get adguardhome.config.web_password 2> /dev/null) - check_if_empty "Password not found in uci adguardhome" ${AGH_PASS} || exit 1 - CODE=$(curl --silent -L -k -u ${AGH_USER}:${AGH_PASS} ${PROTO}://${HOST}:${PORT}/control/$1 -o $TFILE -w "%{http_code"}) - if [[ "${CODE}" == "200" ]]; then - cat $TFILE | tr -d '\n' - else - MSG="REST call failed with '$(cat ${TFILE})'. Are the credentials correct?" - log_error "$MSG" - echo "{\"error\":\"$MSG\"}" > ${TFILE} - fi -} - -############################################################################################ -# Function that groups variables starting with specified string into a single JSON object: -############################################################################################ -group_vars() { - local LOOK_FOR=${1/_1/} - echo -n "\"$LOOK_FOR\":[" - cat ${TFILE} | grep "${LOOK_FOR}" | while read FOUND; do - sed -i "/${FOUND%=*}/d" ${TFILE} - echo "${FOUND##*=}" - done | sed '$!s/$/,/' | tr -d '\n' - echo -n "]," -} - -############################################################################################ -# Parse AGH yaml file and determine necessary variables in order to function: -############################################################################################ -TFILE=/tmp/rpcd-adguardhome-$(date -Ins).tmp -trap 'rm ${TFILE}; exit' EXIT -read_config > ${TFILE} -source ${TFILE} -HOST=${http_address%:*} -[[ "${HOST}" == "0.0.0.0" ]] && HOST=$(uci get system.@system[0].hostname).$(uci get dhcp.@dnsmasq[0].domain) -HOST=$(echo ${HOST} | awk '{print tolower($0)}') -PORT=${http_address##*:} -PROTO="http" -if [[ "${tls_enabled}" == "true" ]]; then - PROTO="https" - HOST=${tls_server_name} - PORT=${tls_port_https} -fi -[[ -z "${http_address}" ]] && http_address=${bind_host}:${bind_port} - -############################################################################################ -# Decision-making cade: -############################################################################################ -case "$1" in - list) - echo '{ "get_config": {}, "get_statistics": {}, "get_status": {}, "set_passwd": {"username":"string", "hash":"string"} }' - ;; - call) - case "$2" in - get_config) - # Start the JSON array: - echo -n "{" - # Group any variables starting with "dns_" together: - grep "_1=\"" ${TFILE} | grep dns_ | while read LINE; do group_vars ${LINE%=*}; done - # Return the AGH configuration as a JSON table: - cat ${TFILE} | sed "s|^|\"|g" | sed "s|=\"|\":\"|g" | sed "s|\"$|\",|g" | tr -d '\n' - # Include web url, then close the JSON array: - echo "\"web_url\":\"${PROTO}://${HOST}:${PORT}\"}" - ;; - - get_statistics) - # Return the AGH statistics as a JSON table: - call_rest_api stats - ;; - - get_status) - # Return the AGH status as a JSON table: - call_rest_api status - ;; - - set_passwd) - # Check if bcrypt-tool is available for use: - # Read and load the argument into JSON array: - read input - json_load "$input" - # Get username and password from JSON array and verify they aren't empty: - json_get_var AGH_USER "username" - check_if_empty "username parameter missing." "${AGH_USER}" || exit 1 - json_get_var AGH_HASH "hash" - check_if_empty "hash parameter missing." "${AGH_HASH}" || exit 1 - # Change the username in the AGH configuration file: - sed -i "s|\- name: .*|\- name: ${AGH_USER} |" /etc/adguardhome/adguardhome.yaml - # Calculate and replace password hash in the AGH configuration file: - sed -i "s|\password: .*|\password: ${AGH_HASH}|" /etc/adguardhome/adguardhome.yaml - # Restart AdGaurdHome: - service adguardhome restart - # Return success to caller: - echo "{\"success\":true}" - ;; - esac - ;; -esac diff --git a/luci-app-adguardhome/root/usr/share/AdGuardHome/adguardhome.nft.tpl b/luci-app-adguardhome/root/usr/share/AdGuardHome/adguardhome.nft.tpl new file mode 100644 index 000000000..d11a9dd08 --- /dev/null +++ b/luci-app-adguardhome/root/usr/share/AdGuardHome/adguardhome.nft.tpl @@ -0,0 +1,10 @@ +table inet adguardhome { + chain prerouting { + type nat hook prerouting priority dstnat; policy accept; + + iifname { __WAN_EXCLUDES__ } return + + fib daddr type local udp dport 53 redirect to :__AGH_PORT__ + fib daddr type local tcp dport 53 redirect to :__AGH_PORT__ + } +} diff --git a/luci-app-adguardhome/root/usr/share/AdGuardHome/control.sh b/luci-app-adguardhome/root/usr/share/AdGuardHome/control.sh new file mode 100755 index 000000000..360e8776d --- /dev/null +++ b/luci-app-adguardhome/root/usr/share/AdGuardHome/control.sh @@ -0,0 +1,223 @@ +#!/bin/sh +# /usr/share/AdGuardHome/control.sh +. /usr/share/AdGuardHome/helper.sh + +ENABLED="$1" +CONFIGURATION="adguardhome" +NFT_RULES_TPL="/usr/share/AdGuardHome/adguardhome.nft.tpl" +NFT_RULES_FILE="/var/etc/adguardhome.nft" +NFT_TABLE="adguardhome" + +set_nft_redirect() { + local port="$1" + [ -z "$port" ] && return 1 + [ ! -f "$NFT_RULES_TPL" ] && return 1 + + local wan_section_name + wan_section_name=$(uci show firewall | awk -F'.' '/\.name='\''wan'\''$/ {print $2}') + local WAN_IFS="" + if [ -n "$wan_section_name" ]; then + WAN_IFS=$(uci get firewall.$wan_section_name.network 2>/dev/null | xargs) + fi + + local WAN_NFT_SET="" + for IF in $WAN_IFS; do + WAN_NFT_SET="${WAN_NFT_SET} \"$IF\"," + done + WAN_NFT_SET=$(echo "$WAN_NFT_SET" | sed 's/,$//') + + sed -e "s/__WAN_EXCLUDES__/${WAN_NFT_SET}/g" -e "s/__AGH_PORT__/${port}/g" "$NFT_RULES_TPL" > "$NFT_RULES_FILE" + + nft delete table inet "$NFT_TABLE" 2>/dev/null + fw4 reload + logger -t adguardhome "nft table $NFT_TABLE applied on port $port, WAN excludes: $WAN_NFT_SET" +} + +clear_nft_redirect() { + # 优化：只有当表存在时才清理和重载防火墙，避免无意义的性能开销 + if nft list table inet "$NFT_TABLE" >/dev/null 2>&1; then + [ -f "$NFT_RULES_FILE" ] && > "$NFT_RULES_FILE" + nft delete table inet "$NFT_TABLE" 2>/dev/null + fw4 reload + logger -t adguardhome "nft table $NFT_TABLE cleared" + fi +} + +set_forward_dnsmasq() { + local PORT="$1" + local addr="127.0.0.1#$PORT" + local OLD_SERVER + OLD_SERVER="$(uci get dhcp.@dnsmasq[0].server 2>/dev/null)" + echo "$OLD_SERVER" | grep -q "^$addr" && return 0 + + uci delete dhcp.@dnsmasq[0].server 2>/dev/null + uci add_list dhcp.@dnsmasq[0].server="$addr" + uci delete dhcp.@dnsmasq[0].resolvfile 2>/dev/null + uci set dhcp.@dnsmasq[0].noresolv=1 + uci commit dhcp + /etc/init.d/dnsmasq restart >/dev/null 2>&1 +} + +stop_forward_dnsmasq() { + local OLD_PORT="$1" + local addr="127.0.0.1#$OLD_PORT" + local OLD_SERVER + OLD_SERVER="$(uci get dhcp.@dnsmasq[0].server 2>/dev/null)" + echo "$OLD_SERVER" | grep -q "^$addr" || return 0 + + uci del_list dhcp.@dnsmasq[0].server="$addr" 2>/dev/null + local addrlist + addrlist="$(uci get dhcp.@dnsmasq[0].server 2>/dev/null)" + if [ -z "$addrlist" ]; then + local resolvfile="/tmp/resolv.conf.d/resolv.conf.auto" + [ ! -f "$resolvfile" ] && resolvfile="/tmp/resolv.conf.auto" + uci set dhcp.@dnsmasq[0].resolvfile="$resolvfile" 2>/dev/null + uci delete dhcp.@dnsmasq[0].noresolv 2>/dev/null + fi + uci commit dhcp + /etc/init.d/dnsmasq restart >/dev/null 2>&1 +} + +agh_reload() { + ubus call service event '{"type":"config.change","data":{"package":"adguardhome"}}' >/dev/null 2>&1 +} + +rm_port53() { + local configpath + configpath=$(uci -q get adguardhome.config.config_file) + [ -z "$configpath" ] && configpath="/etc/adguardhome/adguardhome.yaml" + + local adguardhome_PORT dnsmasq_port + adguardhome_PORT=$(config_editor "dns.port" "" "$configpath" "1") + dnsmasq_port=$(uci get dhcp.@dnsmasq[0].port 2>/dev/null) + [ -z "$dnsmasq_port" ] && dnsmasq_port="53" + + if [ "$dnsmasq_port" = "$adguardhome_PORT" ]; then + [ "$dnsmasq_port" = "53" ] && dnsmasq_port="1745" + elif [ "$dnsmasq_port" = "53" ]; then + return + fi + + config_editor "dns.port" "$dnsmasq_port" "$configpath" + uci set dhcp.@dnsmasq[0].port="53" + uci commit dhcp + + /etc/init.d/dnsmasq restart + agh_reload +} + +use_port53() { + local configpath + configpath=$(uci -q get adguardhome.config.config_file) + [ -z "$configpath" ] && configpath="/etc/adguardhome/adguardhome.yaml" + + local adguardhome_PORT dnsmasq_port + adguardhome_PORT=$(config_editor "dns.port" "" "$configpath" "1") + dnsmasq_port=$(uci get dhcp.@dnsmasq[0].port 2>/dev/null) + [ -z "$dnsmasq_port" ] && dnsmasq_port="53" + + if [ "$dnsmasq_port" = "$adguardhome_PORT" ]; then + [ "$dnsmasq_port" = "53" ] && adguardhome_PORT="1745" + elif [ "$adguardhome_PORT" = "53" ]; then + return + fi + + config_editor "dns.port" "53" "$configpath" + uci set dhcp.@dnsmasq[0].port="$adguardhome_PORT" + uci commit dhcp + /etc/init.d/dnsmasq restart + agh_reload +} + +mark_redirect_flag() { + local enabled="$1" redirect="$2" agh_port="$3" + local configpath flag=0 + configpath=$(uci -q get adguardhome.config.config_file) + [ -z "$configpath" ] && configpath="/etc/adguardhome/adguardhome.yaml" + + if [ "$enabled" = "1" ] && [ "$redirect" != "none" ]; then + flag=1 + if [ "$redirect" = "redirect" ]; then + nft list table inet "$NFT_TABLE" >/dev/null 2>&1 || flag=0 + elif [ "$redirect" = "dnsmasq-upstream" ]; then + local s + s="$(uci -q get dhcp.@dnsmasq[0].server | tr '\n' ' ')" + printf '%s\n' "$s" | grep -q -E "(^|[[:space:]])127\.0\.0\.1#${agh_port}([[:space:]]|$)" || flag=0 + elif [ "$redirect" = "exchange" ]; then + local cfgp dport + cfgp="$(config_editor "dns.port" "" "$configpath" "1")" + dport="$(uci -q get dhcp.@dnsmasq[0].port)" + if [ "$cfgp" != "53" ] || [ "$dport" = "53" ] ; then flag=0; fi + fi + fi + echo -n "$flag" > /var/run/AdGredir +} + +_do_redirect() { + local enabled="$1" + local configpath + configpath=$(uci -q get adguardhome.config.config_file) + [ -z "$configpath" ] && configpath="/etc/adguardhome/adguardhome.yaml" + + local adguardhome_PORT redirect old_redirect old_port old_enabled + adguardhome_PORT="$(config_editor "dns.port" "" "$configpath" "1")" + [ -z "$adguardhome_PORT" ] && adguardhome_PORT="0" + + redirect=$(uci -q get adguardhome.config.redirect || echo "none") + + # 【核心修复】：从内存文件中读取旧状态，彻底放弃污染 UCI + if [ -f /var/run/adguardhome.state ]; then + . /var/run/adguardhome.state + else + old_redirect="none" + old_port="0" + old_enabled="0" + fi + + uci get dhcp.@dnsmasq[0].port >/dev/null 2>&1 || uci set dhcp.@dnsmasq[0].port="53" + uci commit dhcp + + if [ "$old_enabled" = "1" ] && [ "$old_redirect" = "exchange" ]; then + adguardhome_PORT="$(uci get dhcp.@dnsmasq[0].port 2>/dev/null)" + fi + + if [ "$old_redirect" != "$redirect" ] || [ "$old_port" != "$adguardhome_PORT" ] || { [ "$old_enabled" = "1" ] && [ "$enabled" = "0" ]; }; then + if [ "$old_redirect" != "none" ]; then + if [ "$old_redirect" = "redirect" ] && [ "$old_port" != "0" ]; then + clear_nft_redirect + elif [ "$old_redirect" = "dnsmasq-upstream" ]; then + stop_forward_dnsmasq "$old_port" + elif [ "$old_redirect" = "exchange" ]; then + rm_port53 + fi + fi + elif [ "$old_enabled" = "1" ] && [ "$enabled" = "1" ]; then + if [ "$old_redirect" = "redirect" ] && [ "$old_port" != "0" ]; then + clear_nft_redirect + fi + fi + + # 【核心修复】：将当前状态覆盖写入内存文件，轻量、疾速、安全！ + cat < /var/run/adguardhome.state +old_redirect="$redirect" +old_port="$adguardhome_PORT" +old_enabled="$enabled" +EOF + + if [ "$enabled" = "0" ] || [ "$adguardhome_PORT" = "0" ]; then + echo -n "0" > /var/run/AdGredir + return 1 + fi + + if [ "$redirect" = "redirect" ]; then + set_nft_redirect "$adguardhome_PORT" + elif [ "$redirect" = "dnsmasq-upstream" ]; then + set_forward_dnsmasq "$adguardhome_PORT" + elif [ "$redirect" = "exchange" ] && [ "$(uci get dhcp.@dnsmasq[0].port 2>/dev/null)" = "53" ]; then + use_port53 + fi + + mark_redirect_flag "$enabled" "$redirect" "$adguardhome_PORT" +} + +_do_redirect "$ENABLED" diff --git a/luci-app-adguardhome/root/usr/share/AdGuardHome/helper.sh b/luci-app-adguardhome/root/usr/share/AdGuardHome/helper.sh new file mode 100755 index 000000000..35f01985f --- /dev/null +++ b/luci-app-adguardhome/root/usr/share/AdGuardHome/helper.sh @@ -0,0 +1,21 @@ +#!/bin/sh +# Auxiliary functions specially used for reading and writing YAML +config_editor() { + awk -v yaml="$1" -v value="$2" -v file="$3" -v ro="$4" ' + BEGIN{split(yaml,part,"\.");s="";i=1;l=length(part);} + { + if (match($0,s""part[i]":")) { + if (i==l) { + split($0,t,": "); + if (ro==""){ + system("sed -i '\''"FNR"c\\" t[1] ": " value "'\'' " file " >/dev/null 2>&1"); + } else { + print(t[2]); + } + exit; + } + s=s"[- ]{2}"; + i++; + } + }' "$3" +} diff --git a/luci-app-adguardhome/root/usr/share/AdGuardHome/update_core.sh b/luci-app-adguardhome/root/usr/share/AdGuardHome/update_core.sh new file mode 100755 index 000000000..bd8016510 --- /dev/null +++ b/luci-app-adguardhome/root/usr/share/AdGuardHome/update_core.sh @@ -0,0 +1,215 @@ +#!/bin/sh + +# === Core security: self-background operation mechanism === +if [ "$1" != "bg_run" ]; then + rm -f /var/run/update_core* /tmp/AdGuardHome_update.log + touch /var/run/update_core + /usr/share/AdGuardHome/update_core.sh bg_run "$1" /tmp/AdGuardHome_update.log 2>&1 & + exit 0 +fi + +shift +# ========================================================== + +PATH="/usr/sbin:/usr/bin:/sbin:/bin" +binpath="/usr/bin/AdGuardHome" +update_mode=$1 + +core_version=$(uci get adguardhome.config.core_version 2>/dev/null || true) +update_url=$(uci get adguardhome.config.update_url 2>/dev/null || true) + +case "${core_version}" in +beta) + core_api_url=https://api.github.com/repos/AdguardTeam/AdGuardHome/releases + ;; +*) + core_api_url=https://api.github.com/repos/AdguardTeam/AdGuardHome/releases/latest + ;; +esac + +EXIT(){ + rm -rf /var/run/update_core /tmp/AdGuardHome_Update 2>/dev/null + if [ "$1" != "0" ]; then + touch /var/run/update_core_error + fi + exit $1 +} + +trap "EXIT 1" SIGTERM SIGINT + +rm -rf /var/run/update_core_error /var/run/update_core_done 2>/dev/null +touch /var/run/update_core + +Check_Task(){ + running_tasks="$(ps w | grep -v grep | grep 'AdGuardHome' | grep 'update_core' | wc -l)" + case $1 in + force) + echo "Force update requested" + echo "Killing ${running_tasks} running tasks ..." + ps w | grep -v grep | grep -v $$ | grep 'AdGuardHome' | grep 'update_core' | awk '{print $1}' | xargs kill -9 2>/dev/null + ;; + *) + [ "${running_tasks}" -gt 2 ] && echo -e "There are ${running_tasks} update tasks already running. Please wait or stop them manually." && EXIT 2 + ;; + esac +} + +Check_Downloader() { + if command -v curl >/dev/null 2>&1; then + PKG="curl" + return + fi + + if command -v wget >/dev/null 2>&1; then + PKG="wget" + return + fi + + echo "Neither curl nor wget is installed, cannot check updates!" >&2 + EXIT 1 +} + +Check_Updates(){ + Check_Downloader + case "${PKG}" in + curl) + Downloader="curl -L -k -o" + _Downloader="curl -s" + ;; + wget) + Downloader="wget --no-check-certificate -T 5 -O" + _Downloader="wget -q -O -" + ;; + esac + echo "[${PKG}] Checking for updates ..." + Cloud_Version="$(${_Downloader} ${core_api_url} 2>/dev/null | grep 'tag_name' | egrep -o "v[0-9].+[0-9.]" | awk 'NR==1')" + if [ -z "${Cloud_Version}" ]; then + echo "Failed to check updates, please check network." >&2 + EXIT 1 + fi + + if [ -f "${binpath}" ]; then + Current_Version="$(${binpath} --version 2>/dev/null | egrep -o "v[0-9].+[0-9]" | sed -r 's/(.*), c(.*)/\1/')" + else + Current_Version="unknown" + fi + [ -z "${Current_Version}" ] && Current_Version="unknown" + + echo "Binary path: ${binpath%/*}" + echo "Current version: ${Current_Version}" + echo "Latest version: ${Cloud_Version}" + + if [ ! "${Cloud_Version}" = "${Current_Version}" ] || [ "$1" = force ]; then + Update_Core || EXIT 1 + else + echo "Already up to date." + EXIT 0 + fi + EXIT 0 +} + +Update_Core(){ + rm -rf "/tmp/AdGuardHome_Update" > /dev/null 2>&1 + mkdir -p "/tmp/AdGuardHome_Update" || { echo "Unable to create a temporary directory"; EXIT 1; } + + GET_Arch + eval link="${update_url}" + echo "Download link: ${link}" + echo "File name: ${link##*/}" + echo "Downloading AdGuardHome core ..." + + if ! $Downloader "/tmp/AdGuardHome_Update/${link##*/}" "${link}"; then + echo "Download failed." + rm -rf "/tmp/AdGuardHome_Update" + EXIT 1 + fi + + if [ "${link##*.}" = "gz" ]; then + echo "Extracting AdGuardHome ..." + if ! tar -zxf "/tmp/AdGuardHome_Update/${link##*/}" -C "/tmp/AdGuardHome_Update/"; then + echo "Extraction failed!" + rm -rf "/tmp/AdGuardHome_Update" + EXIT 1 + fi + if [ ! -e "/tmp/AdGuardHome_Update/AdGuardHome/AdGuardHome" ]; then + echo "Extraction failed: binary not found!" + rm -rf "/tmp/AdGuardHome_Update" + EXIT 1 + fi + downloadbin="/tmp/AdGuardHome_Update/AdGuardHome/AdGuardHome" + else + downloadbin="/tmp/AdGuardHome_Update/${link##*/}" + fi + + chmod +x "${downloadbin}" 2>/dev/null || true + echo "Core size: $(awk 'BEGIN{printf "%.2fMB\n",'$((`ls -l $downloadbin | awk '{print $5}'`))'/1000000}')" + + /etc/init.d/AdGuardHome stop > /dev/null 2>&1 + echo "Moving AdGuardHome binary to ${binpath%/*} ..." + + if ! mv -f "${downloadbin}" "${binpath}"; then + echo -e "The core movement failed! \nIt may be caused by insufficient space." + rm -rf "/tmp/AdGuardHome_Update" + EXIT 1 + fi + + rm -rf /tmp/AdGuardHome_Update + chmod +x ${binpath} + echo "Restarting AdGuardHome service ..." + /etc/init.d/adguardhome restart > /dev/null 2>&1 + + echo "AdGuardHome core updated successfully!" + touch /var/run/update_core_done + EXIT 0 +} + +GET_Arch() { + Archt="$(uname -m)" + case "${Archt}" in + i386|i686) + Arch="i386" + ;; + x86_64|amd64) + Arch="amd64" + ;; + mipsel|mipsel*) + Arch="mipsle_softfloat" + ;; + mips|mips*) + Arch="mips_softfloat" + ;; + mips64el) + Arch="mips64le_softfloat" + ;; + mips64) + Arch="mips64_softfloat" + ;; + armv5*|armv5l|armv5tel) + Arch="armv5" + ;; + armv6*|armv6l) + Arch="armv6" + ;; + armv7*|armv7l) + Arch="armv7" + ;; + arm|armhf) + Arch="armv7" + ;; + aarch64) + Arch="arm64" + ;; + *) + echo "Unsupported architecture: [${Archt}]" + EXIT 1 + esac + echo "Detected architecture: ${Arch}" +} + + +main(){ + Check_Task ${update_mode} + Check_Updates ${update_mode} +} + +main diff --git a/luci-app-adguardhome/root/usr/share/AdGuardHome/watchconfig.sh b/luci-app-adguardhome/root/usr/share/AdGuardHome/watchconfig.sh new file mode 100755 index 000000000..c7267bfed --- /dev/null +++ b/luci-app-adguardhome/root/usr/share/AdGuardHome/watchconfig.sh @@ -0,0 +1,18 @@ +#!/bin/sh +# /usr/share/AdGuardHome/watchconfig.sh + +PATH="/usr/sbin:/usr/bin:/sbin:/bin" + +configpath=$(uci -q get adguardhome.config.config_file) +[ -z "$configpath" ] && configpath="/etc/adguardhome/adguardhome.yaml" + +while : +do + sleep 10 + if [ -f "$configpath" ]; then + /etc/init.d/adguardhome do_redirect 1 + break + fi +done + +exit 0 diff --git a/luci-app-adguardhome/root/usr/share/luci/menu.d/luci-app-adguardhome.json b/luci-app-adguardhome/root/usr/share/luci/menu.d/luci-app-adguardhome.json index 547b638cc..f4dddb53a 100644 --- a/luci-app-adguardhome/root/usr/share/luci/menu.d/luci-app-adguardhome.json +++ b/luci-app-adguardhome/root/usr/share/luci/menu.d/luci-app-adguardhome.json @@ -1,40 +1,15 @@ { - "admin/services/adguardhome": { - "title": "AdGuard Home", - "action": { - "type": "firstchild" - }, - "depends": { - "acl": [ - "luci-app-adguardhome" - ], - "uci": { - "adguardhome": true - } - } - }, - "admin/services/adguardhome/config": { - "title": "Configuration", - "order": 1, - "action": { - "type": "view", - "path": "adguardhome/config" - } - }, - "admin/services/adguardhome/status": { - "title": "Status", - "order": 11, - "action": { - "type": "view", - "path": "adguardhome/status" - } - }, - "admin/services/adguardhome/logs": { - "title": "Logs", - "order": 21, - "action": { - "type": "view", - "path": "adguardhome/logs" - } - } -} \ No newline at end of file + "admin/services/adguardhome": { + "title": "AdGuard Home", + "action": { + "type": "view", + "path": "adguardhome/config" + }, + "depends": { + "acl": [ "luci-app-adguardhome" ], + "uci": { + "adguardhome": true + } + } + } +} diff --git a/luci-app-adguardhome/root/usr/share/rpcd/acl.d/luci-app-adguardhome.json b/luci-app-adguardhome/root/usr/share/rpcd/acl.d/luci-app-adguardhome.json index 689923c03..7d7cc4997 100644 --- a/luci-app-adguardhome/root/usr/share/rpcd/acl.d/luci-app-adguardhome.json +++ b/luci-app-adguardhome/root/usr/share/rpcd/acl.d/luci-app-adguardhome.json @@ -2,28 +2,23 @@ "luci-app-adguardhome": { "description": "Grant permissions for the AdGuard Home LuCI app", "read": { - "ubus": { - "luci.adguardhome": [ - "get_config", - "get_status", - "get_statistics", - "set_passwd" - ] - }, - "uci": [ "adguardhome" ], "file": { - "/sbin/logread": [ - "stat", - "exec" - ], - "/sbin/logread -e AdGuardHome": [ - "exec" - ], - "/etc/init.d/dnsmasq": [ "exec" ], - "/etc/init.d/firewall": [ "exec" ] - } + "/tmp/AdGuardHome_update.log": [ "read" ], + "/var/run/update_core": [ "stat" ], + "/var/run/update_core_error": [ "stat" ], + "/var/run/AdGredir": [ "read" ], + "/var/run/AdGserverdis": [ "read" ], + "/usr/bin/AdGuardHome --version": [ "exec" ] + }, + "ubus": { + "service": [ "list" ] + }, + "uci": [ "adguardhome" ] }, "write": { + "file": { + "/usr/share/AdGuardHome/update_core.sh": [ "exec" ] + }, "uci": [ "adguardhome" ] } } diff --git a/luci-app-adguardhome/root/usr/share/ucitrack/luci-app-adguardhome.json b/luci-app-adguardhome/root/usr/share/ucitrack/luci-app-adguardhome.json new file mode 100644 index 000000000..003c0887f --- /dev/null +++ b/luci-app-adguardhome/root/usr/share/ucitrack/luci-app-adguardhome.json @@ -0,0 +1,4 @@ +{ + "config": "adguardhome", + "init": "adguardhome" +} diff --git a/luci-app-caddy/.gitattributes b/luci-app-caddy/.gitattributes new file mode 100644 index 000000000..1b12051b3 --- /dev/null +++ b/luci-app-caddy/.gitattributes @@ -0,0 +1,10 @@ +# 保证脚本 / lua / shell 配置以 LF 入库, 避免 Windows 编辑后 CRLF 上传杀死 busybox ash +* text=eol=lf + +# 二进制例外 +*.png binary +*.jpg binary +*.ico binary +*.bin binary +*.zip binary +*.ipk binary diff --git a/luci-app-caddy/.gitignore b/luci-app-caddy/.gitignore new file mode 100644 index 000000000..7ac8a497b --- /dev/null +++ b/luci-app-caddy/.gitignore @@ -0,0 +1,2 @@ +/docs/ +*.md diff --git a/luci-app-caddy/Makefile b/luci-app-caddy/Makefile index 368f882e6..13d331332 100644 --- a/luci-app-caddy/Makefile +++ b/luci-app-caddy/Makefile @@ -1,4 +1,5 @@ -# Copyright (C) 2016 Openwrt.org +# luci-app-caddy - LuCI 管理 Caddy (反向代理 / ACME DNS-01 / Aliyun DDNS) +# Copyright (C) 2026 andangel - https://github.com/andangel/luci-app-caddy # # This is free software, licensed under the Apache License, Version 2.0 . # @@ -9,17 +10,18 @@ PKG_NAME:=luci-app-caddy LUCI_TITLE:=LuCI support for caddy LUCI_DEPENDS:=+caddy -PKG_VERSION:=1.0 -PKG_RELEASE:=2 +PKG_VERSION:=2.0 +PKG_RELEASE:=3 define Package/$(PKG_NAME)/conffiles -/etc/caddy +/etc/config/caddy +/etc/caddy/Caddyfile endef define Package/$(PKG_NAME)/postrm #!/bin/sh [ -f /etc/caddy/Caddyfile ] && rm -rf /etc/caddy/Caddyfile >/dev/null 2>&1 - return 0 +return 0 endef define Package/$(PKG_NAME)/postinst diff --git a/luci-app-caddy/luasrc/controller/caddy.lua b/luci-app-caddy/luasrc/controller/caddy.lua index bff02e337..467ab7f91 100644 --- a/luci-app-caddy/luasrc/controller/caddy.lua +++ b/luci-app-caddy/luasrc/controller/caddy.lua @@ -1,30 +1,38 @@ module("luci.controller.caddy", package.seeall) +local DL_DEFAULT = "https://github.com/andangel/luci-app-caddy/releases/latest/download/caddy_linux_arm64" +local DL_API = "https://api.github.com/repos/andangel/luci-app-caddy/releases/latest" + function index() - entry({"admin", "nas"}, firstchild(), _("NAS") , 45).dependent = false - if not nixio.fs.access("/etc/config/caddy") then - return - end - - local page = entry({"admin", "nas", "caddy"}, alias("admin", "nas", "caddy", "basic"), _("Caddy"), 20) - page.dependent = true - page.acl_depends = { "luci-app-caddy" } - - entry({"admin", "nas"}, firstchild(), "NAS", 44).dependent = false - entry({"admin", "nas", "caddy", "basic"}, cbi("caddy/caddy"), _("基本设置"), 1).leaf = true - entry({"admin", "nas", "caddy", "log"}, cbi("caddy/caddy_log"), _("日志"), 2).leaf = true - entry({"admin", "nas", "caddy", "caddy_status"}, call("caddy_status")).leaf = true - entry({"admin", "nas", "caddy", "get_log"}, call("get_log")).leaf = true - entry({"admin", "nas", "caddy", "clear_log"}, call("clear_log")).leaf = true - entry({"admin", "nas", "caddy", "admin_info"}, call("admin_info")).leaf = true + entry({"admin", "network", "caddy"}, alias("admin", "network", "caddy", "basic"), _("Caddy"), 30) + entry({"admin", "network", "caddy", "basic"}, cbi("caddy/caddy"), _("状态"), 1).leaf = true + entry({"admin", "network", "caddy", "domain"}, cbi("caddy/domain"), _("域名"), 2).leaf = true + entry({"admin", "network", "caddy", "host"}, cbi("caddy/host"), _("主机"), 3).leaf = true + entry({"admin", "network", "caddy", "caddyfile"}, cbi("caddy/caddyfile"), _("配置"), 4).leaf = true + entry({"admin", "network", "caddy", "log"}, cbi("caddy/caddy_log"), _("日志"), 5).leaf = true + entry({"admin", "network", "caddy", "caddy_status"}, call("caddy_status")).leaf = true + entry({"admin", "network", "caddy", "get_log"}, call("get_log")).leaf = true + entry({"admin", "network", "caddy", "clear_log"}, call("clear_log")).leaf = true + entry({"admin", "network", "caddy", "admin_info"}, call("admin_info")).leaf = true + entry({"admin", "network", "caddy", "download"}, call("download")).leaf = true + entry({"admin", "network", "caddy", "download_status"}, call("download_status")).leaf = true + entry({"admin", "network", "caddy", "download_ctl"}, call("download_ctl")).leaf = true end function caddy_status() local e={} - local sys = require "luci.sys" local uci = require "luci.model.uci".cursor() - local port = tonumber(uci:get_first("caddy", "caddy", "port")) - e.port = (port or 12311) + -- Web 界面按钮地址: 取第一个 proxy host 的 域名:端口, 没有则留空 + local weburl = "" + local pname = uci:get_first("caddy", "proxy") + if pname then + local pdom = uci:get("caddy", pname, "domain") + local pprt = uci:get("caddy", pname, "port") + if pdom then + weburl = "http://" .. pdom .. (pprt and (":" .. pprt) or "") + end + end + e.weburl = weburl e.running=luci.sys.call("pidof caddy >/dev/null")==0 local tagfile = io.open("/tmp/caddy_time", "r") if tagfile then @@ -57,7 +65,8 @@ function caddy_status() e.caddyram = "unknown" end - local command4 = io.popen("([ -s /tmp/caddy.tag ] && cat /tmp/caddy.tag ) || (echo `$(uci -q get caddy.@caddy[0].bin_dir) -v |awk '{print $1}' | sed 's/[^0-9.]*//g'` > /tmp/caddy.tag && cat /tmp/caddy.tag)") +-- 官方 CLI: caddy version (输出形如 v2.11.4 h1:xxx, 取版本号段) + local command4 = io.popen("$(uci -q get caddy.@caddy[0].bin_dir) version 2>/dev/null | awk '{print $1}'") e.caddytag = command4:read("*all") command4:close() if e.caddytag == "" then @@ -83,9 +92,165 @@ function clear_log() end function admin_info() - local validate = luci.sys.exec("$(uci -q get caddy.@caddy[0].bin_dir) validate --config /etc/caddy/Caddyfile --adapter caddyfile 2>&1") - + -- HOME=/root 兜底: LuCI CGI (uhttpd) 环境没 $HOME/$XDG_CONFIG_HOME, + -- caddy validate 会 warn "unable to determine directory for user configuration; falling back to current directory". + -- 显式给个家目录就没这条 warn; --config 已显式传, 结果不受 HOME 影响. + local validate = luci.sys.exec("env HOME=/root $(uci -q get caddy.@caddy[0].bin_dir) validate --config /etc/caddy/Caddyfile --adapter caddyfile 2>&1") luci.http.prepare_content("application/json") luci.http.write_json({ validate = validate }) end +function download_status() + local st = { state = "idle", size = 0, total = 0, speed = 0, msg = "" } + local f = io.open("/tmp/caddy_dl.status", "r") + if f then + for line in f:lines() do + local k, v = line:match("^([%a_]+)=(.*)$") + if k then st[k] = v end + end + f:close() + end + st.size = tonumber(st.size) or 0 + st.total = tonumber(st.total) or 0 + st.speed = tonumber(st.speed) or 0 + -- 看门狗: 活动状态下 status 由下载进程每秒刷新一次并带 ts 时间戳 (该 lua 桥无 os.stat, 不靠文件 mtime), + -- 若 >60s 没刷新说明进程已丢失 (被 OOM/清理 SIGKILL 不执行 trap), 状态文件残留会导致 UI 永远下载中 + local actives = { downloading = 1, paused = 1, verifying = 1 } + local ts = tonumber(st.ts) or 0 + if actives[st.state] and ts > 0 and os.time() - ts > 60 then + st.state = "lost" + st.speed = 0 + st.msg = (st.size > 0) and "下载进程已丢失 (保留进度, 点[下载并重启]续传)" or "状态异常 (点[下载并重启]重新开始)" + end + luci.http.prepare_content("application/json") + luci.http.write_json(st) +end + +-- 暂停/继续/停止: 写一个控制命令到 /tmp/caddy_dl.ctl, 下载进程每秒轮询处理. +-- 暂停=SIGSTOP 冻结 curl (连接仍挂着, 不额外撞 GitHub); 继续=SIGCONT; 停止=杀 curl 留已下部分. +function download_ctl() + -- 本 runtime (Luci openwrt-25.12 / ucode 桥) 的 luci.http 不提供 readrequest, 用 formvalue 读 POST 字段 + local act = tostring(luci.http.formvalue("act") or "") + local ok, msg = false, "" + if act == "pause" or act == "resume" or act == "stop" then + local f = io.open("/tmp/caddy_dl.ctl", "w") + if f then f:write(act .. "\n"); f:close(); ok = true; msg = "ok" end + else + msg = "unknown act: " .. act + end + luci.http.prepare_content("application/json") + luci.http.write_json({ ok = ok, msg = msg }) +end + +function download() + local uci = require "luci.model.uci".cursor() + local bin = uci:get("caddy", "caddy", "bin_dir") or "/usr/sbin/caddy" + local u = uci:get("caddy", "caddy", "download_url") + local url = (u and u ~= "") and u or DL_DEFAULT + local use_sha = (url == DL_DEFAULT) and "1" or "0" + + local sq = function(s) return s:gsub("'", "'\\''") end + local L = { + "#!/bin/sh", + "URL='" .. sq(url) .. "'", + "TMP='/tmp/caddy.dl'", + "STATUS='/tmp/caddy_dl.status'", + "CTL='/tmp/caddy_dl.ctl'", + "BIN='" .. sq(bin) .. "'", + "USE_SHA=" .. use_sha, + "API='" .. DL_API .. "'", + "RECEIPT='/tmp/caddy_dl.done'", + "CURLPID=0; PAUSED=0; STOPTED=0", + "rm -f \"$CTL\"", + "", + "# 写临时文件再原子 mv, 防状态端点读到半截文件而把 UI 误渲染成 idle", + "ws(){ printf 'state=%s\\nsize=%s\\ntotal=%s\\nspeed=%s\\nmsg=%s\\nts=%s\\n' \"$1\" \"$2\" \"$3\" \"$4\" \"$5\" $(date +%s) > \"$STATUS.tmp\"; mv -f \"$STATUS.tmp\" \"$STATUS\"; }", + "", + "PIDFILE='/tmp/caddy_dl.pid'", + "# 去重锁: 已有存活实例则直接退出 (防清理漏杀导致多实例竞争写同一文件 / 互相覆盖 status)", + "if [ -f \"$PIDFILE\" ]; then OLD=$(cat \"$PIDFILE\" 2>/dev/null); if [ -n \"$OLD\" ] && kill -0 \"$OLD\" 2>/dev/null; then exit 0; fi; fi", + "echo $$ > \"$PIDFILE\"", + "trap 'rm -f \"$PIDFILE\"' EXIT", + "", + "# 取总大小: 发 Range bytes=0-0 只下 1 字节, 从 Content-Range: bytes 0-0/TOTAL 抽分母 (比完整 HEAD 稳); GitHub 抖则重试 3 次", + "TOT=0", + "i=0", + 'while [ "$i" -lt 3 ]; do', + "TOT=$(curl -s -L -r 0-0 --connect-timeout 10 -D - -o /dev/null \"$URL\" 2>/dev/null | tr -d '\\r' | grep -i 'Content-Range:' | grep -oE '[0-9]+/[0-9]+' | awk -F/ '{print $2}' | head -1)", + "if [ -n \"$TOT\" ] && [ \"$TOT\" -gt 0 ] 2>/dev/null; then break; fi", + "i=$((i+1)); sleep 2", + "done", + "ws downloading $(wc -c < \"$TMP\" 2>/dev/null || echo 0) \"$TOT\" 0 \"\"", + "", + "# 已下载收据: 上次下载且 SHA 通过时, 记下当时的期望 sha (写入在成功替换后). 收据在 /tmp, 重启即清空 → 重启后再点会重新下载(拉到新版).", + "# 本次点击若 API 最新 sha == 收据 == 当前二进制 sha, 说明盘上的就是刚下载的版本 → 不重复下载, 直接重启", + "SKIP=0", + "BINSIZE=$(wc -c < \"$BIN\" 2>/dev/null || echo 0)", + "if [ \"$USE_SHA\" -eq 1 ] && [ -f \"$RECEIPT\" ]; then", + "ws verifying \"$BINSIZE\" \"$BINSIZE\" 0 '核对已下载版本...'", + "API_NOW=$(curl -L -sS --connect-timeout 10 --max-time 20 \"$API\" | grep -oE 'sha256:[0-9a-f]{64}' | head -1 | sed 's/sha256://')", + "BIN_SHA=$(sha256sum \"$BIN\" 2>/dev/null | awk '{print $1}')", + "if [ \"${#API_NOW}\" -ge 64 ] && [ \"${#BIN_SHA}\" -ge 64 ] && [ \"$(cat \"$RECEIPT\" 2>/dev/null)\" = \"$API_NOW\" ] && [ \"$BIN_SHA\" = \"$API_NOW\" ]; then SKIP=1; fi", + "fi", + "if [ $SKIP -eq 1 ]; then /etc/init.d/caddy restart >/dev/null 2>&1; ws done \"$BINSIZE\" \"$BINSIZE\" 0 '已是上次下载的最新版, 无需重复下载, 已直接重启 Caddy'; exit 0; fi", + "", + "# 直接后台运行 curl (不经函数包一层), 使 $! 即真实 curl pid, 暂停/停止(信号)才能直接作用于 curl", + "# GitHub 直连不稳: 除网络类错误外, HTTP/2 reset / -C 续传冲突等瞬时错误也按 --retry 自动再来", + "# speed-limit/speed-time: 低于 ~100B/s 持续 45s 视为假死, 触发重试 (比干等 5 分钟超时快)", + "curl -L -C - -sS --retry 4 --retry-delay 8 --retry-all-errors --connect-timeout 20 --speed-limit 100 --speed-time 45 -o \"$TMP\" \"$URL\" >> /tmp/caddy_dl.log 2>&1 &", + "CURLPID=$!; RC=", + "LAST=$(wc -c < \"$TMP\" 2>/dev/null || echo 0); LTIME=$(date +%s)", + "# 主循环: 每秒刷新进度 + 处理暂停/继续/停止控制命令 (与下载解耦, 控制端点只写 $CTL 文件)", + 'while kill -0 "$CURLPID" 2>/dev/null; do', + 'if [ -f "$CTL" ]; then', + ' CMD=$(cat "$CTL" 2>/dev/null); rm -f "$CTL"', + ' if [ "$CMD" = "pause" ] && [ $PAUSED -eq 0 ]; then kill -STOP $CURLPID 2>/dev/null; PAUSED=1', + ' elif [ "$CMD" = "resume" ] && [ $PAUSED -eq 1 ]; then kill -CONT $CURLPID 2>/dev/null; PAUSED=0', + ' elif [ "$CMD" = "stop" ]; then kill $CURLPID 2>/dev/null; STOPTED=1', + ' fi', + 'fi', + 'if [ $PAUSED -eq 1 ]; then ws paused $(wc -c < "$TMP" 2>/dev/null || echo 0) "$TOT" 0 ""; sleep 1; continue; fi', + 'SZ=$(wc -c < "$TMP" 2>/dev/null || echo 0)', + 'NOW=$(date +%s); DT=$((NOW - LTIME)); SP=0', + 'if [ "$DT" -gt 0 ]; then SP=$(( (SZ - LAST) / DT )); fi', + 'LAST=$SZ; LTIME=$NOW', + 'ws downloading "$SZ" "$TOT" "$SP" ""', + "# 僵尸检测: curl 死掉但未 wait 收尸时 kill -0 仍成功会卡死主循环, /proc 状态 Z 即已死; 已下满按成功, 否则按失败", + 'CS=$(awk "{print $3}" /proc/$CURLPID/stat 2>/dev/null)', + 'if [ "$CS" = "Z" ]; then if [ "$TOT" -gt 0 ] 2>/dev/null && [ "$SZ" -ge "$TOT" ] 2>/dev/null; then RC=0; else RC=128; fi; break; fi', + "sleep 1", + "done", + "# 主循环已判定 (z 检测设了 RC) 则不覆盖; 否则 wait 收尸取真实退出码", + 'if [ -z "$RC" ]; then wait $CURLPID 2>/dev/null; RC=$?; fi', + 'SZ=$(wc -c < "$TMP" 2>/dev/null || echo 0)', + "if [ $STOPTED -eq 1 ]; then ws stopped \"$SZ\" \"$TOT\" 0 '已停止 (保留已下载部分, 点[下载并重启]可续传)'; exit 0; fi", + "if [ \"$RC\" -ne 0 ]; then ws error \"$SZ\" \"$TOT\" 0 '下载失败 (GitHub 波动/网络), 点[下载并重启]可自动续传重试'; exit 0; fi", + "if [ \"$USE_SHA\" -eq 1 ]; then", + "API_SHA=$(curl -L -sS --connect-timeout 10 --max-time 20 \"$API\" | grep -oE 'sha256:[0-9a-f]{64}' | head -1 | sed 's/sha256://')", + "LOC_SHA=$(sha256sum \"$TMP\" 2>/dev/null | awk '{print $1}')", + 'if [ "${#API_SHA}" -ge 64 ] && [ "${#LOC_SHA}" -ge 64 ] && [ "$API_SHA" != "$LOC_SHA" ]; then', + 'rm -f "$TMP"; ws error "$SZ" "$TOT" 0 "SHA256 不匹配, 文件可能损坏, 已丢弃, 请重试"; exit 0', + "fi", + "fi", + "# curl -o 落盘不带可执行位, -h 前先 chmod, 否则任何架构 (包括正确 arm64) 都会 Permission denied", + "chmod +x \"$TMP\" 2>/dev/null", + "if ! \"$TMP\" -h >/dev/null 2>&1; then rm -f \"$TMP\"; ws error \"$SZ\" \"$TOT\" 0 '文件无法执行, 可能架构不匹配 (应为 linux/arm64 静态二进制)'; exit 0; fi", + "if ! mv -f \"$TMP\" \"$BIN\"; then ws error \"$SZ\" \"$TOT\" 0 '替换 $BIN 失败'; exit 0; fi", + "# 写收据: 本版本已在盘上, 下次点击命中 SKIP 不再重复下载 (仅默认 URL 有 API_SHA)", + "[ \"$USE_SHA\" -eq 1 ] && echo \"$API_SHA\" > \"$RECEIPT\" 2>/dev/null", + "if /etc/init.d/caddy restart >/dev/null 2>&1; then ws done \"$SZ\" \"$TOT\" 0 '下载完成, 已替换并重启 Caddy'; else ws done \"$SZ\" \"$TOT\" 0 '下载完成并已替换, 但重启 Caddy 失败, 请手动 /etc/init.d/caddy restart'; fi", + } + local f = io.open("/tmp/caddy_dl.sh", "w") + f:write(table.concat(L, "\n") .. "\n") + f:close() + os.execute("chmod +x /tmp/caddy_dl.sh") + -- 先清掉旧的下载进程 (脚本本体 + 它遗留的写 caddy.dl 的 curl 子进程, 否则多实例互相覆盖 status) + -- ps 会截断命令行导致漏杀 curl, 故直接扫 /proc/*/cmdline; 用 [.] 自转义 glob 避免匹配到本命令自身 + os.execute("for p in /proc/[0-9]*; do c=$(tr '\\0' ' ' < $p/cmdline 2>/dev/null); case \"$c\" in *caddy_dl[.]sh*|*caddy[.]dl*) kill ${p##*/} 2>/dev/null;; esac; done; sleep 1; rm -f /tmp/caddy_dl.status") + -- nohup 脱离 CGI, 页面刷新也不中断 + os.execute("nohup sh /tmp/caddy_dl.sh >/dev/null 2>&1 &") + luci.http.prepare_content("application/json") + -- 注意: call 端点内 _ 未注入 (只在 index 阶段有), 这里用字面量; 该消息仅作启动占位, 随即被进度轮询覆盖 + luci.http.write_json({ ok = true, msg = "已开始后台下载 (支持断点续传), 自动刷新进度..." }) +end + diff --git a/luci-app-caddy/luasrc/model/cbi/caddy/caddy.lua b/luci-app-caddy/luasrc/model/cbi/caddy/caddy.lua index cad4aaafd..8e08f42ac 100644 --- a/luci-app-caddy/luasrc/model/cbi/caddy/caddy.lua +++ b/luci-app-caddy/luasrc/model/cbi/caddy/caddy.lua @@ -1,127 +1,56 @@ -local m, s -m = Map("caddy", translate("Caddy"), translate("Caddy 是一个可扩展的服务器平台,具有自动 HTTPS 功能的快速且可扩展的多平台 HTTP/1-2-3 Web 服务器") .. "
" .. "项目地址：" .. [[]] .. translate("github.com/caddyserver/caddy") .. "    " .. " caddy文档：" .. [[]] .. translate("caddyserver.com/docs/") .. [[]]) +local m, s, o -m:section(SimpleSection).template = "caddy/caddy_status" +m = Map("caddy", translate("Caddy 状态"), + translate("全局配置: 启用 Caddy / 公共开关 / 程序与日志路径. 反向代理 Host 在 [Host] 标签页增删改查") .. "
" .. + [[]] .. + translate("github.com/andangel/luci-app-caddy") .. "  " .. + [[]] .. + translate("caddyserver.com/docs/ (Caddy 官方文档)") .. [[]]) +m:section(SimpleSection).template = "caddy/caddy_status" + +---------------------------------------------------------------------- +-- 全局设置 (单例) - JSON 里的 global 对象, 只有一条, 只有"改", 没有增删 +---------------------------------------------------------------------- s = m:section(TypedSection, "caddy") s.addremove = false s.anonymous = true -o = s:option(Flag, "enabled", translate("Enabled")) +o = s:option(Flag, "enabled", translate("启用 Caddy")) o.rmempty = false -o.default = 0 +o.default = 1 -o = s:option(Button, "btnrm", translate("重启")) -o.inputtitle = translate("重启") -o.description = translate("在没有修改参数的情况下快速重新启动一次") +o = s:option(Button, "restart", translate("重启 Caddy")) +o.inputtitle = translate("重启 Caddy") +o.description = translate("按全局 + Host 配置重新生成 Caddyfile 并重启 Caddy") o.inputstyle = "apply" o:depends("enabled", "1") o.write = function() - os.execute("/etc/init.d/caddy restart") + os.execute("/etc/init.d/caddy restart") end -e=s:option(ListValue,"cmd",translate("启动方式"), - translate("自定义配置文件启动，若不懂参数请勿选择自定义")) -e:value("默认") -e:value("自定义") - -o = s:option(TextValue, "caddyfile", translate("Caddyfile配置文件"), - translate("这是caddy的启动配置文件Caddyfile，路径在/etc/caddy/Caddyfile
使用的命令是：caddy run --config /etc/caddy/Caddyfile --adapter caddyfile
如需设置密码，这里就不能使用明文密码，需要转换
转换命令：$(uci -q get caddy.@caddy[0].bin_dir) hash-password --plaintext 新密码")) -o.rows = 3 -o.wrap = "off" -o:depends("cmd", "自定义") - -o = s:option(Value, "port", translate("端口")) -o.datatype = "and(port,min(1))" -o.default = "12311" -o:depends("cmd", "默认") - -o = s:option(Flag,"file_pass", translate("启用 认证")) -o.datatype = "string" -o.default = "0" -o:depends("cmd", "默认") - -o = s:option(Value,"file_username", translate("用户名")) -o.datatype = "string" -o.default = "admin" -o:depends("file_pass", "1") - -o = s:option(Value,"file_password", translate("密码")) -o.datatype = "string" -o.password = true -o.default = "123456" -o:depends("file_pass", "1") - -o = s:option(Flag, "filezip", translate("启用 压缩")) -o.default = 0 -o:depends("cmd", "默认") - -o = s:option(Flag, "log", translate("启用日志")) -o.default = 1 -o:depends("cmd", "默认") - -o = s:option(Value, "log_dir", translate("日志路径"), - translate("日志的存放路径,填写完整的路径及日志文件名
建议/tmp里,例如：/tmp/caddy/requests.log")) -o.datatype = "string" -o.default = "/tmp/caddy/requests.log" -o:depends("log", "1") - -o = s:option(Value, "bin_dir", translate("程序路径"), - translate("caddy二进制的存放路径,填写完整的路径及caddy名称
例如:/usr/bin/caddy     例如:/tmp/caddy
可自行编译对应架构的二进制程序：编译教程")) -o.datatype = "string" -o.default = "/usr/bin/caddy" - -o = s:option(Value, "data_dir", translate("指向路径"), - translate("指向一个路径，可在web界面访问你的文件，默认为 /mnt")) -o.datatype = "string" -o.default = "/mnt" -o:depends("cmd", "默认") - -o = s:option(Flag, "webdav", translate("启用 webdav")) -o.default = "0" -o:depends("cmd", "默认") - -o = s:option(Flag,"webdav_pass", translate("启用 认证")) -o.datatype = "string" -o:depends("webdav", "1") -o.default = "0" - -o = s:option(Value,"webdav_username", translate("用户名")) -o.datatype = "string" -o.default = "admin" -o:depends("webdav_pass", "1") - -o = s:option(Value,"webdav_password", translate("密码")) -o.datatype = "string" -o.password = true -o.default = "123456" -o:depends("webdav_pass", "1") - -o = s:option(Value,"webdav_port", translate("webdav端口")) -o.datatype = "and(port,min(1))" -o.default = "12322" -o:depends("webdav", "1") - -o = s:option(Flag, "webzip", translate("启用 压缩")) -o.default = 0 -o:depends("webdav", "1") - -o = s:option(Value, "webdav_data_dir", translate("webdav指向路径"), - translate("指向一个路径，使用webdav访问你的文件，默认为 /mnt
连接地址须加/dav后缀  如： 192.168.1.1:12311/dav")) -o.datatype = "string" -o:depends("webdav", "1") -o.default = "/mnt" - -o = s:option(Flag, "allow_wan", translate("允许从外网访问")) -o.rmempty = false - -o = s:option(Flag, "api", translate("启用 API接口")) -o:depends("cmd", "默认") - -o = s:option(Button, "admin_info", translate("检测配置文件"), - translate("验证Caddyfile配置文件是否正确，它会模拟启动caddy
但是并不会真的启动，会列出详细信息，以便修正配置文件")) - +o = s:option(Button, "validate", translate("检测配置文件")) o.rawhtml = true o.template = "caddy/admin_info" +--- 主程序 --- +o = s:option(Value, "bin_dir", translate("主程序"), + translate("caddy 二进制完整路径")) +o.default = "/usr/sbin/caddy" +o.placeholder = "/usr/sbin/caddy" + +o = s:option(Value, "download_url", translate("下载地址(可选)"), + translate("留空用默认 GitHub latest Release. 填了则用该 URL (可换镜像/固定版本). 下载带重试+SHA256 校验")) +o.placeholder = "https://github.com/andangel/luci-app-caddy/releases/latest/download/caddy_linux_arm64" + +o = s:option(Button, "download", translate("下载并重启")) +o.rawhtml = true +o.template = "caddy/download" + +--- 日志 --- +o = s:option(Value, "log_dir", translate("日志"), + translate("各 Host 的访问日志写入此文件, 建议放 /tmp 以免占用闪存")) +o.default = "/tmp/caddy/requests.log" +o.placeholder = "/tmp/caddy/requests.log" + return m diff --git a/luci-app-caddy/luasrc/model/cbi/caddy/caddyfile.lua b/luci-app-caddy/luasrc/model/cbi/caddy/caddyfile.lua new file mode 100644 index 000000000..dee58094f --- /dev/null +++ b/luci-app-caddy/luasrc/model/cbi/caddy/caddyfile.lua @@ -0,0 +1,45 @@ +local m, s, o + +-- 手动 Caddyfile 编辑: 路径从 UCI caddy_file 取 (默认 /etc/caddy/Caddyfile), +-- 与 init.d 里 G_FILE 一致, 避免用户在 [状态] 页改 bin_dir/log_dir 后此处仍写死路径. +local uci = require("luci.model.uci").cursor() +-- get_first 返回的是 section name 而非字段值, 必须用 get(cfg, section, key) 取字段 +local cf_file = uci:get("caddy", "caddy", "caddy_file") or "/etc/caddy/Caddyfile" + +local cur_caddyfile +local cfh = io.open(cf_file, "r") +if cfh then + cur_caddyfile = cfh:read("*a") + cfh:close() +end + +m = Map("caddy", translate("Caddy 配置 (手动)"), + translate("直接编辑 当前 Caddyfile (" .. cf_file .. "). 默认载入当前文件. 注意: 在 [主机] 页重启 Caddy 时会按表单重新生成并覆盖此页内容")) + +s = m:section(TypedSection, "caddy") +s.addremove = false +s.anonymous = true + +o = s:option(TextValue, "caddyfile", translate("Caddyfile"), + translate("完整 Caddyfile. 要 Caddy 的任何功能 (forward_proxy / encode / basicauth / reverse_proxy ...) 都写在这里
" + .. "如需设置密码, 用命令生成 hash: caddy hash-password --plaintext 新密码")) +o.default = cur_caddyfile +o.rows = 25 +o.wrap = "off" + +o = s:option(Button, "apply_caddyfile", translate("写入并重启 Caddy")) +o.inputtitle = translate("写入并重启 Caddy") +o.description = translate("把上方内容写入当前 Caddyfile 并重启 Caddy (下次 [主机] 页重启 Caddy 会覆盖)") +o.inputstyle = "apply" +o.write = function(_, value) + -- 经 /tmp 中转, 避免写一半坏掉 Caddyfile; 写完 mv 原子替换 + local tmp = "/tmp/caddyfile_manual.tmp" + local f = io.open(tmp, "w") + if f then + f:write(value or "") + f:close() + os.execute(string.format("cp '%s' '%s' && rm -f '%s' && /etc/init.d/caddy restart", tmp, cf_file, tmp)) + end +end + +return m diff --git a/luci-app-caddy/luasrc/model/cbi/caddy/domain.lua b/luci-app-caddy/luasrc/model/cbi/caddy/domain.lua new file mode 100644 index 000000000..a1649b131 --- /dev/null +++ b/luci-app-caddy/luasrc/model/cbi/caddy/domain.lua @@ -0,0 +1,65 @@ +local m, s, o +local uci = require("luci.model.uci").cursor() + +m = Map("caddy", translate("Caddy Domain"), + translate("域名列表 (增删改查). 每条域名对应一个阿里云账号 (AK), 该域名的 TLS 证书和 DDNS 都用这份 AK")) + +--- Domain (多条) - 增删改查, 每条 = 一个域名 + 对应的阿里云 AK + DDNS 参数 --- +--- anonymous: 用户点"添加"即可, 无需填 UCI 标识符 (域名含 . 不合 UCI 命名规范) --- +s = m:section(TypedSection, "domain") +s.addremove = true +s.anonymous = true +s.nodeps = true +s.cfgtitle = "domain_name" + +o = s:option(Value, "domain_name", translate("域名"), + translate("例如 example.com. Host 页的监听域名下拉从这里取")) +o.rmempty = false + +o = s:option(Value, "key_id", translate("阿里云 Access Key ID"), + translate("该域名的 AliDNS 写权限 AK. 需要 AliyunDNS 的 Read/Write 权限")) +o.rmempty = false + +o = s:option(Value, "key_secret", translate("阿里云 Access Key Secret")) +o.password = true +o.rmempty = false + +--- DDNS 子块: 勾选 ddns_on 才显示以下字段 --- +o = s:option(Flag, "ddns_on", translate("启用 DDNS (更新 A 记录)"), + translate("勾选 = 生成的 Caddyfile 包含该域名的 aliyun_ddns 块, 定期把公网 IP 写入 A 记录")) +o.default = 0 + +o = s:option(TextValue, "ddns_records", translate("额外记录名 (每行一条)"), + translate("每行一个子域名前缀, 用换行分隔, 不要带主域名. 例如填 mail 会更新 mail.example.com, 填 www 会更新 www.example.com. 留空 = 只更新 @ 主域 A 记录")) +o.rows = 3 +o.wrap = "off" +o:depends("ddns_on", "1") + +o = s:option(ListValue, "ddns_wan_iface", translate("IP 获取方式"), + translate("public = 公网查询 (api.ipify.org 等取出口 IP); 选接口 = 直读该网卡 IPv4. 一般填 pppoe-wan, 下拉自动列出路由器实际接口")) +o:value("public") +local netf = io.popen("ls /sys/class/net 2>/dev/null") +if netf then + for line in netf:lines() do + local name = line:match("%S+") + -- 只保留 WAN 口 (名字含 wan, 如 pppoe-wan / eth0-wan), 过滤掉 LAN/WiFi/桥等无关设备 + if name and name:lower():find("wan", 1, true) then + o:value(name) + end + end + netf:close() +end +o.default = "pppoe-wan" +o:depends("ddns_on", "1") + +o = s:option(Value, "ddns_check_interval", translate("检查间隔"), + translate("多久检查一次 A 记录是否需要更新")) +o.default = "5m" +o:depends("ddns_on", "1") + +o = s:option(Value, "ddns_ttl", translate("TTL"), + translate("A 记录 TTL, 影响公网 DNS 生效速度")) +o.default = "60s" +o:depends("ddns_on", "1") + +return m diff --git a/luci-app-caddy/luasrc/model/cbi/caddy/host.lua b/luci-app-caddy/luasrc/model/cbi/caddy/host.lua new file mode 100644 index 000000000..dbf252a9c --- /dev/null +++ b/luci-app-caddy/luasrc/model/cbi/caddy/host.lua @@ -0,0 +1,80 @@ +local m, s, gs, o + +m = Map("caddy", translate("Caddy Host"), + translate("反向代理 Host 列表 (增删改查). 每条 Host 对应 Caddyfile 里一段 域名:端口 { ... }")) + +---------------------------------------------------------------------- +-- 通用开关 (全局, 单例 @caddy[0]). 放在 Host 列表上方: 跨所有 Host 生效, +-- 不是某一条 Host 的属性. 后续全局项 (如日志开关) 也加在这个 section 里 +---------------------------------------------------------------------- +gs = m:section(TypedSection, "caddy") +gs.addremove = false +gs.anonymous = true +gs.nodeps = true + +o = gs:option(Flag, "disable_redirect", translate("保留 HTTP (禁用自动跳转 HTTPS)"), + translate("勾选 = Caddyfile 写 auto_https disable_redirects; 不勾 = 不写, Caddy 默认 HTTP 自动 301 到 HTTPS")) +o.default = 1 + +o = gs:option(Flag, "log_on", translate("请求日志"), + translate("勾选 = 各 Host 写访问日志到 [状态] 页的 日志 路径; 不勾 = Caddyfile 不生成 log 块, 不写日志, 省资源")) +o.default = 1 + +---------------------------------------------------------------------- +-- Host (多条) - 增删改查, NPM 的 Proxy Hosts +---------------------------------------------------------------------- +s = m:section(TypedSection, "proxy") +s.addremove = true +s.anonymous = true +s.nodeps = true +s.cfgtitle = "name" + +o = s:option(Value, "name", translate("名称"), + translate("给这条 Host 起个名, 便于区分")) +o.rmempty = false + +o = s:option(Flag, "enabled", translate("启用")) +o.default = 1 + +o = s:option(ListValue, "domain", translate("监听域名"), + translate("从 [Domain] 页的域名列表中选择. 每个域名列两个选项: 裸域 (签 example.com 一张证书, 覆盖裸域) 和 *. 通配符 (签 裸域+通配符 各一张, 覆盖裸域+全部子域, 等价 acme.sh 两条 -d). 只要 Domain 页填了 AK 就一律走 DNS-01, 不依赖 80/443 入站. 需先在 Domain 页创建域名")) +o.rmempty = false +-- 从 UCI 文件读 domain_name: 直接读 /etc/config/caddy, 匹配有引号和没引号两种风格. +-- 比 grep + sed 更稳 (不靠 shell pipeline 转义), 比 uci cursor 更简单 (不依赖 cursor API 版本差异). +local f = io.open("/etc/config/caddy", "r") +if f then + for line in f:lines() do + local dn = line:match("option%s+domain_name%s+'([^']+)'") + or line:match("option%s+domain_name%s+([%w%.%-]+)") + if dn and #dn > 0 then + o:value(dn) + o:value("*." .. dn) + end + end + f:close() +end + +o = s:option(Value, "port", translate("监听端口"), + translate("非标端口可防指纹扫描, 例如 443 / 8443")) +o.datatype = "and(port,min(1))" +o.default = "443" + +o = s:option(Value, "target", translate("转发目标"), + translate("内网后端地址, 形如 192.168.1.x:8080")) +o.rmempty = false + +o = s:option(ListValue, "tls_cert", translate("TLS 证书"), + translate("auto = Caddy 自动签发+自动续签 (Domain 页填了 AK 走 DNS-01, 不依赖 80/443 入站); off = 纯 HTTP 不加密 (内网调试用)")) +o.default = "auto" +o:value("auto") +o:value("off") + +o = s:option(Value, "api_key", translate("API Key (可选)"), + translate("留空 = Caddy 不做 key 校验 (交给后端); 填值 = Caddy 层校验 Authorization: Bearer ")) + +o = s:option(TextValue, "extra", translate("自定义指令 (可选)"), + translate("Caddyfile 语法, 原样插入此 Host 块末尾. 用于 path 路由 / rate_limit / encode / basicauth / handle 等表单没覆盖的指令")) +o.rows = 6 +o.wrap = "off" + +return m diff --git a/luci-app-caddy/luasrc/view/caddy/admin_info.htm b/luci-app-caddy/luasrc/view/caddy/admin_info.htm index 0d9ef5f0a..d6b6931ef 100644 --- a/luci-app-caddy/luasrc/view/caddy/admin_info.htm +++ b/luci-app-caddy/luasrc/view/caddy/admin_info.htm @@ -4,7 +4,7 @@ { btn.disabled = true; btn.value = '<%:Collecting data...%>'; - XHR.get('<%=luci.dispatcher.build_url("admin", "nas", "caddy", "admin_info")%>', + XHR.get('<%=luci.dispatcher.build_url("admin", "network", "caddy", "admin_info")%>', null, function(x,rv) { diff --git a/luci-app-caddy/luasrc/view/caddy/caddy_log.htm b/luci-app-caddy/luasrc/view/caddy/caddy_log.htm index cc481b942..0a49a80af 100644 --- a/luci-app-caddy/luasrc/view/caddy/caddy_log.htm +++ b/luci-app-caddy/luasrc/view/caddy/caddy_log.htm @@ -1,124 +1,167 @@ - + -
-
+
+
- - + +
-
- - 共 {{ filteredLogs.length }} 条日志 +
+   + 0 <%:条日志%>
+

<%:加载中...%>

+
-
-
-
时间：{{ time(log.ts) }}
-
访问：{{ fullUrl(log) }}
-
方法：{{ log.request.method }}
-
状态：{{ log.status }}
-
IP：{{ realIp(log) }}
-
标识：{{ userAgent(log) }}
-
耗时：{{ (log.duration*1000).toFixed(2) }} ms
- -
- -
-
-
- -
-
-
-

完整日志

- -
-
- 
{{ modalLog ? JSON.stringify(modalLog,null,2) : '' }}
-
+
+
+
+ <%:完整日志%> +
+ 

 	

 

-
-
返回顶部

-
-
diff --git a/luci-app-caddy/luasrc/view/caddy/caddy_status.htm b/luci-app-caddy/luasrc/view/caddy/caddy_status.htm
index 806f9bdeb..66d68fc27 100644
--- a/luci-app-caddy/luasrc/view/caddy/caddy_status.htm
+++ b/luci-app-caddy/luasrc/view/caddy/caddy_status.htm
@@ -1,26 +1,19 @@
 <%
-	local uci = require 'luci.model.uci'.cursor()
-	ssl = uci:get_first('caddy', 'caddy', 'ssl')
-	if ssl == '1' then
-		protocol="http://"
-	else
-		protocol="http://"
-	end
-%>
+	%>
 
 
+<%+cbi/valuefooter%>
diff --git a/luci-app-caddy/root/etc/caddy/Caddyfile b/luci-app-caddy/root/etc/caddy/Caddyfile
index 740cbab45..3a6ed65d5 100644
--- a/luci-app-caddy/root/etc/caddy/Caddyfile
+++ b/luci-app-caddy/root/etc/caddy/Caddyfile
@@ -1,49 +1,59 @@
-# 此配置文件路径：/etc/caddy/Caddyfile
-  
-{ # 全局配置
-# 启动 cgi 模块
-order cgi before respond
-# 启动 webdav 模块
-order webdav before file_server
-# 关闭 API 端口 
-admin off 
-} 
+# 此配置文件路径: /etc/caddy/Caddyfile
+# 下面是 proxy 模式生成 Caddyfile 的样例 (通用值).
+# 手动模式 (Caddyfile) 下, 本文件内容即你实际使用的配置, 可任意写 Caddy 支持的语法.
 
-:12311 {
-#启用压缩
-encode gzip
-#认证，账号admin 密码123456
-basicauth {
-admin $2a$14$RdbOHzJhf5BaapSdlYTCbe.yWY9cEZjyDpfgwStY28K/qsM1tX8tu
-}
-#路径 /mnt
- root * /mnt
-#文件服务器 端口12311
- file_server browse
-        
- log {
-#日志 路径/tmp/caddy/requests.log
-  output file /tmp/caddy/requests.log {
-   roll_size     1MiB
-   roll_local_time
-   roll_keep     5
-   roll_keep_for 120h
-  }
- }
- 
+{
+	auto_https disable_redirects
+
+	aliyun_ddns {
+		access_key_id     
+		access_key_secret 
+		region_id         cn-hangzhou
+
+		domains {
+	example.com @
+		}
+
+		versions       ipv4
+		ip_source      interface pppoe-wan
+		check_interval 5m
+		ttl            60s
+	}
 }
 
-:12322 {
-#启用压缩
-encode gzip
-#认证，账号admin 密码123456
-basicauth {
-admin $2a$14$RdbOHzJhf5BaapSdlYTCbe.yWY9cEZjyDpfgwStY28K/qsM1tX8tu
-}
+example.com:8443 {
+	tls {
+		dns alidns {
+			access_key_id 
+			access_key_secret 
+		}
+	}
 
-# webdav 路径根目录 端口12322
- webdav /dav/* {
-   prefix /dav
-   root /
-  }
+	header -Server
+
+	request_body max_size 0
+
+	@health path /health
+	@apikey header Authorization "Bearer "
+
+	handle @health {
+		reverse_proxy 192.168.1.x:8080 { flush_interval -1 }
+	}
+
+	handle @apikey {
+		reverse_proxy 192.168.1.x:8080 { flush_interval -1 }
+	}
+
+	handle {
+		respond 404 "Not Found" { close }
+	}
+
+	log {
+		output file /tmp/caddy/requests.log {
+			roll_size     1MiB
+			roll_local_time
+			roll_keep     5
+			roll_keep_for 120h
+		}
+	}
 }
diff --git a/luci-app-caddy/root/etc/config/caddy b/luci-app-caddy/root/etc/config/caddy
index 2d9364f34..14c1a8438 100644
--- a/luci-app-caddy/root/etc/config/caddy
+++ b/luci-app-caddy/root/etc/config/caddy
@@ -1,14 +1,28 @@
+# luci-app-caddy 默认配置
+#
+# 数据模型:
+#   config caddy   -> 全局 (单条): 启用 / 路径 / 重定向开关
+#   config domain  -> 域名 (多条, 增删): 每条 = 一个域名 + AK + DDNS 参数
+#   config proxy   -> Host (多条, 增删): 每条 = 一段 Caddyfile 的 域名:端口 { ... }
+#
+# domain 示例 (在 LuCI [Domain] 页点 添加 创建):
+#   config domain 'd1'
+#       option domain_name 'example.com'
+#       option key_id ''
+#       option key_secret ''
+#       option ddns_on '0'
+#
+# proxy 示例 (在 LuCI [Host] 页点 添加 创建):
+#   config proxy 'host1'
+#       option name 'my-host'
+#       option enabled '1'
+#       option domain 'example.com'
+#       option port '8443'
+#       option tls '1'
+#       option target '192.168.1.x:8080'
+
 config caddy
-	option 'enabled' '0'
-	option cmd '默认'
-	option 'port' '12311'
-	option 'webdav' '0'
-	option 'filezip' '0'
-	option 'webzip' '0'
-	option 'cgi' '0'
-	option 'api' '0'
-	option 'data_dir' '/mnt'
-	option 'file_pass' '0'
-	option 'log' '1'
-	option 'log_dir' '/tmp/caddy/requests.log'
-	option allow_wan '0'
+	option enabled '0'
+	option disable_redirect '1'
+	option bin_dir '/usr/sbin/caddy'
+	option log_dir '/tmp/caddy/requests.log'
diff --git a/luci-app-caddy/root/etc/init.d/caddy b/luci-app-caddy/root/etc/init.d/caddy
index fa6d74724..6021901c6 100755
--- a/luci-app-caddy/root/etc/init.d/caddy
+++ b/luci-app-caddy/root/etc/init.d/caddy
@@ -2,178 +2,315 @@
 
 START=99
 USE_PROCD=1
-PROG="$(uci -q get caddy.@caddy[0].bin_dir)"
 
-get_config() {
-	config_get_bool enabled $1 enabled 0
-	config_get cmd $1 cmd "默认"
-	config_get_bool webdav $1 webdav 0
-	config_get port $1 port 12311
-	config_get webdav_port $1 webdav_port 12322
-	config_get log $1 log 1
-	config_get data_dir $1 data_dir "/mnt"
-	config_get webdav_data_dir $1 webdav_data_dir "/mnt"
-	config_get log_dir $1 log_dir "/tmp/caddy/requests.log"
-	config_get caddy_file $1 caddy_file "/etc/caddy/Caddyfile"
-        config_get caddyfile $1 caddyfile
-	config_get file_pass $1 file_pass 0
-	config_get file_username $1 file_username "admin"
-	config_get file_password $1 file_password "123456"
-        config_get webdav_pass $1 webdav_pass 0
-	config_get webdav_username $1 webdav_username "admin"
-	config_get webdav_password $1 webdav_password "123456"
-	config_get api $1 api 0
-        config_get filezip $1 filezip 0
-        config_get webzip $1 webzip 0
-	config_get allow_wan $1 allow_wan 0
+# ---- 全局值 (来自 @caddy[0]) ----
+G_BIN="$(uci -q get caddy.@caddy[0].bin_dir)"
+[ -z "$G_BIN" ] && G_BIN="/usr/sbin/caddy"
+G_FILE="$(uci -q get caddy.@caddy[0].caddy_file)"
+[ -z "$G_FILE" ] && G_FILE="/etc/caddy/Caddyfile"
+G_LOG="$(uci -q get caddy.@caddy[0].log_dir)"
+[ -z "$G_LOG" ] && G_LOG="/tmp/caddy/requests.log"
 
+TMP="$G_FILE.new"
 
+# 列出所有 domain section 的 UCI 路径 (支持命名+匿名)
+# 返回完整路径如 caddy.d1 或 caddy.@domain[0]
+list_all_domains() {
+	uci show caddy 2>/dev/null | grep '\.domain_name' | sed 's/\.domain_name=.*//'
 }
 
-set_firewall() {
-	if [ "$external_access" = "allow" ]; then
-		uci -q delete firewall.caddy
-		uci set firewall.caddy=rule
-		uci set firewall.caddy.name="caddy"
-		uci set firewall.caddy.target="ACCEPT"
-		uci set firewall.caddy.src="wan"
-		uci set firewall.caddy.proto="tcp"
-		uci set firewall.caddy.dest_port="$port"
-		[ ! -z "$webdav_port" ] && uci set firewall.caddy.dest_port="$webdav_port"
-		uci set firewall.caddy.enabled="1"
-		uci commit firewall
-		/etc/init.d/firewall reload >/dev/null 2>&1
-	elif [ "$external_access" = "deny" ]; then
-		uci -q delete firewall.caddy
-		uci commit firewall
-		/etc/init.d/firewall reload >/dev/null 2>&1
+# 按 domain_name 查找匹配的 section UCI 路径
+find_domain_by_name() {
+	local target="$1" ref dn
+	for ref in $(list_all_domains); do
+		dn="$(uci -q get "$ref".domain_name)"
+		[ "$dn" = "$target" ] && echo "$ref" && return 0
+	done
+	return 1
+}
+
+# 列出所有 proxy section (匿名+命名都认, 按 target 字段识别)
+# 匿名 section 在 uci show 里形如 caddy.@proxy[N]
+list_all_proxies() {
+	uci show caddy 2>/dev/null | grep '\.target=' | sed 's/\.target=.*//'
+}
+
+# ---- 生成 Caddyfile ----
+# 逻辑: 全局块 (auto_https + 每个 ddns_on 的 domain 生成 aliyun_ddns) + 每个启用的 host
+generate_caddyfile() {
+	local cf="$TMP"
+	local disr
+	local p dom prt tgt key tls_cert extra
+
+	disr="$(uci -q get caddy.@caddy[0].disable_redirect)"
+
+	{
+		echo "# /etc/caddy/Caddyfile"
+		echo "# generated by luci-app-caddy, edit via LuCI -> Network -> Caddy"
+		echo
+		echo "{"
+
+		# auto_https: 勾选才写
+		if [ "$disr" = "1" ]; then
+			echo "	auto_https disable_redirects"
+		fi
+
+		# CA 固定 Let's Encrypt, 避开 Caddy 默认可能跳 ZeroSSL
+		echo "	acme_ca https://acme-v02.api.letsencrypt.org/directory"
+
+		# --- DDNS: 遍历 domain, ddns_on=1 的生成 aliyun_ddns 块 ---
+		for d in $(list_all_domains); do
+			local don dkid dksec dname drec diface dint dttl
+			don="$(uci -q get "$d".ddns_on)"
+			[ "$don" != "1" ] && continue
+			dname="$(uci -q get "$d".domain_name)"
+			dkid="$(uci -q get "$d".key_id)"
+			dksec="$(uci -q get "$d".key_secret)"
+			drec="$(uci -q get "$d".ddns_records)"
+			diface="$(uci -q get "$d".ddns_wan_iface)"
+			dint="$(uci -q get "$d".ddns_check_interval)"
+			dttl="$(uci -q get "$d".ddns_ttl)"
+			[ -z "$dname" ] && continue
+			[ -z "$dkid" ] && continue
+			[ -z "$dksec" ] && continue
+			[ -z "$dint" ] && dint="5m"
+			[ -z "$dttl" ] && dttl="60s"
+
+			echo
+			echo "	# DDNS: $dname (@ = 主域 A 记录, * = 泛解析 *.domain 独立记录, 二者互不串用)"
+			echo "	aliyun_ddns {"
+			echo "		access_key_id     $dkid"
+			echo "		access_key_secret $dksec"
+			echo
+			echo "		domains {"
+			echo "			$dname @"
+			printf '%s\n' "$drec" | while IFS= read -r r; do
+				[ -z "$r" ] && continue
+				echo "			$dname $r"
+			done
+			echo "		}"
+			echo
+			echo "		versions       ipv4"
+			case "$diface" in
+				public|"")
+					: # 走插件默认 simple_http (api.ipify.org / icanhazip.com / ifconfig.me / ident.me)
+					;;
+				*)
+					echo "		ip_source      interface $diface"
+					;;
+				esac
+			echo "		check_interval $dint"
+			echo "		ttl            $dttl"
+			echo "	}"
+		done
+
+		echo "}"
+
+		# ---- Host: 每个启用的 proxy (匿名/命名都认) ----
+		for p in $(list_all_proxies); do
+			local pen
+			pen="$(uci -q get "$p".enabled)"
+			[ "$pen" = "0" ] && continue
+
+			# 一次性迁移: 下拉现在只有 auto/off, 任何旧值 (tls Flag / 静态证书路径) 归到这两个
+			local tlsval
+			tlsval="$(uci -q get "$p".tls_cert)"
+			case "$tlsval" in
+				auto|off|"")
+					if [ -z "$tlsval" ]; then
+						# 从未设过: 按旧版 tls Flag 定 (1=auto, 其余 off)
+						if [ "$(uci -q get "$p".tls)" = "1" ]; then
+							tlsval=auto
+						else
+							tlsval=off
+						fi
+						uci -q set "$p".tls_cert="$tlsval"
+						uci commit caddy
+					fi
+					;;
+			*) # 旧值 (静态证书路径等) 一律归 auto, 写回 UCI 一次性归一
+				uci -q set "$p".tls_cert=auto
+				uci commit caddy
+				tlsval=auto
+				;;
+			esac
+
+			dom="$(uci -q get "$p".domain)"
+			prt="$(uci -q get "$p".port)"
+			tgt="$(uci -q get "$p".target)"
+			key="$(uci -q get "$p".api_key)"
+			extra="$(uci -q get "$p".extra)"
+			[ -z "$prt" ] && prt="443"
+			[ -z "$dom" ] && continue
+			[ -z "$tgt" ] && continue
+
+			# 取对应 Domain 的 AK (Host 域名剥掉 *. 前缀再查 Domain 页)
+			# 注意: 必须用 \*.*) 转义前导星号, 否则 example.net 这种含点的裸域会误中 *.*
+			local dmatch dkid dksec dlookup
+			dlookup="$dom"
+			case "$dlookup" in
+				\*.*) dlookup="${dlookup#\*.}" ;;
+			esac
+			dmatch="$(find_domain_by_name "$dlookup")"
+			dkid=""
+			dksec=""
+			if [ -n "$dmatch" ]; then
+				dkid="$(uci -q get "$dmatch".key_id)"
+				dksec="$(uci -q get "$dmatch".key_secret)"
+			fi
+
+			# 监听地址: 完全由表单的 domain+port 决定, 代码不替用户加地址
+			# 选了 *.x 时, 同一行带上裸域 x (官方"一行多名字"模式):
+			#   certmagic 逐名字签发 → 裸域、通配符各一张证书(各一条 order)
+			#   ≡ acme.sh -d x --dns + -d '*.x' --dns, 效果等价: 裸域+全部子域都覆盖
+			local addr="$dom:$prt"
+			case "$dom" in
+				\*.*) addr="$dom:$prt ${dom#\*.}:$prt" ;;
+			esac
+
+			echo
+			echo "$addr {"
+
+			# TLS: 只有 auto / off 两个值 (下拉已砍掉静态证书选项)
+			# auto + Domain 页有 AK: 一律 DNS-01 (裸域/通配符都不依赖 80/443 入站, 适合 NAT 家庭宽带)
+			# auto + 无 AK: 回退官方 HTTP-01 (一行 tls 都不写, Caddy 自动处理)
+			# 用上面迁移后的 $tlsval, 不重读 UCI (迁移刚写回时本轮即生效)
+			case "$tlsval" in
+				auto|"")
+					if [ -n "$dkid" ] && [ -n "$dksec" ]; then
+						echo "	tls {"
+						echo "		dns alidns {"
+						echo "			access_key_id $dkid"
+						echo "			access_key_secret $dksec"
+						echo "		}"
+						echo "	}"
+						echo
+					fi
+					;;
+				off)
+					: # 纯 HTTP, 不写 tls 块
+					;;
+			esac
+
+			echo "	header -Server"
+			echo
+			echo "	request_body max_size 0"
+
+			if [ -n "$key" ]; then
+				echo
+				echo "	# Caddy 层 API key 校验: 除 @apikey 外一律 404 (/health 也需带 key)"
+				echo "	@apikey header Authorization \"Bearer $key\""
+				echo
+				echo "	handle @apikey {"
+				echo "		reverse_proxy $tgt { flush_interval -1 }"
+				echo "	}"
+				echo
+				echo "	handle {"
+				# 无 key 的兜底: 空 body 的 404 (不回 "Not Found" 文本, 不泄露身份)
+				# 注意: respond 带 body 文本 + 尾部 { close } 子块时 Caddyfile 参数错位
+				# (404→body, 文本→status), 运行时 Atoi 炸 500. 故 body 留空.
+				echo "		respond 404 { close }"
+				echo "	}"
+			else
+				echo
+				echo "	reverse_proxy $tgt {"
+				echo "		flush_interval -1"
+				echo "	}"
+			fi
+
+			# 自定义指令 (原样插入)
+			if [ -n "$extra" ]; then
+				echo
+				printf '%s\n' "$extra" | while IFS= read -r line; do
+					echo "	$line"
+				done
+			fi
+
+			# 请求日志: 勾选 log_on 才生成, 关 = 不写日志, 省资源
+			local lon
+			lon="$(uci -q get caddy.@caddy[0].log_on)"
+			if [ "$lon" != "0" ]; then
+				echo
+				echo "	# 请求日志"
+				echo "	log {"
+				echo "		output file $G_LOG {"
+				echo "			roll_size     1MiB"
+				echo "			roll_local_time"
+				echo "			roll_keep     5"
+				echo "			roll_keep_for 120h"
+				echo "		}"
+				echo "	}"
+			fi
+
+			echo "}"
+		done
+	} > "$cf"
+	mv -f "$cf" "$G_FILE"
+	# DDNS/AK secret 明文在文件里, 收紧权限只让 root 读写 (LuCI CGI 同以 root 运行, 不受影响)
+	chmod 600 "$G_FILE"
+
+	# 一次性迁移: wildcard 旧字段. 通配符选择已挪到 Host 页下拉, Domain 页不再显示该字段,
+	# 而 CBI 保存只写页面已定义字段、不删未定义键 → 旧 wildcard 键会永久残留 UCI. 有就删.
+	local wcwipe
+	wcwipe=0
+	for d in $(list_all_domains); do
+		case "$(uci -q get "$d".wildcard)" in
+			""|auto|off) : ;;
+			*) uci -q delete "$d".wildcard; wcwipe=1 ;;
+		esac
+	done
+	[ "$wcwipe" = "1" ] && uci commit caddy
+
+	# 清 UCI 冻结值: [配置] 页 TextValue 点过「保存」后会把当时内容冻进 UCI,
+	# 之后页面优先显示 UCI 而不再读磁盘 (表现: 这里改了但配置页看到的还是旧的).
+	# 每次重新生成后把键删掉, 页面即回落 o.default(读磁盘真值).
+	# 只在键存在时才 commit (commit 会动 /etc/config/caddy 触发 procd reload,
+	# 避免无谓的额外重载: 键存在→删→commit→本轮 reload 重生成时键已不在, 不会死循环)
+	if uci -q get caddy.@caddy[0].caddyfile >/dev/null 2>&1; then
+		uci -q delete caddy.@caddy[0].caddyfile
+		uci commit caddy
+	fi
+}
+
+check_prog() {
+	if [ ! -f "$G_BIN" ]; then
+		uci -q set caddy.@caddy[0].enabled=0
+		uci commit caddy
+		echo "caddy: $G_BIN 未找到" >>"$G_LOG" 2>&1
+		exit 1
+	else
+		chmod +x "$G_BIN"
+		if [ "$($G_BIN -h 2>&1 | wc -l)" -lt 3 ]; then
+			uci -q set caddy.@caddy[0].enabled=0
+			uci commit caddy
+			echo "caddy: 程序不完整或架构不匹配" >>"$G_LOG" 2>&1
+			exit 1
+		fi
 	fi
 }
 
 start_service() {
-	config_load caddy
-	config_foreach get_config caddy
-	[ $enabled -ne 1 ] && return 1
-        log_path="$(dirname $log_dir)"
-	mkdir -p $log_path
-	if [ ! -f "$PROG" ] ;then
-	   uci -q set caddy.@caddy[0].enabled=0 
-	   uci commit caddy
-	   echo "$(TZ=UTC-8 date -R +%Y年%m月%d日\ %X) : $PROG 未找到，无法启动!请确认已上传程序" >>$log_dir 2>&1
-	   exit 1
-	else
-	   chmod +x $PROG
-	   if [ $(($($PROG -h | wc -l))) -lt 3 ] ;then
-	      uci -q set caddy.@caddy[0].enabled=0 
-	      uci commit caddy 
-	      echo "$(TZ=UTC-8 date -R +%Y年%m月%d日\ %X) : $PROG 程序不完整或CPU架构不支持的程序，无法启动!" >>$log_dir 2>&1
-	      exit 1
-	   fi
-	fi
-  if [ "$cmd" = "默认" ] ;then
-	mkdir -p $data_dir 
-	if [ "$log" -eq 1 ] ;then
-	   
-	   logs="log {
- output file $log_dir {
- roll_size     1MiB
- roll_local_time
- roll_keep     5
- roll_keep_for 120h
-  }
-}"
-	fi
-        if [ "$file_pass" -eq 1 ] ;then
-	      filepassword="$($PROG hash-password --plaintext $file_password)"
-	      filebasicauth="basicauth {
-$file_username $filepassword
-}"
-	fi
-	if [ "$webdav" -eq 1 ] ;then
-	   mkdir -p $webdav_data_dir
-	   if [ "$webdav_pass" -eq 1 ] ;then
-	      password="$($PROG hash-password --plaintext $webdav_password)"
-	      basicauth="basicauth {
-$webdav_username $password
-}"
-	   fi
-	   webdavs=":$webdav_port {
-$basicauth
-webdav * {
-prefix /dav
-root $webdav_data_dir
-  }
-}"
-          orderweb="order webdav before file_server # 启动 webdav 模块"
-	fi
-	if [ "$filezip" -eq 1 ] ;then
-	   filezips="encode gzip"
-	fi
-	if [ "$webzip" -eq 1 ] ;then
-	   webzips="encode gzip"
-	fi
-	if [ "$api" != "1" ] ;then
-	   apis="admin off # 关闭 API 端口"
-	fi
-	if [ "$allow_wan" -eq "1" ]; then
-		external_access="allow"
-	else
-		external_access="deny"
-	fi
-	if [ "$webdav" -eq 1 ] || [ "$api" != "1" ] ;then
-	   order="{ # 全局配置
-$orderweb
-$apis
-} "
-	fi
-	set_firewall
-	
-	cat > $caddy_file </dev/null || true
 
-uci -q set caddy.@caddy[0].caddyfile="$(cat $caddy_file)"
-uci commit caddy
-else
-caddyf="$(uci -q get caddy.@caddy[0].caddyfile)"
-logpath="$(echo $caddyf | grep "output file" | awk -F 'output file' '{print $2}' | tr -d '{ ')"
-[ ! -z "$logpath" ] && uci -q set caddy.@caddy[0].log_dir=$logpath && uci commit caddy
- if [ ! -z "$caddyf" ] ;then
-   echo "$caddyf" >$caddy_file 2>&1
- else
-   uci -q set caddy.@caddy[0].enabled=0 
-   uci commit caddy 
-   echo "$(TZ=UTC-8 date -R +%Y年%m月%d日\ %X) : $caddy_file 配置文件Caddyfile为空，无法启动!" >>$log_dir 2>&1
-   exit 1
- fi
-fi
-        $PROG  fmt --overwrite $caddy_file
 	procd_open_instance caddy
-	procd_set_param command $PROG
-	procd_append_param command run 
-	procd_append_param command --config $caddy_file
-	procd_append_param command --adapter caddyfile
-
-	procd_set_param stdout 0
-	procd_set_param stderr 0
+	procd_set_param command "$G_BIN" "run" "--config" "$G_FILE" "--adapter" caddyfile
+	procd_set_param pidfile /var/run/caddy.pid
+	procd_set_param stdout 1
+	procd_set_param stderr 1
 	procd_set_param respawn
 	procd_close_instance caddy
 
-	echo `date +%s` > /tmp/caddy_time
+	date +%s > /tmp/caddy_time
 }
 
 service_triggers() {
@@ -181,14 +318,26 @@ service_triggers() {
 }
 
 stop_service() {
-	external_access="deny"
-	set_firewall
-  rm -rf /tmp/caddy.tag /tmp/caddynew.tag
-  rm -rf $(uci -q get caddy.@caddy[0].log_dir)
+	procd_kill caddy 2>/dev/null
+	rm -f /tmp/caddynew.tag
+	rm -f "$G_LOG" 2>/dev/null
+	rm -f /var/run/caddy.pid
+	return 0
 }
 
-reload_service() {
+# 覆盖 rc.common 的 restart(): 官方零停机热重载 (caddy reload, 等价 POST /load)
+# 有运行实例 -> 热重载, 旧连接不断; 无实例 -> 完整 stop/start
+restart() {
+	generate_caddyfile
+	"$G_BIN" fmt --overwrite "$G_FILE" 2>/dev/null || true
+	if pidof caddy >/dev/null 2>&1; then
+		"$G_BIN" reload --config "$G_FILE" --adapter caddyfile >/dev/null 2>&1 && return 0
+	fi
 	stop
-	sleep 1
 	start
 }
+
+# reload: procd 模式 rc.common 调 reload_service, 委托给热重载
+reload_service() {
+	restart
+}
diff --git a/luci-app-conntrack/999-netfilter-custom-payload-telemetry-nf_conntrack.patch b/luci-app-conntrack/999-netfilter-custom-payload-telemetry-nf_conntrack.patch
new file mode 100644
index 000000000..133be4811
--- /dev/null
+++ b/luci-app-conntrack/999-netfilter-custom-payload-telemetry-nf_conntrack.patch
@@ -0,0 +1,228 @@
+--- a/net/netfilter/Kconfig	2026-09-15 14:22:18.467281704 +0800
++++ b/net/netfilter/Kconfig	2026-09-11 12:51:21.318346650 +0800
+@@ -443,6 +443,20 @@
+ config NETFILTER_SYNPROXY
+ 	tristate
+ 
++config NF_CONNTRACK_CUSTOM_TELEMETRY
++	bool "Lightweight Layer 7 Payload Telemetry via conntrack"
++	depends on NF_CONNTRACK
++	default y
++	help
++	  This option intercepts the first payload-carrying packet of any 
++	  new connection (TCP/UDP) and stores its initial 8 bytes. This 
++	  data is then appended to the /proc/net/nf_conntrack stream.
++	  
++	  Perfect for lightweight gaming/video traffic identification 
++	  without running heavy user-space DPI tools.
++
++	  If unsure, say Y.
++
+ endif # NF_CONNTRACK
+ 
+ config NF_TABLES
+--- a/include/net/netfilter/nf_conntrack.h	2024-01-26 06:34:33.000000000 +0800
++++ b/include/net/netfilter/nf_conntrack.h	2026-09-14 11:54:57.287192651 +0800
+@@ -103,6 +103,15 @@
+ 	/* Extensions */
+ 	struct nf_ct_ext *ext;
+ 
++#if IS_ENABLED(CONFIG_NF_CONNTRACK_CUSTOM_TELEMETRY)
++	/*==================================================================
++	 * CUSTOM FIELDS FOR LIGHTWEIGHT L7 TELEMETRY (STRUCTURE SAFE)
++	 * Placed safely before the protocol union to avoid alignment bugs.
++	 *==================================================================*/
++	u8  init_payload[64];      /* Stores the 64 bytes of L7 payload that maybe plain text rather than hex string */
++	u8  has_custom_payload;   /* Boolean flag: 1 if raw hex string was captured, 2 if plain text was captured */
++#endif
++
+ 	/* Storage reserved for other modules, must be the last member */
+ 	union nf_conntrack_proto proto;
+ };
+--- a/net/netfilter/nf_conntrack_core.c	2026-09-15 14:22:18.467281704 +0800
++++ b/net/netfilter/nf_conntrack_core.c	2026-09-15 14:19:35.912229303 +0800
+@@ -1710,6 +1710,156 @@
+ 		goto out;
+ 	}
+ 
++#if IS_ENABLED(CONFIG_NF_CONNTRACK_CUSTOM_TELEMETRY)
++	/* =================== CUSTOM L7 TELEMETRY START =================== */
++	/* 1. Only process successfully accepted packets if telemetry capture has not locked yet */
++	if (ret == NF_ACCEPT && ct != NULL && !ct->has_custom_payload) {
++		struct iphdr *iph = ip_hdr(skb);
++		if (iph) {
++			unsigned int l4_header_len = 0;
++
++			if (protonum == IPPROTO_TCP) {
++				struct tcphdr *th = tcp_hdr(skb);
++				if (th && th->doff >= 5 && th->doff <= 15) {
++					l4_header_len = th->doff * 4;
++				}
++			} else if (protonum == IPPROTO_UDP) {
++				l4_header_len = sizeof(struct udphdr);
++			}
++
++			if (l4_header_len > 0) {
++				unsigned int total_len = ntohs(iph->tot_len);
++				unsigned int payload_offset = dataoff + l4_header_len;
++
++				if (total_len > payload_offset && protonum == IPPROTO_UDP) {
++					unsigned int payload_len = total_len - payload_offset;
++					if (payload_len >= 8) {
++						u8 udp_buf[8];
++						unsigned int target_grab_len = (payload_len > 8) ? 8 : payload_len;
++						u8 *udp_ptr = skb_header_pointer(skb, payload_offset, target_grab_len, udp_buf);
++						
++						if (udp_ptr) {
++							memset(ct->init_payload, 0, 64);
++							memcpy(ct->init_payload, udp_ptr, target_grab_len);
++							ct->has_custom_payload = 1;
++						}
++					}
++				}
++
++				if (total_len > payload_offset && protonum == IPPROTO_TCP) {
++					unsigned int payload_len = total_len - payload_offset;
++					
++					/* PRE-FILTER BYPASS ANCHOR: Fast drop non-TLS or ultra-short corrupted flows */
++					if (payload_len > 44) {
++						u8 tls_pre_buf[2];
++						u8 *tls_pre = skb_header_pointer(skb, payload_offset, 2, tls_pre_buf);
++						
++						if (tls_pre && tls_pre[0] == 0x16 && tls_pre[1] == 0x03) {
++							unsigned int offset = 5; /* Step 1: Skip TLS Record Layer Header safely */
++							u8 len_buf[2];
++							u8 *p;
++							
++							/* Step 2: Extract Handshake Type (1 byte) and confirm it is Client Hello (0x01) */
++							p = skb_header_pointer(skb, payload_offset + offset, 1, len_buf);
++							if (p && p[0] == 0x01) {
++								offset += 4;  /* Move past Handshake Type(1B) + Handshake Length(3B) */
++								offset += 2;  /* Move past Version (2B, e.g., 0x03 0x03) */
++								offset += 32; /* FLY-OVER: Instantly blast through 32 bytes of static Random data via simple addition */
++								
++								/* Step 3: Extract dynamic Session ID length field safely (1 byte) */
++								p = skb_header_pointer(skb, payload_offset + offset, 1, len_buf);
++								if (p) {
++									u8 session_id_len = p[0];
++									offset += 1 + session_id_len; /* Skip length descriptor + payload data bytes */
++									
++									/* Step 4: Extract dynamic Cipher Suites length field safely (2 bytes) */
++									p = skb_header_pointer(skb, payload_offset + offset, 2, len_buf);
++									if (p) {
++										/* Use safe shift operations to enforce clean endian alignment on all router CPUs */
++										u16 cipher_suites_len = ((u16)p[0] << 8) | p[1];
++										offset += 2 + cipher_suites_len; /* Leap over Ciphers grid completely */
++										
++										/* Step 5: Extract dynamic Compression Methods length field safely (1 byte) */
++										p = skb_header_pointer(skb, payload_offset + offset, 1, len_buf);
++										if (p) {
++											u8 compression_len = p[0];
++											offset += 1 + compression_len; /* Skip Compression descriptors */
++											
++											/* Step 6: We have successfully reached the Extensions Array Block! Read Extensions Total Length (2B) */
++											p = skb_header_pointer(skb, payload_offset + offset, 2, len_buf);
++											if (p) {
++												u16 extensions_total_len = ((u16)p[0] << 8) | p[1];
++												unsigned int extensions_end = offset + 2 + extensions_total_len;
++												offset += 2; /* Shift layout offset right inside the core extensions list sequence */
++												
++												/* Strict boundary sanity guard against malicious malformed padding packets */
++												if (extensions_end <= payload_len) {
++													u8 loop_guard = 0;
++													u8 ext_buf[4];
++													u8 *ext_ptr;
++													
++													/* Step 7: High-Performance O(1) Leap Loop with anti-hang protection */
++													while (offset + 4 <= extensions_end && loop_guard++ < 32) {
++														ext_ptr = skb_header_pointer(skb, payload_offset + offset, 4, ext_buf);
++														if (!ext_ptr) break;
++														
++														u16 ext_type = ((u16)ext_ptr[0] << 8) | ext_ptr[1];
++														u16 ext_len = ((u16)ext_ptr[2] << 8) | ext_ptr[3];
++														
++														/* TARGET MATCHED: Extension Type 0x0000 matches Server Name Indication (SNI) perfectly! */
++														if (ext_type == 0x0000) {
++															unsigned int sni_ptr_offset = offset + 4;
++															u8 sni_buf[5];
++															p = skb_header_pointer(skb, payload_offset + sni_ptr_offset, 5, sni_buf);
++															if (p) {
++																/* Skip SNI List Length(2B) + Name Type(1B, 0=host_name) + Server Name Length(2B) */
++																u16 server_name_len = ((u16)p[3] << 8) | p[4];
++																unsigned int hostname_offset = sni_ptr_offset + 5;
++																
++																if (hostname_offset + server_name_len <= payload_len && server_name_len > 0) {
++																	u8 name_buf[64];
++																	u8 target_len = (server_name_len > 63) ? 63 : server_name_len;
++																	u8 *name_ptr = skb_header_pointer(skb, payload_offset + hostname_offset, target_len, name_buf);
++																	
++																	if (name_ptr) {
++																		memset(ct->init_payload, 0, 64);
++																		memcpy(ct->init_payload, name_ptr, target_len);
++																		ct->has_custom_payload = 2; /* Status '2' -> SNI text successfully harvested and locked! */
++																	}
++																}
++															}
++															break; /* Mission accomplished, kill the loop instantly */
++														}
++														
++														/* ULTRASONIC JUMP: Jump directly over heavy cryptography chunks (e.g. skip key_share 1263 bytes instantly) */
++														offset += 4 + ext_len;
++													}
++												}
++											}
++										}
++									}
++								}
++							}
++						}
++						
++						/* Fallback Route C: Standard original 8-byte hex binary telemetry backup if no structural domain was found */
++						if (!ct->has_custom_payload) {
++							u8 fallback_buf[8];
++							u8 *fb_ptr = skb_header_pointer(skb, payload_offset, 8, fallback_buf);
++							if (fb_ptr) {
++								memset(ct->init_payload, 0, 64);
++								memcpy(ct->init_payload, fb_ptr, 8);
++								ct->has_custom_payload = 1;
++							}
++						}
++					}
++				}
++			}
++		}
++	}
++	/* ==================== CUSTOM L7 TELEMETRY END ==================== */
++#endif
++
+ 	if (ctinfo == IP_CT_ESTABLISHED_REPLY &&
+ 	    !test_and_set_bit(IPS_SEEN_REPLY_BIT, &ct->status))
+ 		nf_conntrack_event_cache(IPCT_REPLY, ct);
+--- a/net/netfilter/nf_conntrack_standalone.c	2026-09-15 14:22:17.815253367 +0800
++++ b/net/netfilter/nf_conntrack_standalone.c	2026-09-12 16:27:05.964393178 +0800
+@@ -369,6 +369,25 @@
+ 	ct_show_zone(s, ct, NF_CT_DEFAULT_ZONE_DIR);
+ 	ct_show_delta_time(s, ct);
+ 
++#if IS_ENABLED(CONFIG_NF_CONNTRACK_CUSTOM_TELEMETRY)
++	/* =================== CUSTOM L7 OUTPUT START =================== */
++	if (ct->has_custom_payload) {
++		/* If status flag is '2', we successfully isolated an authentic plain-text ASCII string fragment! */
++		if (ct->has_custom_payload == 2) {
++			/* Enforce strict termination rendering using standard %s formatting safely bounded by your size allocation */
++			seq_printf(s, "payload=%s ", (char *)ct->init_payload);
++		} else {
++			/* Fallback status '1': Print classic 8-byte hexadecimal string sequence safely to avoid data corruption */
++			seq_printf(s, "payload=%02x%02x%02x%02x%02x%02x%02x%02x ",
++				   ct->init_payload[0], ct->init_payload[1],
++				   ct->init_payload[2], ct->init_payload[3],
++				   ct->init_payload[4], ct->init_payload[5],
++				   ct->init_payload[6], ct->init_payload[7]);
++		}
++	}
++	/* ==================== CUSTOM L7 OUTPUT END ==================== */
++#endif
++
+ 	seq_printf(s, "use=%u\n", atomic_read(&ct->ct_general.use));
+ 
+ 	if (seq_has_overflowed(s))
diff --git a/luci-app-conntrack/Makefile b/luci-app-conntrack/Makefile
new file mode 100644
index 000000000..58084a38a
--- /dev/null
+++ b/luci-app-conntrack/Makefile
@@ -0,0 +1,18 @@
+include $(TOPDIR)/rules.mk
+
+LUCI_TITLE:=Realtime Connection Tracking Stream Monitor
+LUCI_DEPENDS:=+luci-lib-jsonc
+LUCI_PKGARCH:=all
+
+LUCI_MINIFY:=0
+
+PKG_NAME:=luci-app-conntrack
+PKG_VERSION:=1.0.4
+PKG_RELEASE:=1
+
+PKG_MAINTAINER:=simonchen 
+
+include $(TOPDIR)/feeds/luci/luci.mk
+
+# call BuildPackage - OpenWrt buildroot signature
+
diff --git a/luci-app-conntrack/README.md b/luci-app-conntrack/README.md
new file mode 100644
index 000000000..43c8931ec
--- /dev/null
+++ b/luci-app-conntrack/README.md
@@ -0,0 +1,94 @@
+image
+image
+
+# luci-app-conntrack
+
+[English](#english) | [中文说明](#中文说明)
+
+---
+
+## English
+
+A highly-optimized, lightweight **Realtime Connection Tracking & Network Audit Monitor** for OpenWrt/LEDE. This plugin provides single-direction (TX/RX split), high-frequency, millisecond-level traffic visualization directly within the LuCI web interface.
+
+### 🚀 Key Features
+
+* **Zero Kernel Contamination (No kmod):** 
+  Unlike legacy traffic accounting tools, it does not inject any custom hooks or proprietary kernel modules. It fully leverages the Linux native `/proc/net/nf_conntrack` subsystem—data that the kernel already maintains for NAT routing—guaranteeing **zero system pollution and maximum stability**.
+* **UI Features:**
+  * **Realtime Connection Speed:** Displays instant throughput for each traffic direction in real time.
+  * **Bit / B Unit Toggling:** Seamlessly switch between `Bit` (bps/Mbps) and `B` (B/s/MB/s) locally via JS without dropping the SSE pipeline.
+  * **Original/Reply Traffic Splitting:** Tears apart conntrack rows to display precise directional analytics (TX/RX isolation).
+  * **QUIC/HTTP3 Recognition:** Automatically sniffs out modern HTTP/3 streams via UDP 443 heuristic auditing.
+  * **IPv4/v6 double stacks** supported.
+  * **Adaptive Layout with Tooltips:** Prevents UI breakage from long IPv6 addresses using CSS ellipsis combined with native hover tooltips.
+  * **Specific IP / Local & Loopback IP filter** supported.
+  * **Local host name** supported.
+  * **GeoIP info** supported.
+  * **Experiment feature** Show app name(YouTube, Instagram, TikTok, etc.) associated with the connection, this will need to patch kmod-nf-conntrack (patch file: 999-netfilter-custom-payload-telemetry-nf_conntrack.patch).
+  * **Cutomized App Icons***
+    
+### 🛠️ Architecture & Directory Tree
+
+Conforms strictly to the `luci.mk` unified application build framework:
+
+```text
+luci-app-conntrack/
+├── Makefile                # Build script using feeds/luci/luci.mk
+├── luasrc/
+│   ├── controller/
+│   │   └── conntrack.lua   # Non-blocking Event-Stream (SSE) backend server
+│   └── view/
+│       └── conntrack/
+│           └── conntrack.htm # Vanilla JS dynamic reconnect frontend view
+└── po/
+    └── zh-cn/
+        └── conntrack.po    # I18n translation source file
+```
+
+### 🧱 Installation & Compilation
+
+```bash
+# Update compilation feeds
+./scripts/feeds update -i
+./scripts/feeds install -f luci-app-conntrack
+
+# Compile the package independently
+make package/feeds/luci/luci-app-conntrack/compile V=s
+```
+
+---
+
+## 中文说明
+
+一款为 OpenWrt/LEDE 深度定制、工业级稳定的**实时连接跟踪与单向流量审计看板**。该插件完全基于轻量级的 Event-Stream (SSE) 长连接架构下运行，无需刷新页面即可在 Web 界面实现真正高频、正反向物理隔离的网络吞吐审计。
+
+### 🚀 核心优势
+
+* **零内核污染 (无需 kmod)：** 
+  不同于传统流量统计插件需要往内核安插臃肿的探针或第三方驱动，本插件完全基于 Linux 内核原生维护的 `/proc/net/nf_conntrack`（连接跟踪表）作为数据源。对系统内核**零开销、零污染**，保障极限负载下的系统稳定性。
+* **UI 特性：**
+  * **实时连接速率：** 高频显示每一条活跃网络连接当前的实时瞬时物理吞吐速率。
+  * **前端零延迟单位切换：** 表头集成智能交互按钮，支持在 `Bit`（比特率，Mbps）和 `B`（字节率，MB/s）之间 1 毫秒无缝切换，无需掐断或重启后台长连接。
+  * **正反单向流量分离：** 将 conntrack 报文拆分为 Original（发起方）与 Reply（回应方），实现真正的单向 TX/RX 独立审计与降序排列。
+  * **QUIC / HTTP3 智能识别：** 基于启发式行为审计，自动将隐藏在 UDP 443 端口下的现代高并发视频/下载流标记并显示为 `QUIC` 协议。
+  * **IPv4/v6 双栈支持**
+  * **超长 IPv6 弹性布局：** 引入 CSS 精确截断裁切，使超长 IPv6 地址自动变为省略号，鼠标悬停时原生 Tooltip 气泡自动浮现完整内容，排版永不撑破。
+  * **手动指定IP或本地以及回环IP 过滤支持**
+  * **本地主机名显示支持**
+  * **地理IP信息显示支持**
+  * **实验特色** 显示与连接相关的应用名称(YouTube, Instagram, TikTok, 王者荣耀..), 你需要给内核模块 kmod-nf-conntrack 打补丁 (补丁文件: 999-netfilter-custom-payload-telemetry-nf_conntrack.patch).
+  * ** 定制化App图标库 **
+    
+### 🧱 依赖与安装
+
+本插件在 OpenWrt 源码树下的标准相对路径为 `package/feeds/luci/luci-app-conntrack`：
+
+```bash
+# 1. 刷新编译环境 feeds 映射
+./scripts/feeds update -i
+./scripts/feeds install -f luci-app-conntrack
+
+# 2. 单包高效构建 
+make package/feeds/luci/luci-app-conntrack/compile V=s
+```
diff --git a/luci-app-conntrack/htdocs/luci-static/conntrack/js/iconify_custom_icons.js b/luci-app-conntrack/htdocs/luci-static/conntrack/js/iconify_custom_icons.js
new file mode 100644
index 000000000..cf35d4f83
--- /dev/null
+++ b/luci-app-conntrack/htdocs/luci-static/conntrack/js/iconify_custom_icons.js
@@ -0,0 +1,48 @@
+if (typeof (Iconify) != undefined) {
+Iconify.addIcon('logos:honorofkings', {
+    width: 146,
+    height: 112,
+    
+    body: `
+        
+        
+        
+        
+        
+        
+        
+        
+        
+        
+        
+        
+        
+        
+        
+        
+        
+        
+        
+        
+    `
+});
+
+Iconify.addIcon('logos:tencent-video', {
+    width: 32,
+    height: 32,
+    
+    body: `
+           
+           
+           `
+});
+
+Iconify.addIcon('logos:iqiyi', {
+    width: 125,
+    height: 45,
+    body: `
+	
+	`
+});
+
+}
diff --git a/luci-app-conntrack/luasrc/controller/conntrack.lua b/luci-app-conntrack/luasrc/controller/conntrack.lua
new file mode 100644
index 000000000..52fa1c9a3
--- /dev/null
+++ b/luci-app-conntrack/luasrc/controller/conntrack.lua
@@ -0,0 +1,474 @@
+module("luci.controller.conntrack", package.seeall)
+
+function index()
+	if not nixio.fs.access("/proc/net/nf_conntrack") then
+		return
+	end
+	entry({"admin", "network", "conntrack"}, template("conntrack/conntrack"), _("ConnTrack"), 90).dependent = true
+	entry({"admin", "network", "conntrack", "get_settings"}, call("action_get_settings"))
+	entry({"admin", "network", "conntrack", "set_settings"}, call("action_set_settings"))
+	entry({"admin", "network", "conntrack_stream"}, call("action_stream")).dependent = true
+end
+
+function action_get_settings()
+	local uci = require("luci.model.uci").cursor()
+	local jsonc = require("luci.jsonc")
+	luci.http.prepare_content("application/json")
+	
+	local res = {
+		interval = uci:get("conntrack", "settings", "interval") or "1500",
+		rows = uci:get("conntrack", "settings", "rows") or "50",
+		filter_local = uci:get("conntrack", "settings", "filter_local") or "true",
+		show_appname = uci:get("conntrack", "settings", "show_appname") or "false"
+	}
+	luci.http.write(jsonc.stringify(res))
+end
+
+function action_set_settings()
+	local uci = require("luci.model.uci").cursor()
+	local jsonc = require("luci.jsonc")
+	luci.http.prepare_content("application/json")
+	
+	local raw_body = luci.http.content()
+	if raw_body then
+		local data = jsonc.parse(raw_body)
+		if data and type(data) == "table" then
+			local has_settings = false
+			uci:foreach("conntrack", "global", function(s)
+				if s[".name"] == "settings" then
+					has_settings = true
+					return false
+				end
+			end)
+			
+			if not has_settings then
+				uci:section("conntrack", "global", "settings")
+			end
+			
+			if data.interval then uci:set("conntrack", "settings", "interval", tostring(data.interval)) end
+			if data.rows then uci:set("conntrack", "settings", "rows", tostring(data.rows)) end
+			if data.filter_local ~= nil then uci:set("conntrack", "settings", "filter_local", tostring(data.filter_local)) end
+			if data.show_appname ~= nil then uci:set("conntrack", "settings", "show_appname", tostring(data.show_appname)) end
+			
+			local commit_ok = uci:commit("conntrack")
+			if commit_ok then
+				luci.http.write('{"status":"ok"}')
+			else
+				luci.http.write('{"status":"commit_failed"}')
+			end
+			return
+		end
+	end
+	luci.http.write('{"status":"error"}')
+end
+
+local function nixio_lines_fast(path)
+	local nixio = require("nixio")
+	local fd = nixio.open(path, "r")
+	if not fd then return function() return nil end end
+
+	local chunks = {}
+	while true do
+		local chunk = fd:read(65536)
+		if not chunk or #chunk == 0 then break end
+		table.insert(chunks, chunk)
+	end
+	fd:close()
+
+	local content = table.concat(chunks)
+	local pos = 1
+	local content_len = #content
+
+	return function()
+		if pos > content_len then
+			return nil
+		end
+
+		local newline = content:find("\n", pos, true)
+		if newline then
+			local line = content:sub(pos, newline - 1)
+			pos = newline + 1
+			if #line > 0 and line:sub(-1) == "\r" then line = line:sub(1, -2) end
+			return line
+		else
+			local line = content:sub(pos)
+			pos = content_len + 1
+			if #line > 0 and line:sub(-1) == "\r" then line = line:sub(1, -2) end
+			return #line > 0 and line or nil
+		end
+	end
+end
+
+local function file_exists(path)
+	local f = io.open(path, "r")
+	if f then f:close() return true else return false end
+end
+
+local function create_file(path)
+	local file, err = io.open(path, "w")
+	if not file then return false else file:close() return true end
+end
+
+local function remove_file(path)
+	if file_exists(path) then
+		os.remove(path)
+	end
+end
+
+-- Experiment: the performance wouldn't be quite good than realtime 'action_strem'
+function action_stream_ubus()
+        local nixio = require "nixio"
+        local jsonc = require "luci.jsonc"
+        local http = require "luci.http"
+
+	local conntrack_lock_file = '/tmp/conntrack_event.lock'
+
+        local interval = tonumber(http.formvalue("interval")) or 1000
+        local max_rows = tonumber(http.formvalue("rows")) or 50
+        local filter_src = http.formvalue("filter_src") or "all"
+        local filter_dst = http.formvalue("filter_dst") or "all"
+        local filter_local = http.formvalue("filter_local") or "false"
+
+	http.header("Content-Type", "text/event-stream; charset=utf-8")
+	http.header("Cache-Control", "no-cache")
+	http.header("Connection", "keep-alive")
+	http.context.redirect = false
+
+	http.write("retry: 1000\n\n")
+	io.flush()
+
+	if not file_exists(conntrack_lock_file) then
+		create_file(conntrack_lock_file)
+	end
+	local stat = nixio.fs.stat(conntrack_lock_file)
+	nixio.fs.utimes(conntrack_lock_file, os.time(), stat.atime)
+
+	local handle = io.popen("ubus listen conntrack_event 2>/dev/null")
+	if not handle then return end
+
+	for line in handle:lines() do
+		nixio.fs.utimes(conntrack_lock_file, os.time(), stat.atime)
+		local ct = jsonc.parse(line)
+		if ct and ct.conntrack_event then
+			for _, value in ipairs(ct.conntrack_event) do
+				-- [Your custom code goes here]
+			end
+
+			local success = pcall(function()
+				io.write("data: " .. jsonc.stringify(ct.conntrack_event) .. "\n\n")
+				io.flush()
+			end)
+			if not success then
+				break
+			end
+		end
+
+                if luci.http.getenv("HTTP_CONNECTION") == "close" then
+                        break
+                end
+	end
+
+	handle:close()
+end
+
+function action_stream()
+	local nixio = require "nixio"
+	local jsonc = require "luci.jsonc"
+	local http = require "luci.http"
+
+	local interval = tonumber(http.formvalue("interval")) or 1000
+	local max_rows = tonumber(http.formvalue("rows")) or 50
+	local filter_src = http.formvalue("filter_src") or "all"
+	local filter_dst = http.formvalue("filter_dst") or "all"
+	local filter_local = http.formvalue("filter_local") or "false"
+	local sort = http.formvalue("sort") or "rate"
+
+	local lan_prefix = "192.168.1."
+	local lan_ip = luci.util.exec("uci -q get network.lan.ipaddr"):gsub("%s+", "")
+	if lan_ip and lan_ip ~= "" then
+		if lan_ip:match("^192%.168%.") or lan_ip:match("^10%.") or lan_ip:match("^172%.") then
+			lan_prefix = lan_ip:match("^([%d%.]+%.)%d+$") or "192.168.1."
+		end
+	end
+
+        local function is_local_ip(ip)
+                if not ip then return true end
+                local clean_ip = ip:lower():gsub("%s+", ""):gsub("%[", ""):gsub("%]", "")
+                if clean_ip == "127.0.0.1" or clean_ip == "0.0.0.0" or clean_ip == "::1" or clean_ip == "::" then return true end
+                local no_zeros = clean_ip:gsub("0", "")
+                if no_zeros == ":::::::1" or no_zeros == "::::::::" then return true end
+                if clean_ip:find("^192%.168%.") or clean_ip:find("^10%.") or clean_ip:find("^172%.1[6-9]%.") or clean_ip:find("^172%.2%d%.") or clean_ip:find("^172%.3%.") then
+                        return true
+                end
+                if clean_ip:find("^fc") or clean_ip:find("^fd") then
+                        return true
+                end
+                if clean_ip:find("^fe[89ab]") then
+                        return true
+                end
+                return false
+        end
+
+	local function normalize_ipv6(ip)
+		if not ip or not ip:find(":") then return ip end
+		local clean_ip = ip:lower():gsub("%s+", "")
+		if clean_ip:find("::") then
+			local _, count = clean_ip:gsub(":", "")
+			local colons_to_add = 8 - count
+			local replacement = ":"
+			for i = 1, colons_to_add do replacement = replacement .. ":" end
+			clean_ip = clean_ip:gsub("::", replacement)
+		end
+		local parts = {}
+		for part in clean_ip:gmatch("([^:]+)") do
+			while #part < 4 do part = "0" .. part end
+			table.insert(parts, part)
+		end
+		while #parts < 8 do table.insert(parts, "0000") end
+		return table.concat(parts, ":")
+	end
+
+	local lease_map = {}
+	local mac_host_map = {}
+	local ipv6_mac_map = {}
+
+	local lf = io.open("/tmp/dhcp.leases", "r")
+	if lf then
+		for line in lf:lines() do
+			local mac, ip, host = line:match("^%d+%s+([%a%d%:]+)%s+([%d%.%a%d%:]+)%s+([%w%-_]+)")
+			if not mac or not host then
+				ip, host = line:match("^%d+%s+[%a%d%:]+%s+([%d%.]+)%s+([%w%-_]+)")
+			end
+			if ip and host and host ~= "*" then
+				lease_map[ip] = host
+			end
+			if mac and host and host ~= "*" then
+				mac_host_map[mac:lower()] = host
+			end
+		end
+		lf:close()
+	end
+
+	local sys_host = luci.util.exec("uci -q get system.@system[0].hostname"):gsub("%s+", "")
+	if sys_host == "" then sys_host = "lan" end
+	if lan_ip and lan_ip ~= "" then
+		lease_map[lan_ip] = sys_host
+	end
+
+	-- adding ipv6 <-> host mapping
+	local np = io.popen("ip -6 neighbor | grep -E -v 'FAILED'")
+	if np then
+		for line in np:lines() do
+			local ip, mac = line:match("^([%a%d%:]+).-lladdr%s+([%a%d%:]+)")
+			if ip and mac then
+				local clean_ip = ip:lower():gsub("%s+", "")
+				if not is_local_ip(clean_ip) then
+					local norm_ip = normalize_ipv6(clean_ip)
+					ipv6_mac_map[norm_ip] = mac:lower()
+				end
+			end
+		end
+		np:close()
+	end
+
+	for ipv6, mac in pairs(ipv6_mac_map) do
+		local host = mac_host_map[mac]
+		if host then
+			lease_map[ipv6] = host
+		end
+	end
+
+	if interval < 500 then interval = 500 end
+	if interval > 10000 then interval = 10000 end
+
+	http.header("Content-Type", "text/event-stream; charset=utf-8")
+	http.header("Cache-Control", "no-cache")
+	http.header("Connection", "keep-alive")
+	http.context.redirect = false
+
+	http.write("retry: 1000\n\n")
+	io.flush()
+
+	local function get_current_time()
+		local sec, usec = nixio.gettimeofday()
+		return sec + (usec / 1000000)
+	end
+
+	local last_connections = {}
+	local last_timestamp = get_current_time()
+	local layer3, proto, state, src1, dst1, sport1, dport1, bytes1, src2, dst2, sport2, dport2, bytes2, remain
+	local type1, code1, id1, type2, code2, id2
+	local srckey1, dstkey1, srckey2, dstkey2
+
+	while true do
+		local sec = math.floor(interval / 1000)
+		local nsec = (interval % 1000) * 1000000
+		-- nixio.nanosleep(sec, nsec)
+
+		local current_timestamp = get_current_time()
+		local current_connections = {}
+		local ip_map = {}
+		
+		-- local f = io.open("/proc/net/nf_conntrack", "r")
+		-- if not f then break end
+
+		-- for line in f:lines() do
+		for line in nixio_lines_fast("/proc/net/nf_conntrack") do
+			local s_end = line:find("src=", 1, true)
+			local has_state = true
+			local remain = ""
+			local payload = ""
+			if s_end and line:byte(s_end-2) >= 48 and line:byte(s_end-2) <= 57 then
+				has_state = false
+			end
+			if has_state then
+				layer3, proto, state, src1, dst1, sport1, dport1, bytes1, src2, dst2, sport2, dport2, bytes2, remain = line:match("^(%w+)%s+%d+%s+(%w+)%s+%d+%s+%d+%s+(%S+)%s+src=([%a%d%.%:]+)%s+dst=([%a%d%.%:]+)%s+sport=(%d+)%s+dport=(%d+).-bytes=(%d+).-src=([%a%d%.%:]+)%s+dst=([%a%d%.%:]+)%s+sport=(%d+)%s+dport=(%d+).-bytes=(%d+)(.*)")
+			else
+				state = 'UNTRACKED'	
+				layer3, proto, src1, dst1, sport1, dport1, bytes1, src2, dst2, sport2, dport2, bytes2, remain = line:match("^(%w+)%s+%d+%s+(%w+)%s+%d+%s+%d+%s+src=([%a%d%.%:]+)%s+dst=([%a%d%.%:]+)%s+sport=(%d+)%s+dport=(%d+).-bytes=(%d+).-src=([%a%d%.%:]+)%s+dst=([%a%d%.%:]+)%s+sport=(%d+)%s+dport=(%d+).-bytes=(%d+)(.*)")
+			end
+			if not layer3 then -- icmp
+				layer3, proto, src1, dst1, type1, code1, id1, bytes1, src2, dst2, type2, code2, id2, bytes2, remain = line:match("^(%w+)%s+%d+%s+(%w+)%s+%d+%s+%d+%s+src=([%a%d%.%:]+)%s+dst=([%a%d%.%:]+)%s+type=(%d+)%s+code=(%d+)%s+id=(%d+).-bytes=(%d+).-src=([%a%d%.%:]+)%s+dst=([%a%d%.%:]+)%s+type=(%d+)%s+code=(%d+)%s+id=(%d+).-bytes=(%d+)(.*)")
+				if not layer3 then -- gre
+					layer3, proto, src1, dst1, srckey1, dstkey1, bytes1, src2, dst2, srckey2, dstkey2, bytes2, remain = line:match("^(%w+)%s+%d+%s+(%w+)%s+%d+%s+%d+%s+src=([%a%d%.%:]+)%s+dst=([%a%d%.%:]+)%s+srckey=(%S+)%s+dstkey=(%S+).-bytes=(%d+).-src=([%a%d%.%:]+)%s+dst=([%a%d%.%:]+)%s+srckey=(%S+)%s+dstkey=(%S+).-bytes=(%d+)(.*)")
+				end
+				if layer3 then
+					sport1, dport1, sport2, dport2 = "", "", "", ""
+				end
+			end
+
+			if remain then payload = remain:match("payload=(%S+)") or "" end
+
+			if layer3 then
+				if bytes1 and bytes2 then
+					local display_proto = proto
+					if proto == "udp" and (sport1 == "443" or dport1 == "443" or sport2 == "443" or dport2 == "443") then
+						display_proto = "quic"
+					end
+
+				      if filter_local == "true" and is_local_ip(src1) and is_local_ip(dst1) then
+						-- do nothing
+				      else
+					if layer3 == "ipv4" then
+						-- IPv4 DNAT revert --
+						if src2 == lan_ip or src2 == '127.0.0.1' then src2 = dst1 sport2 = dport1 end
+						-- IPv4 SNAT revert --
+						if dst2 ~= src1 then dst2 = src1 dport2 = sport1 end
+					end
+
+					ip_map[src1] = true
+					ip_map[dst1] = true
+					ip_map[src2] = true
+					ip_map[dst2] = true
+
+					local pass_orig = true
+					if filter_src ~= "all" and src1 ~= filter_src then pass_orig = false end
+					if filter_dst ~= "all" and dst1 ~= filter_dst then pass_orig = false end
+
+					if pass_orig then
+						local key_orig = string.format("%s_%s_%s:%s->%s:%s_ORIG", layer3, display_proto, src1, sport1, dst1, dport1)
+						current_connections[key_orig] = {
+							l3 = layer3, proto = display_proto, state = state,
+							src = src1, sport = sport1, dst = dst1, dport = dport1, bytes = tonumber(bytes1), speed = 0, payload = payload
+						}
+					end
+
+					local pass_repl = true
+					if filter_src ~= "all" and src2 ~= filter_src then pass_repl = false end
+					if filter_dst ~= "all" and dst2 ~= filter_dst then pass_repl = false end
+
+					if pass_repl then
+						local key_repl = string.format("%s_%s_%s:%s->%s:%s_REPL", layer3, display_proto, src2, sport2, dst2, dport2)
+						current_connections[key_repl] = {
+							l3 = layer3, proto = display_proto, state = state,
+							src = src2, sport = sport2, dst = dst2, dport = dport2, bytes = tonumber(bytes2), speed = 0, payload = payload
+						}
+					end
+				      end
+				end
+			end
+		end
+		-- f:close()
+		local lines_proc_time = get_current_time() - current_timestamp
+
+		local delta_time = current_timestamp - last_timestamp
+		if delta_time > 0 then
+			for key, curr in pairs(current_connections) do
+				local prev = last_connections[key]
+				if prev then
+					local diff = curr.bytes - prev.bytes
+					curr.speed = diff >= 0 and math.floor(diff / delta_time) or 0
+				else
+					curr.speed = 0
+				end
+			end
+		end
+
+		local sorted_list = current_connections
+		local sorted_list = {}
+		for _, conn in pairs(current_connections) do
+			-- if conn.speed > 0 then
+				table.insert(sorted_list, conn)
+			-- end
+		end
+
+		if sort == 'rate' then
+			table.sort(sorted_list, function(a, b) return a.speed > b.speed end)
+		elseif sort == 'flow' then
+			table.sort(sorted_list, function(a, b) return a.bytes > b.bytes end)
+		end
+
+		local output_list = {}
+		for i = 1, math.min(#sorted_list, max_rows) do
+			table.insert(output_list, sorted_list[i])
+		end
+
+		local lan_ips = {}
+		local v4_ips = {}
+		local v6_ips = {}
+		local lan_pattern = "^" .. lan_prefix:gsub("%.", "%%.")
+
+		for ip in pairs(ip_map) do
+			if ip:find(":") then
+				table.insert(v6_ips, ip)
+			elseif ip:match(lan_pattern) then
+				table.insert(lan_ips, ip)
+			else
+				table.insert(v4_ips, ip)
+			end
+		end
+		table.sort(lan_ips)
+		table.sort(v4_ips)
+		table.sort(v6_ips)
+
+		local unique_ips = {}
+		for _, ip in ipairs(lan_ips) do table.insert(unique_ips, ip) end
+		for _, ip in ipairs(v4_ips) do table.insert(unique_ips, ip) end
+		for _, ip in ipairs(v6_ips) do table.insert(unique_ips, ip) end
+
+		local response = {
+			lines_proc_time = string.format("%.2f", lines_proc_time),
+			delta = string.format("%.2f", delta_time),
+			connections = output_list,
+			unique_ips = unique_ips,
+			host_map = lease_map
+		}
+
+		local json_str = jsonc.stringify(response)
+		local ok = pcall(function()
+			io.write("data: " .. json_str .. "\n\n")
+			io.flush()
+		end)
+
+		if not ok then break end
+
+		if luci.http.getenv("HTTP_CONNECTION") == "close" then
+                        break
+                end
+
+		last_connections = current_connections
+		last_timestamp = current_timestamp
+
+		nixio.nanosleep(sec, nsec)
+	end
+end
diff --git a/luci-app-conntrack/luasrc/controller/conntrack_icons.lua b/luci-app-conntrack/luasrc/controller/conntrack_icons.lua
new file mode 100644
index 000000000..22e680a99
--- /dev/null
+++ b/luci-app-conntrack/luasrc/controller/conntrack_icons.lua
@@ -0,0 +1,92 @@
+module("luci.controller.conntrack_icons", package.seeall)
+
+function index()
+	entry({"admin", "network", "conntrack", "conntrack_icons_config"}, cbi("conntrack_icons"), nil, nil).dependent = true
+	entry({"admin", "network", "conntrack", "conntrack_custom_js"}, call("action_generate_js"), nil, nil)
+end
+
+local function base64_decode(data)
+	local b = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'
+	data = string.gsub(data, '[^'..b..'=]', '')
+	return (data:gsub('.', function(x)
+		if (x == '=') then return '' end
+		local r, f = '', (b:find(x) - 1)
+		for i = 6, 1, -1 do r = r .. (f % 2^i - f % 2^(i-1) >= 2^(i-1) and '1' or '0') end
+		return r;
+	end):gsub('%d%d%d%d%d%d%d%d', function(x)
+		local c = 0
+		for i = 1, 8 do c = c + (x:sub(i, i) == '1' and 2^(8-i) or 0) end
+		return string.char(c)
+	end))
+end
+
+function action_generate_js()
+	local uci = require("luci.model.uci").cursor()
+	luci.http.prepare_content("application/javascript")
+
+	local rules = {}
+	local bundles = {}
+
+	uci:foreach("conntrack", "regex_icon", function(s)
+		if s.pattern and s.icon then
+			local raw_pattern, modifier = s.pattern:match("^/(.-)/(%a*)$")
+			if raw_pattern then
+				table.insert(rules, string.format("\t\t{ reg: new RegExp(%q, \"%s\"), icon: %q }", raw_pattern, modifier or "", s.icon))
+			else
+				table.insert(rules, string.format("\t\t{ reg: new RegExp(%q, \"i\"), icon: %q }", s.pattern, s.icon))
+			end
+		end
+	end)
+
+	uci:foreach("conntrack", "my_custom_icons", function(s)
+		if s.name and s.svg_body then
+			-- local safe_svg = nixio.bin.b64decode(s.svg_body):gsub("[\r\n\t]", " ")
+			table.insert(bundles, string.format("\t\t%q: { body: %q, width: %d, height: %d }", 
+				s.name, s.svg_body, tonumber(s.width) or 24, tonumber(s.height) or 24))
+		end
+	end)
+
+	luci.http.write("window._customIconRules = [\n" .. table.concat(rules, ",\n") .. "\n];\n\n")
+	luci.http.write("window._customIconBundles = {\n" .. table.concat(bundles, ",\n") .. "\n};\n\n")
+	
+	luci.http.write([[
+(function() {
+	if (window.Iconify && window._customIconBundles) {
+		for (var name in window._customIconBundles) {
+			if (window._customIconBundles.hasOwnProperty(name)) {
+				var b = window._customIconBundles[name];
+				var parts = name.split(':');
+				if (parts.length === 2) {
+					var prefix = parts[0];
+					var localName = parts[1];
+					var iconData = { icons: {} };
+					iconData.icons[localName] = { body: atob(b.body), width: b.width, height: b.height };
+					iconData.prefix = prefix;
+					Iconify.addIcon(name, iconData.icons[localName]);
+				}
+			}
+		}
+	}
+	
+	document.addEventListener("DOMContentLoaded", function() {
+	var previews = document.querySelectorAll(".iconify-live-preview");
+	previews.forEach(function(span) {
+		var iconName = span.getAttribute("data-icon");
+		if (iconName && window.Iconify && typeof window.Iconify.getIcon === "function") {
+			var iconObj = window.Iconify.getIcon(iconName);
+			if (iconObj && iconObj.body) {
+				var iw = 48, ih = 48;
+				if (iconObj.width/iconObj.height > 2 ||
+					iconObj.height/iconObj.width > 2) {
+					iw = ""; ih = "";
+				}
+				span.innerHTML = '' + iconObj.body + '';
+			}
+		}
+	});
+	});
+
+})();
+]])
+end
+
diff --git a/luci-app-conntrack/luasrc/model/cbi/conntrack_icons.lua b/luci-app-conntrack/luasrc/model/cbi/conntrack_icons.lua
new file mode 100644
index 000000000..b9ae42db7
--- /dev/null
+++ b/luci-app-conntrack/luasrc/model/cbi/conntrack_icons.lua
@@ -0,0 +1,129 @@
+local i18n = require("luci.i18n")
+local nixio = require("nixio")
+
+local m = Map("conntrack", i18n.translate("Conntrack Custom App Icons"), i18n.translate("Manage your custom application regex mappings and SVG icons here. Note that the regex and icon mappings only apply to tracked TCP connections that successfully return a domain name for matching, and will not affect existing hardcoded rules (such as YouTube detection). Custom regex expressions and icon mappings will be matched with the highest priority based on their ranking order."))
+
+local old_map_render = m.render
+function m.render(self, ...)
+	luci.http.write([[
+
+
+

+
+

+]])
+	return old_map_render(self, ...)
+end
+
+local s1 = m:section(TypedSection, "regex_icon", i18n.translate("Regex Expression & Icon Mappings"))
+s1.description = i18n.translate('You can use an existing Iconify ID (e.g., logos:youtube) or a custom ID defined in the Custom SVG Icons Repository below.')
+s1.anonymous = true
+s1.addremove = true
+s1.sortable = true
+s1.template = "cbi/tblsection"
+
+local p1 = s1:option(Value, "pattern", i18n.translate("Regex Pattern"))
+p1.rmempty = false
+p1.placeholder = "/\\.google\\./i"
+
+local i1_hint = i18n.translate("You can use an existing Iconify ID (e.g., logos:youtube) or a custom ID defined in the Custom SVG Icons Repository below.")
+local i1 = s1:option(Value, "icon", string.format('%s (?)', i18n.translate("Iconify ID"), i1_hint, i1_hint))
+i1.rmempty = false
+i1.placeholder = "conntrack:google"
+
+local s2 = m:section(TypedSection, "my_custom_icons", i18n.translate("Custom SVG Icons Repository"))
+s2.anonymous = true
+s2.addremove = true
+s2.template = "cbi/tblsection"
+
+local v2 = s2:option(DummyValue, "_preview", i18n.translate("Icon Preview"))
+function v2.cfgvalue(self, section)
+	local name = self.map:get(section, "name") or "mdi:server-network"
+	return string.format('', name)
+end
+v2.rawhtml = true
+
+local n2_hint = i18n.translate("The Iconify ID must start with 'conntrack:' prefix to avoid overriding existing Iconify datasets.")
+local n2 = s2:option(Value, "name", string.format('%s (?)', i18n.translate("Iconify ID"), i18n.translate(n2_hint), i18n.translate(n2_hint)))
+n2.rmempty = false
+n2.placeholder = "conntrack:google"
+function n2.validate(self, value)
+	if value and value ~= "" then
+		if not value:match("^conntrack:") then
+			return nil, i18n.translate("Validation Error: The Iconify ID must begin with 'conntrack:' prefix (e.g., conntrack:custom_name).")
+		end
+	end
+	return value
+end
+
+local w2 = s2:option(Value, "width", i18n.translate("Icon Width"))
+w2.rmempty = false
+w2.datatype = "uinteger"
+w2.placeholder = "24"
+w2.default = "24"
+
+local h2 = s2:option(Value, "height", i18n.translate("Icon Height"))
+h2.rmempty = false
+h2.datatype = "uinteger"
+h2.placeholder = "24"
+h2.default = "24"
+
+local b2 = s2:option(TextValue, "svg_body", i18n.translate("SVG Body (Raw XML)"))
+b2.rmempty = false
+b2.rows = 3
+
+local function base64_encode(data)
+	local b = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'
+	return ((data:gsub('.', function(x)
+		local r, b_val = '', x:byte()
+		for i = 8, 1, -1 do r = r .. (b_val % 2^i - b_val % 2^(i-1) >= 2^(i-1) and '1' or '0') end
+		return r
+	end) .. '0000'):gsub('%d%d%d%d%d%d', function(x)
+		if (#x < 6) then return '' end
+		local c = 0
+		for i = 1, 6 do c = c + (x:sub(i, i) == '1' and 2^(6-i) or 0) end
+		return b:sub(c + 1, c + 1)
+	end) .. ({ '', '==', '=' })[#data % 3 + 1])
+end
+
+local function base64_decode(data)
+	local b = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'
+	data = string.gsub(data, '[^'..b..'=]', '')
+	return (data:gsub('.', function(x)
+		if (x == '=') then return '' end
+		local r, f = '', (b:find(x) - 1)
+		for i = 6, 1, -1 do r = r .. (f % 2^i - f % 2^(i-1) >= 2^(i-1) and '1' or '0') end
+		return r;
+	end):gsub('%d%d%d%d%d%d%d%d', function(x)
+		local c = 0
+		for i = 1, 8 do c = c + (x:sub(i, i) == '1' and 2^(8-i) or 0) end
+		return string.char(c)
+	end))
+end
+
+function b2.cfgvalue(self, section)
+	local value = Value.cfgvalue(self, section)
+	if value and value ~= "" then
+		local pcall_ok, decoded = pcall(nixio.bin.b64decode, value)
+		if pcall_ok then
+			return decoded
+		end
+	end
+	return value
+end
+
+function b2.validate(self, value)
+	if value and value ~= "" then
+		if not value:match("^%s* tag.")
+		end
+		return nixio.bin.b64encode(value)
+	end
+	return value
+end
+
+return m
+
diff --git a/luci-app-conntrack/luasrc/view/conntrack/conntrack.htm b/luci-app-conntrack/luasrc/view/conntrack/conntrack.htm
new file mode 100644
index 000000000..154a8dce4
--- /dev/null
+++ b/luci-app-conntrack/luasrc/view/conntrack/conntrack.htm
@@ -0,0 +1,933 @@
+<%+header%>
+
+
+
+
+
+
+
+
+

+	

+		
+	

+	
<%:Realtime single-direction traffic speed flow based on Event-Stream (SSE).%>
<%:To show AppName, you'll need to patch kmod-nf-conntrack, please refers to%> Github luci-app-conntrack

+	
+	

+		

+			

+				
+				

+					
+				

+			

+			

+				
+				

+					
+				

+			

+			

+			

+				

+					
+					
0.0000s

+				

+				

+					
+                                        
+				

+			

+		

+	

+
+	

+		
+			
+				
+				
+				
+				
+				
+				
+				
+				
+			
+			
+		
<%:L3%><%:Protocol%><%:State (Direction)%>
+					
+				
+					
+				<%:Accumulated%>↓
+					<%:Current Speed%>⇅Bit
+				<%:AppName%>
<%:Connecting to Event-Stream...%>

+	

+

+
+
+
+
+<%+footer%>
+
diff --git a/luci-app-conntrack/po/zh-cn/conntrack.po b/luci-app-conntrack/po/zh-cn/conntrack.po
new file mode 100644
index 000000000..c61353f44
--- /dev/null
+++ b/luci-app-conntrack/po/zh-cn/conntrack.po
@@ -0,0 +1,135 @@
+msgid "ConnTrack"
+msgstr "连接跟踪"
+
+msgid "ConnTrack Connection Monitor"
+msgstr "ConnTrack 连接实时监视器"
+
+msgid "Realtime single-direction traffic speed flow based on Event-Stream (SSE)."
+msgstr "基于 Event-Stream (SSE) 长连接架构的单向实时网速/协议审计看板。"
+
+msgid "To show AppName, you'll need to patch kmod-nf-conntrack, please refers to"
+msgstr "想查看应用名称, 你需要给内核模块kmod-nf-connntrack打补丁, 详见"
+
+msgid "AppName"
+msgstr "应用名称"
+
+msgid "Show AppName (experiment)"
+msgstr "显示应用名称 (实验)"
+
+msgid "Interval (Seconds)"
+msgstr "采样刷新时间间隔"
+
+msgid "Display Rows"
+msgstr "屏幕显示最大行数"
+
+msgid "Actual Delta Time"
+msgstr "内核实际采样物理间隔"
+
+msgid "L3"
+msgstr "网络层"
+
+msgid "Protocol"
+msgstr "传输协议"
+
+msgid "State (Direction)"
+msgstr "连接状态 (单向流量方向)"
+
+msgid "Source IP:Port"
+msgstr "源 IP 地址 : 端口号"
+
+msgid "Destination IP:Port"
+msgstr "目的 IP 地址 : 端口号"
+
+msgid "Accumulated"
+msgstr "该方向累计消耗流量"
+
+msgid "Current Speed"
+msgstr "当前方向即时网速"
+
+msgid "Connecting to Event-Stream..."
+msgstr "正在安全握手并建立 Event-Stream 毫秒级长连接数据通道..."
+
+msgid "No active traffic speed detected..."
+msgstr "当前暂无活跃网速的大流量连接，表格已自动过滤零速率空闲链..."
+
+msgid "Stream connection lost, retrying..."
+msgstr "Event-Stream 连接意外被系统或网页剥离，正在疯狂尝试自动重新重连..."
+
+msgid "Filter Local/Loopback"
+msgstr "过滤本地或回环连接"
+
+msgid "Honor of Kings"
+msgstr "王者荣耀"
+
+msgid "YouTube"
+msgstr "油管"
+
+msgid "TikTok"
+msgstr "抖音"
+
+msgid "Tencent Video"
+msgstr "腾讯视频"
+
+msgid "X (Twitter)"
+msgstr "X (推特)"
+
+msgid "Instagram"
+msgstr "INS 照片墙"
+
+msgid "HTTPS Connection"
+msgstr "HTTPS 连接"
+
+msgid "Custom Icons Config"
+msgstr "自定义图标配置"
+
+msgid "Manage your custom application regex mappings and SVG icons here. Note that the regex and icon mappings only apply to tracked TCP connections that successfully return a domain name for matching, and will not affect existing hardcoded rules (such as YouTube detection). Custom regex expressions and icon mappings will be matched with the highest priority based on their ranking order."
+msgstr "在此管理您的自定义应用正则表达式与 SVG 图标库。请注意，正则表达式与图标映射仅适用于能够成功返回明文域名进行匹配的跟踪 TCP 连接，且绝不会影响系统中已有的固定硬编码规则（例如 YouTube 判定）。自定义的正则表达式与图标映射将严格按照列表中的上下排名次序享有最高优先匹配权。"
+
+msgid "Connection Tracking List"
+msgstr "连接跟踪列表"
+
+msgid "Custom App Icons Config"
+msgstr "自定义应用图标配置"
+
+msgid "Conntrack Custom App Icons"
+msgstr "连接跟踪自定义应用图标"
+
+msgid "Regex Expression & Icon Mappings"
+msgstr "正则表达式与图标映射"
+
+msgid "Regex Pattern"
+msgstr "正则模式"
+
+msgid "Iconify ID"
+msgstr "Iconify ID"
+
+msgid "Custom SVG Icons Repository"
+msgstr "自定义 SVG 图标库"
+
+msgid "Icon Preview"
+msgstr "图标预览"
+
+msgid "Icon Width"
+msgstr "宽度"
+
+msgid "Icon Height"
+msgstr "高度"
+
+msgid "SVG Body (Raw XML)"
+msgstr "SVG 源码 (原始 XML)"
+
+msgid "You can use an existing Iconify ID (e.g., logos:youtube) or a custom ID defined in the Custom SVG Icons Repository below."
+msgstr "可以使用已有的公共 Iconify ID（例如 logos:youtube），或者下方【自定义 SVG 图标库】中已注册的专属 ID。"
+
+msgid "You can use an existing Iconify ID (e.g., logos:youtube) or a custom ID defined in the Custom SVG Icons Repository below."
+msgstr "可以使用已有的公共 Iconify ID（例如 logos:youtube），或者下方【自定义 SVG 图标库】中已注册的专属 ID。"
+
+msgid "The Iconify ID must start with 'conntrack:' prefix to avoid overriding existing Iconify datasets."
+msgstr "Iconify ID 必须以 'conntrack:' 前缀起始，以避免与系统已有的远程通用图标集产生命名空间冲突。"
+
+msgid "Validation Error: The Iconify ID must begin with 'conntrack:' prefix (e.g., conntrack:custom_name)."
+msgstr "验证错误：Iconify ID 必须以 'conntrack:' 前缀起始 (例如 conntrack:custom_name)。"
+
+msgid "Invalid SVG content. Must start with  tag."
+msgstr "无效的 SVG 内容。必须以  标签起始。"
+
diff --git a/luci-app-conntrack/po/zh_Hans b/luci-app-conntrack/po/zh_Hans
new file mode 120000
index 000000000..41451e4a1
--- /dev/null
+++ b/luci-app-conntrack/po/zh_Hans
@@ -0,0 +1 @@
+zh-cn
\ No newline at end of file
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/LICENSE b/luci-app-dlna-player/LICENSE
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/LICENSE
rename to luci-app-dlna-player/LICENSE
diff --git a/luci-app-dlna-player/Makefile b/luci-app-dlna-player/Makefile
new file mode 100644
index 000000000..ff60e8bfe
--- /dev/null
+++ b/luci-app-dlna-player/Makefile
@@ -0,0 +1,44 @@
+#
+# Copyright (C) 2026
+#
+# This is free software, licensed under the GNU General Public License v3.0
+#
+
+include $(TOPDIR)/rules.mk
+
+LUCI_TITLE:=LuCI DLNA Music Player
+LUCI_DESCRIPTION:=Turn an OpenWrt device into a music player: auto-detect the sound card, \
+configure MPD and upmpdcli (DLNA casting), browse and play local music.
+#
+# 依赖说明：
+#   mpd-full / mpc / upmpdcli / alsa-utils  → 播放与 DLNA 核心
+#   中文翻译：lmo 已内置在主包 root/usr/lib/lua/luci/i18n/ 里，
+#            勾上插件即带中文，无需额外选包
+#            （翻译源文件在 i18n-src/，改名是为了避免 luci.mk 重复生成 i18n 包）
+#   kmod-sound-*                            → 声卡驱动（覆盖常见板载 HDA + USB 声卡）
+#
+LUCI_DEPENDS:=+mpd-full +mpc +upmpdcli +alsa-utils \
+	+kmod-sound-core +kmod-sound-seq \
+	+kmod-sound-hda-core +kmod-sound-hda-intel \
+	+kmod-sound-hda-codec-realtek +kmod-sound-hda-codec-conexant \
+	+kmod-sound-hda-codec-analog +kmod-sound-hda-codec-hdmi \
+	+kmod-sound-hda-codec-via +kmod-sound-hda-codec-idt \
+	+kmod-sound-hda-codec-cirrus +kmod-sound-hda-codec-cmedia \
+	+kmod-sound-hda-codec-ca0132 +kmod-sound-hda-codec-ca0110 \
+	+kmod-usb-audio
+
+PKG_NAME:=luci-app-dlna-player
+PKG_VERSION:=1.0.0
+PKG_RELEASE:=1
+PKG_MAINTAINER:=sakura-builder1 
+PKG_LICENSE:=GPL-3.0
+
+# 配置文件：安装/升级时保留用户修改
+# 注意：必须在 include luci.mk 之前定义（luci.mk 内部会 eval 包定义）
+define Package/luci-app-dlna-player/conffiles
+/etc/config/dlna-player
+endef
+
+include $(TOPDIR)/feeds/luci/luci.mk
+
+# call BuildPackage - OpenWrt buildroot signature
diff --git a/luci-app-dlna-player/README.md b/luci-app-dlna-player/README.md
new file mode 100644
index 000000000..8fc248197
--- /dev/null
+++ b/luci-app-dlna-player/README.md
@@ -0,0 +1,124 @@
+# luci-app-dlna-player
+
+> 把 OpenWrt 设备（尤其是 x86 小主机）变成一台 **DLNA 音乐播放器** —— 自动探测声卡、配置 MPD 播放、支持手机投送。
+
+> 🤖 **本插件由 AI 编写**（从需求梳理、代码实现到调试排错，全程由 AI 完成）。
+
+[![License](https://img.shields.io/badge/license-GPL--3.0-blue.svg)](LICENSE)
+
+## ✨ 特性
+
+- 🔍 **声卡自动探测** —— 无需手动找 `hw:X,Y`，自动识别模拟输出设备
+- 🔊 **自动解除静音** —— ALSA 新装默认静音，脚本自动处理
+- 🎵 **MPD 自动配置** —— 自动生成可用的 `mpd.conf`
+- 📡 **DLNA 投送** —— 手机（网易云 / QQ音乐 / BubbleUPnP）直接投送
+- 🎚️ **实时音量 / 进度滑块** —— 网页上直接拖动调节
+- 🔍 **音乐库搜索** —— 歌曲多了也能快速找到
+- 🔁 **播放模式** —— 循环 / 随机 / 顺序播放
+- 💾 **持久化音量** —— 绕过 tmpfs，重启后音量不丢
+- 🌏 **中文界面** —— 内置翻译，开箱即用
+- 🔄 **完整开机自启** —— 服务顺序自动编排
+
+## 📋 适用场景
+
+- x86 小主机 / 软路由装了 OpenWrt，想用它的 **3.5mm 音频口**放歌
+- 想把 OpenWrt 变成一台 **DLNA 音箱**
+- 树莓派等带音频输出的设备
+
+## 📦 安装
+
+在 OpenWrt 源码根目录执行：
+
+```bash
+# 1. 进入 package 目录，克隆插件
+cd package
+git clone https://github.com/sakura-builder1/luci-app-dlna-player.git
+
+# 2. 回到源码根目录
+cd ..
+
+# 3. 更新一下 feeds（首次编译需要）
+./scripts/feeds update -a && ./scripts/feeds install -a
+
+# 4. 只编译这个插件
+make package/luci-app-dlna-player/compile V=s
+```
+
+编译产物在：
+
+```
+bin/packages/<架构>/base/luci-app-dlna-player_*.ipk
+```
+
+例如 x86_64：
+
+```
+bin/packages/x86_64/base/luci-app-dlna-player_1.0.0-r5_all.ipk
+```
+
+把它拷到路由器上安装：
+
+```bash
+scp bin/packages/x86_64/base/luci-app-dlna-player_*.ipk root@192.168.1.1:/tmp/
+ssh root@192.168.1.1
+opkg install /tmp/luci-app-dlna-player_*.ipk
+/etc/init.d/rpcd restart          # 重要！否则菜单不显示
+```
+
+> 💡 依赖会自动带上（mpd-full / upmpdcli / alsa-utils / 常见声卡驱动），不用手动选。
+
+安装后在 **服务 → DLNA 音乐播放器** 里配置使用。
+
+## ⚙️ 配置项
+
+配置文件：`/etc/config/dlna-player`
+
+```uci
+config audio 'main'
+	option enabled '0'              # 是否启用（默认关闭）
+	option device ''                # 声卡设备，留空=自动探测（如 hw:3,0）
+	option music_dir '/srv/music'   # 音乐目录
+	option volume '40'              # 默认音量 0-100
+	option dlna_name ''             # DLNA 显示名，留空=用主机名
+	option unmute '1'               # 自动解除 ALSA 静音
+	option persist_volume '1'       # 持久化音量
+```
+
+修改后应用：
+
+```bash
+uci set dlna-player.main.volume='60'
+uci commit dlna-player
+/etc/init.d/dlna-player start
+```
+
+## 🏗️ 工作原理
+
+```
+启动流程：
+  S50 dlna-player          → 探测声卡 + 修权限 + 解静音 + 生成 mpd.conf + 建目录
+  S93 mpd                  → 启动 MPD（以 root 运行）
+  S94 dlna-player-volume   → 设置默认音量（有持久状态则跳过）
+  S95 upmpdcli             → 启动 DLNA 服务
+
+播放链路：
+  手机 App ──DLNA──▶ upmpdcli ──MPD协议──▶ MPD ──ALSA──▶ 声卡 ──▶ 🎵
+```
+
+image
+
+
+## 🔧 兼容性
+
+| OpenWrt 版本 | 状态 |
+|---|---|
+| 24.10 | ✅ 已测试 |
+| 23.05 | ⚠️ 理论可用，未测试 |
+| 25.12 | ⚠️ 需要适配 `apk` |
+
+## 📄 License
+
+GPL-3.0
+
+本项目采用 **GNU General Public License v3.0** 授权 —— 你可以自由使用、修改、分发，
+但**衍生作品必须同样以 GPL-3.0 开源**，不能闭源独吞。
diff --git a/luci-app-dlna-player/htdocs/luci-static/resources/view/dlna-player2.js b/luci-app-dlna-player/htdocs/luci-static/resources/view/dlna-player2.js
new file mode 100644
index 000000000..9eb053089
--- /dev/null
+++ b/luci-app-dlna-player/htdocs/luci-static/resources/view/dlna-player2.js
@@ -0,0 +1,477 @@
+/* This is free software, licensed under the Apache License, Version 2.0 */
+
+'use strict';
+'require view';
+'require form';
+'require fs';
+'require uci';
+'require ui';
+
+var APLAY = '/usr/bin/aplay';
+var MPC   = '/usr/bin/mpc';
+
+/* LuCI 的 fs.exec 不会因非零退出码 reject，需自己判断 */
+function mpcText(args) {
+	return fs.exec(MPC, args).then(function (rv) {
+		return (rv && rv.code === 0) ? (rv.stdout || '') : '';
+	}).catch(function () { return ''; });
+}
+function mpcRun(args) {
+	return fs.exec(MPC, args).catch(function () { });
+}
+
+return view.extend({
+	load: function () {
+		function running(cmd) {
+			return fs.exec('/bin/pidof', [ cmd ]).then(function (rv) {
+				return !!(rv && rv.code === 0 && (rv.stdout || '').trim() !== '');
+			}).catch(function () { return false; });
+		}
+		return Promise.all([
+			uci.load('dlna-player'),
+			L.resolveDefault(fs.exec(APLAY, ['-l']), { stdout: '' }),
+			mpcText(['status']),
+			running('mpd'),
+			running('upmpdcli'),
+			mpcText(['listall'])
+		]);
+	},
+
+	render: function (data) {
+		var aplayOut = (data[1] && data[1].stdout) || '';
+		var mpdUp    = data[3];
+		var upnpUp   = data[4];
+		var allFiles = (data[5] || '').split('\n').filter(function (s) { return s.trim() !== ''; });
+
+		var cards = [];
+		aplayOut.split('\n').forEach(function (line) {
+			var mm = line.match(/^card\s+(\d+):\s+(\S+)\s+\[([^\]]+)\],\s+device\s+(\d+):\s+([^\[]+)\[([^\]]+)\]/);
+			if (mm) {
+				cards.push({
+					dev: 'hw:' + mm[1] + ',' + mm[4],
+					label: 'card ' + mm[1] + ' / device ' + mm[4] + ' — ' + mm[3] + ' / ' + mm[6].trim()
+				});
+			}
+		});
+
+		var m, s, o;
+
+		m = new form.Map('dlna-player', _('DLNA Music Player'),
+			_('Turn this device into a music player: auto-detect the sound card, configure MPD and upmpdcli (DLNA).'));
+
+		/* ================= 基础设置 ================= */
+		s = m.section(form.TypedSection, 'audio', _('Basic settings'));
+		s.anonymous = true;
+		s.addremove = false;
+
+		o = s.option(form.Flag, 'enabled', _('Enable audio service'),
+			_('Turn the audio setup on or off. When off, MPD and upmpdcli are stopped and disabled.'));
+		o.rmempty = false;
+		o.default = '0';                 /* 默认关闭 */
+
+		o = s.option(form.DummyValue, '_status', _('Service status'));
+		o.rawhtml = true;
+		o.cfgvalue = function () {
+			function badge(ok, name) {
+				return '' +
+					name + ' ' + (ok ? _('running') : _('stopped')) + '';
+			}
+			return badge(mpdUp, 'MPD') + badge(upnpUp, 'upmpdcli');
+		};
+
+		o = s.option(form.Value, 'device', _('Sound card'),
+			_('Leave empty to auto-detect. Pick a detected card below, or type a custom device such as hw:0,0.'));
+		o.rmempty = true;
+		o.placeholder = _('auto-detect');
+		cards.forEach(function (c) { o.value(c.dev, c.label); });
+
+		o = s.option(form.Value, 'music_dir', _('Music directory'),
+			_('Where your music files are stored (can be a mount point, e.g. /mnt/sda1/music).'));
+		o.default = '/srv/music';
+		o.rmempty = false;
+
+		o = s.option(form.Value, 'volume', _('Default volume'),
+			_('Default playback volume (0-100). Applied when you save, and on boot if "Remember volume" is off.'));
+		o.datatype = 'range(0,100)';
+		o.default = '40';
+		o.rmempty = false;
+
+		/* DLNA 名称：默认留空 */
+		o = s.option(form.Value, 'dlna_name', _('DLNA device name'),
+			_('The name shown on your phone when casting music. Leave empty to use the hostname.'));
+		o.rmempty = true;
+		o.placeholder = _('use hostname');
+
+		o = s.option(form.Flag, 'unmute', _('Unmute on boot'),
+			_('ALSA devices are muted by default. Enable to unmute automatically.'));
+		o.default = '1';
+		o.rmempty = false;
+
+		o = s.option(form.Flag, 'persist_volume', _('Remember volume'),
+			_('Keep the playback volume across reboots.'));
+		o.default = '1';
+		o.rmempty = false;
+
+		return m.render().then(function (node) {
+			if (!document.getElementById('dlna-player-layout-css')) {
+				document.head.appendChild(E('style', { 'id': 'dlna-player-layout-css' }, [
+					'.dlna-player-row { display:flex; gap:1rem; flex-wrap:wrap; align-items:stretch; }',
+					'.dlna-player-row > .dlna-player-col { flex:1 1 15rem; min-width:14rem; max-width:100%; display:flex; flex-direction:column; }',
+					'.dlna-player-row > .dlna-player-col > .cbi-section { flex:1 1 auto; }',
+					'.dlna-player-name { flex:1; min-width:0; white-space:nowrap; overflow-x:auto; overflow-y:hidden; padding:.1rem 0; }',
+					'.dlna-player-row .cbi-value { display:flex; align-items:flex-start; gap:.75rem; flex-wrap:wrap; }',
+					'.dlna-player-row .cbi-value-title { text-align:left; flex:0 0 8.5rem; max-width:8.5rem; padding-top:.35rem; }',
+					'.dlna-player-row .cbi-value-field { flex:1 1 auto; min-width:0; }',
+					'.dlna-player-row .cbi-value-description { margin-left:9.25rem; }',
+					'.dlna-player-line { display:flex; align-items:center; gap:.75rem; flex-wrap:wrap; margin-bottom:.5rem; padding-left:1rem; }',
+					'.dlna-player-line > label { flex:0 0 8.5rem; max-width:8.5rem; text-align:left; }',
+					/* 列表也留出同样的左边距，视觉更整齐 */
+					'.dlna-player-row .dlna-player-list { margin-left:1rem; }'
+				]));
+			}
+
+			var h2 = node.querySelector('h2');
+			if (h2) h2.style.width = '100%';
+			var desc = node.querySelector('.cbi-map-descr');
+			if (desc) desc.style.width = '100%';
+
+			var formSec = node.querySelector('.cbi-section') ||
+				E('div', { 'class': 'cbi-section dlna-player-col' }, []);
+
+			var statusLine = E('code', {}, [ _('loading...') ]);
+			var volSlider, volLabel, seekSlider, seekLabel;
+			var repeatBtn, randomBtn, orderBtn;
+			var filterInput, listFrame, listCount;
+			var curFile = '';
+			var fileRows = [];
+
+			/* ---------- 状态刷新（就地更新） ---------- */
+			function refreshStatus() {
+				return Promise.all([
+					mpcText(['status']),
+					mpcText(['-f', '%file%', 'current'])
+				]).then(function (r) {
+					var st  = r[0] || '';
+					var cur = (r[1] || '').trim();
+					curFile = cur;
+
+					var line = st.split('\n').filter(function (l) { return l.trim() !== ''; })
+						.slice(0, 2).join(' — ');
+					statusLine.textContent = line || _('stopped');
+
+					/* 音量 */
+					var vm = st.match(/volume:\s*(\d+)%/);
+					if (vm && volSlider && document.activeElement !== volSlider) {
+						volSlider.value = vm[1];
+						volLabel.textContent = vm[1] + '%';
+					}
+
+					/* 播放进度：数字始终更新；滑块仅在未拖动时同步 */
+					var pm = st.match(/#(\d+)\/(\d+)\s+(\d+):(\d+)\/(\d+):(\d+)/);
+					if (seekSlider && seekLabel) {
+						if (pm) {
+							var elapsed = parseInt(pm[3], 10) * 60 + parseInt(pm[4], 10);
+							var total   = parseInt(pm[5], 10) * 60 + parseInt(pm[6], 10);
+							var pct = total > 0 ? Math.round(elapsed * 100 / total) : 0;
+							/* 数字永远更新（修掉"拖动后数字不动"） */
+							seekLabel.textContent = pm[3] + ':' + pm[4] + ' / ' + pm[5] + ':' + pm[6];
+							/* 滑块只在没被拖动时跟随 */
+							if (document.activeElement !== seekSlider)
+								seekSlider.value = pct;
+						} else {
+							/* 没有播放时归零 */
+							seekLabel.textContent = '0:00 / 0:00';
+							if (document.activeElement !== seekSlider)
+								seekSlider.value = 0;
+						}
+					}
+
+					/* 循环 / 随机 / 顺序 */
+					var rep = /repeat:\s*on/.test(st);
+					var rnd = /random:\s*on/.test(st);
+					var sgl = /single:\s*on/.test(st);
+					if (repeatBtn) {
+						repeatBtn.textContent = rep ? _('Loop: ON') : _('Loop: OFF');
+						repeatBtn.className = 'btn cbi-button cbi-button-' + (rep ? 'apply' : 'reset');
+					}
+					if (randomBtn) {
+						randomBtn.textContent = rnd ? _('Shuffle: ON') : _('Shuffle: OFF');
+						randomBtn.className = 'btn cbi-button cbi-button-' + (rnd ? 'apply' : 'reset');
+					}
+					if (orderBtn) {
+						var seq = !rnd && !rep && !sgl;      /* 三者都关 = 纯顺序播放 */
+						orderBtn.textContent = seq ? _('Sequential: ON') : _('Sequential: OFF');
+						orderBtn.className = 'btn cbi-button cbi-button-' + (seq ? 'apply' : 'reset');
+					}
+
+					fileRows.forEach(function (item) {
+						var on = (item.name === cur);
+						item.el.style.background = on ? '#e8f5e9' : '';
+						item.el.style.fontWeight = on ? 'bold' : '';
+					});
+				});
+			}
+
+			function act(args) {
+				return mpcRun(args).then(function () { return refreshStatus(); });
+			}
+
+			function nextLocalFile() {
+				return mpcText(['-f', '%file%', 'current']).then(function (cur) {
+					cur = (cur || '').trim();
+					var i = allFiles.indexOf(cur);
+					if (i >= 0 && i + 1 < allFiles.length) return allFiles[i + 1];
+					return allFiles.length ? allFiles[0] : null;
+				});
+			}
+
+			/* 播放某首：把「全部歌曲」加入队列，再跳到这一首
+			   这样放完会自动播下一首（顺序播放）✅ */
+			function playFile(f) {
+				var idx = allFiles.indexOf(f);
+				return mpcRun(['clear']).then(function () {
+					return mpcRun(['add', '/']);
+				}).then(function () {
+					/* mpc play 用 1-based 序号；找不到时回退到第 1 首 */
+					return mpcRun(['play', String(idx >= 0 ? idx + 1 : 1)]);
+				}).then(function () { return refreshStatus(); });
+			}
+
+			function pbtn(label, style, handler) {
+				return E('button', {
+					'class': 'btn cbi-button cbi-button-' + style,
+					'click': ui.createHandlerFn(this, handler)
+				}, [ label ]);
+			}
+
+			/* ---------- 音乐列表（只滚动，不翻页） ---------- */
+			function currentFilter() {
+				return (filterInput && filterInput.value || '').toLowerCase();
+			}
+
+			function renderList() {
+				var kw = currentFilter();
+				var fl = kw ? allFiles.filter(function (f) { return f.toLowerCase().indexOf(kw) >= 0; })
+				            : allFiles;
+
+				fileRows = [];
+				listFrame.innerHTML = '';
+				if (!fl.length) {
+					listFrame.appendChild(E('div', { 'style': 'padding:.8rem;color:#888;text-align:center' }, [
+						_('No matching music.')
+					]));
+				} else {
+					fl.forEach(function (f) {
+						var row = E('div', {
+							'style': 'display:flex;align-items:center;gap:.5rem;padding:.3rem .4rem;border-radius:.2rem'
+						}, [
+							pbtn(_('Play'), 'action', function () { return playFile(f); }),
+							E('span', { 'class': 'dlna-player-name' }, [ f ]),
+							pbtn(_('Add'), 'reset', function () {
+								return mpcRun(['add', f]).then(function () { return refreshStatus(); });
+							})
+						]);
+						fileRows.push({ name: f, el: row });
+						listFrame.appendChild(row);
+					});
+				}
+
+				listCount.textContent = _('Showing %d / %d').format(fl.length, allFiles.length);
+
+				fileRows.forEach(function (item) {
+					var on = (item.name === curFile);
+					item.el.style.background = on ? '#e8f5e9' : '';
+					item.el.style.fontWeight = on ? 'bold' : '';
+				});
+			}
+
+			/* ============ 播放器区域 ============ */
+			var playerSec = E('div', { 'class': 'cbi-section dlna-player-col' }, [
+				E('h3', {}, [ _('Player') ]),
+				E('p', { 'class': 'cbi-section-descr' }, [ _('Current:') + ' ', statusLine ]),
+
+				/* 音量 */
+				E('div', { 'class': 'dlna-player-line' }, [
+					E('label', {}, [ _('Volume') ]),
+					volSlider = E('input', {
+						'type': 'range', 'min': '0', 'max': '100', 'step': '1',
+						'style': 'flex:1;max-width:20rem;cursor:pointer'
+					}, []),
+					volLabel = E('code', { 'style': 'min-width:3rem' }, [ '--%' ])
+				]),
+
+				/* 进度 */
+				E('div', { 'class': 'dlna-player-line' }, [
+					E('label', {}, [ _('Progress') ]),
+					seekSlider = E('input', {
+						'type': 'range', 'min': '0', 'max': '100', 'step': '1',
+						'style': 'flex:1;max-width:20rem;cursor:pointer'
+					}, []),
+					seekLabel = E('code', { 'style': 'min-width:7.5rem' }, [ '0:00 / 0:00' ])
+				]),
+
+				/* 播放控制（用 dlna-player-line 保证与左侧标签对齐一致） */
+				E('div', { 'class': 'dlna-player-line' }, [
+					E('label', {}, [ _('Player control') ]),
+					E('div', { 'style': 'display:flex;gap:.5rem;flex-wrap:wrap' }, [
+						pbtn(_('Play'),   'apply',  function () { return act(['play']); }),
+						pbtn(_('Pause'),  'reset',  function () { return act(['pause']); }),
+						pbtn(_('Stop'),   'reset',  function () { return act(['stop']); }),
+						pbtn(_('Next track'), 'action', function () {
+							return nextLocalFile().then(function (f) {
+								if (!f) return refreshStatus();
+								return playFile(f);
+							});
+						}),
+						pbtn(_('Rescan'), 'action', function () { return act(['update']); })
+					])
+				]),
+
+				/* 循环 / 随机 / 顺序 */
+				E('div', { 'class': 'dlna-player-line' }, [
+					E('label', {}, [ _('Play mode') ]),
+					E('div', { 'style': 'display:flex;gap:.5rem;flex-wrap:wrap' }, [
+						repeatBtn = pbtn(_('Loop: OFF'), 'reset', function () {
+							return mpcText(['status']).then(function (st) {
+								return act(['repeat', /repeat:\s*on/.test(st) ? 'off' : 'on']);
+							});
+						}),
+						randomBtn = pbtn(_('Shuffle: OFF'), 'reset', function () {
+							return mpcText(['status']).then(function (st) {
+								return act(['random', /random:\s*on/.test(st) ? 'off' : 'on']);
+							});
+						}),
+						orderBtn = pbtn(_('Sequential: ON'), 'apply', function () {
+							/* 顺序播放：关闭 随机 / 循环 / 单曲 */
+							return mpcRun(['random', 'off']).then(function () {
+								return mpcRun(['repeat', 'off']);
+							}).then(function () {
+								return mpcRun(['single', 'off']);
+							}).then(function () { return refreshStatus(); });
+						})
+					])
+				]),
+
+				/* 队列操作 */
+				E('div', { 'class': 'dlna-player-line' }, [
+					E('label', {}, [ _('Play queue') ]),
+					E('div', { 'style': 'display:flex;gap:.5rem;flex-wrap:wrap' }, [
+						pbtn(_('Clear queue'), 'reset', function () { return act(['clear']); })
+					])
+				]),
+
+				/* 搜索 */
+				E('div', { 'class': 'dlna-player-line' }, [
+					E('label', {}, [ _('Search') ]),
+					E('div', { 'style': 'flex:1;min-width:0;display:flex;flex-direction:column' }, [
+						filterInput = E('input', {
+							'type': 'text', 'class': 'cbi-input-text',
+							'placeholder': _('type to filter...'),
+							'style': 'width:100%;max-width:22rem'
+						}, []),
+						E('div', { 'style': 'margin-top:.2rem;color:#666;font-size:.9em' }, [
+							listCount = E('span', {}, [ '' ])
+						])
+					])
+				]),
+
+				/* 列表：只滚动，不翻页 */
+				listFrame = E('div', {
+					'class': 'dlna-player-list',
+					'style': 'border:1px solid #ccc;border-radius:.3rem;' +
+						'max-height:20rem;overflow-y:auto;overflow-x:hidden;background:#fff'
+				}, [])
+			]);
+
+			/* 响应式：宽屏并排，窄屏自动上下（靠 flex-wrap）
+			   注意：LuCI 保存后会重渲染表单，导致自定义布局被清掉，
+			   所以做成「可重复挂载」的函数，丢失时自动重建 ✅ */
+			var layoutRow = null;
+
+			function mountLayout() {
+				/* 布局还在 → 什么都不做 */
+				if (layoutRow && document.body.contains(layoutRow) &&
+					document.body.contains(playerSec))
+					return;
+
+				/* 找到（或重新找到）基础设置那个 section */
+				var fs = node.querySelector('.cbi-section.dlna-player-col') ||
+				         node.querySelector('.cbi-section');
+				if (!fs) return;
+
+				/* 清掉可能残留的旧 row */
+				var old = node.querySelector('.dlna-player-row');
+				if (old) old.remove();
+
+				layoutRow = E('div', { 'class': 'dlna-player-row' }, [
+					E('div', { 'class': 'dlna-player-col' }, [ fs ]),
+					playerSec
+				]);
+				node.appendChild(layoutRow);
+			}
+
+			mountLayout();
+
+			/* ---- 事件绑定 ---- */
+			var volTimer = null;
+			volSlider.addEventListener('input', function () {
+				var v = volSlider.value;
+				volLabel.textContent = v + '%';
+				if (volTimer) clearTimeout(volTimer);
+				volTimer = setTimeout(function () {
+					mpcRun(['volume', v]).then(function () { return refreshStatus(); });
+				}, 150);
+			});
+
+			var seekTimer = null;
+			seekSlider.addEventListener('input', function () {
+				if (seekTimer) clearTimeout(seekTimer);
+				seekTimer = setTimeout(function () {
+					mpcRun(['seek', seekSlider.value + '%']).then(function () {
+						/* 关键：拖完立即失焦，否则滑块会一直"被拖动中"而不再刷新 */
+						seekSlider.blur();
+						return refreshStatus();
+					});
+				}, 250);
+			});
+
+			filterInput.addEventListener('input', function () { renderList(); });
+
+			renderList();
+			refreshStatus();
+
+			/* 每 3 秒同步一次状态（进度条会跟着走），顺便补回被清掉的布局 */
+			var syncTimer = setInterval(function () {
+				if (!document.body.contains(statusLine)) { clearInterval(syncTimer); return; }
+				mountLayout();
+				refreshStatus();
+			}, 3000);
+
+			return node;
+		});
+	},
+
+	handleSaveApply: function (ev, mode) {
+		var self = this;
+		return this.handleSave(ev).then(function () {
+			return uci.apply();
+		}).catch(function (e) {
+			console.warn('dlna-player: uci apply failed', e);
+		}).then(function () {
+			return fs.exec('/etc/init.d/dlna-player', ['start']);
+		}).then(function () {
+			/* 应用「默认音量」——保存时就立即生效（不等下次开机） */
+			var v = uci.get('dlna-player', 'main', 'volume');
+			if (v !== null && v !== undefined && v !== '')
+				return fs.exec('/usr/bin/mpc', ['volume', String(v)]).catch(function () { });
+		}).then(function () {
+			ui.addNotification(null, E('p', _('Settings applied. Services restarted.')));
+			/* 保存后 LuCI 会重渲染，稍等再刷新页面让布局重建 */
+			window.setTimeout(function () { location.reload(); }, 2000);
+		}).catch(function (e) {
+			ui.addNotification(null, E('p', _('Apply failed: %s').format(
+				(e && (e.message || e.toString())) || 'unknown')));
+		});
+	}
+});
diff --git a/luci-app-dlna-player/i18n-src/zh_Hans/dlna-player.po b/luci-app-dlna-player/i18n-src/zh_Hans/dlna-player.po
new file mode 100644
index 000000000..c8d5a54a9
--- /dev/null
+++ b/luci-app-dlna-player/i18n-src/zh_Hans/dlna-player.po
@@ -0,0 +1,153 @@
+msgid ""
+msgstr ""
+"Content-Type: text/plain; charset=UTF-8\n"
+"Language: zh_Hans\n"
+"Plural-Forms: nplurals=1; plural=0;\n"
+
+
+msgid "ALSA devices are muted by default. Enable to unmute automatically."
+msgstr "ALSA 设备默认静音，启用后开机自动解除。"
+
+msgid "Add"
+msgstr "加入队列"
+
+msgid "Apply failed: %s"
+msgstr "应用失败：%s"
+
+msgid "Basic settings"
+msgstr "基础设置"
+
+msgid "Clear queue"
+msgstr "清空队列"
+
+msgid "Current:"
+msgstr "当前播放："
+
+msgid "DLNA Music Player"
+msgstr "DLNA音乐播放器"
+
+msgid "DLNA device name"
+msgstr "DLNA 设备名"
+
+msgid "Default playback volume (0-100). Applied when you save, and on boot if \"Remember volume\" is off."
+msgstr "默认播放音量（0-100）。保存时立即生效；若关闭「记住音量」，开机也会应用。"
+
+msgid "Default volume"
+msgstr "默认音量"
+
+msgid "Enable audio service"
+msgstr "启用音频服务"
+
+msgid "Keep the playback volume across reboots."
+msgstr "重启后仍保留播放音量。"
+
+msgid "Leave empty to auto-detect. Pick a detected card below, or type a custom device such as hw:0,0."
+msgstr "留空则自动探测。可从下方列表选择，也可手填设备名（如 hw:0,0）。"
+
+msgid "Loop: OFF"
+msgstr "循环：关"
+
+msgid "Loop: ON"
+msgstr "循环：开"
+
+msgid "Music directory"
+msgstr "音乐目录"
+
+msgid "Next track"
+msgstr "下一首"
+
+msgid "No matching music."
+msgstr "没有匹配的音乐。"
+
+msgid "Pause"
+msgstr "暂停"
+
+msgid "Play"
+msgstr "播放"
+
+msgid "Play mode"
+msgstr "播放模式"
+
+msgid "Play queue"
+msgstr "队列"
+
+msgid "Player"
+msgstr "播放器"
+
+msgid "Player control"
+msgstr "播放控制"
+
+msgid "Progress"
+msgstr "进度"
+
+msgid "Remember volume"
+msgstr "记住音量"
+
+msgid "Rescan"
+msgstr "重新扫描"
+
+msgid "Search"
+msgstr "搜索"
+
+msgid "Sequential: OFF"
+msgstr "顺序播放：关"
+
+msgid "Sequential: ON"
+msgstr "顺序播放：开"
+
+msgid "Service status"
+msgstr "服务状态"
+
+msgid "Settings applied. Services restarted."
+msgstr "设置已应用，服务已重启。"
+
+msgid "Showing %d / %d"
+msgstr "显示 %d / %d 条"
+
+msgid "Shuffle: OFF"
+msgstr "随机：关"
+
+msgid "Shuffle: ON"
+msgstr "随机：开"
+
+msgid "Sound card"
+msgstr "声卡"
+
+msgid "Stop"
+msgstr "停止"
+
+msgid "The name shown on your phone when casting music. Leave empty to use the hostname."
+msgstr "手机投送音乐时显示的名称。留空则使用主机名。"
+
+msgid "Turn the audio setup on or off. When off, MPD and upmpdcli are stopped and disabled."
+msgstr "开启或关闭音频服务。关闭时会停止并禁用 MPD 与 upmpdcli。"
+
+msgid "Turn this device into a music player: auto-detect the sound card, configure MPD and upmpdcli (DLNA)."
+msgstr "把本机变成音乐播放器：自动探测声卡，配置 MPD 与 upmpdcli（DLNA 投送）。"
+
+msgid "Unmute on boot"
+msgstr "开机解除静音"
+
+msgid "Volume"
+msgstr "音量"
+
+msgid "Where your music files are stored (can be a mount point, e.g. /mnt/sda1/music)."
+msgstr "音乐文件存放位置（可以是挂载点，例如 /mnt/sda1/music）。"
+
+msgid "auto-detect"
+msgstr "自动探测"
+
+msgid "loading..."
+msgstr "加载中…"
+
+msgid "running"
+msgstr "运行中"
+
+msgid "stopped"
+msgstr "已停止"
+
+msgid "type to filter..."
+msgstr "输入关键词筛选…"
+
+msgid "use hostname"
+msgstr "使用主机名"
diff --git a/luci-app-dlna-player/root/etc/config/dlna-player b/luci-app-dlna-player/root/etc/config/dlna-player
new file mode 100644
index 000000000..b60a5982e
--- /dev/null
+++ b/luci-app-dlna-player/root/etc/config/dlna-player
@@ -0,0 +1,8 @@
+config audio 'main'
+	option enabled '0'
+	option device ''
+	option music_dir '/srv/music'
+	option volume '40'
+	option dlna_name ''
+	option unmute '1'
+	option persist_volume '1'
diff --git a/luci-app-dlna-player/root/etc/init.d/dlna-player b/luci-app-dlna-player/root/etc/init.d/dlna-player
new file mode 100755
index 000000000..38b6f9dcb
--- /dev/null
+++ b/luci-app-dlna-player/root/etc/init.d/dlna-player
@@ -0,0 +1,194 @@
+#!/bin/sh /etc/rc.common
+# DLNA Music Player - 声卡初始化 + MPD/upmpdcli 配置
+# 在 MPD 之前运行，负责把声卡准备好
+
+START=50
+STOP=99
+
+. /lib/functions.sh
+
+MUSIC_DIR_DEFAULT="/srv/music"
+MPD_CONF="/etc/mpd.conf"
+MPD_STATE_DIR="/etc/mpd"
+
+log() { logger -t dlna-player "$@"; }
+
+# 刷新前端文件 mtime，避免浏览器因"文件没变"而使用旧缓存
+refresh_web_cache() {
+	touch /www/luci-static/resources/view/dlna-player2.js 2>/dev/null
+	rm -f /tmp/luci-indexcache* 2>/dev/null
+}
+
+# ---------- 自动探测声卡 ----------
+detect_device() {
+	local dev
+
+	# 1) 优先选名字里带 Analog 的（板载模拟输出）
+	dev=$(aplay -l 2>/dev/null \
+		| grep -i 'analog' \
+		| head -n1 \
+		| sed -n 's/^card \([0-9]*\): .*device \([0-9]*\):.*/hw:\1,\2/p')
+	[ -n "$dev" ] && { echo "$dev"; return 0; }
+
+	# 2) 退而求其次：排除 Dummy / pcsp / HDMI，取第一个可播放设备
+	dev=$(aplay -l 2>/dev/null \
+		| grep '^card ' \
+		| grep -viE 'dummy|pcsp|hdmi|iec958' \
+		| head -n1 \
+		| sed -n 's/^card \([0-9]*\): .*device \([0-9]*\):.*/hw:\1,\2/p')
+	[ -n "$dev" ] && { echo "$dev"; return 0; }
+
+	return 1
+}
+
+# ---------- 等声卡就绪 ----------
+wait_soundcard() {
+	local i=0
+	while [ $i -lt 30 ]; do
+		[ -d /proc/asound ] && aplay -l >/dev/null 2>&1 && return 0
+		sleep 1
+		i=$((i + 1))
+	done
+	return 0
+}
+
+# ---------- 生成 mpd.conf ----------
+gen_mpd_conf() {
+	local dev="$1" music="$2"
+
+	cat > "$MPD_CONF" </dev/null
+		/etc/init.d/mpd disable 2>/dev/null
+		/etc/init.d/upmpdcli stop 2>/dev/null
+		/etc/init.d/upmpdcli disable 2>/dev/null
+		refresh_web_cache
+		return 0
+	}
+
+	# 启用时：确保两个服务开机自启，并且现在就跑起来
+	/etc/init.d/mpd enable 2>/dev/null
+	/etc/init.d/upmpdcli enable 2>/dev/null
+	pidof mpd >/dev/null 2>&1 || /etc/init.d/mpd start 2>/dev/null
+	# upmpdcli 用 restart：既保证运行，又能让新的 DLNA 名称生效
+	/etc/init.d/upmpdcli restart 2>/dev/null
+
+	# --- 1. 等声卡 ---
+	wait_soundcard
+
+	# --- 2. 探测设备 ---
+	if [ -z "$device" ]; then
+		device=$(detect_device)
+		if [ -z "$device" ]; then
+			log "no usable sound card found!"
+			return 1
+		fi
+		log "auto-detected sound card: $device"
+	else
+		log "using configured sound card: $device"
+	fi
+
+	# --- 2.1 检查 PulseAudio 冲突 ---
+	# PulseAudio 会抢占 ALSA 设备，导致 MPD 无声
+	if pidof pulseaudio >/dev/null 2>&1; then
+		log "WARNING: pulseaudio is running and may grab the sound card!"
+		log "WARNING: run '/etc/init.d/pulseaudio stop; /etc/init.d/pulseaudio disable' if MPD has no sound"
+	fi
+
+	# --- 3. 声卡权限（/dev 是 tmpfs，每次开机都要修）---
+	chmod 666 /dev/snd/* 2>/dev/null
+
+	# --- 4. 恢复混音器状态 + 解除静音 ---
+	# 先尝试恢复上次保存的混音器状态（/etc 是持久目录）
+	[ -f /etc/alsa/asound.state ] && alsactl restore -f /etc/alsa/asound.state 2>/dev/null
+
+	if [ "$unmute" = "1" ]; then
+		local card="${device#hw:}"     # 3,0
+		card="${card%%,*}"             # 3
+		amixer -c "$card" sset 'Master' 100% unmute 2>/dev/null
+	fi
+
+	# --- 5. 音乐目录 ---
+	[ -d "$music" ] || mkdir -p "$music"
+	chmod 755 "$music"
+	chown -R mpd:mpd "$music" 2>/dev/null
+
+	# --- 6. MPD 运行目录（/var 是 tmpfs）---
+	mkdir -p /var/lib/mpd/playlists
+	chown -R mpd:mpd /var/lib/mpd 2>/dev/null
+	mkdir -p "$MPD_STATE_DIR"
+
+	# --- 6.1 确保 MPD 以 root 运行 ---
+	# 原因：PulseAudio 等其他服务会重置 /dev/snd 权限，mpd 用户可能打不开声卡
+	# 每次开机都检查，避免 MPD 包升级后补丁丢失
+	if [ -f /etc/init.d/mpd ]; then
+		if grep -q '^USER="mpd"' /etc/init.d/mpd; then
+			sed -i 's/^USER="mpd"/USER="root"/; s/^GROUP="mpd"/GROUP="root"/' /etc/init.d/mpd
+			log "patched mpd init to run as root"
+		fi
+	fi
+
+	# --- 7. 生成 mpd.conf ---
+	gen_mpd_conf "$device" "$music"
+
+	# --- 8. upmpdcli 名称 ---
+	[ -z "$dlna" ] && dlna="$(uci get system.@system[0].hostname 2>/dev/null)"
+	[ -z "$dlna" ] && dlna="OpenWrt Audio"
+	uci -q set upmpdcli.lan=upmpdcli
+	uci -q set upmpdcli.lan.interface='br-lan'
+	uci -q set upmpdcli.lan.friendly_name="$dlna"
+	uci -q commit upmpdcli
+
+	log "dlna-player done (device=$device, volume=$volume)"
+	refresh_web_cache
+}
+
+stop() {
+	# 关机时保存混音器状态（/etc 是持久目录，重启后能恢复）
+	mkdir -p /etc/alsa 2>/dev/null
+	alsactl store -f /etc/alsa/asound.state 2>/dev/null
+	log "stopped, mixer state saved"
+}
+
+reload() {
+	stop
+	start
+}
diff --git a/luci-app-dlna-player/root/etc/init.d/dlna-player-volume b/luci-app-dlna-player/root/etc/init.d/dlna-player-volume
new file mode 100755
index 000000000..b54ef11e8
--- /dev/null
+++ b/luci-app-dlna-player/root/etc/init.d/dlna-player-volume
@@ -0,0 +1,40 @@
+#!/bin/sh /etc/rc.common
+# Audio Volume - 在 MPD 启动后设置默认音量
+# 注意：仅在"没有持久状态文件"时设置，避免覆盖用户手动调过的音量
+
+START=94
+STOP=98
+
+. /lib/functions.sh
+
+log() { logger -t dlna-player-volume "$@"; }
+
+start() {
+	local enabled volume persist
+
+	config_load dlna-player
+	config_get enabled main enabled 1
+	config_get volume  main volume '40'
+	config_get persist main persist_volume '1'
+
+	[ "$enabled" = "1" ] || return 0
+
+	# 等 MPD 起来
+	local i=0
+	while [ $i -lt 15 ]; do
+		mpc status >/dev/null 2>&1 && break
+		sleep 1
+		i=$((i + 1))
+	done
+
+	# 有持久状态就不动它
+	if [ "$persist" = "1" ] && [ -f /etc/mpd/mpdstate ]; then
+		log "persistent state found, keep user volume"
+		return 0
+	fi
+
+	mpc volume "$volume" 2>/dev/null
+	log "set default volume to ${volume}%"
+}
+
+stop() { :; }
diff --git a/luci-app-dlna-player/root/etc/uci-defaults/99-dlna-player b/luci-app-dlna-player/root/etc/uci-defaults/99-dlna-player
new file mode 100755
index 000000000..2c89d23f6
--- /dev/null
+++ b/luci-app-dlna-player/root/etc/uci-defaults/99-dlna-player
@@ -0,0 +1,22 @@
+#!/bin/sh
+# 首次启动时执行一次：启用各服务
+
+# 启用音频初始化脚本（START=50，早于 mpd）
+/etc/init.d/dlna-player enable
+
+# 创建音乐目录
+MUSIC_DIR="$(uci -q get dlna-player.main.music_dir)"
+[ -z "$MUSIC_DIR" ] && MUSIC_DIR="/srv/music"
+mkdir -p "$MUSIC_DIR"
+chmod 755 "$MUSIC_DIR"
+
+# MPD 需要以 root 运行（否则打不开声卡）
+if [ -f /etc/init.d/mpd ]; then
+	sed -i 's/^USER="mpd"/USER="root"/; s/^GROUP="mpd"/GROUP="root"/' /etc/init.d/mpd
+	/etc/init.d/mpd enable
+fi
+
+# DLNA 服务
+[ -f /etc/init.d/upmpdcli ] && /etc/init.d/upmpdcli enable
+
+exit 0
diff --git a/luci-app-dlna-player/root/usr/lib/lua/luci/i18n/dlna-player.zh-cn.lmo b/luci-app-dlna-player/root/usr/lib/lua/luci/i18n/dlna-player.zh-cn.lmo
new file mode 100644
index 000000000..a01365f6a
Binary files /dev/null and b/luci-app-dlna-player/root/usr/lib/lua/luci/i18n/dlna-player.zh-cn.lmo differ
diff --git a/luci-app-dlna-player/root/usr/share/luci/menu.d/luci-app-dlna-player.json b/luci-app-dlna-player/root/usr/share/luci/menu.d/luci-app-dlna-player.json
new file mode 100644
index 000000000..1223cf629
--- /dev/null
+++ b/luci-app-dlna-player/root/usr/share/luci/menu.d/luci-app-dlna-player.json
@@ -0,0 +1,13 @@
+{
+	"admin/services/dlna-player": {
+		"title": "DLNA 音乐播放器",
+		"order": 50,
+		"action": {
+			"type": "view",
+			"path": "dlna-player2"
+		},
+		"depends": {
+			"acl": [ "luci-app-dlna-player" ]
+		}
+	}
+}
diff --git a/luci-app-dlna-player/root/usr/share/rpcd/acl.d/luci-app-dlna-player.json b/luci-app-dlna-player/root/usr/share/rpcd/acl.d/luci-app-dlna-player.json
new file mode 100644
index 000000000..787d6919e
--- /dev/null
+++ b/luci-app-dlna-player/root/usr/share/rpcd/acl.d/luci-app-dlna-player.json
@@ -0,0 +1,24 @@
+{
+	"luci-app-dlna-player": {
+		"description": "Grant access to DLNA Music Player",
+		"read": {
+			"file": {
+				"/usr/bin/aplay": [ "exec" ],
+				"/usr/bin/mpc": [ "exec" ],
+				"/bin/pidof": [ "exec" ],
+				"/etc/init.d/dlna-player": [ "exec" ]
+			},
+			"uci": [ "dlna-player" ]
+		},
+		"write": {
+			"file": {
+				"/usr/bin/mpc": [ "exec" ],
+				"/etc/init.d/dlna-player": [ "exec" ],
+				"/etc/init.d/dlna-player-volume": [ "exec" ],
+				"/etc/init.d/upmpdcli": [ "exec" ],
+				"/etc/init.d/mpd": [ "exec" ]
+			},
+			"uci": [ "dlna-player" ]
+		}
+	}
+}
diff --git a/luci-app-dnsguard/.gitattributes b/luci-app-dnsguard/.gitattributes
new file mode 100644
index 000000000..3c8f4882c
--- /dev/null
+++ b/luci-app-dnsguard/.gitattributes
@@ -0,0 +1,18 @@
+# 统一换行：仓库内存 LF，避免 Windows 上 checkout 出 CRLF 破坏 shell/Lua 脚本
+* text=auto eol=lf
+
+# 二进制：不做任何转换
+*.png binary
+*.jpg binary
+*.jpeg binary
+*.gif binary
+*.ico binary
+
+# 明确脚本类型（在这些设备上必须是 LF，否则 #!/bin/sh 会带 \r 直接执行失败）
+*.sh    text eol=lf
+*.lua   text eol=lf
+*.htm   text eol=lf
+dnsguard-apply    text eol=lf
+dnsguard-selftest text eol=lf
+dnsguard-rollback text eol=lf
+dnsguard          text eol=lf
diff --git a/luci-app-dnsguard/.gitignore b/luci-app-dnsguard/.gitignore
new file mode 100644
index 000000000..29a081c93
--- /dev/null
+++ b/luci-app-dnsguard/.gitignore
@@ -0,0 +1,23 @@
+# 临时/生成物
+*.bak
+*.bak-*
+*.orig
+*.rej
+*.swp
+*~
+__pycache__/
+*.pyc
+.DS_Store
+Thumbs.db
+
+# 编辑器
+.vscode/
+.idea/
+
+# 本地部署残留（deploy.sh 打包产物）
+/tmp/
+*.tgz
+
+# 敏感物：绝不入库
+.env
+*.secret
diff --git a/luci-app-dnsguard/LICENSE b/luci-app-dnsguard/LICENSE
new file mode 100644
index 000000000..e29456814
--- /dev/null
+++ b/luci-app-dnsguard/LICENSE
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 dellzou (https://xiaozou123.cn)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/luci-app-dnsguard/README.md b/luci-app-dnsguard/README.md
new file mode 100644
index 000000000..e90b5ce14
--- /dev/null
+++ b/luci-app-dnsguard/README.md
@@ -0,0 +1,141 @@
+# luci-app-dnsguard —— DNS 防绕过（LuCI 应用）
+
+把局域网内「绕过 AdGuard Home 的 DNS」拉回本机解析：**53 明文用透明重定向**（客户端无感），
+**853 DoT 用阻断**（逼其回落 53），**DoH 专用 IP** 可选阻断。全部可在 WebUI 开关。
+
+- 入口：**LuCI → 服务 → DNS 防绕过**（`admin/services/dnsguard`）
+- 配置：`/etc/config/dnsguard`
+- 渲染产物：`/etc/nftables.d/20-dns-guard.nft`（由 fw4 在 `inet/fw4` 表上下文内 include）
+- 回滚点：`/mnt/data/backup-dnsguard/<时间戳>/`（含 `20-dns-guard.nft` + `dnsguard.uci`）
+
+## 为什么需要它
+
+OpenWrt 自带的「DNS 重定向」开关重定向到的是 **dnsmasq 自己的端口**。本机架构里 dnsmasq 已退居
+5353、53 由 AdGuard Home 接管，所以打开那个开关会让**全屋绕过 AGH、广告过滤失效**；
+而且它只匹配 `udp dport 53`，TCP 不覆盖。本应用是它的正确替代实现：
+
+| 项 | OpenWrt 自带开关 | 本应用 |
+|---|---|---|
+| 重定向目标 | dnsmasq 的 `port`（本机 = 5353）❌ | AdGuard Home 的 `:53` ✅ |
+| 协议覆盖 | 仅 UDP | TCP + UDP |
+| 目标过滤 | 无（跨子网也劫持） | 排除内网/保留段 + 可配设备例外 |
+| 前置校验 | 无 | `nft -c` + `fw4 check` + 应用后核对链 |
+| 回滚 | 无 | 回滚点 + 延迟自动回滚 |
+
+## 文件清单
+
+| 路径（设备） | 作用 |
+|---|---|
+| `/etc/config/dnsguard` | UCI 配置（`main` / `limits` 两个节） |
+| `/usr/bin/dnsguard-apply` | **唯一写防火墙的地方**：UCI → 渲染 → 校验 → 落盘 → `fw4 reload` |
+| `/usr/bin/dnsguard-selftest` | 健康自检（AGH 进程 / :53 监听 / 解析 / 链与计数 / 回滚倒计时） |
+| `/usr/bin/dnsguard-rollback` | 回滚点管理 + 延迟自动回滚 |
+| `/etc/init.d/dnsguard` | `reload` / `stop`（boot 为空实现，开机不需要它做事） |
+| `controller/dnsguard.lua`、`view/dnsguard/main.htm`、`acl.d/luci-app-dnsguard.json` | 界面 |
+
+## 关键技术点
+
+### 1. 规则写在哪、优先级怎么排
+
+`/etc/nftables.d/*.nft` 的文件是**被 include 进 `table inet fw4` 内部**的（见设备上 `/etc/nftables.d/README`），
+所以文件里只写 `set` / `chain`，**不要写 `table` 包裹**。
+
+fw4 自己的 DNAT 链是 `dstnat`（`priority dstnat` = **-100**）。我们的重定向链用 `priority -105`，
+在它**之前**执行：
+
+```nft
+chain dns_guard_redirect {
+	type nat hook prerouting priority -105; policy accept;
+	iifname "br-lan" meta l4proto { tcp, udp } th dport 53 ip  daddr != @dns_never_hijack4 counter redirect to :53
+	iifname "br-lan" meta l4proto { tcp, udp } th dport 53 ip6 daddr != @dns_never_hijack6 counter redirect to :53
+}
+```
+
+`redirect to :53`（只给端口）= 改道到本机 :53。目标写死 AGH 的端口，**不是** dnsmasq 的 5353。
+
+### 2. 「永不劫持」集合里不要放 192.168.0.0/16
+
+默认排除 `192.168.1.0/24`、`172.16.0.0/12`、`127.0.0.0/8`、`169.254.0.0/16`、`224.0.0.0/4`。
+
+> ⚠️ 仓库里带的默认配置用的是 `192.168.1.0/24` 这个**占位网段**。`install.sh` 在首次安装时会自动读
+> `br-lan` 的 IPv4 地址、算出真实网段并替换它（不影响已有配置）。如果你不是用 `install.sh` 装的，
+> 请到界面把「永不劫持（IPv4）」改成你自己的 LAN 网段。
+**故意不排除整个 `192.168.0.0/16`**：红米 K80 的静态 DNS 指向旧网段 `192.168.5.1`（该网段已不存在），
+若把 192.168/16 全排除，它会继续"DNS 打空"；现在被重定向后反而恢复正常解析。
+
+### 3. 安全闸门与三层校验
+
+- **闸门**：`redirect53=1` 而 `AdGuardHome` 进程不存在 → **直接拒绝应用**（exit 3，不落盘）
+- **校验 1**：渲染片段包进临时表名做 `nft -c`，不通过绝不落盘
+- **校验 2**：落盘后 `fw4 check`（fw4 自带的全量校验器），不通过立即还原旧文件
+- **校验 3**：`fw4 reload` 后核对 `dns_guard_redirect` 链真的存在，不存在则还原 + 重载
+
+### 4. 延迟自动回滚
+
+DNS 是全家网的命门：改错了人可能连这台路由器都**访问不到**（域名解析不了）。
+所以「53 重定向」从**关改到开**时，控制器会：
+
+1. 先把**当前 UCI + 当前规则文件**拍成回滚点（必须在写 UCI **之前**拍，否则快照里就是新配置）
+2. 起一个 `setsid` 倒计时进程（默认 10 分钟）
+3. 到点未点「确认保留」→ 自动还原 UCI + 规则文件 + `fw4 reload`
+
+`/tmp/.dnsguard-rollback` 是唯一真相：`--disarm` 删掉它，倒计时进程醒来发现记录没了就什么都不做（僵尸进程无害）。
+
+### 5. 幂等
+
+文件头有「生成时间」，所以比较时**先剔除该行**再 `cmp`——否则每次都比出差异、白白重载一次防火墙。
+验收：连跑两次 `dnsguard-apply`，第二次必须报 `file:"unchanged"`。
+
+## 命令行速查
+
+```sh
+# 渲染并应用（输出一行 JSON）
+/usr/bin/dnsguard-apply
+
+# 只渲染，不碰防火墙（界面「预览将要生成的规则」用的就是它）
+/usr/bin/dnsguard-apply --render-only --out /tmp/x.nft
+
+# 健康自检
+/usr/bin/dnsguard-selftest
+
+# 回滚
+/usr/bin/dnsguard-rollback                # 列出回滚点
+/usr/bin/dnsguard-rollback latest         # 还原到最近一个
+/usr/bin/dnsguard-rollback 20260926-182913
+/usr/bin/dnsguard-rollback --arm 10       # 挂 10 分钟自动回滚
+/usr/bin/dnsguard-rollback --disarm       # 确认保留
+
+# 服务
+/etc/init.d/dnsguard reload
+/etc/init.d/dnsguard stop                 # 临时摘链（配置不动，fw4 reload 后恢复）
+```
+
+## 部署 / 回滚
+
+```sh
+export PATH="/c/Users/27970/.workbuddy/binaries/PortableGit/versions/1.2.0/usr/bin:$PATH"
+sh deploy.sh --check     # 静态检查（shell / JSON / Lua 控制器 / 模板内嵌 Lua）
+sh deploy.sh --install   # 打包上传安装（会先备份旧文件）
+```
+
+**安装阶段不碰防火墙**——规则文件只会在界面点「保存并应用」时生成。
+
+回滚（install.sh 也会打印）：
+
+```sh
+cp -r /mnt/data/backup-dnsguard/<安装时间戳>/* / \
+  && rm -f /usr/lib/lua/luci/controller/dnsguard.lua \
+  && rm -rf /usr/lib/lua/luci/view/dnsguard /usr/share/rpcd/acl.d/luci-app-dnsguard.json /etc/init.d/dnsguard \
+  && rm -f /tmp/luci-indexcache*
+# 再删掉重定向链：
+nft delete chain inet fw4 dns_guard_redirect 2>/dev/null; fw4 reload
+```
+
+## 开发时的三个坑（都真踩过）
+
+1. **`while read` 丢末行**：`printf '%s' "$list" | ... | while read e` 会把**最后一个元素**丢掉，
+   必须 `printf '%s\n'`。症状是 `224.0.0.0/4`、`140.207.198.6` 之类的**最后一个元素**神秘消失。
+2. **Lua 白名单漏 `/`**：控制器里清洗地址用的 `gsub("[^%w%.%:%-%s%,]", "")` 会把 CIDR 洗成
+   `192.168.1.024`（打桩测试抓到的）。白名单必须含 `/`。
+3. **shell 里给变量赋值 PATH 在部分环境下有坑**：`PATH=/x:$PATH cmd` 在某些封装 shell 里会被改写成
+   带 `$( )` 的形式而语法报错；测试时改用 `/usr/bin/env PATH=... cmd` 更稳。
diff --git a/luci-app-dnsguard/VERSION b/luci-app-dnsguard/VERSION
new file mode 100644
index 000000000..9dc0e0b30
--- /dev/null
+++ b/luci-app-dnsguard/VERSION
@@ -0,0 +1,31 @@
+0.1.0 (2026-09-26)
+
+target : iStoreOS 25.12.5 (x86_64, apk) / LuCI 26.253 + luci-compat / fw4 + nftables 1.1.6 / kernel 6.12.94
+form   : 纯文件 LuCI 应用（免 SDK 免编译）+ 三个 POSIX shell 脚本
+
+功能：
+  - 53 透明重定向 -> AdGuard Home（nat prerouting priority -105，早于 fw4 dstnat -100）
+  - 853(DoT) 阻断 / DoH 专用 IP 阻断（可选，默认关）
+  - 观察计数链（沿用阶段 1，只计数 + 抽样记日志）
+  - 健康自检、规则预览、回滚点管理、延迟自动回滚（DNS 变更的安全绳）
+  - 安全闸门：AdGuardHome 未运行时拒绝启用重定向；渲染片段先 nft -c 校验，落盘后 fw4 check 全量校验，
+    应用后核对链是否真的存在，任一环节失败即自动还原旧规则
+  - install.sh 首次安装会读 br-lan 的 IPv4 地址、算出真实 LAN 网段，替换默认配置里的占位网段
+
+repo note:
+  - 公开仓库里的默认配置使用 192.168.1.0/24 作占位网段，真实部署值以设备上的 UCI 为准
+  - deploy.sh / install.sh 中出现的路由器地址是通用占位值，请按自己的环境替换
+  - 不含任何截图二进制；README 中的图走博客图床外链
+
+verified on device:
+  - 静态检查（shell / JSON / Lua 控制器 / 模板内嵌 Lua）
+  - nft 片段语法预检（临时表包裹，nft -c）通过
+  - fw4 check 全量校验通过
+  - UCI 解析自检 + 首次安装迁移现有防火墙状态
+  - 渲染脚本幂等（第二次报 unchanged，不重载防火墙）
+  - 53 重定向端到端：LAN 客户端查询 8.8.8.8 被收编到 AGH（计数增加、AGH 查询日志可见）
+  - 例外设备（skip_devices）写入 dns_hijack_skip4/6 后确实不被重定向
+  - 延迟自动回滚：--arm 后 --disarm 可取消；不取消则到点自动还原 UCI + 规则文件
+  - AGH 停机时 dnsguard-apply 返回 status=error 且不落盘（安全闸门生效）
+  - 控制器打桩直调 action_api：12 个分支全部返回合法 JSON
+  - LAN 网段探测：/24、/16、/8、/12、/25、/30 六种前缀算出的网络地址均正确
diff --git a/luci-app-dnsguard/deploy.sh b/luci-app-dnsguard/deploy.sh
new file mode 100755
index 000000000..f65412525
--- /dev/null
+++ b/luci-app-dnsguard/deploy.sh
@@ -0,0 +1,96 @@
+#!/bin/sh
+# deploy.sh —— 把「DNS 防绕过」LuCI 应用从电脑部署到路由器（在电脑上执行）
+#
+#   ./deploy.sh --check     只做语法检查，不往路由器写任何文件
+#   ./deploy.sh --install   上传并安装（会先备份旧文件到 /mnt/data/backup-dnsguard/）
+#
+# 生成：WorkBuddy  2026-09-26
+# 注意：本机 Git Bash 的 PATH 里可能没有 coreutils，先执行
+#   export PATH="/c/Users/27970/.workbuddy/binaries/PortableGit/versions/1.2.0/usr/bin:$PATH"
+
+set -u
+DIR=$(cd "$(dirname "$0")" && pwd)
+MODE="${1:---check}"
+LUA_CTRL="$DIR/root/usr/lib/lua/luci/controller/dnsguard.lua"
+LUA_VIEW="$DIR/root/usr/lib/lua/luci/view/dnsguard/main.htm"
+SH_APPLY="$DIR/root/usr/bin/dnsguard-apply"
+SH_TEST="$DIR/root/usr/bin/dnsguard-selftest"
+SH_ROLL="$DIR/root/usr/bin/dnsguard-rollback"
+SH_INIT="$DIR/root/etc/init.d/dnsguard"
+SH_INSTALL="$DIR/install.sh"
+
+echo "== 1) 本地 shell 语法检查 =="
+for f in "$SH_APPLY" "$SH_TEST" "$SH_ROLL" "$SH_INIT" "$SH_INSTALL"; do
+	if [ -f "$f" ] && sh -n "$f" 2>/tmp/.dg-sh.err; then
+		echo "   OK   $(basename "$f")"
+	else
+		echo "   FAIL $(basename "$f")"; cat /tmp/.dg-sh.err 2>/dev/null; exit 1
+	fi
+done
+rm -f /tmp/.dg-sh.err
+
+echo "== 2) JSON 检查（acl 文件）=="
+if command -v python >/dev/null 2>&1; then
+	python -c "import json,sys;json.load(sys.stdin);print('   OK   acl json')" \
+		< "$DIR/root/usr/share/rpcd/acl.d/luci-app-dnsguard.json" || exit 1
+else
+	echo "   SKIP 没有 python，跳过（内容很短，可肉眼核对）"
+fi
+
+echo "== 3) Lua 语法检查（借路由器上的 lua 解释器，只读 stdin，不在设备上写文件）=="
+if ssh -o ConnectTimeout=8 router 'command -v lua >/dev/null 2>&1'; then
+	if ssh router 'lua -e "local s=io.read(\"*a\"); local f,e=loadstring(s); if f then print(\"   OK   controller\") else print(\"   FAIL \"..tostring(e)); os.exit(1) end"' < "$LUA_CTRL"; then
+		echo "   controller 语法通过"
+	else
+		echo "   controller 语法失败"; exit 1
+	fi
+	# 视图里的 Lua 只取 <% ... %> 块（跳过 <%+include%> 与 <%=expr%>）
+	awk '/^<%/ && $0 !~ /^<%[+="]/ { inb=1; sub(/^<%/,"") } inb { if (/%>/) { sub(/%>.*/,""); print; inb=0 } else print }' "$LUA_VIEW" > /tmp/.dg-view.lua
+	echo "   （视图内嵌 Lua 片段 $(wc -l < /tmp/.dg-view.lua) 行）"
+	if ssh router 'lua -e "local s=io.read(\"*a\"); local f,e=loadstring(s); if f then print(\"   OK   view-lua\") else print(\"   FAIL \"..tostring(e)); os.exit(1) end"' < /tmp/.dg-view.lua; then
+		echo "   视图 Lua 语法通过"
+	else
+		echo "   视图 Lua 语法失败"; exit 1
+	fi
+	rm -f /tmp/.dg-view.lua
+else
+	echo "   SKIP 路由器上没有 lua 命令"
+fi
+
+echo "== 4) 渲染脚本语法自检（在设备上以 --render-only 跑一次，不碰防火墙）=="
+if [ "$MODE" = "--check" ]; then
+	if ssh -o ConnectTimeout=8 router 'test -x /usr/bin/dnsguard-apply'; then
+		ssh router '/usr/bin/dnsguard-apply --render-only --out /tmp/dg-check.nft' 2>&1 | sed 's/^/   /'
+		ssh router 'rm -f /tmp/dg-check.nft'
+	else
+		echo "   SKIP 尚未安装到设备（安装后再跑本项）"
+	fi
+fi
+
+if [ "$MODE" = "--check" ]; then
+	echo
+	echo "全部检查通过（未改动路由器上的任何文件）。"
+	exit 0
+fi
+
+if [ "$MODE" != "--install" ]; then
+	echo "未知参数：$MODE（可用 --check / --install）" >&2
+	exit 1
+fi
+
+echo "== 5) 打包上传 =="
+TARBALL=/tmp/luci-app-dnsguard.tgz
+STAGE=/tmp/.dg-stage.$$
+rm -rf "$STAGE"; mkdir -p "$STAGE"
+cp -r "$DIR/root" "$DIR/install.sh" "$STAGE/"
+tar czf "$TARBALL" -C "$STAGE" .
+rm -rf "$STAGE"
+echo "   包大小：$(wc -c < "$TARBALL") 字节"
+cat "$TARBALL" | ssh router 'cat > /tmp/luci-app-dnsguard.tgz'
+rm -f "$TARBALL"
+
+echo "== 6) 在路由器上安装 =="
+ssh router 'cd /tmp && rm -rf /tmp/luci-app-dnsguard && mkdir -p /tmp/luci-app-dnsguard && tar xzf /tmp/luci-app-dnsguard.tgz -C /tmp/luci-app-dnsguard && sh /tmp/luci-app-dnsguard/install.sh'
+
+echo
+echo "部署结束。请在浏览器打开 http://192.168.1.1 -> 服务 -> DNS 防绕过"
diff --git a/luci-app-dnsguard/install.sh b/luci-app-dnsguard/install.sh
new file mode 100755
index 000000000..6d14d6393
--- /dev/null
+++ b/luci-app-dnsguard/install.sh
@@ -0,0 +1,137 @@
+#!/bin/sh
+# install.sh —— 在路由器上安装「DNS 防绕过」LuCI 应用（纯文件，无 apk 包管理）
+#
+# 前提：部署包已解到 /tmp/luci-app-dnsguard/（deploy.sh 会自动做）
+# 重要：本脚本**不碰防火墙**。规则文件 /etc/nftables.d/20-dns-guard.nft 只会在
+#       你在界面点「保存并应用」时由 dnsguard-apply 生成 —— 安装阶段零网络风险。
+#
+# 特性：① 覆盖前自动备份到 /mnt/data/backup-dnsguard/<时间戳>/
+#       ② /etc/config/dnsguard 已存在则不覆盖
+#       ③ 首次安装会读现有 nft 文件，把"现在到底开没开"回填进 UCI
+#
+# 生成：WorkBuddy  2026-09-26
+
+SRC=/tmp/luci-app-dnsguard/root
+TS=$(date +%Y%m%d-%H%M%S)
+BAK=/mnt/data/backup-dnsguard/$TS
+NFOUT=/etc/nftables.d/20-dns-guard.nft
+
+if [ ! -d "$SRC" ]; then
+	echo "错误：找不到 $SRC，请先运行 deploy.sh 上传" >&2
+	exit 1
+fi
+
+FILES="etc/config/dnsguard etc/init.d/dnsguard usr/bin/dnsguard-apply usr/bin/dnsguard-selftest usr/bin/dnsguard-rollback usr/lib/lua/luci/controller/dnsguard.lua usr/lib/lua/luci/view/dnsguard/main.htm usr/share/rpcd/acl.d/luci-app-dnsguard.json"
+
+# 从 br-lan 的 IPv4 地址推出网络地址 CIDR（掉主机位）。
+# 为什么需要：仓库里带的默认配置用 192.168.1.0/24 作占位，装到别人的网络上必须自动纠正成真实网段，
+# 否则「永不劫持」集合会写错，重定向可能把指向内网 DNS 的查询也一起改道。
+lan_cidr() {
+	l=$(ip -4 addr show dev br-lan 2>/dev/null | sed -n 's#.*inet \([0-9.]*/[0-9]*\).*#\1#p' | head -1)
+	[ -n "$l" ] || return 1
+	printf '%s\n' "$l" | awk -F'[./]' '{
+		p = $5 + 0
+		if (p < 0 || p > 32) { exit 1 }
+		m = 0
+		for (i = 0; i < p; i++) m += 2 ^ (31 - i)
+		printf "%d.%d.%d.%d/%d\n", and($1, int(m/16777216) % 256), and($2, int(m/65536) % 256), and($3, int(m/256) % 256), and($4, m % 256), p
+	}'
+}
+
+# ---------- 1. 备份 ----------
+mkdir -p "$BAK"
+for f in $FILES; do
+	if [ -f "/$f" ]; then
+		mkdir -p "$BAK/$(dirname "$f")"
+		cp "/$f" "$BAK/$f"
+	fi
+done
+echo "已备份旧文件 -> $BAK"
+
+# ---------- 2. 拷文件 ----------
+FIRST_INSTALL=0
+if [ -f /etc/config/dnsguard ]; then
+	echo "已存在 /etc/config/dnsguard —— 保留不动（你的配置不会被覆盖）"
+else
+	cp "$SRC/etc/config/dnsguard" /etc/config/dnsguard
+	FIRST_INSTALL=1
+	echo "已写入默认 UCI 配置"
+fi
+chmod 600 /etc/config/dnsguard
+
+# 首次安装：把默认配置里的占位网段 192.168.1.0/24 换成本机真实 LAN 网段
+if [ "$FIRST_INSTALL" = "1" ]; then
+	LAN=$(lan_cidr)
+	if [ -n "$LAN" ]; then
+		OLD_NH4=$(uci -q get dnsguard.limits.never_hijack4)
+		NEW_NH4=$(printf '%s' "$OLD_NH4" | sed "s#192\.168\.1\.0/24#$LAN#")
+		if [ "$NEW_NH4" != "$OLD_NH4" ]; then
+			uci -q set dnsguard.limits.never_hijack4="$NEW_NH4"
+			uci -q commit dnsguard
+			echo "已按本机网段修正「永不劫持」：$LAN"
+		fi
+	else
+		echo "警告：未能探测 br-lan 网段，请到界面确认「永不劫持（IPv4）」是否为你真实的 LAN 网段" >&2
+	fi
+fi
+
+# 配置自检：整个文件必须能被 UCI 解析。
+# 踩过的坑：两个节的「名字」相同会让整个文件直接不可用，而 uci -q set 是静默失败 ——
+# 结果就是"配了等于没配"，必须在这里拦住。
+if ! uci -q show dnsguard >/dev/null 2>&1; then
+	echo "错误：/etc/config/dnsguard 无法被 UCI 解析（多半是分节名重复）—— 已中止安装" >&2
+	uci show dnsguard >&2
+	exit 1
+fi
+echo "配置解析自检通过"
+
+for f in usr/bin/dnsguard-apply usr/bin/dnsguard-selftest usr/bin/dnsguard-rollback; do
+	cp "$SRC/$f" "/$f"
+	chmod 755 "/$f"
+done
+cp "$SRC/etc/init.d/dnsguard" /etc/init.d/dnsguard
+chmod 755 /etc/init.d/dnsguard
+
+mkdir -p /usr/lib/lua/luci/controller /usr/lib/lua/luci/view/dnsguard /usr/share/rpcd/acl.d
+cp "$SRC/usr/lib/lua/luci/controller/dnsguard.lua" /usr/lib/lua/luci/controller/dnsguard.lua
+cp "$SRC/usr/lib/lua/luci/view/dnsguard/main.htm" /usr/lib/lua/luci/view/dnsguard/main.htm
+cp "$SRC/usr/share/rpcd/acl.d/luci-app-dnsguard.json" /usr/share/rpcd/acl.d/luci-app-dnsguard.json
+echo "程序文件已安装"
+
+# 让 /etc/init.d/dnsguard 进入启动序列（boot() 是空实现，开机不做任何动作）
+/etc/init.d/dnsguard enable >/dev/null 2>&1
+
+# ---------- 3. 首次安装：读现有 nft 文件，回填 UCI ----------
+SEEDED=0
+if [ -f "$NFOUT" ]; then
+	if grep -q 'dns_guard_redirect' "$NFOUT" 2>/dev/null; then
+		uci -q set dnsguard.main.redirect53='1'; SEEDED=1
+	fi
+	if grep -q 'dns_guard_pre_forward' "$NFOUT" 2>/dev/null; then
+		uci -q set dnsguard.main.watch='1'; SEEDED=1
+	fi
+	if grep -q 'dns_guard_block' "$NFOUT" 2>/dev/null; then
+		uci -q set dnsguard.main.block853='1'; SEEDED=1
+	fi
+	if [ "$SEEDED" = "0" ]; then
+		# 文件存在但不含任何我们的链 -> 认为这是纯观察期的老文件
+		uci -q set dnsguard.main.watch='1'; SEEDED=1
+	fi
+fi
+
+if [ "$SEEDED" = "1" ]; then
+	uci -q commit dnsguard
+	chmod 600 /etc/config/dnsguard
+	echo "已把现有防火墙状态回填进 UCI（WebUI 打开即可看到当前值）"
+	echo "  自检 enabled='$(uci -q get dnsguard.main.enabled)'  redirect53='$(uci -q get dnsguard.main.redirect53)'  watch='$(uci -q get dnsguard.main.watch)'"
+fi
+
+# ---------- 4. 让 LuCI 认到新菜单 ----------
+rm -f /tmp/luci-indexcache* 2>/dev/null
+/etc/init.d/rpcd reload >/dev/null 2>&1
+/etc/init.d/uhttpd reload >/dev/null 2>&1
+
+echo
+echo "安装完成（未改动任何防火墙规则）。入口：LuCI -> 服务 -> DNS 防绕过"
+echo "回滚：cp -r $BAK/* / && rm -f /usr/lib/lua/luci/controller/dnsguard.lua && rm -rf /usr/lib/lua/luci/view/dnsguard /usr/share/rpcd/acl.d/luci-app-dnsguard.json /etc/init.d/dnsguard && rm -f /tmp/luci-indexcache*"
+exit 0
diff --git a/luci-app-dnsguard/push-github.sh b/luci-app-dnsguard/push-github.sh
new file mode 100755
index 000000000..2b56a7bc2
--- /dev/null
+++ b/luci-app-dnsguard/push-github.sh
@@ -0,0 +1,48 @@
+#!/bin/sh
+# push-github.sh —— 把 luci-app-dnsguard 推到 GitHub（dellzou/luci-app-dnsguard）
+#
+# 为什么单独写这个脚本：WorkBuddy 的 GitHub 连接器（Copilot 作用域）**没有建仓权限**
+# （create_repository 返回 403 Resource not accessible by integration），
+# 而 GitHub 也不会因为一次 push 就自动建仓。所以第一次必须先在网页建一个**空仓库**。
+#
+# 用法：
+#   sh push-github.sh            # 预检 + 推送
+#
+# 前置：先在 https://github.com/new 建仓库
+#   Repository name : luci-app-dnsguard
+#   Public / Private: 自选（建议 Public，和 luci-app-routerreport 一致）
+#   ⚠️ 不要勾 Add a README / .gitignore / license —— 勾了就会和本地历史冲突
+
+set -u
+REPO="git@github.com:dellzou/luci-app-dnsguard.git"
+DIR=$(cd "$(dirname "$0")" && pwd)
+
+cd "$DIR" || exit 1
+
+echo "== 1) SSH 鉴权 =="
+ssh -o ConnectTimeout=10 -T git@github.com 2>&1 | grep -q 'Hi dellzou' \
+	&& echo "   OK  已认证为 dellzou" \
+	|| { echo "   FAIL 密钥未生效（期望 'Hi dellzou!'）"; exit 1; }
+
+echo "== 2) 远端仓库是否存在 =="
+if git ls-remote "$REPO" >/dev/null 2>&1; then
+	echo "   OK  远端可达"
+else
+	echo "   FAIL 仓库还不存在。请先到 https://github.com/new 建一个空仓库："
+	echo "        name = luci-app-dnsguard（不要勾 README/.gitignore/license）"
+	exit 1
+fi
+
+echo "== 3) 本地待推内容 =="
+git log --oneline | head -5
+echo "   tag: $(git tag -l | tr '\n' ' ')"
+echo "   待推提交数: $(git rev-list --count HEAD)  文件数: $(git ls-files | wc -l)"
+
+echo "== 4) 推送 =="
+git branch -M main 2>/dev/null || true
+git remote set-url origin "$REPO" 2>/dev/null || git remote add origin "$REPO"
+git push -u origin main
+git push origin --tags
+
+echo
+echo "完成：https://github.com/dellzou/luci-app-dnsguard"
diff --git a/luci-app-dnsguard/root/etc/config/dnsguard b/luci-app-dnsguard/root/etc/config/dnsguard
new file mode 100644
index 000000000..6a5f1c2fb
--- /dev/null
+++ b/luci-app-dnsguard/root/etc/config/dnsguard
@@ -0,0 +1,17 @@
+config dnsguard 'main'
+	option enabled '1'
+	option redirect53 '0'
+	option watch '1'
+	option block853 '0'
+	option blockdoh '0'
+	option target_port '53'
+	option ifaces 'br-lan'
+	option skip_devices ''
+	option log_limit '5'
+	option rollback_minutes '10'
+	option logpath '/mnt/data/logs/messages'
+
+config limits 'limits'
+	option never_hijack4 '192.168.1.0/24 172.16.0.0/12 127.0.0.0/8 169.254.0.0/16 224.0.0.0/4'
+	option never_hijack6 'fd00::/8 fe80::/10 ff00::/8'
+	option doh_servers '1.1.1.1 1.0.0.1 8.8.8.8 8.8.4.4 9.9.9.9 149.112.112.112 208.67.222.222 208.67.220.220 94.140.14.14 94.140.15.15 223.5.5.5 223.6.6.6 119.29.29.29 182.254.116.116 114.114.114.114 114.114.115.115 180.76.76.76 117.50.11.11 52.80.66.66 101.226.4.6 218.30.118.6 123.125.81.6 140.207.198.6'
diff --git a/luci-app-dnsguard/root/etc/init.d/dnsguard b/luci-app-dnsguard/root/etc/init.d/dnsguard
new file mode 100755
index 000000000..5785aa62b
--- /dev/null
+++ b/luci-app-dnsguard/root/etc/init.d/dnsguard
@@ -0,0 +1,32 @@
+#!/bin/sh /etc/rc.common
+# dnsguard —— DNS 防绕过服务封装（纯文件应用，无 procd 常驻进程）
+#
+# 规则真正的生效路径是 fw4 在启动/重载时 include /etc/nftables.d/20-dns-guard.nft，
+# 所以开机不需要本脚本做任何事（boot 为空实现）；这里只提供手工 reload / 临时卸载。
+#
+# 生成：WorkBuddy  2026-09-26
+
+START=99
+STOP=10
+
+boot() {
+	# 开机不做动作：规则文件由 fw4 include，本脚本若在 AGH 起来之前跑会被安全闸门拒绝
+	return 0
+}
+
+start() {
+	/usr/bin/dnsguard-apply --quiet
+}
+
+reload() {
+	/usr/bin/dnsguard-apply --quiet
+}
+
+stop() {
+	# 只临时摘掉本应用注入的链（配置文件不动，fw4 reload 后会按配置恢复）
+	nft delete chain inet fw4 dns_guard_redirect 2>/dev/null
+	nft delete chain inet fw4 dns_guard_block 2>/dev/null
+	nft delete chain inet fw4 dns_guard_pre_forward 2>/dev/null
+	logger -t dnsguard "已临时移除 DNS 防绕过链（配置未改，fw4 reload 后恢复）"
+	echo "已临时移除 DNS 防绕过链（配置未改，fw4 reload 后恢复）"
+}
diff --git a/luci-app-dnsguard/root/usr/bin/dnsguard-apply b/luci-app-dnsguard/root/usr/bin/dnsguard-apply
new file mode 100755
index 000000000..7b0fea5cc
--- /dev/null
+++ b/luci-app-dnsguard/root/usr/bin/dnsguard-apply
@@ -0,0 +1,388 @@
+#!/bin/sh
+# dnsguard-apply —— 把 UCI(/etc/config/dnsguard) 渲染成 /etc/nftables.d/20-dns-guard.nft 并应用
+#
+# 设计原则（与邮件日报应用一致）：本脚本是唯一"写防火墙"的地方，WebUI 只调用它。
+#
+#   用法：
+#     dnsguard-apply                    渲染 + 校验 + 落盘 + fw4 reload，输出一行 JSON
+#     dnsguard-apply --quiet            同上，不输出
+#     dnsguard-apply --render-only      只渲染到 --out 指定文件（不动 /etc、不 reload），用于界面预览
+#     dnsguard-apply --no-reload        渲染 + 落盘，但不 reload（文件变更下次 fw4 reload 生效）
+#
+#   安全闸门：
+#     ① 片段先包进临时表名做 nft -c 语法校验，不通过绝不落盘
+#     ② 落盘后用 fw4 check 全量校验真实规则集，不通过立即还原旧文件
+#     ③ reload 后核对 dns_guard_redirect 链是否真的存在，不存在立即还原
+#     ④ redirect53=1 而 AdGuardHome 未运行 -> 直接拒绝（不然全屋解析全挂）
+#
+# 生成：WorkBuddy  2026-09-26
+
+set -u
+
+CFG=dnsguard
+OUT=/etc/nftables.d/20-dns-guard.nft
+BAKDIR=/mnt/data/backup-dnsguard
+GENMARK='由 LuCI 应用「DNS 防绕过」自动生成'
+
+QUIET=0
+RENDER_ONLY=0
+NO_RELOAD=0
+OUTFILE=""
+
+while [ $# -gt 0 ]; do
+	case "$1" in
+		--quiet)       QUIET=1 ;;
+		--render-only) RENDER_ONLY=1 ;;
+		--no-reload)   NO_RELOAD=1 ;;
+		--out)         shift; OUTFILE="${1:-}" ;;
+		*) : ;;
+	esac
+	shift
+done
+
+# ---------------- 工具 ----------------
+
+uget() { uci -q get "$CFG.$1" 2>/dev/null; }
+
+bool() {
+	case "${1:-}" in
+		1|on|true|yes|enabled) echo 1 ;;
+		*) echo 0 ;;
+	esac
+}
+
+digits_only() { printf '%s' "${1:-}" | tr -dc '0-9'; }
+
+# 单行转义成 JSON 字符串内容（换行 -> \n，反斜杠与双引号转义）
+jesc() {
+	printf '%s' "${1:-}" | tr '\n' '\001' | sed 's/\\/\\\\/g; s/"/\\"/g' | tr '\001' '\n' | awk '{printf "%s\\n", $0}' | sed 's/\\n$//'
+}
+
+# 统一的行输出：整行作为单个参数传入，避免 ${VAR} 里的双引号被 shell 吃掉
+p() { printf '%s\n' "$1"; }
+
+out_json() {
+	[ "$QUIET" -eq 1 ] && return 0
+	printf '%s\n' "$1"
+}
+
+EMIT_JSON() {
+	out_json "{\"status\":\"${STATUS:-error}\",\"message\":\"$(jesc "${MSG:-}")\",\"enabled\":\"${ENABLED:-0}\",\"redirect\":\"${REDIRECT:-0}\",\"watch\":\"${WATCH:-0}\",\"block853\":\"${B853:-0}\",\"blockdoh\":\"${BDOH:-0}\",\"file\":\"${FILE_STATE:-none}\",\"reload\":\"${RELOAD_STATE:-skipped}\",\"redirect_active\":\"${REDIRECT_ACTIVE:-0}\",\"target\":\"${TARGET:-53}\",\"ifaces\":\"$(jesc "${IFACES:-}")\",\"backup\":\"$(jesc "${BAK_TS:-}")\"}"
+}
+
+fail() {
+	STATUS=error
+	MSG="$1"
+	EMIT_JSON
+	exit "${2:-1}"
+}
+
+# 只保留合法 IP/CIDR，其余丢弃 —— 防止把垃圾写进 nft 导致整个防火墙加载失败
+# ⚠️ 必须用 printf '%s\n' 补结尾换行：否则 while read 会把「最后一个元素」丢掉（踩过）
+set_elems() {
+	printf '%s\n' "${1:-}" | sed 's/[[:space:]]\{1,\}/\n/g' | while read -r e; do
+		[ -n "$e" ] || continue
+		case "$e" in
+			*:*)
+				printf '%s' "$e" | grep -qE '^[0-9a-fA-F:]+(/[0-9]{1,3})?$' && printf '%s ' "$e" ;;
+			*)
+				printf '%s' "$e" | grep -qE '^([0-9]{1,3}\.){3}[0-9]{1,3}(/[0-9]{1,2})?$' && printf '%s ' "$e" ;;
+		esac
+	done
+}
+
+# 允许的入接口（字母数字点下划线连字符）
+set_ifaces() {
+	printf '%s\n' "${1:-}" | sed 's/[[:space:]]\{1,\}/\n/g' | while read -r e; do
+		[ -n "$e" ] || continue
+		printf '%s' "$e" | grep -qE '^[0-9A-Za-z._-]+$' && printf '%s ' "$e"
+	done
+}
+
+split4() { for e in ${1:-}; do case "$e" in *:*) : ;; *) printf '%s ' "$e" ;; esac; done; }
+split6() { for e in ${1:-}; do case "$e" in *:*) printf '%s ' "$e" ;; *) : ;; esac; done; }
+
+# 空格分隔 -> nft 集合元素 "a, b, c"
+join_elems() {
+	printf '%s' "${1:-}" | sed 's/^ *//; s/ *$//; s/  */, /g'
+}
+
+# ---------------- 1. 读配置 ----------------
+
+ENABLED=$(bool "$(uget main.enabled)")
+REDIRECT=$(bool "$(uget main.redirect53)")
+WATCH=$(bool "$(uget main.watch)")
+B853=$(bool "$(uget main.block853)")
+BDOH=$(bool "$(uget main.blockdoh)")
+
+TARGET=$(digits_only "$(uget main.target_port)"); [ -n "$TARGET" ] || TARGET=53
+LOGLIMIT=$(digits_only "$(uget main.log_limit)"); [ -n "$LOGLIMIT" ] || LOGLIMIT=5
+IFACES=$(set_ifaces "$(uget main.ifaces)")
+[ -n "$IFACES" ] || IFACES="br-lan"
+IFACES=$(printf '%s' "$IFACES" | sed 's/ *$//')
+
+SKIP_RAW=$(set_elems "$(uget main.skip_devices)")
+SKIP4=$(split4 "$SKIP_RAW")
+SKIP6=$(split6 "$SKIP_RAW")
+
+NH4=$(set_elems "$(uget limits.never_hijack4)")
+NH6=$(set_elems "$(uget limits.never_hijack6)")
+DOH=$(set_elems "$(uget limits.doh_servers)")
+
+# 接口集合：单接口写 "br-lan"，多接口写 { "a", "b" }
+IIF_RENDER=$(printf '%s' "$IFACES" | sed 's/^ *//; s/ *$//' | awk '{
+	n = split($0, a, " ")
+	if (n <= 1) { print "\"" a[1] "\"" }
+	else { s = "{ "; for (i = 1; i <= n; i++) { s = s "\"" a[i] "\"" (i < n ? ", " : " ") } s = s "}"; print s }
+}')
+
+STATUS=ok
+MSG=""
+FILE_STATE=none
+RELOAD_STATE=skipped
+REDIRECT_ACTIVE=0
+BAK_TS=""
+
+# 安全闸门 ④：重定向开着但 AGH 没跑 —— 无论如何都不能生成这条规则
+AGH_PID=$(pidof AdGuardHome 2>/dev/null)
+if [ "$ENABLED" = "1" ] && [ "$REDIRECT" = "1" ] && [ -z "$AGH_PID" ]; then
+	fail "AdGuard Home 未运行（pidof 为空）—— 已拒绝应用 53 透明重定向：此时重定向会让全屋解析失败。请先启动 AdGuard Home。" 3
+fi
+
+# ---------------- 2. 渲染 ----------------
+
+TMPD="/tmp/dg-apply.$$"
+mkdir -p "$TMPD" 2>/dev/null
+TMP="$TMPD/20-dns-guard.nft"
+
+gen() {
+	p "## ============================================================"
+	p "## DNS 防绕过 —— ${GENMARK}，请勿手工编辑"
+	p "##   生成时间：$(date '+%Y-%m-%d %H:%M:%S')  （= 规则上一次实际变化的时间；幂等比较时会忽略本行）"
+	p "##   入口：LuCI -> 服务 -> DNS 防绕过    回滚：/usr/bin/dnsguard-rollback"
+	p "##   备份目录：$BAKDIR"
+	p "##   本文件由 fw4 在 inet/fw4 表上下文内 include（见 /etc/nftables.d/README）"
+	p "## ============================================================"
+	p ""
+
+	if [ "$ENABLED" != "1" ]; then
+		p "## 总开关已关闭：不生成任何链（等于恢复出厂状态）"
+		return 0
+	fi
+
+	# ---- 集合 ----
+	if [ -n "$DOH" ]; then
+		p "set doh_servers {"
+		p "	type ipv4_addr"
+		p "	flags interval"
+		p "	elements = { $(join_elems "$DOH") }"
+		p "}"
+		p ""
+	fi
+
+	p "## 永不劫持的目标（内网 / 保留段）—— 避免把指向内网 DNS 的查询也改道"
+	p "set dns_never_hijack4 {"
+	p "	type ipv4_addr"
+	p "	flags interval"
+	[ -n "$NH4" ] && p "	elements = { $(join_elems "$NH4") }"
+	p "}"
+	p ""
+	p "set dns_never_hijack6 {"
+	p "	type ipv6_addr"
+	p "	flags interval"
+	[ -n "$NH6" ] && p "	elements = { $(join_elems "$NH6") }"
+	p "}"
+	p ""
+
+	if [ "$REDIRECT" = "1" ] && [ -n "$SKIP_RAW" ]; then
+		p "## 设备级例外：这些源地址不做透明重定向（界面「例外设备」）"
+		p "set dns_hijack_skip4 {"
+		p "	type ipv4_addr"
+		p "	flags interval"
+		[ -n "$SKIP4" ] && p "	elements = { $(join_elems "$SKIP4") }"
+		p "}"
+		p ""
+		p "set dns_hijack_skip6 {"
+		p "	type ipv6_addr"
+		p "	flags interval"
+		[ -n "$SKIP6" ] && p "	elements = { $(join_elems "$SKIP6") }"
+		p "}"
+		p ""
+	fi
+
+	# ---- 层 ①：53 透明重定向 ----
+	if [ "$REDIRECT" = "1" ]; then
+		if [ -n "$SKIP_RAW" ]; then
+			S4="ip saddr != @dns_hijack_skip4"
+			S6="ip6 saddr != @dns_hijack_skip6"
+		else
+			S4=""
+			S6=""
+		fi
+		p "## 层 ① 53 透明重定向 -> AdGuard Home（nat prerouting priority -105，早于 fw4 dstnat -100）"
+		p "##       客户端无感：以为还在跟 8.8.8.8 说话，实际被改道到本机 :${TARGET}"
+		p "chain dns_guard_redirect {"
+		p "	type nat hook prerouting priority -105; policy accept;"
+		p ""
+		p "	iifname ${IIF_RENDER} meta l4proto { tcp, udp } th dport 53 ${S4} ip daddr != @dns_never_hijack4 counter redirect to :${TARGET}"
+		p "	iifname ${IIF_RENDER} meta l4proto { tcp, udp } th dport 53 ${S6} ip6 daddr != @dns_never_hijack6 counter redirect to :${TARGET}"
+		p "}"
+		p ""
+	fi
+
+	# ---- 层 ②③：853 / DoH 阻断（默认关闭）----
+	if [ "$B853" = "1" ] || [ "$BDOH" = "1" ]; then
+		p "## 层 ②③ 853(DoT) 与 DoH 专用地址阻断（filter forward priority -2，早于 fw4 默认链）"
+		p "chain dns_guard_block {"
+		p "	type filter hook forward priority -2; policy accept;"
+		p ""
+		if [ "$B853" = "1" ]; then
+			if [ -n "$SKIP_RAW" ]; then SB="ip saddr != @dns_hijack_skip4"; else SB=""; fi
+			p "	## DoT 阻断：客户端会回落到明文 53，从而被上面的重定向收编"
+			p "	iifname ${IIF_RENDER} meta l4proto tcp th dport 853 ${SB} counter reject with tcp reset"
+			p "	iifname ${IIF_RENDER} meta l4proto udp th dport 853 ${SB} counter reject"
+			p ""
+		fi
+		if [ "$BDOH" = "1" ] && [ -n "$DOH" ]; then
+			p "	## DoH 专用地址阻断（按 IP 命中，可能误伤「恰好也在这个 IP 上」的其它服务，慎用）"
+			p "	iifname ${IIF_RENDER} tcp dport 443 ip daddr @doh_servers counter reject with tcp reset"
+			p ""
+		fi
+		p "}"
+		p ""
+	fi
+
+	# ---- 观察计数（阶段 1 沿用）----
+	if [ "$WATCH" = "1" ]; then
+		p "## 观察计数：只计数 + 抽样记日志，不拦截"
+		p "##   注意：53 被上面重定向后不再进 forward 链，此链的 53 计数会趋近于 0（只剩 853/DoH）"
+		p "chain dns_guard_pre_forward {"
+		p "	type filter hook forward priority -1; policy accept;"
+		p ""
+		p "	iifname ${IIF_RENDER} oifname \"pppoe-wan\" meta l4proto { tcp, udp } th dport { 53, 853 } counter log prefix \"DNS-BYPASS-53853: \" limit rate ${LOGLIMIT}/minute"
+		[ -n "$DOH" ] && p "	iifname ${IIF_RENDER} oifname \"pppoe-wan\" meta l4proto tcp th dport 443 ip daddr @doh_servers counter log prefix \"DNS-BYPASS-DOH: \" limit rate ${LOGLIMIT}/minute"
+		p "}"
+		p ""
+	fi
+
+	return 0
+}
+
+gen > "$TMP" 2>/dev/null
+
+if [ ! -s "$TMP" ]; then
+	rm -rf "$TMPD"
+	fail "渲染失败：生成的规则文件为空" 4
+fi
+
+# ---------------- 3. 语法校验（临时表包裹）----------------
+
+validate() {
+	CK="$TMPD/check.nft"
+	{ echo "table inet dgcheck {"; cat "$1"; echo "}"; } > "$CK" 2>/dev/null
+	ERR=$(nft -c -f "$CK" 2>&1)
+	RC=$?
+	rm -f "$CK"
+	if [ "$RC" -ne 0 ]; then
+		printf '%s' "$ERR"
+		return 1
+	fi
+	return 0
+}
+
+ERRMSG=$(validate "$TMP")
+if [ -n "$ERRMSG" ]; then
+	rm -rf "$TMPD"
+	fail "nft 语法校验未通过，已中止（未改动任何文件）：$ERRMSG" 5
+fi
+
+# ---------------- 4. 仅渲染（界面预览）----------------
+
+if [ "$RENDER_ONLY" -eq 1 ]; then
+	DEST="${OUTFILE:-/tmp/dg-preview.nft}"
+	cp "$TMP" "$DEST" 2>/dev/null
+	rm -rf "$TMPD"
+	STATUS=ok
+	MSG="已渲染到 $DEST（未应用到防火墙）"
+	FILE_STATE=preview
+	EMIT_JSON
+	exit 0
+fi
+
+# ---------------- 5. 落盘 + 应用 ----------------
+
+# 幂等比较：必须忽略会变的「生成时间」行，否则每次都比出差异、白白重载一次防火墙
+strip_volatile() { sed '/^##   生成时间：/d' "$1"; }
+
+if [ -f "$OUT" ]; then
+	strip_volatile "$TMP" > "$TMPD/norm.new" 2>/dev/null
+	strip_volatile "$OUT" > "$TMPD/norm.old" 2>/dev/null
+	if cmp -s "$TMPD/norm.new" "$TMPD/norm.old"; then
+		FILE_STATE=unchanged
+		rm -rf "$TMPD"
+		if [ "$REDIRECT" = "1" ]; then
+			nft list chain inet fw4 dns_guard_redirect >/dev/null 2>&1 && REDIRECT_ACTIVE=1
+		fi
+		STATUS=ok
+		MSG="规则无变化（未重新加载防火墙）"
+		EMIT_JSON
+		exit 0
+	fi
+fi
+
+# 备份旧文件
+OLD="/tmp/dg-old.$$.nft"
+cp "$OUT" "$OLD" 2>/dev/null
+if [ -f "$OUT" ]; then
+	BAK_TS=$(date +%Y%m%d-%H%M%S)
+	mkdir -p "$BAKDIR/$BAK_TS" 2>/dev/null
+	cp "$OUT" "$BAKDIR/$BAK_TS/20-dns-guard.nft" 2>/dev/null
+fi
+
+cp "$TMP" "$OUT" 2>/dev/null
+chmod 644 "$OUT" 2>/dev/null
+FILE_STATE=written
+
+# fw4 全量校验：不通过就立刻还原
+if ! fw4 check >/dev/null 2>&1; then
+	CKERR=$(fw4 check 2>&1 | grep -v 'Automatically including' | grep -v 'docker_nat' | head -5)
+	if [ -f "$OLD" ]; then
+		cp "$OLD" "$OUT" 2>/dev/null
+	else
+		rm -f "$OUT"
+	fi
+	rm -f "$OLD"; rm -rf "$TMPD"
+	fail "fw4 全量校验未通过，已还原旧规则：$CKERR" 6
+fi
+
+if [ "$NO_RELOAD" -eq 1 ]; then
+	RELOAD_STATE="deferred"
+	rm -f "$OLD"; rm -rf "$TMPD"
+	STATUS=ok
+	MSG="规则已写入 $OUT（未重载，下次防火墙重载生效）"
+	EMIT_JSON
+	exit 0
+fi
+
+fw4 reload >/dev/null 2>&1
+RELOAD_STATE=done
+
+# 应用后核对：开了重定向就必须真有这条链
+if [ "$REDIRECT" = "1" ]; then
+	if nft list chain inet fw4 dns_guard_redirect >/dev/null 2>&1; then
+		REDIRECT_ACTIVE=1
+	else
+		if [ -f "$OLD" ]; then
+			cp "$OLD" "$OUT" 2>/dev/null
+			fw4 reload >/dev/null 2>&1
+		fi
+		rm -f "$OLD"; rm -rf "$TMPD"
+		fail "规则已写入但重定向链未生效（已还原旧规则）—— 请检查 /etc/nftables.d 与 fw4 日志" 7
+	fi
+fi
+
+rm -f "$OLD"; rm -rf "$TMPD"
+STATUS=ok
+MSG="规则已应用并重载防火墙"
+EMIT_JSON
+exit 0
diff --git a/luci-app-dnsguard/root/usr/bin/dnsguard-rollback b/luci-app-dnsguard/root/usr/bin/dnsguard-rollback
new file mode 100755
index 000000000..a2d7ebf33
--- /dev/null
+++ b/luci-app-dnsguard/root/usr/bin/dnsguard-rollback
@@ -0,0 +1,135 @@
+#!/bin/sh
+# dnsguard-rollback —— 回滚点管理与自动回滚
+#
+#   dnsguard-rollback                     列出可用回滚点
+#   dnsguard-rollback --arm [分钟]        把"当前 UCI + 当前规则文件"做成回滚点，并挂倒计时自动回滚
+#   dnsguard-rollback --disarm            取消挂起的自动回滚（= 确认保留；不影响已有回滚点）
+#   dnsguard-rollback --status            输出一行 JSON：挂起状态 + 可用回滚点
+#   dnsguard-rollback <时间戳|latest>      还原到指定回滚点（UCI + 规则文件一起还原）并 reload
+#   dnsguard-rollback --auto  <秒>    内部使用：倒计时结束后自动还原
+#
+# 为什么要有「自动回滚」：DNS 是全家网的命门，改错了人可能连路由器都访问不到（域名解析不了）。
+# 挂一个 N 分钟倒计时，人不在旁边确认就自动还原 —— 与"改 LAN IP 前挂回滚定时器"同一套纪律。
+#
+# 生成：WorkBuddy  2026-09-26
+
+set -u
+
+BAKDIR=/mnt/data/backup-dnsguard
+OUT=/etc/nftables.d/20-dns-guard.nft
+REC=/tmp/.dnsguard-rollback
+LOG_TAG=dnsguard
+
+snapshot() {
+	# snapshot <时间戳>   把 UCI + 当前规则文件存进回滚点目录
+	_t="$1"
+	mkdir -p "$BAKDIR/$_t" 2>/dev/null
+	[ -f "$OUT" ] && cp "$OUT" "$BAKDIR/$_t/20-dns-guard.nft" 2>/dev/null
+	uci export dnsguard > "$BAKDIR/$_t/dnsguard.uci" 2>/dev/null
+	[ -f "$BAKDIR/$_t/dnsguard.uci" ] && chmod 600 "$BAKDIR/$_t/dnsguard.uci" 2>/dev/null
+}
+
+do_restore() {
+	_t="$1"
+	if [ ! -d "$BAKDIR/$_t" ]; then
+		echo "回滚点不存在：$BAKDIR/$_t" >&2
+		return 1
+	fi
+	# 还原 UCI（让界面显示与实际一致）
+	if [ -f "$BAKDIR/$_t/dnsguard.uci" ]; then
+		uci import dnsguard < "$BAKDIR/$_t/dnsguard.uci" 2>/dev/null
+		uci commit dnsguard 2>/dev/null
+	fi
+	# 还原规则文件
+	if [ -f "$BAKDIR/$_t/20-dns-guard.nft" ]; then
+		cp "$BAKDIR/$_t/20-dns-guard.nft" "$OUT" 2>/dev/null
+	else
+		rm -f "$OUT" 2>/dev/null
+	fi
+	fw4 reload >/dev/null 2>&1
+	logger -t "$LOG_TAG" "已回滚到回滚点 $_t（UCI + 规则文件），防火墙已重载"
+	echo "已回滚到 $_t"
+	return 0
+}
+
+# ---------------- 参数分发 ----------------
+
+case "${1:-}" in
+	"")
+		echo "可用回滚点（新 → 旧）："
+		ls -1t "$BAKDIR" 2>/dev/null | head -20
+		;;
+
+	--status)
+		PEND=""
+		if [ -f "$REC" ]; then
+			read -r RTS RSEC RDL RSRC < "$REC" 2>/dev/null
+			NOW=$(date +%s)
+			LEFT=$(( ${RDL:-0} - NOW ))
+			[ "$LEFT" -lt 0 ] && LEFT=0
+			PEND="\"pending\":true,\"pending_ts\":\"${RTS:-}\",\"pending_left\":${LEFT},\"pending_total\":${RSEC:-0}"
+		else
+			PEND='"pending":false,"pending_ts":"","pending_left":0,"pending_total":0'
+		fi
+		LIST=""
+		for d in $(ls -1t "$BAKDIR" 2>/dev/null | head -10); do
+			[ -n "$LIST" ] && LIST="$LIST,"
+			LIST="$LIST\"$d\""
+		done
+		printf '{"status":"ok",%s,"backups":[%s]}\n' "$PEND" "$LIST"
+		;;
+
+	--arm)
+		SEC=$(printf '%s' "${2:-10}" | tr -dc '0-9'); [ -n "$SEC" ] || SEC=10
+		# 秒数上限保护：1 分钟 ~ 120 分钟
+		[ "$SEC" -lt 1 ] && SEC=1
+		[ "$SEC" -gt 120 ] && SEC=120
+		TS=$(date +%Y%m%d-%H%M%S)
+		snapshot "$TS"
+		DL=$(( $(date +%s) + SEC * 60 ))
+		printf '%s %s %s %s\n' "$TS" "$((SEC * 60))" "$DL" "pending" > "$REC"
+		setsid /bin/sh -c "/usr/bin/dnsguard-rollback --auto '$TS' '$((SEC * 60))'" >/dev/null 2>&1 &
+		logger -t "$LOG_TAG" "已挂自动回滚：$SEC 分钟后（若无确认）还原到回滚点 $TS"
+		printf '{"status":"ok","ts":"%s","seconds":%s}\n' "$TS" "$((SEC * 60))"
+		;;
+
+	--disarm)
+		if [ -f "$REC" ]; then
+			read -r RTS RSEC RDL RSRC < "$REC" 2>/dev/null
+			rm -f "$REC"
+			# 尽力杀掉倒计时进程；即使没杀干净，--auto 也会因为记录文件不存在而放弃
+			for pid in $(ps w 2>/dev/null | grep '[d]nsguard-rollback --auto' | awk '{print $1}'); do
+				kill "$pid" 2>/dev/null
+			done
+			logger -t "$LOG_TAG" "已取消自动回滚（确认保留当前设置），回滚点 $RTS 仍保留"
+			printf '{"status":"ok","message":"已取消自动回滚，当前设置被保留","ts":"%s"}\n' "$RTS"
+		else
+			printf '{"status":"ok","message":"没有挂起的自动回滚"}\n'
+		fi
+		;;
+
+	--auto)
+		TS="${2:-}"
+		SEC="${3:-600}"
+		sleep "$SEC" 2>/dev/null
+		# 记录文件是唯一真相：被 --disarm 删掉、或被后来的 --arm 覆盖，就什么都不做
+		[ -f "$REC" ] || exit 0
+		read -r RTS RSEC RDL RSRC < "$REC" 2>/dev/null
+		[ "${RTS:-}" = "$TS" ] || exit 0
+		rm -f "$REC"
+		logger -t "$LOG_TAG" "自动回滚触发：$((SEC / 60)) 分钟内未确认，正在还原到 $TS"
+		do_restore "$TS" >/dev/null 2>&1
+		exit 0
+		;;
+
+	*)
+		TS="$1"
+		if [ "$TS" = "latest" ]; then
+			TS=$(ls -1t "$BAKDIR" 2>/dev/null | head -1)
+		fi
+		[ -n "$TS" ] || { echo "找不到回滚点" >&2; exit 1; }
+		do_restore "$TS"
+		;;
+esac
+
+exit 0
diff --git a/luci-app-dnsguard/root/usr/bin/dnsguard-selftest b/luci-app-dnsguard/root/usr/bin/dnsguard-selftest
new file mode 100755
index 000000000..3ea9dd07b
--- /dev/null
+++ b/luci-app-dnsguard/root/usr/bin/dnsguard-selftest
@@ -0,0 +1,131 @@
+#!/bin/sh
+# dnsguard-selftest —— DNS 防绕过健康自检，输出一行 JSON（供 WebUI 渲染）
+#
+#   用法：dnsguard-selftest
+#   只读：不修改任何配置、不重启任何服务
+#
+# 生成：WorkBuddy  2026-09-26
+
+set -u
+
+jesc() {
+	printf '%s' "${1:-}" | tr '\n' '\001' | sed 's/\\/\\\\/g; s/"/\\"/g' | tr '\001' '\n' | awk '{printf "%s\\n", $0}' | sed 's/\\n$//'
+}
+
+ITEMS=""
+add() {
+	# add <名称>  <说明>
+	_n="$1"; _s="$2"; _d="$3"
+	[ -n "$ITEMS" ] && ITEMS="$ITEMS,"
+	ITEMS="$ITEMS{\"name\":\"$(jesc "$_n")\",\"state\":\"$_s\",\"detail\":\"$(jesc "$_d")\"}"
+}
+
+MODE="none"
+
+# ---- 1. AdGuard Home 进程 ----
+AGH_PID=$(pidof AdGuardHome 2>/dev/null)
+if [ -n "$AGH_PID" ]; then
+	add "AdGuard Home 进程" ok "运行中，PID $AGH_PID"
+	AGH_OK=1
+else
+	add "AdGuard Home 进程" fail "未运行 —— 此时若已启用 53 重定向，全屋解析会失败"
+	AGH_OK=0
+fi
+
+# ---- 2. :53 监听 ----
+LISTEN=$(netstat -lntup 2>/dev/null | grep ':53 ' | tr -s ' ' ' ')
+if [ -n "$LISTEN" ]; then
+	add ":53 监听（TCP/UDP）" ok "$(printf '%s' "$LISTEN" | sed 's/ *$//' | tr '\n' ';')"
+	LISTEN_OK=1
+else
+	add ":53 监听（TCP/UDP）" fail "没有任何进程监听 :53"
+	LISTEN_OK=0
+fi
+
+# ---- 3. 本机解析（走 AGH）----
+if [ "$AGH_OK" = 1 ]; then
+	OUT1=$(nslookup baidu.com 127.0.0.1 2>&1)
+	N1=$(printf '%s' "$OUT1" | grep -c 'Address')
+	if [ "${N1:-0}" -ge 2 ]; then
+		IP1=$(printf '%s' "$OUT1" | grep 'Address' | tail -1 | awk '{print $NF}')
+		add "公网域名解析（baidu.com → 127.0.0.1）" ok "成功，返回 $IP1"
+	else
+		add "公网域名解析（baidu.com → 127.0.0.1）" fail "$(printf '%s' "$OUT1" | tr '\n' ' ' | sed 's/  */ /g' | cut -c1-160)"
+	fi
+
+	OUT2=$(nslookup iStoreOS.lan 127.0.0.1 2>&1)
+	N2=$(printf '%s' "$OUT2" | grep -c 'Address')
+	if [ "${N2:-0}" -ge 2 ]; then
+		IP2=$(printf '%s' "$OUT2" | grep 'Address' | tail -1 | awk '{print $NF}')
+		add "本地域名解析（iStoreOS.lan → 127.0.0.1）" ok "成功，返回 $IP2"
+	else
+		add "本地域名解析（iStoreOS.lan → 127.0.0.1）" warn "未返回地址（dnsmasq 5353 或 .lan 转发可能异常）"
+	fi
+else
+	add "本机解析自检" warn "AdGuard Home 未运行，跳过解析测试"
+fi
+
+# ---- 4. 重定向链是否生效 ----
+RED=$(nft list chain inet fw4 dns_guard_redirect 2>/dev/null)
+if printf '%s' "$RED" | grep -q 'chain dns_guard_redirect'; then
+	MODE=redirect
+	RP=$(printf '%s' "$RED" | grep -o 'counter packets [0-9]*' | head -1 | awk '{print $3}')
+	RB=$(printf '%s' "$RED" | grep -o 'bytes [0-9]*' | awk '{s+=$2} END {print s+0}')
+	add "53 透明重定向链" ok "已生效 · 已收编 ${RP:-0} 个包 / ${RB:-0} 字节（自上次重载起）"
+	if [ "${RP:-0}" -gt 0 ]; then
+		add "端到端收编验证" ok "有 LAN 客户端的 53 查询被改道到本机（计数 > 0）"
+	else
+		add "端到端收编验证" warn "计数为 0：可能是刚重载，或当前没有设备使用非本机 DNS"
+	fi
+else
+	add "53 透明重定向链" warn "不存在（未启用，或总开关关闭）"
+fi
+
+# ---- 5. 观察计数链 ----
+OBS=$(nft list chain inet fw4 dns_guard_pre_forward 2>/dev/null)
+if printf '%s' "$OBS" | grep -q 'chain dns_guard_pre_forward'; then
+	CNT=$(printf '%s' "$OBS" | grep -o 'packets [0-9]*' | awk '{print $2}' | tr '\n' ' ')
+	CNT=$(printf '%s' "$CNT" | sed 's/ *$//; s/  */ \/ /g')
+	add "观察计数链" ok "存在 · 各规则包数 ${CNT:-0}"
+else
+	add "观察计数链" warn "不存在（观察模式未启用）"
+fi
+
+# ---- 6. 规则文件归属 ----
+FN=/etc/nftables.d/20-dns-guard.nft
+if [ -f "$FN" ]; then
+	MT=$(stat -c '%y' "$FN" 2>/dev/null | cut -c1-19)
+	if grep -q 'DNS 防绕过' "$FN" 2>/dev/null; then
+		add "规则文件" ok "$FN · 由本应用托管 · 最后生成 $MT"
+	else
+		add "规则文件" warn "$FN 存在但不是本应用生成的（手工文件）—— 点「保存并应用」会被接管"
+	fi
+else
+	add "规则文件" warn "$FN 不存在（总开关关闭或从未应用过）"
+fi
+
+# ---- 7. 例外设备 ----
+SKIP=$(uci -q get dnsguard.main.skip_devices)
+TMODE=$(uci -q get dnsguard.main.redirect53)
+if [ "${TMODE:-0}" = "1" ]; then
+	if [ -n "$SKIP" ]; then
+		add "重定向例外设备" ok "已配置：$SKIP"
+	else
+		add "重定向例外设备" ok "无（所有 LAN 客户端的明文 DNS 都会被收编）"
+	fi
+fi
+
+# ---- 8. 挂起的自动回滚 ----
+RF=/tmp/.dnsguard-rollback
+if [ -f "$RF" ]; then
+	read -r RTS RSEC RDL RSRC < "$RF" 2>/dev/null
+	NOW=$(date +%s)
+	LEFT=$(( ${RDL:-0} - NOW ))
+	[ "$LEFT" -lt 0 ] && LEFT=0
+	add "自动回滚倒计时" warn "挂起中：剩余约 ${LEFT} 秒后自动还原到快照 $RTS（点「确认保留」可取消）"
+else
+	add "自动回滚倒计时" ok "无挂起"
+fi
+
+printf '{"status":"ok","mode":"%s","items":[%s]}\n' "$MODE" "$ITEMS"
+exit 0
diff --git a/luci-app-dnsguard/root/usr/lib/lua/luci/controller/dnsguard.lua b/luci-app-dnsguard/root/usr/lib/lua/luci/controller/dnsguard.lua
new file mode 100644
index 000000000..c0efb5503
--- /dev/null
+++ b/luci-app-dnsguard/root/usr/lib/lua/luci/controller/dnsguard.lua
@@ -0,0 +1,358 @@
+-- dnsguard.lua —— LuCI 控制器：DNS 防绕过（53 透明重定向 / 观察计数 / 853·DoH 阻断 / 健康自检 / 回滚）
+--
+-- 实现方式与同机第三方应用 luci-app-lmclient、以及本机 luci-app-routerreport 一致：
+--   控制器只做「校验参数 -> uci set/commit -> 调本机脚本」，真正写防火墙的动作全在 dnsguard-apply 里。
+-- 生成：WorkBuddy  2026-09-26
+
+module("luci.controller.dnsguard", package.seeall)
+
+local sys  = require "luci.sys"
+local http = require "luci.http"
+local uci  = require "luci.model.uci".cursor()
+
+local APPLY    = "/usr/bin/dnsguard-apply"
+local SELFTEST = "/usr/bin/dnsguard-selftest"
+local ROLLBACK = "/usr/bin/dnsguard-rollback"
+local NFTPREV  = "/tmp/dg-preview.nft"
+local LOGFILE  = "/mnt/data/logs/messages"
+local NFTOUT   = "/etc/nftables.d/20-dns-guard.nft"
+
+-- ---------- 小工具 ----------
+
+local function jesc(s)
+	s = tostring(s or "")
+	s = s:gsub("\\", "\\\\"):gsub('"', '\\"'):gsub("\r", "")
+	s = s:gsub("\n", "\\n"):gsub("\t", " ")
+	return s
+end
+
+local function jstr(s) return '"' .. jesc(s) .. '"' end
+
+local function num(s) return tonumber(s or "") or 0 end
+
+local function exec(cmd)
+	local out = sys.exec(cmd .. " 2>/dev/null")
+	return out or ""
+end
+
+local function trim(s) return (tostring(s or ""):gsub("^%s+", ""):gsub("%s+$", "")) end
+
+local function json_out(s)
+	http.prepare_content("application/json")
+	http.write(s)
+	return
+end
+
+local function fv(name, maxlen)
+	local v = http.formvalue(name)
+	if v == nil then return nil end
+	v = v:gsub("[\r\n\t]", " ")
+	if maxlen and #v > maxlen then v = v:sub(1, maxlen) end
+	return v
+end
+
+-- 只保留 IP/CIDR 里合法出现的字符（写入 nft 前的第一道清洗；dnsguard-apply 里还有第二道）
+-- ⚠️ 白名单必须含 `/`，否则 CIDR 会被洗成 192.168.1.024 这种怪物（联调时真踩到过）
+local function clean_set(s)
+	s = tostring(s or "")
+	return trim(s:gsub("[^%w%.%:%-/%s%,]", ""))
+end
+
+-- 接口名：字母数字点下划线连字符 + 空格
+local function clean_ifaces(s)
+	s = tostring(s or "")
+	return trim(s:gsub("[^%w%._%-%s]", ""))
+end
+
+local function digits(s)
+	s = tostring(s or "")
+	return s:gsub("[^%d]", "")
+end
+
+-- ---------- 菜单 ----------
+
+function index()
+	entry({ "admin", "services", "dnsguard" },
+		template("dnsguard/main"), _("DNS 防绕过"), 82).acl_depends = { "luci-app-dnsguard" }
+	entry({ "admin", "services", "dnsguard", "api" },
+		call("action_api"), nil).acl_depends = { "luci-app-dnsguard" }
+end
+
+-- ---------- 动作分发 ----------
+
+function action_api()
+	local action = fv("action") or ""
+	if not action:match("^[%w_]+$") then
+		return json_out('{"status":"error","message":"invalid action"}')
+	end
+	if action == "save" then
+		return action_save()
+	elseif action == "apply" then
+		return action_apply()
+	elseif action == "status" then
+		return action_status()
+	elseif action == "selftest" then
+		return action_selftest()
+	elseif action == "rules" then
+		return action_rules()
+	elseif action == "disarm" then
+		return action_rollback_cmd("--disarm", "")
+	elseif action == "rollback" then
+		return action_restore()
+	end
+	return json_out('{"status":"error","message":"unknown action"}')
+end
+
+-- ---------- 保存配置 ----------
+
+function action_save()
+	local function flag(n) return (fv(n) == "1") and "1" or "0" end
+
+	local new_enabled  = flag("enabled")
+	local new_redirect = flag("redirect53")
+	local watch        = flag("watch")
+	local block853     = flag("block853")
+	local blockdoh     = flag("blockdoh")
+
+	local target_port  = digits(fv("target_port", 6))
+	local log_limit    = digits(fv("log_limit", 4))
+	local roll_min     = digits(fv("rollback_minutes", 4))
+	local ifaces       = clean_ifaces(fv("ifaces", 200))
+	local skip         = clean_set(fv("skip_devices", 400))
+	local nh4          = clean_set(fv("never_hijack4", 600))
+	local nh6          = clean_set(fv("never_hijack6", 600))
+	local doh          = clean_set(fv("doh_servers", 900))
+
+	-- 校验
+	if target_port == "" or num(target_port) < 1 or num(target_port) > 65535 then
+		return json_out('{"status":"error","message":"重定向目标端口必须是 1-65535 的数字"}')
+	end
+	if ifaces == "" then
+		return json_out('{"status":"error","message":"入接口不能为空（默认 br-lan）"}')
+	end
+	if log_limit == "" then log_limit = "5" end
+	if num(log_limit) < 1 or num(log_limit) > 999 then
+		return json_out('{"status":"error","message":"日志限速必须是 1-999（每分钟条数）"}')
+	end
+	if roll_min == "" then roll_min = "10" end
+	if num(roll_min) < 1 or num(roll_min) > 120 then
+		return json_out('{"status":"error","message":"自动回滚倒计时必须是 1-120 分钟"}')
+	end
+
+	local c = uci
+	local OLD_REDIRECT = c:get("dnsguard", "main", "redirect53") or "0"
+
+	c:set("dnsguard", "main", "enabled", new_enabled)
+	c:set("dnsguard", "main", "redirect53", new_redirect)
+	c:set("dnsguard", "main", "watch", watch)
+	c:set("dnsguard", "main", "block853", block853)
+	c:set("dnsguard", "main", "blockdoh", blockdoh)
+	c:set("dnsguard", "main", "target_port", target_port)
+	c:set("dnsguard", "main", "ifaces", ifaces)
+	c:set("dnsguard", "main", "skip_devices", skip)
+	c:set("dnsguard", "main", "log_limit", log_limit)
+	c:set("dnsguard", "main", "rollback_minutes", roll_min)
+
+	c:set("dnsguard", "limits", "never_hijack4", nh4)
+	c:set("dnsguard", "limits", "never_hijack6", nh6)
+	c:set("dnsguard", "limits", "doh_servers", doh)
+	c:commit("dnsguard")
+
+	-- 关 -> 开 的那一刻，自动挂一个回滚倒计时（DNS 改错会让全家上不了网，留条后路）
+	local armed = ""
+	if new_enabled == "1" and new_redirect == "1" and OLD_REDIRECT ~= "1" then
+		local r = exec(ROLLBACK .. " --arm " .. roll_min)
+		if r:match('"ts":"([%d%-]+)"') then
+			armed = r:match('"ts":"([%d%-]+)"')
+		end
+	end
+
+	-- 渲染并应用
+	local out = trim(exec(APPLY))
+	local j = out:match("({.*})")
+	if not j then
+		return json_out('{"status":"error","message":"配置已保存，但应用失败：' .. jesc(out) .. '"}')
+	end
+
+	local st  = j:match('"status":"([%w]+)"') or "error"
+	local msg = j:match('"message":"(.-)","enabled"') or ""
+
+	if st ~= "ok" then
+		return json_out('{"status":"error","message":' .. jstr(msg) .. ',"apply":' .. jstr(j) .. '}')
+	end
+
+	local red_ok  = (j:match('"redirect_active":"(%d)"') == "1")
+	local file_st = j:match('"file":"([%w]+)"') or ""
+
+	local head = "配置已保存"
+	if file_st == "unchanged" then
+		head = head .. "（规则无变化，未重载防火墙）"
+	else
+		head = head .. "并生效"
+	end
+	head = head .. " · 53 重定向：" .. ((new_enabled == "1" and new_redirect == "1") and (red_ok and "已生效" or "未生效") or "关闭")
+
+	if armed ~= "" then
+		head = head .. " · 已挂 " .. roll_min .. " 分钟自动回滚（快照 " .. armed .. "），未确认将自动还原"
+	end
+
+	return json_out('{"status":"ok","message":' .. jstr(head) ..
+		',"at":' .. jstr(os.date("%H:%M:%S")) ..
+		',"armed":' .. jstr(armed) ..
+		',"redirect_active":' .. (red_ok and "true" or "false") ..
+		',"apply":' .. jstr(j) .. '}')
+end
+
+-- ---------- 只重新应用（不改配置）----------
+
+function action_apply()
+	local out = trim(exec(APPLY .. " --quiet"))
+	local j = out:match("({.*})")
+	if not j then
+		return json_out('{"status":"error","message":"应用失败：' .. jesc(out) .. '"}')
+	end
+	local st  = j:match('"status":"([%w]+)"') or "error"
+	local msg = j:match('"message":"(([^"\\]|\\.)*)"') or ""
+	if st ~= "ok" then
+		return json_out('{"status":"error","message":' .. jstr(msg) .. ',"apply":' .. jstr(j) .. '}')
+	end
+	return json_out('{"status":"ok","message":' .. jstr(msg) ..
+		',"at":' .. jstr(os.date("%H:%M:%S")) .. ',"apply":' .. jstr(j) .. '}')
+end
+
+-- ---------- 状态 ----------
+
+local function nft_chain_summary(name)
+	local t = exec("nft list chain inet fw4 " .. name)
+	local active = t:find("chain " .. name) ~= nil
+	local pk, by, list = 0, 0, {}
+	for a, b in t:gmatch("counter packets (%d+) bytes (%d+)") do
+		pk = pk + num(a); by = by + num(b)
+		list[#list + 1] = '{"packets":' .. num(a) .. ',"bytes":' .. num(b) .. '}'
+	end
+	return active, pk, by, "[" .. table.concat(list, ",") .. "]"
+end
+
+function action_status()
+	local c = uci
+	local function g(sec, opt, def)
+		local v = c:get("dnsguard", sec, opt)
+		if v == nil or v == "" then return def or "" end
+		return v
+	end
+
+	local agh = trim(exec("pidof AdGuardHome"))
+	local listen = trim(exec("netstat -lntup 2>/dev/null | grep ':53 ' | head -2 | tr -s ' ' ' '"))
+
+	local r_active, r_pk, r_by, r_list = nft_chain_summary("dns_guard_redirect")
+	local o_active, o_pk, o_by, o_list = nft_chain_summary("dns_guard_pre_forward")
+	local b_active = nft_chain_summary("dns_guard_block")
+
+	-- 规则文件是否由本应用托管
+	local managed = "0"
+	local mtime = ""
+	local fh = io.open(NFTOUT, "r")
+	if fh then
+		local body = fh:read("*a") or ""
+		fh:close()
+		if body:find("DNS 防绕过", 1, true) then managed = "1" end
+	end
+	mtime = trim(exec("stat -c '%y' " .. NFTOUT .. " 2>/dev/null | cut -c1-19"))
+
+	-- 观察日志条数
+	local logs = trim(exec("grep -c 'DNS-BYPASS' " .. LOGFILE))
+
+	-- 回滚状态
+	local rb = exec(ROLLBACK .. " --status")
+	local pending = (rb:find('"pending":true', 1, true) ~= nil)
+	local pts = rb:match('"pending_ts":"([%d%-]*)"') or ""
+	local pleft = num(rb:match('"pending_left":(%d+)'))
+	local backups = rb:match('"backups":%[([^%]]*)%]') or ""
+
+	local resp = {
+		'{"status":"ok"',
+		'"enabled":' .. jstr(g("main", "enabled", "0")),
+		'"redirect53":' .. jstr(g("main", "redirect53", "0")),
+		'"watch":' .. jstr(g("main", "watch", "0")),
+		'"block853":' .. jstr(g("main", "block853", "0")),
+		'"blockdoh":' .. jstr(g("main", "blockdoh", "0")),
+		'"target_port":' .. jstr(g("main", "target_port", "53")),
+		'"ifaces":' .. jstr(g("main", "ifaces", "br-lan")),
+		'"skip_devices":' .. jstr(g("main", "skip_devices", "")),
+		'"log_limit":' .. jstr(g("main", "log_limit", "5")),
+		'"rollback_minutes":' .. jstr(g("main", "rollback_minutes", "10")),
+		'"never_hijack4":' .. jstr(g("limits", "never_hijack4", "")),
+		'"never_hijack6":' .. jstr(g("limits", "never_hijack6", "")),
+		'"doh_servers":' .. jstr(g("limits", "doh_servers", "")),
+		'"agh_pid":' .. jstr(agh),
+		'"listen53":' .. jstr(listen),
+		'"redirect_active":' .. (r_active and "true" or "false"),
+		'"redirect_packets":' .. r_pk,
+		'"redirect_bytes":' .. r_by,
+		'"redirect_rules":' .. r_list,
+		'"watch_active":' .. (o_active and "true" or "false"),
+		'"watch_packets":' .. o_pk,
+		'"watch_bytes":' .. o_by,
+		'"watch_rules":' .. o_list,
+		'"block_active":' .. (b_active and "true" or "false"),
+		'"managed":' .. jstr(managed),
+		'"file_mtime":' .. jstr(mtime),
+		'"bypass_lines":' .. jstr(logs),
+		'"pending":' .. (pending and "true" or "false"),
+		'"pending_ts":' .. jstr(pts),
+		'"pending_left":' .. pleft,
+		'"backups":[' .. backups .. ']'
+	}
+	return json_out(table.concat(resp, ",") .. "}")
+end
+
+-- ---------- 健康自检 ----------
+
+function action_selftest()
+	local out = trim(exec(SELFTEST))
+	local j = out:match("({.*})")
+	if not j then
+		return json_out('{"status":"error","message":"自检脚本执行失败","raw":' .. jstr(out) .. '}')
+	end
+	return json_out(j)
+end
+
+-- ---------- 预览将要生成的规则 ----------
+
+function action_rules()
+	exec(APPLY .. " --render-only --out " .. NFTPREV .. " --quiet")
+	local fh = io.open(NFTPREV, "r")
+	local text = ""
+	if fh then
+		text = fh:read("*a") or ""
+		fh:close()
+	end
+	if text == "" then
+		return json_out('{"status":"error","message":"渲染预览失败：未取到内容（请查看 dnsguard-apply 是否可执行）"}')
+	end
+	local n = select(2, text:gsub("\n", "\n"))
+	return json_out('{"status":"ok","lines":' .. n .. ',"text":' .. jstr(text) .. '}')
+end
+
+-- ---------- 取消自动回滚（确认保留）----------
+
+function action_rollback_cmd(opt, extra)
+	local out = trim(exec(ROLLBACK .. " " .. opt .. " " .. extra))
+	local j = out:match("({.*})")
+	if not j then
+		return json_out('{"status":"error","message":' .. jstr(out) .. '}')
+	end
+	return json_out(j)
+end
+
+-- ---------- 还原到指定回滚点 ----------
+
+function action_restore()
+	local ts = fv("ts", 40) or ""
+	if ts ~= "latest" and not ts:match("^[%d%-]+$") then
+		return json_out('{"status":"error","message":"时间戳格式不正确"}')
+	end
+	local out = trim(exec(ROLLBACK .. " " .. ts))
+	return json_out('{"status":"ok","message":' .. jstr(out ~= "" and out or ("已回滚到 " .. ts)) ..
+		',"at":' .. jstr(os.date("%H:%M:%S")) .. '}')
+end
diff --git a/luci-app-dnsguard/root/usr/lib/lua/luci/view/dnsguard/main.htm b/luci-app-dnsguard/root/usr/lib/lua/luci/view/dnsguard/main.htm
new file mode 100644
index 000000000..f4eee73f7
--- /dev/null
+++ b/luci-app-dnsguard/root/usr/lib/lua/luci/view/dnsguard/main.htm
@@ -0,0 +1,524 @@
+<%+header%>
+<%
+local uci = require "luci.model.uci".cursor()
+
+local function g(sec, opt, def)
+	local v = uci:get("dnsguard", sec, opt)
+	if v == nil or v == "" then return def or "" end
+	return v
+end
+
+local function e(s)
+	s = tostring(s or "")
+	return (s:gsub("&", "&"):gsub("<", "<"):gsub(">", ">"):gsub('"', """))
+end
+
+local function on(sec, opt)
+	return g(sec, opt, "0") == "1"
+end
+
+-- 取 API 地址：优先 build_url，拿不到就退回固定路径（保证页面不白屏）
+local api_url = "/cgi-bin/luci/admin/services/dnsguard/api"
+local ok_disp, disp = pcall(require, "luci.dispatcher")
+if ok_disp and disp and disp.build_url then
+	local ok1, u1 = pcall(disp.build_url, "admin", "services", "dnsguard", "api")
+	if ok1 and u1 then api_url = u1 end
+end
+
+local cfg_enabled   = on("main", "enabled")
+local cfg_redirect  = on("main", "redirect53")
+local cfg_watch     = on("main", "watch")
+local cfg_853       = on("main", "block853")
+local cfg_doh       = on("main", "blockdoh")
+local cfg_port      = g("main", "target_port", "53")
+local cfg_ifaces    = g("main", "ifaces", "br-lan")
+local cfg_skip      = g("main", "skip_devices", "")
+local cfg_loglimit  = g("main", "log_limit", "5")
+local cfg_rollmin   = g("main", "rollback_minutes", "10")
+local cfg_nh4       = g("limits", "never_hijack4", "")
+local cfg_nh6       = g("limits", "never_hijack6", "")
+local cfg_dohsrv    = g("limits", "doh_servers", "")
+%>
+
+
+
+

+	
DNS 防绕过

+	

+		把局域网内「绕过 AdGuard Home 的 DNS」拉回本机解析：53 明文用透明重定向（客户端无感）、
+		853 DoT 用阻断（逼其回落 53）、DoH 专用 IP 可选阻断。
+		配置存于 /etc/config/dnsguard，保存后渲染到 /etc/nftables.d/20-dns-guard.nft 并重载 fw4。
+	

+
+	

+		
当前状态

+		

+			

+				

+				
+					
+					
+					
+					
+					
+					
+					
+					
+				
总开关读取中…
AdGuard Home—
:53 监听—
53 透明重定向—
已收编包数—
观察计数（forward）—
规则文件—
观察期累计日志—

+			

+		

+	

+
+	

+		

+			
开关

+			

+				

+					
+					

+						 checked="checked"<% end %> />
+						
总开关。关闭后不生成任何规则（等于恢复出厂状态）。

+					

+				

+				

+					
+					

+						 checked="checked"<% end %> />
+						

+							把 LAN 内发往外部 :53 的 TCP/UDP 查询改道到本机 AdGuard Home（nat prerouting，优先级 -105）。
+							客户端无感，硬编码 DNS 的设备不用改设置。

+							⚠️ 只在 AdGuard Home 正常运行时才有意义：AGH 挂了就会被安全闸门拒绝应用。
+						

+					

+				

+				

+					
+					

+						 checked="checked"<% end %> />
+						

+							只计数 + 抽样记日志到 /mnt/data/logs/messages，不拦截。

+							注意：53 被重定向后不再进入 forward 链，此计数会趋近于 0（只剩 853 / DoH），这是正常的。
+						

+					

+				

+				

+					
+					

+						 checked="checked"<% end %> />
+						
DoT 无法透明重定向，只能阻断；客户端会回落到 853 之外的明文 53，从而被上面的重定向收编。建议重定向稳定 1 天后再开。

+					

+				

+				

+					
+					

+						 checked="checked"<% end %> />
+						

+							⚠️ 风险最高：按 IP 命中，可能误伤「恰好也部署在这些 IP 上」的其它服务（例如 223.5.5.5:443）。
+							更精准的做法是在 AdGuard Home 里加域名规则。默认关闭。
+						

+					

+				

+			

+		

+
+		

+			
参数

+			

+				

+					
+					

+						
+						
本机 AdGuard Home 的监听端口，默认 53。不要填 dnsmasq 的 5353。

+					

+				

+				

+					
+					

+						
+						
监听哪个接口进来的流量，默认 br-lan。多个用空格分隔。

+					

+				

+				

+					
+					

+						
+						

+							这些源地址不做重定向（IPv4 / IPv6 混填，空格分隔）。只在确实需要保留某个设备走外部 DNS 时使用。

+							⚠️ 不要把整个 192.168.0.0/16 填进「永不劫持」：那样红米 K80 这类静态指向旧私网地址的设备会继续解析失败。
+						

+					

+				

+				

+					
+					

+						
+						
观察日志每分钟最多写几条（1-999），防止刷爆日志。

+					

+				

+				

+					
+					

+						
+						

+							把「53 重定向」从关改到开时，自动拍一个回滚快照并倒计时；到点未点「确认保留」就自动还原。

+							DNS 是全家网的命门，改错了人可能连这台路由器都访问不到（域名解析不了）——这是最后的保险绳。单位：分钟（1-120）。
+						

+					

+				

+			

+		

+
+		

+			
高级：地址集合

+			

+				

+					
+					

+						
+						
指向这些网段的 DNS 查询不会被改道（内网 / 保留段）。空格分隔。

+					

+				

+				

+					
+					

+						
+					

+				

+				

+					
+					

+						
+						
用于「DoH 专用 IP 阻断」与观察计数，也用于反查哪些设备在走这些地址。空格分隔。

+					

+				

+			

+		

+	

+
+	

+		
操作

+		

+			

+				

+
+				
+
+				

+					
+					
+					
+					
+				

+
+				
+
+				

+					自检结果 / 规则预览 / 命令回显（点开查看）
+					

+					
（等待操作）

+				

+			

+		

+	

+
+	

+		
回滚点

+		

+			

+				
+				

+					
+					
+					

+						还原会同时恢复 UCI 配置 + 规则文件并重载防火墙。回滚点目录：/mnt/data/backup-dnsguard/
+					

+				

+			

+		

+	

+

+
+
+
+<%+footer%>
diff --git a/luci-app-dnsguard/root/usr/share/rpcd/acl.d/luci-app-dnsguard.json b/luci-app-dnsguard/root/usr/share/rpcd/acl.d/luci-app-dnsguard.json
new file mode 100644
index 000000000..16fdb25af
--- /dev/null
+++ b/luci-app-dnsguard/root/usr/share/rpcd/acl.d/luci-app-dnsguard.json
@@ -0,0 +1,11 @@
+{
+	"luci-app-dnsguard": {
+		"description": "Grant UCI access for the DNS guard (DNS bypass prevention / 53 transparent redirect) LuCI application",
+		"read": {
+			"uci": [ "dnsguard" ]
+		},
+		"write": {
+			"uci": [ "dnsguard" ]
+		}
+	}
+}
diff --git a/luci-app-dnsguard/root/usr/share/ucitrack/luci-app-dnsguard.json b/luci-app-dnsguard/root/usr/share/ucitrack/luci-app-dnsguard.json
new file mode 100644
index 000000000..fd16dff34
--- /dev/null
+++ b/luci-app-dnsguard/root/usr/share/ucitrack/luci-app-dnsguard.json
@@ -0,0 +1,4 @@
+{
+	"config": "dnsguard",
+	"init": "dnsguard"
+}
diff --git a/luci-app-dnsguard/test-controller.lua b/luci-app-dnsguard/test-controller.lua
new file mode 100644
index 000000000..55f906574
--- /dev/null
+++ b/luci-app-dnsguard/test-controller.lua
@@ -0,0 +1,62 @@
+-- 控制器打桩测试 v2：直调 action_api，覆盖各分支（含「关->开自动挂回滚」）
+-- 用 ssh router 'lua -' < 本文件 执行；不在设备上落任何文件
+package.path = "/usr/lib/lua/?.lua;" .. package.path
+
+local F = {}
+local http = require "luci.http"
+local cap = {}
+http.formvalue       = function(k) return F[k] end
+http.prepare_content = function(t) cap.ct = t end
+http.write           = function(s) cap.body = s end
+
+local ucic = require("luci.model.uci").cursor()
+local function cur(sec, opt) return ucic:get("dnsguard", sec, opt) or "" end
+
+local ctrl = require "luci.controller.dnsguard"
+
+local function run(name)
+	cap.body = nil
+	local ok, err = pcall(ctrl.action_api)
+	print("###CASE:" .. name .. "###")
+	if not ok then print("LUA_ERROR: " .. tostring(err)) else print(cap.body or "(nil)") end
+	print("###END###")
+end
+
+local function clear() for k in pairs(F) do F[k] = nil end end
+
+-- 用设备上当前值填表，避免测试数据漂移
+local function fill(redirect)
+	clear()
+	F.action           = "save"
+	F.enabled          = "1"
+	F.redirect53       = redirect or cur("main", "redirect53")
+	F.watch            = "1"
+	F.block853         = "0"
+	F.blockdoh         = "0"
+	F.target_port      = cur("main", "target_port")
+	F.ifaces           = cur("main", "ifaces")
+	F.skip_devices     = cur("main", "skip_devices")
+	F.log_limit        = cur("main", "log_limit")
+	F.rollback_minutes = "1"
+	F.never_hijack4    = cur("limits", "never_hijack4")
+	F.never_hijack6    = cur("limits", "never_hijack6")
+	F.doh_servers      = cur("limits", "doh_servers")
+end
+
+clear(); F.action = "status";   run("status")
+clear(); F.action = "selftest"; run("selftest")
+clear(); F.action = "rules";    run("rules")
+
+fill();                        run("save-same")
+fill("0");                     run("save-off")
+fill("1");                     run("save-on-arm")     -- 这里应挂上回滚
+clear(); F.action = "disarm";  run("disarm")
+
+-- 校验分支
+clear(); F.action="save"; F.target_port="70000"; run("bad-port")
+clear(); F.action="save"; F.target_port="53"; F.ifaces=""; run("bad-iface")
+clear(); F.action="save"; F.target_port="53"; F.ifaces="br-lan"; F.log_limit="0"; run("bad-loglimit")
+clear(); F.action="save"; F.target_port="53"; F.ifaces="br-lan"; F.log_limit="5"; F.rollback_minutes="999"; run("bad-rollmin")
+clear(); F.action="rollback"; F.ts="; rm -rf /";  run("bad-ts")
+clear(); F.action="nope";                        run("unknown")
+clear(); F.action="bad action!; x";              run("bad-action")
diff --git a/luci-app-honk/.gitignore b/luci-app-honk/.gitignore
deleted file mode 100644
index 31c7d0682..000000000
--- a/luci-app-honk/.gitignore
+++ /dev/null
@@ -1,8 +0,0 @@
-*.ipk
-*.apk
-*.o
-*.so
-*.a
-.DS_Store
-*~
-
diff --git a/luci-app-honk/luci-app-honk/Makefile b/luci-app-honk/Makefile
similarity index 96%
rename from luci-app-honk/luci-app-honk/Makefile
rename to luci-app-honk/Makefile
index c12866ab7..5cd932767 100644
--- a/luci-app-honk/luci-app-honk/Makefile
+++ b/luci-app-honk/Makefile
@@ -7,7 +7,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=luci-app-honk
 PKG_VERSION:=1.1.1
-PKG_RELEASE:=1
+PKG_RELEASE:=2
 
 LUCI_TITLE:=LuCI support for honk
 LUCI_PKGARCH:=all
diff --git a/luci-app-honk/README.md b/luci-app-honk/README.md
deleted file mode 100644
index b7afc7509..000000000
--- a/luci-app-honk/README.md
+++ /dev/null
@@ -1,40 +0,0 @@
-# luci-app-honk
-
-OpenWrt 上的 honk（eBPF 透明代理引擎，dae 兼容）LuCI 管理界面与二进制包。
-
-本仓库包含两个包：
-
-- `honk`：从 [daeuniverse/honk](https://github.com/daeuniverse/honk) 的
-  GitHub Release 按目标架构下载预编译静态 `honk-core`，不在本地编译。
-- `luci-app-honk`：参考 `luci-app-dae` 实现的 LuCI 配置界面。
-
-## 使用
-
-把本仓库放入 OpenWrt 源码树的 `package/honk`：
-
-```bash
-git clone https://github.com/QiuSimons/luci-app-honk package/honk
-```
-
-然后：
-
-```bash
-make menuconfig
-# Network -> Web Servers/Proxies -> luci-app-honk
-make package/honk/luci-app-honk/compile V=s
-```
-
-honk 目前只提供 `x86_64` 与 `aarch64` 的静态 musl 二进制，因此包通过
-`@(x86_64||aarch64)` 限制架构。
-
-## 配置
-
-默认配置在 `/etc/honk/config.dae`，拆分配置位于
-`/etc/honk/config.d/{node,route,dns}.dae`。首次使用前请替换示例节点与订阅。
-
-## 版本号
-
-`scripts/update_honk_version.sh` 会读取 daeuniverse/honk 最新 Release，
-把 tag（如 `v0.0.1.beta.49`）清洗成同时满足 ipk 与 apk 的版本
-（`0.0.1_beta49`），并写回 `honk/Makefile`。
-
diff --git a/luci-app-honk/honk/Makefile b/luci-app-honk/honk/Makefile
deleted file mode 100644
index 01a298e91..000000000
--- a/luci-app-honk/honk/Makefile
+++ /dev/null
@@ -1,100 +0,0 @@
-# SPDX-License-Identifier: GPL-2.0-only
-
-include $(TOPDIR)/rules.mk
-
-PKG_NAME:=honk
-PKG_VERSION:=0.0.1_beta81
-PKG_RELEASE:=1
-
-# Raw upstream release tag. It keeps the dots in qualifiers (e.g. v0.0.1.beta.49)
-# because that is what the GitHub release asset name uses.
-HONK_RELEASE_TAG:=v0.0.1.beta.81
-
-# SHA256 of each release tarball, kept in sync by scripts/update_honk_version.sh.
-HONK_HASH_X86_64:=88e5c3b29200c6ad729cc89636e14a452d974108cd08852c9c1e44074d23e10e
-HONK_HASH_AARCH64:=b160a3c8674556222b2b29ce6c975bc346f7ce3cddeb049474c6ca9e0a8191a6
-
-PKG_LICENSE:=AGPL-3.0-only
-PKG_LICENSE_FILE:=LICENSE
-PKG_MAINTAINER:=luci-app-honk maintainers
-
-ifeq ($(ARCH),x86_64)
-  HONK_TARGET:=x86_64-unknown-linux-musl
-  HONK_HASH:=$(HONK_HASH_X86_64)
-else ifeq ($(ARCH),aarch64)
-  HONK_TARGET:=aarch64-unknown-linux-musl
-  HONK_HASH:=$(HONK_HASH_AARCH64)
-endif
-
-# Default to the stock-malloc build: lower RSS high-water on small gateways.
-# Use an empty suffix to switch back to the mimalloc build (faster QUIC).
-HONK_SUFFIX:=-stock
-HONK_ASSET:=honk-core-$(HONK_RELEASE_TAG)-$(HONK_TARGET)$(HONK_SUFFIX).tar.gz
-
-PKG_SOURCE:=$(HONK_ASSET)
-PKG_SOURCE_URL:=https://github.com/daeuniverse/honk/releases/download/$(HONK_RELEASE_TAG)/
-PKG_HASH:=$(HONK_HASH)
-
-include $(INCLUDE_DIR)/package.mk
-
-define Package/honk
-  SECTION:=net
-  CATEGORY:=Network
-  SUBMENU:=Web Servers/Proxies
-  TITLE:=honk - eBPF transparent proxy engine (dae-compatible)
-  URL:=https://github.com/daeuniverse/honk
-  DEPENDS:=@(x86_64||aarch64) \
-    +ca-bundle +ip-full \
-    +kmod-sched-core +kmod-sched-bpf +kmod-veth +kmod-nft-queue \
-    +v2ray-geoip +v2ray-geosite \
-    +@KERNEL_XDP_SOCKETS \
-    +HONK_USE_VMLINUX_BTF:vmlinux-btf
-endef
-
-define Package/honk/config
-	choice
-		prompt "BTF source for CO-RE"
-		default HONK_USE_KERNEL_BTF
-		depends on PACKAGE_honk
-
-	config HONK_USE_KERNEL_BTF
-		bool "Use kernel BTF (integrated)"
-		depends on KERNEL_DEBUG_INFO_BTF
-
-	config HONK_USE_VMLINUX_BTF
-		bool "Use vmlinux-btf package"
-	endchoice
-endef
-
-define Package/honk/conffiles
-/etc/honk/
-/etc/config/honk
-endef
-
-define Build/Prepare
-	mkdir -p $(PKG_BUILD_DIR)
-	$(TAR) -xzf $(DL_DIR)/$(PKG_SOURCE) -C $(PKG_BUILD_DIR) --strip-components=1
-endef
-
-define Build/Compile
-	true
-endef
-
-define Package/honk/install
-	$(INSTALL_DIR) $(1)/usr/bin
-	$(INSTALL_BIN) $(PKG_BUILD_DIR)/honk-core $(1)/usr/bin/honk-core
-
-	$(INSTALL_DIR) $(1)/etc/honk/config.d
-	$(INSTALL_CONF) $(CURDIR)/files/config.dae $(1)/etc/honk/config.dae
-	$(INSTALL_CONF) $(CURDIR)/files/config.d/node.dae $(1)/etc/honk/config.d/node.dae
-	$(INSTALL_CONF) $(CURDIR)/files/config.d/route.dae $(1)/etc/honk/config.d/route.dae
-	$(INSTALL_CONF) $(CURDIR)/files/config.d/dns.dae $(1)/etc/honk/config.d/dns.dae
-
-	$(INSTALL_DIR) $(1)/etc/config
-	$(INSTALL_CONF) $(CURDIR)/files/honk.config $(1)/etc/config/honk
-
-	$(INSTALL_DIR) $(1)/etc/init.d
-	$(INSTALL_BIN) $(CURDIR)/files/honk.init $(1)/etc/init.d/honk
-endef
-
-$(eval $(call BuildPackage,honk))
diff --git a/luci-app-honk/honk/files/config.d/dns.dae b/luci-app-honk/honk/files/config.d/dns.dae
deleted file mode 100644
index 8693bfd37..000000000
--- a/luci-app-honk/honk/files/config.d/dns.dae
+++ /dev/null
@@ -1,23 +0,0 @@
-# dns.dae
-dns {
-    bind: 'tcp+udp://[::]:53530'
-    client_subnet: auto
-    #ipversion_prefer: 4
-    upstream {
-        local: 'udp://127.0.0.1:53' -> direct
-        remote: 'tcp+udp://dns.google:53'
-    }
-    routing {
-        request {
-            qtype(https) -> reject
-            qname(geosite: gfw) -> remote
-            fallback: local
-        }
-        response {
-            upstream(remote) -> accept
-            qname(geosite: private) -> accept
-            ip(geoip: cn) -> accept
-            fallback: remote
-        }
-    }
-}
diff --git a/luci-app-honk/honk/files/config.d/node.dae b/luci-app-honk/honk/files/config.d/node.dae
deleted file mode 100644
index 848dcb48f..000000000
--- a/luci-app-honk/honk/files/config.d/node.dae
+++ /dev/null
@@ -1,35 +0,0 @@
-# node.dae
-node {
-    node1: 'xxx'
-    node2: 'xxx'
-}
-
-subscription {
-    # 短形式：默认 86400s 刷新一次
-    sub: 'http://sub'
-
-    # 短形式 + UA：仍然只能默认 86400s
-    sub_ua: 'http://sub'(honk/1.0 like)
-
-    # 块形式：可以自定义定时刷新周期
-    sub2: {
-        url: 'http://sub'
-        ua: 'honk/1.0'
-        interval: '10000s'   # 每 10000 秒刷新一次
-    }
-
-    # 禁用定期刷新
-    sub3: {
-        url: 'http://sub'
-        interval: 0
-    }
-}
-
-group {
-    proxy {
-        filter: subtag(sub) && !name(keyword: 'ExpireAt:')
-        filter: name(node1, node2)
-        policy: score
-    }
-}
-
diff --git a/luci-app-honk/honk/files/config.d/route.dae b/luci-app-honk/honk/files/config.d/route.dae
deleted file mode 100644
index 31106c7f5..000000000
--- a/luci-app-honk/honk/files/config.d/route.dae
+++ /dev/null
@@ -1,27 +0,0 @@
-# route.dae
-routing {
-    pname(dnsmasq, zerotier-one) -> direct(must)
-    dip(224.0.0.0/3, 'ff00::/8', geoip: private) -> direct
-    domain(geosite: category-bank-cn, geosite: boc@!cn, geosite: synology) -> direct
-
-    # block quic, if u node has poor quic support, enable this line
-    # l4proto(udp) && dport(443) -> block
-
-    domain(geosite: spotify) -> proxy
-    domain(geosite: category-doh) -> proxy
-    domain(geosite: tiktok) -> proxy
-    domain(geosite: category-ai-!cn, geosite: github) -> proxy
-    domain(geosite: gfw) -> proxy
-
-    dip(geoip: telegram) -> proxy
-
-    dip(geoip: cn) -> direct
-    # geoip:cn always using chiness asn, can use domain rule to override
-    # domain(geosite: cn) -> direct
-
-    # using proxy for ssh, http, https, and common ports, avoid (bt, or other p2p)
-    # dport(22, 80, 443, 8080, 6443, 9090) -> proxy
-
-    # fallback: direct
-    fallback: proxy
-}
diff --git a/luci-app-honk/honk/files/config.dae b/luci-app-honk/honk/files/config.dae
deleted file mode 100644
index 4115010bb..000000000
--- a/luci-app-honk/honk/files/config.dae
+++ /dev/null
@@ -1,47 +0,0 @@
-# config.dae
-# Load all honk files placed in ./config.d/.
-include {
-    config.d/*.dae
-}
-
-global {
-    log_level: warn
-    check_interval: 600s
-    check_tolerance: 30ms
-    lan_interface: br-lan
-    wan_interface: auto
-    auto_config_kernel_parameter: true
-    data_dir: '/etc/honk'
-    log_file: '/var/log/honk/honk.log'
-    store_subscribe: true
-    # if u not using dns bind, set dial_mode to domain++ prefer
-    dial_mode: domain
-    bootstrap_resolver: '223.5.5.5:53'
-    tcp_check_url: 'https://www.gstatic.com/generate_204'
-    tcp_check_http_method: HEAD
-    udp_check_dns: 'dns.google.com:53', '8.8.8.8', '2001:4860:4860::8888'
-}
-
-# using for enable experimental features
-# native-api, clash-api, cache-file
-#experimental {
-#    native_api {
-#        enabled: true
-#        listen: '0.0.0.0:9527'
-#        secret: 'honk'
-#        ui: '/etc/honk/dashboard'
-#    }
-#    clash_api {
-#        external_controller: '0.0.0.0:9090'
-#        external_ui: '/etc/honk/zashboard'
-#        secret: ''
-#        default_mode: 'Rule'
-#    }
-#    cache_file {
-#        enabled: true
-#        path: '/etc/honk/cache.db'
-#        cache_id: ''
-#        store_fakeip: false #in this time, this field will be ignored
-#    }
-#}
-
diff --git a/luci-app-honk/honk/files/honk.config b/luci-app-honk/honk/files/honk.config
deleted file mode 100644
index 8b33dcf88..000000000
--- a/luci-app-honk/honk/files/honk.config
+++ /dev/null
@@ -1,7 +0,0 @@
-
-config honk 'config'
-	option enabled '0'
-	option advanced '0'
-	option dashboard 'doona'
-	option config_file '/etc/honk/config.dae'
-
diff --git a/luci-app-honk/honk/files/honk.init b/luci-app-honk/honk/files/honk.init
deleted file mode 100644
index 0e6789b52..000000000
--- a/luci-app-honk/honk/files/honk.init
+++ /dev/null
@@ -1,112 +0,0 @@
-#!/bin/sh /etc/rc.common
-
-USE_PROCD=1
-START=96
-STOP=10
-
-extra_command "hot_reload" "Hot-reload service"
-
-CONF="honk"
-PROG="/usr/bin/honk-core"
-# honk-core hardcodes dae-compatible datapath names (dae0/dae0peer + daens);
-# these are the real interface/netns names, not leftover dae config.
-HONK_HOST_IFACE="dae0"
-HONK_PEER_IFACE="dae0peer"
-HONK_NETNS_NAME="daens"
-HONK_NETNS_PATH="/run/netns/$HONK_NETNS_NAME"
-RESOLV_HONK="/tmp/resolv.conf.honk"
-
-set_chmod_640() {
-    mkdir -p /etc/honk/config.d
-    chmod -R 640 /etc/honk/ 2>/dev/null || true
-}
-
-cleanup_netns() {
-    ip netns del "$HONK_NETNS_NAME" 2>/dev/null || true
-    umount "$HONK_NETNS_PATH" 2>/dev/null || true
-    rm -f "$HONK_NETNS_PATH" 2>/dev/null || true
-    ip link del "$HONK_HOST_IFACE" 2>/dev/null || true
-    ip link del "$HONK_PEER_IFACE" 2>/dev/null || true
-}
-
-hijack_resolv_conf() {
-    grep -q ' /tmp/resolv\.conf ' /proc/mounts && return 0
-
-    grep -E '^(search|domain) ' /tmp/resolv.conf > "$RESOLV_HONK" 2>/dev/null
-
-    local dns_list LOGICAL_WAN
-    . /lib/functions/network.sh
-    network_find_wan LOGICAL_WAN 2>/dev/null
-    if [ -n "$LOGICAL_WAN" ]; then
-        dns_list=$(ubus call "network.interface.$LOGICAL_WAN" status 2>/dev/null | \
-            jsonfilter -e '@["dns-server"][*]' 2>/dev/null)
-    fi
-
-    if [ -z "$dns_list" ] && [ -f "/tmp/resolv.conf.d/resolv.conf.auto" ]; then
-        dns_list=$(awk '/^nameserver/{print $2}' "/tmp/resolv.conf.d/resolv.conf.auto")
-    fi
-
-    [ -z "$dns_list" ] && dns_list="119.29.29.29 223.5.5.5"
-
-    for dns in $dns_list; do
-        echo "nameserver $dns" >> "$RESOLV_HONK"
-    done
-
-    mount --bind "$RESOLV_HONK" /tmp/resolv.conf
-    mount -o remount,ro,bind /tmp/resolv.conf
-}
-
-restore_resolv_conf() {
-    grep -q ' /tmp/resolv\.conf ' /proc/mounts || return 0
-    mount -o remount,rw,bind /tmp/resolv.conf 2>/dev/null
-    umount /tmp/resolv.conf 2>/dev/null
-    rm -f "$RESOLV_HONK"
-}
-
-start_service() {
-    local enabled config_file
-
-    config_load "$CONF"
-    config_get_bool enabled "config" "enabled" "0"
-    [ "$enabled" -eq "1" ] || return 1
-
-    config_get config_file "config" "config_file" "/etc/honk/config.dae"
-
-    set_chmod_640
-    cleanup_netns
-	hijack_resolv_conf
-
-    procd_open_instance "$CONF"
-    procd_set_param env DAE_LOCATION_ASSET="/usr/share/v2ray"
-    procd_set_param command "$PROG" --config "$config_file"
-	procd_set_param netdev "$HONK_HOST_IFACE" "$HONK_PEER_IFACE"
-    procd_set_param limits core="unlimited"
-    procd_set_param limits nofile="1000000 1000000"
-    procd_set_param term_timeout 8
-    procd_set_param respawn 3600 5 5
-    procd_set_param stderr 1
-    procd_close_instance
-}
-
-service_stopped() {
-    restore_resolv_conf
-    cleanup_netns
-}
-
-reload_service() {
-    stop
-    start
-}
-
-service_triggers() {
-    procd_add_reload_trigger "$CONF"
-}
-
-hot_reload() {
-    set_chmod_640
-    if /etc/init.d/honk running; then
-        "$PROG" reload
-    else
-        /etc/init.d/honk restart
-    fi
-}
diff --git a/luci-app-honk/po/zh-cn b/luci-app-honk/po/zh-cn
new file mode 120000
index 000000000..8d69574dd
--- /dev/null
+++ b/luci-app-honk/po/zh-cn
@@ -0,0 +1 @@
+zh_Hans
\ No newline at end of file
diff --git a/luci-app-honk/luci-app-honk/po/zh_Hans/honk.po b/luci-app-honk/po/zh_Hans/honk.po
similarity index 100%
rename from luci-app-honk/luci-app-honk/po/zh_Hans/honk.po
rename to luci-app-honk/po/zh_Hans/honk.po
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/CHANGELOG.md b/luci-app-honk/root/etc/honk/dashboard/CHANGELOG.md
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/CHANGELOG.md
rename to luci-app-honk/root/etc/honk/dashboard/CHANGELOG.md
diff --git a/luci-app-honk/root/etc/honk/dashboard/LICENSE b/luci-app-honk/root/etc/honk/dashboard/LICENSE
new file mode 100644
index 000000000..f288702d2
--- /dev/null
+++ b/luci-app-honk/root/etc/honk/dashboard/LICENSE
@@ -0,0 +1,674 @@
+                    GNU GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. 
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU General Public License is a free, copyleft license for
+software and other kinds of works.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+the GNU General Public License is intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.  We, the Free Software Foundation, use the
+GNU General Public License for most of our software; it applies also to
+any other work released this way by its authors.  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  To protect your rights, we need to prevent others from denying you
+these rights or asking you to surrender the rights.  Therefore, you have
+certain responsibilities if you distribute copies of the software, or if
+you modify it: responsibilities to respect the freedom of others.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must pass on to the recipients the same
+freedoms that you received.  You must make sure that they, too, receive
+or can get the source code.  And you must show them these terms so they
+know their rights.
+
+  Developers that use the GNU GPL protect your rights with two steps:
+(1) assert copyright on the software, and (2) offer you this License
+giving you legal permission to copy, distribute and/or modify it.
+
+  For the developers' and authors' protection, the GPL clearly explains
+that there is no warranty for this free software.  For both users' and
+authors' sake, the GPL requires that modified versions be marked as
+changed, so that their problems will not be attributed erroneously to
+authors of previous versions.
+
+  Some devices are designed to deny users access to install or run
+modified versions of the software inside them, although the manufacturer
+can do so.  This is fundamentally incompatible with the aim of
+protecting users' freedom to change the software.  The systematic
+pattern of such abuse occurs in the area of products for individuals to
+use, which is precisely where it is most unacceptable.  Therefore, we
+have designed this version of the GPL to prohibit the practice for those
+products.  If such problems arise substantially in other domains, we
+stand ready to extend this provision to those domains in future versions
+of the GPL, as needed to protect the freedom of users.
+
+  Finally, every program is threatened constantly by software patents.
+States should not allow patents to restrict development and use of
+software on general-purpose computers, but in those that do, we wish to
+avoid the special danger that patents applied to a free program could
+make it effectively proprietary.  To prevent this, the GPL assures that
+patents cannot be used to render the program non-free.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Use with the GNU Affero General Public License.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU Affero General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the special requirements of the GNU Affero General Public License,
+section 13, concerning interaction through a network will apply to the
+combination as such.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    
+    Copyright (C)   
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see .
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If the program does terminal interaction, make it output a short
+notice like this when it starts in an interactive mode:
+
+      Copyright (C)   
+    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, your program's commands
+might be different; for a GUI interface, you would use an "about box".
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU GPL, see
+.
+
+  The GNU General Public License does not permit incorporating your program
+into proprietary programs.  If your program is a subroutine library, you
+may consider it more useful to permit linking proprietary applications with
+the library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.  But first, please read
+.
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/LICENSES/Apache-2.0.txt b/luci-app-honk/root/etc/honk/dashboard/LICENSES/Apache-2.0.txt
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/LICENSES/Apache-2.0.txt
rename to luci-app-honk/root/etc/honk/dashboard/LICENSES/Apache-2.0.txt
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/NOTICE b/luci-app-honk/root/etc/honk/dashboard/NOTICE
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/NOTICE
rename to luci-app-honk/root/etc/honk/dashboard/NOTICE
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/README.md b/luci-app-honk/root/etc/honk/dashboard/README.md
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/README.md
rename to luci-app-honk/root/etc/honk/dashboard/README.md
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/ActionGroup-C-LVMOvQ.js b/luci-app-honk/root/etc/honk/dashboard/assets/ActionGroup-C-LVMOvQ.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/ActionGroup-C-LVMOvQ.js
rename to luci-app-honk/root/etc/honk/dashboard/assets/ActionGroup-C-LVMOvQ.js
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/AddCircle-DSsJ-CRu.js b/luci-app-honk/root/etc/honk/dashboard/assets/AddCircle-DSsJ-CRu.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/AddCircle-DSsJ-CRu.js
rename to luci-app-honk/root/etc/honk/dashboard/assets/AddCircle-DSsJ-CRu.js
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/AreaChart-BPSqH5mH.js b/luci-app-honk/root/etc/honk/dashboard/assets/AreaChart-BPSqH5mH.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/AreaChart-BPSqH5mH.js
rename to luci-app-honk/root/etc/honk/dashboard/assets/AreaChart-BPSqH5mH.js
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/AreaCurve-BriPYJva.js b/luci-app-honk/root/etc/honk/dashboard/assets/AreaCurve-BriPYJva.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/AreaCurve-BriPYJva.js
rename to luci-app-honk/root/etc/honk/dashboard/assets/AreaCurve-BriPYJva.js
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/Arrange-C-Cvg5Lz.js b/luci-app-honk/root/etc/honk/dashboard/assets/Arrange-C-Cvg5Lz.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/Arrange-C-Cvg5Lz.js
rename to luci-app-honk/root/etc/honk/dashboard/assets/Arrange-C-Cvg5Lz.js
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/Arrange-Dd3j3leY.css b/luci-app-honk/root/etc/honk/dashboard/assets/Arrange-Dd3j3leY.css
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/Arrange-Dd3j3leY.css
rename to luci-app-honk/root/etc/honk/dashboard/assets/Arrange-Dd3j3leY.css
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/Config-BVUCd2Cc.js b/luci-app-honk/root/etc/honk/dashboard/assets/Config-BVUCd2Cc.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/Config-BVUCd2Cc.js
rename to luci-app-honk/root/etc/honk/dashboard/assets/Config-BVUCd2Cc.js
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/Connections-DAjj-jeW.js b/luci-app-honk/root/etc/honk/dashboard/assets/Connections-DAjj-jeW.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/Connections-DAjj-jeW.js
rename to luci-app-honk/root/etc/honk/dashboard/assets/Connections-DAjj-jeW.js
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/DaeCode-B4MDdwFy.js b/luci-app-honk/root/etc/honk/dashboard/assets/DaeCode-B4MDdwFy.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/DaeCode-B4MDdwFy.js
rename to luci-app-honk/root/etc/honk/dashboard/assets/DaeCode-B4MDdwFy.js
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/Dns-BCY3zvs7.js b/luci-app-honk/root/etc/honk/dashboard/assets/Dns-BCY3zvs7.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/Dns-BCY3zvs7.js
rename to luci-app-honk/root/etc/honk/dashboard/assets/Dns-BCY3zvs7.js
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/Donut-Dusnd_Se.js b/luci-app-honk/root/etc/honk/dashboard/assets/Donut-Dusnd_Se.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/Donut-Dusnd_Se.js
rename to luci-app-honk/root/etc/honk/dashboard/assets/Donut-Dusnd_Se.js
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/Events-BUl_BoAv.js b/luci-app-honk/root/etc/honk/dashboard/assets/Events-BUl_BoAv.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/Events-BUl_BoAv.js
rename to luci-app-honk/root/etc/honk/dashboard/assets/Events-BUl_BoAv.js
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/FactStrip-vcLr7nBw.js b/luci-app-honk/root/etc/honk/dashboard/assets/FactStrip-vcLr7nBw.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/FactStrip-vcLr7nBw.js
rename to luci-app-honk/root/etc/honk/dashboard/assets/FactStrip-vcLr7nBw.js
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/ListLayout-DU_9AgrU.js b/luci-app-honk/root/etc/honk/dashboard/assets/ListLayout-DU_9AgrU.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/ListLayout-DU_9AgrU.js
rename to luci-app-honk/root/etc/honk/dashboard/assets/ListLayout-DU_9AgrU.js
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/Login-CoF6Tj1K.js b/luci-app-honk/root/etc/honk/dashboard/assets/Login-CoF6Tj1K.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/Login-CoF6Tj1K.js
rename to luci-app-honk/root/etc/honk/dashboard/assets/Login-CoF6Tj1K.js
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/Logs-JK5xuRFC.js b/luci-app-honk/root/etc/honk/dashboard/assets/Logs-JK5xuRFC.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/Logs-JK5xuRFC.js
rename to luci-app-honk/root/etc/honk/dashboard/assets/Logs-JK5xuRFC.js
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/NodeSearch-BdGpTyio.js b/luci-app-honk/root/etc/honk/dashboard/assets/NodeSearch-BdGpTyio.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/NodeSearch-BdGpTyio.js
rename to luci-app-honk/root/etc/honk/dashboard/assets/NodeSearch-BdGpTyio.js
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/Nodes-BPHOu_UD.js b/luci-app-honk/root/etc/honk/dashboard/assets/Nodes-BPHOu_UD.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/Nodes-BPHOu_UD.js
rename to luci-app-honk/root/etc/honk/dashboard/assets/Nodes-BPHOu_UD.js
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/Overview-D7zbQze3.js b/luci-app-honk/root/etc/honk/dashboard/assets/Overview-D7zbQze3.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/Overview-D7zbQze3.js
rename to luci-app-honk/root/etc/honk/dashboard/assets/Overview-D7zbQze3.js
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/Policies-VixfIaVZ.js b/luci-app-honk/root/etc/honk/dashboard/assets/Policies-VixfIaVZ.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/Policies-VixfIaVZ.js
rename to luci-app-honk/root/etc/honk/dashboard/assets/Policies-VixfIaVZ.js
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/PolicyPicker-iyQz7WhP.js b/luci-app-honk/root/etc/honk/dashboard/assets/PolicyPicker-iyQz7WhP.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/PolicyPicker-iyQz7WhP.js
rename to luci-app-honk/root/etc/honk/dashboard/assets/PolicyPicker-iyQz7WhP.js
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/Rules-2i24Jtpl.js b/luci-app-honk/root/etc/honk/dashboard/assets/Rules-2i24Jtpl.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/Rules-2i24Jtpl.js
rename to luci-app-honk/root/etc/honk/dashboard/assets/Rules-2i24Jtpl.js
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/Rules-l5FnUA9B.css b/luci-app-honk/root/etc/honk/dashboard/assets/Rules-l5FnUA9B.css
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/Rules-l5FnUA9B.css
rename to luci-app-honk/root/etc/honk/dashboard/assets/Rules-l5FnUA9B.css
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/SearchDialog-ByDSjolq.js b/luci-app-honk/root/etc/honk/dashboard/assets/SearchDialog-ByDSjolq.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/SearchDialog-ByDSjolq.js
rename to luci-app-honk/root/etc/honk/dashboard/assets/SearchDialog-ByDSjolq.js
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/Settings-Cznhh7lT.js b/luci-app-honk/root/etc/honk/dashboard/assets/Settings-Cznhh7lT.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/Settings-Cznhh7lT.js
rename to luci-app-honk/root/etc/honk/dashboard/assets/Settings-Cznhh7lT.js
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/Sparkline-C9XwgOxX.js b/luci-app-honk/root/etc/honk/dashboard/assets/Sparkline-C9XwgOxX.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/Sparkline-C9XwgOxX.js
rename to luci-app-honk/root/etc/honk/dashboard/assets/Sparkline-C9XwgOxX.js
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/Table-DLlwyNFJ.js b/luci-app-honk/root/etc/honk/dashboard/assets/Table-DLlwyNFJ.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/Table-DLlwyNFJ.js
rename to luci-app-honk/root/etc/honk/dashboard/assets/Table-DLlwyNFJ.js
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/TimeCell-DxlzlVpw.js b/luci-app-honk/root/etc/honk/dashboard/assets/TimeCell-DxlzlVpw.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/TimeCell-DxlzlVpw.js
rename to luci-app-honk/root/etc/honk/dashboard/assets/TimeCell-DxlzlVpw.js
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/Virtualizer-CTh266-x.js b/luci-app-honk/root/etc/honk/dashboard/assets/Virtualizer-CTh266-x.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/Virtualizer-CTh266-x.js
rename to luci-app-honk/root/etc/honk/dashboard/assets/Virtualizer-CTh266-x.js
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/array-C0P64tl-.js b/luci-app-honk/root/etc/honk/dashboard/assets/array-C0P64tl-.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/array-C0P64tl-.js
rename to luci-app-honk/root/etc/honk/dashboard/assets/array-C0P64tl-.js
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/auth-CPB25VPp.js b/luci-app-honk/root/etc/honk/dashboard/assets/auth-CPB25VPp.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/auth-CPB25VPp.js
rename to luci-app-honk/root/etc/honk/dashboard/assets/auth-CPB25VPp.js
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/dns-BoPCaePc.js b/luci-app-honk/root/etc/honk/dashboard/assets/dns-BoPCaePc.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/dns-BoPCaePc.js
rename to luci-app-honk/root/etc/honk/dashboard/assets/dns-BoPCaePc.js
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/duck-night-CbKHyiul.webp b/luci-app-honk/root/etc/honk/dashboard/assets/duck-night-CbKHyiul.webp
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/duck-night-CbKHyiul.webp
rename to luci-app-honk/root/etc/honk/dashboard/assets/duck-night-CbKHyiul.webp
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/files-BxEOxSF8.js b/luci-app-honk/root/etc/honk/dashboard/assets/files-BxEOxSF8.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/files-BxEOxSF8.js
rename to luci-app-honk/root/etc/honk/dashboard/assets/files-BxEOxSF8.js
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/flows-Bv2rvXJX.js b/luci-app-honk/root/etc/honk/dashboard/assets/flows-Bv2rvXJX.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/flows-Bv2rvXJX.js
rename to luci-app-honk/root/etc/honk/dashboard/assets/flows-Bv2rvXJX.js
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/fonts-sc-DWPGxLPK.css b/luci-app-honk/root/etc/honk/dashboard/assets/fonts-sc-DWPGxLPK.css
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/fonts-sc-DWPGxLPK.css
rename to luci-app-honk/root/etc/honk/dashboard/assets/fonts-sc-DWPGxLPK.css
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/fonts-tc-B6Zt5HQN.css b/luci-app-honk/root/etc/honk/dashboard/assets/fonts-tc-B6Zt5HQN.css
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/fonts-tc-B6Zt5HQN.css
rename to luci-app-honk/root/etc/honk/dashboard/assets/fonts-tc-B6Zt5HQN.css
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/geodata-DprMPspn.js b/luci-app-honk/root/etc/honk/dashboard/assets/geodata-DprMPspn.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/geodata-DprMPspn.js
rename to luci-app-honk/root/etc/honk/dashboard/assets/geodata-DprMPspn.js
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/index-BJD5IosD.js b/luci-app-honk/root/etc/honk/dashboard/assets/index-BJD5IosD.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/index-BJD5IosD.js
rename to luci-app-honk/root/etc/honk/dashboard/assets/index-BJD5IosD.js
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/index-CszNs-yj.css b/luci-app-honk/root/etc/honk/dashboard/assets/index-CszNs-yj.css
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/index-CszNs-yj.css
rename to luci-app-honk/root/etc/honk/dashboard/assets/index-CszNs-yj.css
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/index-zQjLFfuj.js b/luci-app-honk/root/etc/honk/dashboard/assets/index-zQjLFfuj.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/index-zQjLFfuj.js
rename to luci-app-honk/root/etc/honk/dashboard/assets/index-zQjLFfuj.js
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/layout-B3T-zLsm.js b/luci-app-honk/root/etc/honk/dashboard/assets/layout-B3T-zLsm.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/layout-B3T-zLsm.js
rename to luci-app-honk/root/etc/honk/dashboard/assets/layout-B3T-zLsm.js
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/link-CaqmdEp1.js b/luci-app-honk/root/etc/honk/dashboard/assets/link-CaqmdEp1.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/link-CaqmdEp1.js
rename to luci-app-honk/root/etc/honk/dashboard/assets/link-CaqmdEp1.js
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/locale-en-xL0bZCSM.js b/luci-app-honk/root/etc/honk/dashboard/assets/locale-en-xL0bZCSM.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/locale-en-xL0bZCSM.js
rename to luci-app-honk/root/etc/honk/dashboard/assets/locale-en-xL0bZCSM.js
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/locale-zh-CN-FbJVHSGr.js b/luci-app-honk/root/etc/honk/dashboard/assets/locale-zh-CN-FbJVHSGr.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/locale-zh-CN-FbJVHSGr.js
rename to luci-app-honk/root/etc/honk/dashboard/assets/locale-zh-CN-FbJVHSGr.js
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/locale-zh-TW-tVBw2Pbf.js b/luci-app-honk/root/etc/honk/dashboard/assets/locale-zh-TW-tVBw2Pbf.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/locale-zh-TW-tVBw2Pbf.js
rename to luci-app-honk/root/etc/honk/dashboard/assets/locale-zh-TW-tVBw2Pbf.js
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/logo-obi05X1B.svg b/luci-app-honk/root/etc/honk/dashboard/assets/logo-obi05X1B.svg
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/logo-obi05X1B.svg
rename to luci-app-honk/root/etc/honk/dashboard/assets/logo-obi05X1B.svg
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/logs-KkruktUh.js b/luci-app-honk/root/etc/honk/dashboard/assets/logs-KkruktUh.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/logs-KkruktUh.js
rename to luci-app-honk/root/etc/honk/dashboard/assets/logs-KkruktUh.js
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/nav--TYgv3Ng.js b/luci-app-honk/root/etc/honk/dashboard/assets/nav--TYgv3Ng.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/nav--TYgv3Ng.js
rename to luci-app-honk/root/etc/honk/dashboard/assets/nav--TYgv3Ng.js
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/nav-BIVfQR1w.js b/luci-app-honk/root/etc/honk/dashboard/assets/nav-BIVfQR1w.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/nav-BIVfQR1w.js
rename to luci-app-honk/root/etc/honk/dashboard/assets/nav-BIVfQR1w.js
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/nav-BIpfWn6-.js b/luci-app-honk/root/etc/honk/dashboard/assets/nav-BIpfWn6-.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/nav-BIpfWn6-.js
rename to luci-app-honk/root/etc/honk/dashboard/assets/nav-BIpfWn6-.js
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/nav-BeFLfZq8.js b/luci-app-honk/root/etc/honk/dashboard/assets/nav-BeFLfZq8.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/nav-BeFLfZq8.js
rename to luci-app-honk/root/etc/honk/dashboard/assets/nav-BeFLfZq8.js
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/outbounds-CM0Hhk3q.js b/luci-app-honk/root/etc/honk/dashboard/assets/outbounds-CM0Hhk3q.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/outbounds-CM0Hhk3q.js
rename to luci-app-honk/root/etc/honk/dashboard/assets/outbounds-CM0Hhk3q.js
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/policyText-IIH31itq.js b/luci-app-honk/root/etc/honk/dashboard/assets/policyText-IIH31itq.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/policyText-IIH31itq.js
rename to luci-app-honk/root/etc/honk/dashboard/assets/policyText-IIH31itq.js
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/probe-CjOLdDVD.js b/luci-app-honk/root/etc/honk/dashboard/assets/probe-CjOLdDVD.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/probe-CjOLdDVD.js
rename to luci-app-honk/root/etc/honk/dashboard/assets/probe-CjOLdDVD.js
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/ranked-C_Wt6A1w.js b/luci-app-honk/root/etc/honk/dashboard/assets/ranked-C_Wt6A1w.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/ranked-C_Wt6A1w.js
rename to luci-app-honk/root/etc/honk/dashboard/assets/ranked-C_Wt6A1w.js
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/setup-BqwQo7FE.js b/luci-app-honk/root/etc/honk/dashboard/assets/setup-BqwQo7FE.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/setup-BqwQo7FE.js
rename to luci-app-honk/root/etc/honk/dashboard/assets/setup-BqwQo7FE.js
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/useFilter-BYneYrGs.js b/luci-app-honk/root/etc/honk/dashboard/assets/useFilter-BYneYrGs.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/useFilter-BYneYrGs.js
rename to luci-app-honk/root/etc/honk/dashboard/assets/useFilter-BYneYrGs.js
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/useGridSelectionCheckbox-BK6qtlfZ.js b/luci-app-honk/root/etc/honk/dashboard/assets/useGridSelectionCheckbox-BK6qtlfZ.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/useGridSelectionCheckbox-BK6qtlfZ.js
rename to luci-app-honk/root/etc/honk/dashboard/assets/useGridSelectionCheckbox-BK6qtlfZ.js
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/vendor-editor-BYSNX95r.js b/luci-app-honk/root/etc/honk/dashboard/assets/vendor-editor-BYSNX95r.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/vendor-editor-BYSNX95r.js
rename to luci-app-honk/root/etc/honk/dashboard/assets/vendor-editor-BYSNX95r.js
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/vendor-react-Bf71BWbF.js b/luci-app-honk/root/etc/honk/dashboard/assets/vendor-react-Bf71BWbF.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/assets/vendor-react-Bf71BWbF.js
rename to luci-app-honk/root/etc/honk/dashboard/assets/vendor-react-Bf71BWbF.js
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/icons/apple-touch-icon.png b/luci-app-honk/root/etc/honk/dashboard/icons/apple-touch-icon.png
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/icons/apple-touch-icon.png
rename to luci-app-honk/root/etc/honk/dashboard/icons/apple-touch-icon.png
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/icons/icon-192.png b/luci-app-honk/root/etc/honk/dashboard/icons/icon-192.png
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/icons/icon-192.png
rename to luci-app-honk/root/etc/honk/dashboard/icons/icon-192.png
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/icons/icon-512.png b/luci-app-honk/root/etc/honk/dashboard/icons/icon-512.png
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/icons/icon-512.png
rename to luci-app-honk/root/etc/honk/dashboard/icons/icon-512.png
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/icons/maskable-512.png b/luci-app-honk/root/etc/honk/dashboard/icons/maskable-512.png
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/icons/maskable-512.png
rename to luci-app-honk/root/etc/honk/dashboard/icons/maskable-512.png
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/index.html b/luci-app-honk/root/etc/honk/dashboard/index.html
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/index.html
rename to luci-app-honk/root/etc/honk/dashboard/index.html
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/logo.svg b/luci-app-honk/root/etc/honk/dashboard/logo.svg
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/logo.svg
rename to luci-app-honk/root/etc/honk/dashboard/logo.svg
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/manifest.webmanifest b/luci-app-honk/root/etc/honk/dashboard/manifest.webmanifest
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/manifest.webmanifest
rename to luci-app-honk/root/etc/honk/dashboard/manifest.webmanifest
diff --git a/luci-app-honk/luci-app-honk/root/etc/honk/dashboard/sw.js b/luci-app-honk/root/etc/honk/dashboard/sw.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/honk/dashboard/sw.js
rename to luci-app-honk/root/etc/honk/dashboard/sw.js
diff --git a/luci-app-honk/luci-app-honk/root/etc/uci-defaults/luci-honk b/luci-app-honk/root/etc/uci-defaults/luci-honk
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/etc/uci-defaults/luci-honk
rename to luci-app-honk/root/etc/uci-defaults/luci-honk
diff --git a/luci-app-honk/luci-app-honk/root/usr/share/honk/download_dashboard.sh b/luci-app-honk/root/usr/share/honk/download_dashboard.sh
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/usr/share/honk/download_dashboard.sh
rename to luci-app-honk/root/usr/share/honk/download_dashboard.sh
diff --git a/luci-app-honk/luci-app-honk/root/usr/share/luci/menu.d/luci-app-honk.json b/luci-app-honk/root/usr/share/luci/menu.d/luci-app-honk.json
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/usr/share/luci/menu.d/luci-app-honk.json
rename to luci-app-honk/root/usr/share/luci/menu.d/luci-app-honk.json
diff --git a/luci-app-honk/luci-app-honk/root/usr/share/rpcd/acl.d/luci-app-honk.json b/luci-app-honk/root/usr/share/rpcd/acl.d/luci-app-honk.json
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/usr/share/rpcd/acl.d/luci-app-honk.json
rename to luci-app-honk/root/usr/share/rpcd/acl.d/luci-app-honk.json
diff --git a/luci-app-honk/luci-app-honk/root/usr/share/rpcd/ucode/honk.uc b/luci-app-honk/root/usr/share/rpcd/ucode/honk.uc
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/usr/share/rpcd/ucode/honk.uc
rename to luci-app-honk/root/usr/share/rpcd/ucode/honk.uc
diff --git a/luci-app-honk/luci-app-honk/root/www/luci-static/resources/honk/addon/edit/closebrackets.js b/luci-app-honk/root/www/luci-static/resources/honk/addon/edit/closebrackets.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/www/luci-static/resources/honk/addon/edit/closebrackets.js
rename to luci-app-honk/root/www/luci-static/resources/honk/addon/edit/closebrackets.js
diff --git a/luci-app-honk/luci-app-honk/root/www/luci-static/resources/honk/addon/edit/matchbrackets.js b/luci-app-honk/root/www/luci-static/resources/honk/addon/edit/matchbrackets.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/www/luci-static/resources/honk/addon/edit/matchbrackets.js
rename to luci-app-honk/root/www/luci-static/resources/honk/addon/edit/matchbrackets.js
diff --git a/luci-app-honk/luci-app-honk/root/www/luci-static/resources/honk/addon/fold/foldcode.js b/luci-app-honk/root/www/luci-static/resources/honk/addon/fold/foldcode.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/www/luci-static/resources/honk/addon/fold/foldcode.js
rename to luci-app-honk/root/www/luci-static/resources/honk/addon/fold/foldcode.js
diff --git a/luci-app-honk/luci-app-honk/root/www/luci-static/resources/honk/addon/fold/foldgutter.css b/luci-app-honk/root/www/luci-static/resources/honk/addon/fold/foldgutter.css
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/www/luci-static/resources/honk/addon/fold/foldgutter.css
rename to luci-app-honk/root/www/luci-static/resources/honk/addon/fold/foldgutter.css
diff --git a/luci-app-honk/luci-app-honk/root/www/luci-static/resources/honk/addon/fold/foldgutter.js b/luci-app-honk/root/www/luci-static/resources/honk/addon/fold/foldgutter.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/www/luci-static/resources/honk/addon/fold/foldgutter.js
rename to luci-app-honk/root/www/luci-static/resources/honk/addon/fold/foldgutter.js
diff --git a/luci-app-honk/luci-app-honk/root/www/luci-static/resources/honk/addon/fold/indent-fold.js b/luci-app-honk/root/www/luci-static/resources/honk/addon/fold/indent-fold.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/www/luci-static/resources/honk/addon/fold/indent-fold.js
rename to luci-app-honk/root/www/luci-static/resources/honk/addon/fold/indent-fold.js
diff --git a/luci-app-honk/luci-app-honk/root/www/luci-static/resources/honk/common.js b/luci-app-honk/root/www/luci-static/resources/honk/common.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/www/luci-static/resources/honk/common.js
rename to luci-app-honk/root/www/luci-static/resources/honk/common.js
diff --git a/luci-app-honk/luci-app-honk/root/www/luci-static/resources/honk/lib/codemirror.css b/luci-app-honk/root/www/luci-static/resources/honk/lib/codemirror.css
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/www/luci-static/resources/honk/lib/codemirror.css
rename to luci-app-honk/root/www/luci-static/resources/honk/lib/codemirror.css
diff --git a/luci-app-honk/luci-app-honk/root/www/luci-static/resources/honk/lib/codemirror.js b/luci-app-honk/root/www/luci-static/resources/honk/lib/codemirror.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/www/luci-static/resources/honk/lib/codemirror.js
rename to luci-app-honk/root/www/luci-static/resources/honk/lib/codemirror.js
diff --git a/luci-app-honk/luci-app-honk/root/www/luci-static/resources/honk/mode/dae/dae.js b/luci-app-honk/root/www/luci-static/resources/honk/mode/dae/dae.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/www/luci-static/resources/honk/mode/dae/dae.js
rename to luci-app-honk/root/www/luci-static/resources/honk/mode/dae/dae.js
diff --git a/luci-app-honk/luci-app-honk/root/www/luci-static/resources/view/honk/dashboard.js b/luci-app-honk/root/www/luci-static/resources/view/honk/dashboard.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/www/luci-static/resources/view/honk/dashboard.js
rename to luci-app-honk/root/www/luci-static/resources/view/honk/dashboard.js
diff --git a/luci-app-honk/luci-app-honk/root/www/luci-static/resources/view/honk/dns.js b/luci-app-honk/root/www/luci-static/resources/view/honk/dns.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/www/luci-static/resources/view/honk/dns.js
rename to luci-app-honk/root/www/luci-static/resources/view/honk/dns.js
diff --git a/luci-app-honk/luci-app-honk/root/www/luci-static/resources/view/honk/global.js b/luci-app-honk/root/www/luci-static/resources/view/honk/global.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/www/luci-static/resources/view/honk/global.js
rename to luci-app-honk/root/www/luci-static/resources/view/honk/global.js
diff --git a/luci-app-honk/luci-app-honk/root/www/luci-static/resources/view/honk/log.js b/luci-app-honk/root/www/luci-static/resources/view/honk/log.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/www/luci-static/resources/view/honk/log.js
rename to luci-app-honk/root/www/luci-static/resources/view/honk/log.js
diff --git a/luci-app-honk/luci-app-honk/root/www/luci-static/resources/view/honk/node.js b/luci-app-honk/root/www/luci-static/resources/view/honk/node.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/www/luci-static/resources/view/honk/node.js
rename to luci-app-honk/root/www/luci-static/resources/view/honk/node.js
diff --git a/luci-app-honk/luci-app-honk/root/www/luci-static/resources/view/honk/route.js b/luci-app-honk/root/www/luci-static/resources/view/honk/route.js
similarity index 100%
rename from luci-app-honk/luci-app-honk/root/www/luci-static/resources/view/honk/route.js
rename to luci-app-honk/root/www/luci-static/resources/view/honk/route.js
diff --git a/luci-app-honk/scripts/update_doona.sh b/luci-app-honk/scripts/update_doona.sh
deleted file mode 100755
index fcf2de833..000000000
--- a/luci-app-honk/scripts/update_doona.sh
+++ /dev/null
@@ -1,84 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-REPO_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-TARGET_DIR="${1:-$REPO_DIR/luci-app-honk/root/etc/honk/dashboard}"
-UPSTREAM_REPO="Zakkaus/doona"
-
-echo "==> Updating embedded Doona dashboard..."
-echo "Target directory: $TARGET_DIR"
-
-# 1. Fetch latest release tag
-RELEASES_HTML="$(curl -fsSL --retry 3 --connect-timeout 10 "https://github.com/${UPSTREAM_REPO}/releases" 2>/dev/null || true)"
-LATEST_TAG="$(printf "%s" "$RELEASES_HTML" | grep -o 'releases/tag/[^"/]*' | head -n 1 | sed 's|releases/tag/||')"
-
-if [ -z "$LATEST_TAG" ]; then
-    echo "Warning: Could not detect latest tag from GitHub releases HTML. Trying git ls-remote..."
-    LATEST_TAG="$(git ls-remote --tags "https://github.com/${UPSTREAM_REPO}.git" | awk '{print $2}' | sed 's|refs/tags/||' | grep -v '\^{}' | sort -V | tail -n 1)"
-fi
-
-[ -n "$LATEST_TAG" ] || { echo "Error: Failed to resolve latest release tag for ${UPSTREAM_REPO}" >&2; exit 1; }
-echo "Latest release tag: $LATEST_TAG"
-
-# 2. Resolve asset download URL (handling both doona-X.X.X.tar.gz and doona-vX.X.X.tar.gz)
-ASSETS_HTML="$(curl -fsSL --retry 3 --connect-timeout 10 "https://github.com/${UPSTREAM_REPO}/releases/expanded_assets/${LATEST_TAG}" 2>/dev/null || true)"
-ASSET_PATH="$(printf "%s" "$ASSETS_HTML" | grep -o "/${UPSTREAM_REPO}/releases/download/[^\"]*\\.tar\\.gz" | grep -v 'fonts' | head -n 1 || true)"
-
-TAG_NO_V="${LATEST_TAG#[vV]}"
-DOWNLOAD_URL=""
-
-if [ -n "$ASSET_PATH" ]; then
-    DOWNLOAD_URL="https://github.com${ASSET_PATH}"
-    echo "Found upstream asset: $ASSET_PATH"
-else
-    # Inferred fallback: try without 'v' first (doona-0.1.0-beta.2.tar.gz), then with 'v'
-    DOWNLOAD_URL="https://github.com/${UPSTREAM_REPO}/releases/download/${LATEST_TAG}/doona-${TAG_NO_V}.tar.gz"
-    echo "Inferred asset URL: $DOWNLOAD_URL"
-fi
-
-# 3. Download and extract
-TMP_DIR="$(mktemp -d)"
-trap 'rm -rf "$TMP_DIR"' EXIT
-
-ARCHIVE_FILE="$TMP_DIR/doona.tar.gz"
-echo "Downloading $DOWNLOAD_URL ..."
-
-if ! curl -fsSL --retry 3 --connect-timeout 15 -o "$ARCHIVE_FILE" "$DOWNLOAD_URL" 2>/dev/null || [ ! -s "$ARCHIVE_FILE" ]; then
-    # Try alternative format (switch between doona-v and doona-)
-    ALT_URL=""
-    case "$DOWNLOAD_URL" in
-        *doona-v*)
-            ALT_URL="$(echo "$DOWNLOAD_URL" | sed 's/doona-v/doona-/')"
-            ;;
-        *doona-[0-9]*)
-            ALT_URL="$(echo "$DOWNLOAD_URL" | sed 's/doona-/doona-v/')"
-            ;;
-    esac
-    if [ -n "$ALT_URL" ] && [ "$ALT_URL" != "$DOWNLOAD_URL" ]; then
-        echo "Retrying with alternative asset name format: $ALT_URL"
-        curl -fsSL --retry 3 --connect-timeout 15 -o "$ARCHIVE_FILE" "$ALT_URL"
-    fi
-fi
-
-[ -s "$ARCHIVE_FILE" ] || { echo "Error: Downloaded package is empty or failed to download." >&2; exit 1; }
-
-EXTRACT_DIR="$TMP_DIR/extracted"
-mkdir -p "$EXTRACT_DIR"
-tar -xzf "$ARCHIVE_FILE" -C "$EXTRACT_DIR"
-
-DEPLOY_SRC="$EXTRACT_DIR"
-if [ ! -f "$DEPLOY_SRC/index.html" ] && [ -f "$EXTRACT_DIR/dist/index.html" ]; then
-    DEPLOY_SRC="$EXTRACT_DIR/dist"
-fi
-
-[ -f "$DEPLOY_SRC/index.html" ] || { echo "Error: index.html not found in extracted archive." >&2; exit 1; }
-
-# 4. Deploy to target directory
-mkdir -p "$TARGET_DIR"
-rm -rf "${TARGET_DIR:?}"/* "${TARGET_DIR:?}"/.[!.]* 2>/dev/null || true
-cp -rf "$DEPLOY_SRC/"* "$TARGET_DIR/"
-find "$TARGET_DIR" -type d -exec chmod 755 {} +
-find "$TARGET_DIR" -type f -exec chmod 644 {} +
-
-echo "==> Successfully embedded Doona dashboard (${LATEST_TAG}) into $TARGET_DIR"
-ls -lh "$TARGET_DIR"
diff --git a/luci-app-honk/scripts/update_honk_version.sh b/luci-app-honk/scripts/update_honk_version.sh
deleted file mode 100644
index 6d9a02107..000000000
--- a/luci-app-honk/scripts/update_honk_version.sh
+++ /dev/null
@@ -1,190 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-REPO_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-MAKEFILE="$REPO_DIR/honk/Makefile"
-UPSTREAM_REPO="daeuniverse/honk"
-
-git_ls_remote() {
-    local attempt
-    for attempt in 1 2 3 4 5; do
-        if git ls-remote --tags "https://github.com/${UPSTREAM_REPO}.git" 2>/dev/null; then
-            return 0
-        fi
-        sleep 3
-    done
-    return 1
-}
-
-calc_sha256() {
-    local file="$1"
-    if command -v sha256sum >/dev/null 2>&1; then
-        sha256sum "$file" | awk '{print $1}'
-    elif command -v shasum >/dev/null 2>&1; then
-        shasum -a 256 "$file" | awk '{print $1}'
-    else
-        echo "error: neither sha256sum nor shasum is installed" >&2
-        return 1
-    fi
-}
-
-derive_version() {
-    local tag="$1"
-    local v="${tag#[vV]}"
-    local prefix rest stage stage_num patch_num
-    stage=""
-    stage_num=""
-    patch_num=""
-
-    # 1. 提取主版本号
-    prefix="$(printf '%s' "$v" | sed -E 's/^([0-9]+(\.[0-9]+)*).*/\1/')"
-    [ -n "$prefix" ] || prefix="0.0.0"
-
-    # 2. 剥离已提取部分及连接符
-    rest="${v#"$prefix"}"
-    rest="$(printf '%s' "$rest" | sed -E 's/^[-_.]+//')"
-
-    if [ -n "$rest" ]; then
-        # 统一小写
-        rest="$(printf '%s' "$rest" | tr '[:upper:]' '[:lower:]')"
-
-        # 3. 提取阶段性标签 (alpha/beta/rc 等)
-        if printf '%s' "$rest" | grep -qE '^(alpha|beta|pre|rc|cvs|git|hg|svn)'; then
-            stage="$(printf '%s' "$rest" | sed -E -n 's/^(alpha|beta|pre|rc|cvs|git|hg|svn).*/\1/p')"
-            rest="$(printf '%s' "$rest" | sed -E 's/^(alpha|beta|pre|rc|cvs|git|hg|svn)//' | sed -E 's/^[-_.]+//')"
-
-            stage_num="$(printf '%s' "$rest" | sed -E -n 's/^([0-9]+).*/\1/p')"
-            if [ -n "$stage_num" ]; then
-                rest="${rest#"$stage_num"}"
-                rest="$(printf '%s' "$rest" | sed -E 's/^[-_.]+//')"
-            fi
-        fi
-
-        # 4. 提取补丁标签 (抹除所有分隔符，将 fix.fix 压扁为 fixfix)
-        if [ -n "$rest" ]; then
-            rest="$(printf '%s' "$rest" | sed -E 's/[-_.]//g')"
-            if printf '%s' "$rest" | grep -qE '^(fix)+$'; then
-                local orig_len="${#rest}"
-                local stripped_rest="${rest//fix/}"
-                patch_num=$(( (orig_len - ${#stripped_rest}) / 3 ))
-            elif printf '%s' "$rest" | grep -qE '^(fix|patch|hotfix|p)[0-9]+'; then
-                patch_num="$(printf '%s' "$rest" | sed -E -n 's/^(fix|patch|hotfix|p)([0-9]+).*/\2/p')"
-            elif printf '%s' "$rest" | grep -qE '^(fix|patch|hotfix|p)$'; then
-                patch_num="1"
-            fi
-        fi
-    fi
-
-    # 5. 组装合规版本号
-    local result="$prefix"
-    [ -z "$stage" ] || result="${result}_${stage}${stage_num}"
-    [ -z "$patch_num" ] || result="${result}_p${patch_num}"
-    
-    printf '%s\n' "$result"
-}
-
-assert_apk_version() {
-    local v="$1"
-
-    if command -v apk >/dev/null 2>&1; then
-        apk version -c "$v" >/dev/null 2>&1 && return 0 || return 1
-    fi
-
-    local apk_regex="^[0-9]+(\.[0-9]+)*[a-z]?(_(alpha|beta|pre|rc|cvs|svn|git|hg|p)[0-9]*)*$"
-    printf '%s' "$v" | grep -qE "$apk_regex"
-}
-
-resolve_tag() {
-    if [ -n "${HONK_RELEASE_TAG:-}" ]; then
-        printf '%s\n' "$HONK_RELEASE_TAG"
-        return 0
-    fi
-
-    local json="${HONK_RELEASE_JSON:-}"
-    if [ -z "$json" ]; then
-        json="$(curl -fsSL --retry 3 --connect-timeout 15 \
-            "https://api.github.com/repos/${UPSTREAM_REPO}/releases/latest" 2>/dev/null || true)"
-    fi
-
-    if [ -n "$json" ]; then
-        local tag
-        tag="$(printf '%s' "$json" | sed -n 's/.*"tag_name"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | head -n 1)"
-        if [ -n "$tag" ]; then
-            printf '%s\n' "$tag"
-            return 0
-        fi
-    fi
-
-    git_ls_remote | awk '{print $2}' | sed 's|refs/tags/||' | grep -v '\^{}' | sort -V | tail -n 1
-}
-
-resolve_hash() {
-    local var_name="$1"
-    local target="$2"
-    local suffix="$3"
-    local tag="$4"
-    local asset="honk-core-${tag}-${target}${suffix}.tar.gz"
-
-    if [ -n "${!var_name:-}" ]; then
-        printf '%s\n' "${!var_name}"
-        return 0
-    fi
-
-    local tmp hash
-    tmp="$(mktemp)"
-    if ! curl -fsSL --retry 3 --connect-timeout 20 \
-        "https://github.com/daeuniverse/honk/releases/download/${tag}/${asset}" -o "$tmp" 2>/dev/null; then
-        rm -f "$tmp"
-        echo "error: unable to download ${asset}" >&2
-        return 1
-    fi
-
-    if ! hash="$(calc_sha256 "$tmp")"; then
-        rm -f "$tmp"
-        echo "error: unable to hash ${asset}" >&2
-        return 1
-    fi
-    rm -f "$tmp"
-
-    printf '%s\n' "$hash"
-}
-
-main() {
-    local tag version suffix hash_x86_64 hash_aarch64
-    tag="$(resolve_tag)"
-    [ -n "$tag" ] || { echo "error: unable to resolve honk release tag" >&2; exit 1; }
-    
-    version="$(derive_version "$tag")"
-
-    if ! assert_apk_version "$version"; then
-        echo "WARNING: Parsed version '${version}' is invalid for apk-tools!" >&2
-        # Fallback：仅提取纯数字基准版本号 (剥离不可靠后缀)
-        version="$(printf '%s' "${tag#[vV]}" | sed -E 's/^([0-9]+(\.[0-9]+)*).*/\1/')"
-        [ -n "$version" ] || version="0.0.0"
-        echo "INFO: Falling back to strict safe PKG_VERSION='${version}'" >&2
-    else
-        echo "INFO: Validated PKG_VERSION='${version}'" >&2
-    fi
-
-    suffix="$(grep '^HONK_SUFFIX:=' "$MAKEFILE" | head -n 1 | cut -d= -f2- || true)"
-
-    hash_x86_64="$(resolve_hash HONK_HASH_X86_64 "x86_64-unknown-linux-musl" "$suffix" "$tag")"
-    hash_aarch64="$(resolve_hash HONK_HASH_AARCH64 "aarch64-unknown-linux-musl" "$suffix" "$tag")"
-
-    # Stream substitution compatible across Linux and macOS/BSD
-    sed -E \
-        -e "s/^PKG_VERSION:=.*/PKG_VERSION:=${version}/" \
-        -e "s/^HONK_RELEASE_TAG:=.*/HONK_RELEASE_TAG:=${tag}/" \
-        -e "s/^HONK_HASH_X86_64:=.*/HONK_HASH_X86_64:=${hash_x86_64}/" \
-        -e "s/^HONK_HASH_AARCH64:=.*/HONK_HASH_AARCH64:=${hash_aarch64}/" \
-        "$MAKEFILE" > "${MAKEFILE}.tmp"
-    
-    mv "${MAKEFILE}.tmp" "$MAKEFILE"
-
-    echo "==================================="
-    echo "honk updated to ${tag} (PKG_VERSION=${version})"
-    echo "HONK_HASH_X86_64=${hash_x86_64}"
-    echo "HONK_HASH_AARCH64=${hash_aarch64}"
-}
-
-main "$@"
diff --git a/luci-app-meow/README.md b/luci-app-meow/README.md
new file mode 100644
index 000000000..0181c3015
--- /dev/null
+++ b/luci-app-meow/README.md
@@ -0,0 +1,10 @@
+本仓库完全自包含:init 脚本、UCI 默认配置、默认 YAML、LuCI JS/JSON 均已收录
+(取自 meow-rs 仓库 `openwrt/` 目录),CI 里不需要再从上游仓库复制任何文件;
+构建时唯一的外部依赖是 `meow/Makefile` 声明的官方 release tarball
+(`PKG_SOURCE_URL` + `PKG_HASH` 校验)。
+
+## 参考
+
+- meow-rs: https://github.com/meow-rs/meow-rs
+- OpenWrt feeds 文档: https://openwrt.org/docs/guide-developer/feeds
+- OpenWrt apk 包管理器(25.12+): https://openwrt.org/docs/guide-user/additional-software/apk
diff --git a/luci-app-meow/luci-app-meow/Makefile b/luci-app-meow/luci-app-meow/Makefile
new file mode 100644
index 000000000..35f9429b8
--- /dev/null
+++ b/luci-app-meow/luci-app-meow/Makefile
@@ -0,0 +1,16 @@
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=luci-app-meow
+PKG_VERSION:=0.21.2
+PKG_RELEASE:=1
+
+LUCI_TITLE:=LuCI support for meow (panel + settings)
+LUCI_DEPENDS:=+luci-base +meow
+LUCI_PKGARCH:=all
+
+PKG_MAINTAINER:=Max Lv 
+PKG_LICENSE:=Apache-2.0
+
+include $(TOPDIR)/feeds/luci/luci.mk
+
+# call BuildPackage - OpenWrt buildroot signature
diff --git a/luci-app-meow/luci-app-meow/htdocs/luci-static/resources/view/meow/config.js b/luci-app-meow/luci-app-meow/htdocs/luci-static/resources/view/meow/config.js
new file mode 100644
index 000000000..1a6a0931a
--- /dev/null
+++ b/luci-app-meow/luci-app-meow/htdocs/luci-static/resources/view/meow/config.js
@@ -0,0 +1,356 @@
+// SPDX-License-Identifier: Apache-2.0
+
+'use strict';
+'require form';
+'require fs';
+'require ui';
+'require view';
+'require rpc';
+'require uci';
+
+var callFileWrite = rpc.declare({
+	object: 'file',
+	method: 'write',
+	params: [ 'path', 'data' ]
+});
+
+var configFile = '/etc/meow/config.yaml';
+
+return view.extend({
+	editorInstance: null,
+
+	handleSaveApply: function (ev, mode) {
+		var value = document.getElementById('cbid_meow_config__configuration').value;
+
+		if (!value) {
+			ui.addNotification(null, E('p', _('Configuration cannot be empty!')), 'error');
+			return Promise.reject(new Error('Empty configuration'));
+		}
+
+		if (this.editorInstance) {
+			var model = this.editorInstance.getModel();
+			var markers = monaco.editor.getModelMarkers({
+				owner: 'meow-validator',
+				resource: model.uri
+			});
+
+			if (markers && markers.length > 0) {
+				var errorMessages = markers.map(function (marker) {
+					return marker.message + ' ' + _('(Line: %d)').format(marker.startLineNumber);
+				}).join('
');
+
+				ui.addNotification(null, E('p', [
+					_('Configuration validation failed!'),
+					E('br'),
+					E('small', errorMessages)
+				]), 'error');
+
+				return Promise.reject(new Error('Invalid configuration'));
+			}
+		}
+
+		return callFileWrite(configFile, value)
+			.then(function () {
+				return L.resolveDefault(
+					fs.exec_direct('/bin/chmod', [ '0600', configFile ]),
+					null
+				);
+			})
+			.then(function () {
+				/*
+				 * fs.exec_direct resolves with stdout and rejects
+				 * on non-zero exit code.
+				 *
+				 * It does not return an object containing `code`.
+				 * Reload first, restart only when reload fails.
+				 */
+				return fs.exec_direct('/etc/init.d/meow', [ 'reload' ])
+					.catch(function () {
+						return fs.exec_direct('/etc/init.d/meow', [ 'restart' ]);
+					});
+			})
+			.catch(function (e) {
+				ui.addNotification(
+					null,
+					E('p', _('Failed to save configuration: %s').format(e.message))
+				);
+
+				return Promise.reject(e);
+			});
+	},
+
+	load: function () {
+		return fs.read_direct(configFile, 'text')
+			.then(function (content) {
+				return content ?? '';
+			})
+			.catch(function (e) {
+				ui.addNotification(null, E('p', e.message));
+				return '';
+			});
+	},
+
+	render: function (content) {
+		var m, s;
+		var self = this;
+
+		self.formvalue = {};
+
+		var css = E('style', {}, `
+			#code_editor {
+				height: 500px;
+				width: 100%;
+				border: 1px solid #ccc;
+			}
+			#fallback_editor {
+				height: 500px;
+				width: 100%;
+				font-family: monospace;
+				white-space: pre;
+			}
+			@media (prefers-color-scheme: dark) {
+				#code_editor {
+					border-color: #555;
+				}
+				#fallback_editor {
+					background: #1e1e1e;
+					color: #d4d4d4;
+				}
+			}
+		`);
+
+		var editorDiv = E('div', { id: 'code_editor' });
+
+		var hiddenInput = E('input', {
+			type: 'hidden',
+			id: 'cbid_meow_config__configuration',
+			name: 'cbid.meow.config._configuration',
+			value: content
+		});
+
+		m = new form.Map(
+			'meow',
+			_('Configuration'),
+			_('Here you can edit the meow YAML configuration. It will be automatically validated and the service reloaded after apply.')
+		);
+
+		m.onValidate = function (map, data) {
+			self.formvalue = data;
+		};
+
+		m.submitSave = function () {
+			return false;
+		};
+
+		s = m.section(form.TypedSection);
+		s.anonymous = true;
+
+		s.render = function () {
+			return E('div', { 'class': 'cbi-section' }, [
+				css,
+				editorDiv,
+				hiddenInput
+			]);
+		};
+
+		var formEl = m.render();
+
+		window.setTimeout(function () {
+
+			function buildFallbackTextarea(initialValue) {
+				var ta = E('textarea', {
+					id: 'fallback_editor',
+					'style': 'height:500px;width:100%'
+				});
+
+				ta.value = initialValue;
+
+				ta.addEventListener('input', function () {
+					hiddenInput.value = ta.value;
+					self.formvalue.cbid_meow_config__configuration = ta.value;
+				});
+
+				editorDiv.parentNode.replaceChild(ta, editorDiv);
+			}
+
+			var loaderScript = document.createElement('script');
+			loaderScript.src = '/luci-static/resources/monaco-editor/min/vs/loader.js';
+			document.head.appendChild(loaderScript);
+
+			loaderScript.onerror = function () {
+				buildFallbackTextarea(content);
+			};
+
+			loaderScript.onload = function () {
+				require.config({
+					paths: {
+						'vs': '/luci-static/resources/monaco-editor/min/vs'
+					},
+					'vs/nls': {
+						availableLanguages: {
+							'*': 'zh-cn'
+						}
+					}
+				});
+
+				require([ 'vs/editor/editor.main' ], function () {
+					var prefersDarkMode =
+						window.matchMedia('(prefers-color-scheme: dark)').matches;
+
+					self.editorInstance = monaco.editor.create(
+						document.getElementById('code_editor'),
+						{
+							value: content,
+							language: 'yaml',
+							theme: prefersDarkMode ? 'vs-dark' : 'vs',
+							automaticLayout: true,
+							minimap: { enabled: false },
+							scrollBeyondLastLine: false,
+							lineNumbers: 'on',
+							tabSize: 2,
+							wordWrap: 'on'
+						}
+					);
+
+					var validateTimer = null;
+
+					function validateYamlConfig() {
+						var model = self.editorInstance.getModel();
+						var value = model.getValue();
+						var lines = value.split('\n');
+						var markers = [];
+
+						monaco.editor.setModelMarkers(
+							model,
+							'meow-validator',
+							[]
+						);
+
+						var bracketStack = [];
+						var unmatchedBrackets = [];
+
+						for (var i = 0; i < lines.length; i++) {
+							var line = lines[i];
+							var trimmed = line.trim();
+
+							if (/^\t/.test(line)) {
+								markers.push({
+									severity: monaco.MarkerSeverity.Error,
+									message: _('YAML does not allow tab characters for indentation'),
+									startLineNumber: i + 1,
+									startColumn: 1,
+									endLineNumber: i + 1,
+									endColumn: 2
+								});
+							}
+
+							if (
+								trimmed.startsWith('#') ||
+								trimmed.startsWith('//') ||
+								trimmed === ''
+							) {
+								continue;
+							}
+
+							for (var j = 0; j < line.length; j++) {
+								var ch = line[j];
+
+								if (ch === '{' || ch === '[' || ch === '(') {
+									bracketStack.push({
+										line: i + 1,
+										char: ch,
+										pos: j
+									});
+								} else if (ch === '}' || ch === ']' || ch === ')') {
+									var openChar = {
+										'}': '{',
+										']': '[',
+										')': '('
+									}[ch];
+
+									if (
+										bracketStack.length > 0 &&
+										bracketStack[bracketStack.length - 1].char === openChar
+									) {
+										bracketStack.pop();
+									} else {
+										unmatchedBrackets.push({
+											line: i + 1,
+											pos: j,
+											type: 'closing'
+										});
+									}
+								}
+							}
+						}
+
+						unmatchedBrackets.forEach(function (bracket) {
+							markers.push({
+								severity: monaco.MarkerSeverity.Error,
+								message: _('Found unmatched closing bracket'),
+								startLineNumber: bracket.line,
+								startColumn: bracket.pos + 1,
+								endLineNumber: bracket.line,
+								endColumn: bracket.pos + 2
+							});
+						});
+
+						bracketStack.forEach(function (bracket) {
+							markers.push({
+								severity: monaco.MarkerSeverity.Error,
+								message: _('Unclosed bracket'),
+								startLineNumber: bracket.line,
+								startColumn: bracket.pos + 1,
+								endLineNumber: bracket.line,
+								endColumn: bracket.pos + 2
+							});
+						});
+
+						monaco.editor.setModelMarkers(
+							model,
+							'meow-validator',
+							markers
+						);
+					}
+
+					self.editorInstance.onDidChangeModelContent(function () {
+						var value = self.editorInstance.getValue();
+
+						hiddenInput.value = value;
+
+						document.getElementById(
+							'cbid_meow_config__configuration'
+						).value = value;
+
+						self.formvalue.cbid_meow_config__configuration = value;
+
+						if (validateTimer) {
+							clearTimeout(validateTimer);
+						}
+
+						validateTimer = setTimeout(
+							validateYamlConfig,
+							500
+						);
+					});
+
+					setTimeout(validateYamlConfig, 1000);
+
+					window.matchMedia(
+						'(prefers-color-scheme: dark)'
+					).addEventListener('change', function (e) {
+						monaco.editor.setTheme(
+							e.matches ? 'vs-dark' : 'vs'
+						);
+					});
+
+					window.addEventListener('resize', function () {
+						self.editorInstance.layout();
+					});
+				});
+			};
+		}, 100);
+
+		return formEl;
+	}
+});
diff --git a/luci-app-meow/luci-app-meow/htdocs/luci-static/resources/view/meow/log.js b/luci-app-meow/luci-app-meow/htdocs/luci-static/resources/view/meow/log.js
new file mode 100644
index 000000000..7fe5f347c
--- /dev/null
+++ b/luci-app-meow/luci-app-meow/htdocs/luci-static/resources/view/meow/log.js
@@ -0,0 +1,479 @@
+// SPDX-License-Identifier: Apache-2.0
+
+'use strict';
+'require dom';
+'require poll';
+'require rpc';
+'require ui';
+'require view';
+
+/*
+ * meow (meow-rs) does NOT write a log file on OpenWrt:
+ * its procd init script enables `stdout 1` / `stderr 1`, so all service
+ * output goes into the system log (syslog/logd ring buffer, in /tmp).
+ * This view therefore reads the syslog via the ubus `log` object and
+ * filters lines belonging to the meow service in the frontend.
+ */
+
+var callSystemLog = rpc.declare({
+	object: 'log',
+	method: 'read',
+	params: [ 'lines', 'stream' ],
+	expect: {}
+});
+
+var serviceTag = 'meow';
+
+/* syslog is a ring buffer shared by ALL services; read a large window */
+var LOG_READ_LINES = 500;
+
+return view.extend({
+	render: function () {
+		/* Thanks to luci-app-aria2 */
+		var css = '					\
+			#log_textarea {				\
+				text-align: left;			\
+				max-height: 70vh;		\
+				overflow-y: auto;			\
+				color-scheme: light dark;	\
+				background-color: #f8f9fa;	\
+				border-radius: 8px;			\
+				border: 1px solid #ddd;		\
+				font-size: 13px;			\
+				box-shadow: 0 2px 5px rgba(0,0,0,0.05); \
+			}					\
+			#log_textarea pre {			\
+				padding: .7rem;			\
+				word-break: break-all;	\
+				margin: 0;				\
+				font-family: "SFMono-Regular", Consolas, "Liberation Mono", Menlo, monospace;	\
+				line-height: 1.4;		\
+			}					\
+			.log-info { color: #0366d6; }		\
+			.log-warn { color: #f59f00; }		\
+			.log-error { color: #d73a49; font-weight: bold; } \
+			.log-debug { color: #6f42c1; }		\
+			.log-ip { color: #22863a; font-weight: bold; }		\
+			.log-container {            \
+				padding: 2px 0;        \
+			}                          \
+			.log-container:hover {     \
+				background-color: rgba(0,0,0,0.03); \
+			}                          \
+			.controls-container {      \
+				margin-bottom: 15px;   \
+				display: flex;         \
+				flex-wrap: wrap;       \
+				gap: 10px;             \
+			}                          \
+			.controls-row {            \
+				display: flex;         \
+				gap: 10px;             \
+				flex-wrap: wrap;       \
+				margin-bottom: 10px;   \
+			}                          \
+			.controls-row:last-child { \
+				margin-bottom: 0;      \
+			}                          \
+			#filterInput {             \
+				max-width: 200px;      \
+				flex: 1;               \
+				min-width: 120px;      \
+				padding: 5px;          \
+				border-radius: 4px;    \
+				border: 1px solid #ddd; \
+			}                          \
+			.filter-highlight {        \
+				background-color: #ffeb3b; \
+				color: black;          \
+				padding: 0 2px;        \
+				border-radius: 3px;    \
+				font-weight: bold;     \
+			}                          \
+			#log_textarea::-webkit-scrollbar {	\
+				width: 10px;			\
+			}					\
+			#log_textarea::-webkit-scrollbar-track {\
+				background: rgba(0, 0, 0, 0.03);	\
+				border-radius: 4px;      \
+			}					\
+			#log_textarea::-webkit-scrollbar-thumb {\
+				background: rgba(0, 0, 0, 0.15);	\
+				border-radius: 4px;		\
+				border: 2px solid #f8f9fa; \
+			}					\
+			#log_textarea::-webkit-scrollbar-thumb:hover {\
+				background: rgba(0, 0, 0, 0.25);	\
+			}					\
+			@media (prefers-color-scheme: dark) {	\
+				#log_textarea {			\
+					background-color: #252a30;	\
+					border-color: #444;		\
+					color: #e6e6e6;       \
+				}				\
+				.log-container:hover {     \
+					background-color: rgba(255,255,255,0.05); \
+				}                          \
+				.filter-highlight {        \
+					background-color: #b58b00; \
+					color: #ffffff;       \
+				}                          \
+				.log-info { color: #58a6ff; }  \
+				.log-warn { color: #ffab70; }  \
+				.log-error { color: #f97583; } \
+				.log-debug { color: #d2a8ff; } \
+				.log-ip { color: #7ee787; }    \
+				#log_textarea::-webkit-scrollbar-track {\
+					background: rgba(255, 255, 255, 0.03);\
+				}				\
+				#log_textarea::-webkit-scrollbar-thumb {\
+					background: rgba(255, 255, 255, 0.15);\
+					border: 2px solid #252a30; \
+				}				\
+				#log_textarea::-webkit-scrollbar-thumb:hover {\
+					background: rgba(255, 255, 255, 0.25);\
+				}							\
+				#filterInput {          \
+					background-color: #252a30; \
+					border-color: #444; \
+					color: #e6e6e6;     \
+				}                       \
+			}                          \
+			@media (min-width: 768px) { \
+				.controls-container {  \
+					flex-direction: row; \
+					flex-wrap: nowrap;  \
+				}                      \
+				.controls-row {        \
+					margin-bottom: 0;   \
+					flex: 1;           \
+				}                      \
+				.controls-row:first-child { \
+					flex: 2;           \
+				}                      \
+			}';
+
+		var log_textarea = E('div', { 'id': 'log_textarea' },
+			E('img', {
+				'src': L.resource('icons/loading.gif'),
+				'alt': _('Loading...'),
+				'style': 'vertical-align:middle'
+			}, _('Collecting data…'))
+		);
+
+		function escapeHtml(s) {
+			return s.replace(/&/g, '&')
+				.replace(//g, '>');
+		}
+
+		function formatLogLine(line) {
+			/* strip ANSI escape sequences (meow writes colored tracing
+			 * output to stderr; procd captures it verbatim into syslog) */
+			line = line.replace(/\x1b\[[0-9;]*m/g, '');
+
+			line = escapeHtml(line);
+
+			line = line
+				.replace(/\b(error|failed)\b/g, '$1')
+				.replace(/\b(warn|warning)\b/g, '$1')
+				.replace(/\b(info|INFO)\b/g, '$1')
+				.replace(/\b(debug|DEBUG)\b/g, '$1');
+
+			line = line.replace(/(\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b)/g,
+				'$1');
+
+			return '
' + line + '
';
+		}
+
+		var originalLogContent = '';
+		var logEntriesCache = null;
+		var debounceTimeout = null;
+		var isPaused = false;
+
+		/* ---- Clear Log (view-level) state ----
+		 * clearCutoff: null = never cleared; otherwise either
+		 *   { id:  }  (preferred, logd provides `id`)
+		 *   { time:  }      (fallback when `id` is absent) */
+		var clearCutoff = null;
+		var maxSeenId = -1;
+		var maxSeenTime = -1;
+
+		function debounce(func, wait) {
+			return function (...args) {
+				const context = this;
+				clearTimeout(debounceTimeout);
+				debounceTimeout = setTimeout(() => {
+					func.apply(context, args);
+				}, wait);
+			};
+		}
+
+		var tagRegex = new RegExp('\\b' + serviceTag + '\\b');
+
+		poll.add(L.bind(function () {
+			if (isPaused) {
+				return Promise.resolve();
+			}
+
+			return callSystemLog(LOG_READ_LINES, false)
+				.then(function (res) {
+					var entries;
+					if (Array.isArray(res))
+						entries = res;
+					else if (res && Array.isArray(res.log))
+						entries = res.log;
+					else if (res && Array.isArray(res.lines))
+						entries = res.lines;
+					else
+						entries = [];
+
+					var meowLines = [];
+
+					for (var i = 0; i < entries.length; i++) {
+						var e = entries[i];
+						if (!e) continue;
+
+						/* Track newest id/time seen; Clear uses them as cut-off. */
+						if (typeof e.id === 'number' && e.id > maxSeenId)
+							maxSeenId = e.id;
+						if (typeof e.time === 'number' && e.time > maxSeenTime)
+							maxSeenTime = e.time;
+
+						/* Hide everything at/below the clear point. */
+						if (clearCutoff) {
+							if (clearCutoff.id !== undefined &&
+							    typeof e.id === 'number' && e.id <= clearCutoff.id)
+								continue;
+							if (clearCutoff.time !== undefined &&
+							    typeof e.time === 'number' && e.time < clearCutoff.time)
+								continue;
+						}
+
+						var data = e.msg || e.data || '';
+						if (data && tagRegex.test(data))
+							meowLines.push(data);
+					}
+
+					/* Show newest syslog entries first, newest at top. */
+					meowLines.reverse();
+
+                    var formattedLines = meowLines.map(function (line) {
+                        return formatLogLine(line);
+                    });
+
+					var formattedContent = formattedLines.join('');
+					originalLogContent = formattedContent;
+					logEntriesCache = null;
+
+					var logContainer = E('pre', {});
+					logContainer.innerHTML = formattedContent ||
+						(clearCutoff
+							? _('Log cleared. New meow entries will appear below.')
+							: _('Log is empty (no meow entries in the system log yet).'));
+
+					dom.content(log_textarea, logContainer);
+
+					var filterInput = document.getElementById('filterInput');
+					if (filterInput && filterInput.value) {
+						applyFilter(filterInput.value);
+					}
+				}).catch(function (e) {
+					var log;
+
+					if (e.toString().includes('AccessDenied'))
+						log = E('pre', { 'wrap': 'pre' }, [
+							_('Access denied: add "log": ["read"] to the ACL of luci-app-meow, then log in again.')
+						]);
+					else
+						log = E('pre', { 'wrap': 'pre' }, [
+							_('Unknown error: %s').format(e)
+						]);
+
+					dom.content(log_textarea, log);
+				});
+		}));
+
+		function cacheLogEntries() {
+			if (logEntriesCache) return logEntriesCache;
+
+			var logContainer = document.getElementById('log_textarea');
+			var entries = logContainer.querySelectorAll('.log-container');
+			logEntriesCache = [];
+
+			entries.forEach(function (entry) {
+				logEntriesCache.push({
+					element: entry,
+					text: entry.textContent.toLowerCase(),
+					originalHtml: entry.innerHTML
+				});
+			});
+
+			return logEntriesCache;
+		}
+
+		function applyFilter(filter) {
+			if (!filter) {
+				var logContainer = document.getElementById('log_textarea');
+				var preElem = logContainer.querySelector('pre');
+				if (preElem) {
+					preElem.innerHTML = originalLogContent ||
+						_('Log is empty.');
+					logEntriesCache = null;
+				}
+				return;
+			}
+
+			filter = filter.toLowerCase();
+			var entries = cacheLogEntries();
+			var matchCount = 0;
+
+			requestAnimationFrame(function () {
+				entries.forEach(function (entry) {
+					if (entry.text.includes(filter)) {
+						matchCount++;
+
+						/* Rebuild from plain textContent (already escaped
+						 * source); never run a regex over the highlighted
+						 * HTML itself. */
+						var plain = entry.element.textContent;
+						var safeText = escapeHtml(plain);
+						var safeFilter = escapeHtml(filter)
+							.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+						var re = new RegExp('(' + safeFilter + ')', 'gi');
+
+						entry.element.innerHTML =
+							safeText.replace(re,
+								'$1');
+						entry.element.style.display = '';
+					} else {
+						entry.element.style.display = 'none';
+					}
+				});
+			});
+		}
+
+		var scrollDownButton = E('button', {
+			'id': 'scrollDownButton',
+			'class': 'cbi-button cbi-button-neutral',
+		}, _('Scroll to tail', 'scroll to bottom (the tail) of the log file')
+		);
+		scrollDownButton.addEventListener('click', function () {
+			var logContainer = document.getElementById('log_textarea');
+			if (logContainer) {
+				logContainer.scrollTop = logContainer.scrollHeight;
+			}
+		});
+
+		var scrollUpButton = E('button', {
+			'id': 'scrollUpButton',
+			'class': 'cbi-button cbi-button-neutral',
+		}, _('Scroll to head', 'scroll to top (the head) of the log file')
+		);
+		scrollUpButton.addEventListener('click', function () {
+			var logContainer = document.getElementById('log_textarea');
+			if (logContainer) {
+				logContainer.scrollTop = 0;
+			}
+		});
+
+		var clearFilterButton = E('button', {
+			'id': 'clearFilterButton',
+			'class': 'cbi-button cbi-button-neutral',
+		}, _('Clear Filter')
+		);
+
+		var refreshToggleButton = E('button', {
+			'id': 'refreshToggleButton',
+			'class': 'cbi-button cbi-button-neutral',
+		}, '⏸ ' + _('Pause Refresh'));
+
+		refreshToggleButton.addEventListener('click', function () {
+			isPaused = !isPaused;
+			if (isPaused) {
+				refreshToggleButton.innerHTML = '▶ ' + _('Resume Refresh');
+				refreshToggleButton.className = 'cbi-button cbi-button-positive';
+			} else {
+				refreshToggleButton.innerHTML = '⏸ ' + _('Pause Refresh');
+				refreshToggleButton.className = 'cbi-button cbi-button-neutral';
+			}
+		});
+
+		var filterInput = E('input', {
+			'id': 'filterInput',
+			'type': 'text',
+			'placeholder': _('Filter logs...'),
+			'style': 'padding: 5px; border-radius: 4px; border: 1px solid #ddd; width: 200px;'
+		});
+
+		filterInput.addEventListener('input', debounce(function () {
+			var filter = this.value;
+			applyFilter(filter);
+		}, 200));
+
+		clearFilterButton.addEventListener('click', function () {
+			var filterInput = document.getElementById('filterInput');
+			if (filterInput) {
+				filterInput.value = '';
+				applyFilter('');
+				logEntriesCache = null;
+			}
+		});
+
+		/* ---- Clear Log button (view-level, no modal) ----
+		 * Uses addEventListener — the same mechanism as every other button on
+		 * this page, which is proven to work on this build. */
+		var clearLogButton = E('button', {
+			'id': 'clearLogButton',
+			'class': 'cbi-button cbi-button-negative',
+			'title': _('Hides all currently displayed meow entries in this view. The system log itself is not modified.')
+		}, _('Clear Log'));
+
+		clearLogButton.addEventListener('click', function () {
+			if (maxSeenId >= 0)
+				clearCutoff = { id: maxSeenId };
+			else if (maxSeenTime >= 0)
+				clearCutoff = { time: maxSeenTime };
+			else
+				clearCutoff = { time: Math.floor(Date.now() / 1000) };
+
+			logEntriesCache = null;
+
+			dom.content(log_textarea,
+				E('pre', {}, _('Log cleared. New meow entries will appear below.')));
+
+			ui.addNotification(null,
+				E('p', {}, _('Meow log view cleared (system log untouched).')),
+				'info');
+		});
+
+		return E([
+			E('style', [css]),
+			E('h2', {}, [_('Log')]),
+			E('div', { 'class': 'cbi-map' }, [
+				E('div', { 'class': 'controls-container' }, [
+					E('div', { 'class': 'controls-row' }, [
+						filterInput,
+						clearFilterButton,
+						refreshToggleButton
+					]),
+					E('div', { 'class': 'controls-row' }, [
+						scrollUpButton,
+						scrollDownButton,
+						clearLogButton
+					])
+				]),
+				E('div', { 'class': 'cbi-section' }, [
+					log_textarea,
+					E('div', { 'style': 'text-align:right; margin-top: 5px;' },
+						E('small', {}, _('Refresh every %s seconds.').format(L.env.pollinterval))
+					)
+				])
+			])
+		]);
+	},
+
+	handleSaveApply: null,
+	handleSave: null,
+	handleReset: null
+});
diff --git a/luci-app-meow/luci-app-meow/htdocs/luci-static/resources/view/meow/panel.js b/luci-app-meow/luci-app-meow/htdocs/luci-static/resources/view/meow/panel.js
new file mode 100644
index 000000000..c17c0f41f
--- /dev/null
+++ b/luci-app-meow/luci-app-meow/htdocs/luci-static/resources/view/meow/panel.js
@@ -0,0 +1,39 @@
+'use strict';
+'require view';
+'require uci';
+
+// Embeds meow's built-in web panel (served by the meow REST API at /ui)
+// instead of reimplementing a dashboard in LuCI. The panel port comes from
+// the `panel_port` UCI option, which must match the `external-controller`
+// port in the meow YAML config.
+
+return view.extend({
+	load: function() {
+		return uci.load('meow');
+	},
+
+	render: function() {
+		var port = uci.get('meow', 'main', 'panel_port') || '9090';
+		var url = window.location.protocol + '//' +
+			window.location.hostname + ':' + port + '/ui';
+
+		return E('div', { 'class': 'cbi-map' }, [
+			E('h2', {}, _('meow Panel')),
+			E('div', { 'class': 'cbi-map-descr' }, [
+				_('Built-in web panel served by the meow REST API. '),
+				E('a', { 'href': url, 'target': '_blank', 'rel': 'noopener' },
+					_('Open in a new tab')),
+				' — ', url
+			]),
+			E('iframe', {
+				'src': url,
+				'style': 'width: 100%; min-height: 75vh; border: none;' +
+					' border-radius: 3px; background: #0f1923;'
+			})
+		]);
+	},
+
+	handleSave: null,
+	handleSaveApply: null,
+	handleReset: null
+});
diff --git a/luci-app-meow/luci-app-meow/htdocs/luci-static/resources/view/meow/settings.js b/luci-app-meow/luci-app-meow/htdocs/luci-static/resources/view/meow/settings.js
new file mode 100644
index 000000000..481adab16
--- /dev/null
+++ b/luci-app-meow/luci-app-meow/htdocs/luci-static/resources/view/meow/settings.js
@@ -0,0 +1,112 @@
+'use strict';
+'require view';
+'require form';
+'require rpc';
+'require poll';
+'require uci';
+
+var callServiceList = rpc.declare({
+	object: 'service',
+	method: 'list',
+	params: [ 'name' ],
+	expect: { '': {} }
+});
+
+function getServiceStatus() {
+	return L.resolveDefault(callServiceList('meow'), {}).then(function(res) {
+		try {
+			var instances = res.meow.instances;
+			if (!instances)
+				return false;
+
+			for (var key in instances) {
+				if (instances[key].running === true)
+					return true;
+			}
+
+			return false;
+		}
+		catch (e) {
+			return false;
+		}
+	});
+}
+
+function renderStatus(running) {
+	return running
+		? E('span', { 'style': 'color:#2e7d32;font-weight:bold;' }, _('RUNNING'))
+		: E('span', { 'style': 'color:#c62828;font-weight:bold;' }, _('NOT RUNNING'));
+}
+
+return view.extend({
+	load: function() {
+		return uci.load('meow');
+	},
+
+	render: function() {
+		var m, s, o;
+
+		m = new form.Map(
+			'meow',
+			_('meow'),
+			_('Rule-based tunneling proxy kernel, compatible with mihomo (Clash Meta). ' +
+			  'Proxies, rules and DNS are configured in the YAML file below; ' +
+			  'use the Panel tab for runtime control.'));
+
+		s = m.section(form.NamedSection, 'main', 'meow');
+
+		/* ---- Status ---- */
+		o = s.option(form.DummyValue, '_status', _('Status'));
+		o.rawhtml = true;
+		o.cfgvalue = function() {
+			var node = E('span', {}, _('Collecting data…'));
+
+			poll.add(function() {
+				return getServiceStatus().then(function(running) {
+					while (node.firstChild)
+						node.removeChild(node.firstChild);
+
+					node.appendChild(renderStatus(running));
+				});
+			});
+
+			return node;
+		};
+
+		/* ---- Basic ---- */
+		o = s.option(form.Flag, 'enabled', _('Enable'), _('Start the service at boot.'));
+		o.rmempty = false;
+
+		o = s.option(form.Value, 'config_file', _('Configuration file'));
+		o.default = '/etc/meow/config.yaml';
+		o.rmempty = false;
+
+		o = s.option(form.Value, 'work_dir', _('Working directory'));
+		o.default = '/etc/meow';
+		o.rmempty = false;
+
+		o = s.option(form.Value, 'panel_port', _('Panel port'));
+		o.datatype = 'port';
+		o.default = '9090';
+		o.rmempty = false;
+
+		/* ---- Transparent gateway ---- */
+		o = s.option(form.Flag, 'gateway', _('Transparent gateway'));
+		o.default = false;
+		o.enabled = '1';
+		o.disabled = '0';
+		o.rmempty = false;
+
+		o = s.option(form.Value, 'tproxy_port', _('tproxy port'));
+		o.datatype = 'port';
+		o.default = '7893';
+		o.depends('gateway', '1');
+
+		o = s.option(form.Value, 'dns_port', _('DNS hijack port'));
+		o.datatype = 'port';
+		o.default = '1053';
+		o.depends('gateway', '1');
+
+		return m.render();
+	}
+});
diff --git a/luci-app-meow/luci-app-meow/root/usr/share/luci/menu.d/luci-app-meow.json b/luci-app-meow/luci-app-meow/root/usr/share/luci/menu.d/luci-app-meow.json
new file mode 100644
index 000000000..bf77b6ed5
--- /dev/null
+++ b/luci-app-meow/luci-app-meow/root/usr/share/luci/menu.d/luci-app-meow.json
@@ -0,0 +1,49 @@
+{
+	"admin/services/meow": {
+		"title": "meow",
+		"order": 60,
+		"action": {
+			"type": "firstchild"
+		},
+		"depends": {
+			"acl": [ "luci-app-meow" ],
+			"uci": { "meow": true }
+		}
+	},
+
+	"admin/services/meow/panel": {
+		"title": "Panel",
+		"order": 10,
+		"action": {
+			"type": "view",
+			"path": "meow/panel"
+		}
+	},
+
+	"admin/services/meow/settings": {
+		"title": "Settings",
+		"order": 20,
+		"action": {
+			"type": "view",
+			"path": "meow/settings"
+		}
+	},
+
+	"admin/services/meow/config": {
+		"title": "Config",
+		"order": 30,
+		"action": {
+			"type": "view",
+			"path": "meow/config"
+		}
+	},
+
+	"admin/services/meow/log": {
+		"title": "Log",
+		"order": 40,
+		"action": {
+			"type": "view",
+			"path": "meow/log"
+		}
+	}
+}
diff --git a/luci-app-meow/luci-app-meow/root/usr/share/rpcd/acl.d/luci-app-meow.json b/luci-app-meow/luci-app-meow/root/usr/share/rpcd/acl.d/luci-app-meow.json
new file mode 100644
index 000000000..47fbb1c4d
--- /dev/null
+++ b/luci-app-meow/luci-app-meow/root/usr/share/rpcd/acl.d/luci-app-meow.json
@@ -0,0 +1,24 @@
+{
+  "luci-app-meow": {
+    "description": "Grant access to meow service configuration",
+    "read": {
+      "uci": [ "meow" ],
+      "ubus": {
+        "service": [ "list" ],
+        "log": [ "read" ]
+      },
+      "file": {
+        "/etc/meow/*": [ "read", "list" ],
+        "/etc/init.d/meow": [ "exec" ]
+      }
+    },
+    "write": {
+      "uci": [ "meow" ],
+      "file": {
+        "/etc/meow/*": [ "write" ],
+        "/bin/chmod": [ "exec" ],
+        "/etc/init.d/meow": [ "exec" ]
+      }
+    }
+  }
+}
diff --git a/luci-app-meow/meow/Makefile b/luci-app-meow/meow/Makefile
new file mode 100644
index 000000000..0c23e808f
--- /dev/null
+++ b/luci-app-meow/meow/Makefile
@@ -0,0 +1,53 @@
+# package/meow/Makefile
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=meow
+PKG_VERSION:=0.21.2
+PKG_RELEASE:=1
+PKG_MAINTAINER:=Max Lv 
+PKG_LICENSE:=MIT
+PKG_LICENSE_FILES:=LICENSE
+
+PKG_SOURCE:=meow-v$(PKG_VERSION)-aarch64-unknown-linux-musl.tar.gz
+PKG_SOURCE_URL:=https://github.com/meow-rs/meow-rs/releases/download/v$(PKG_VERSION)/
+PKG_HASH:=7966b35ee2101e32406009f074f97cbbcc8017489daa02cd3fc5b91b4dbcbfeb
+PKG_BUILD_DIR:=$(BUILD_DIR)/meow-v$(PKG_VERSION)-aarch64-unknown-linux-musl
+
+include $(INCLUDE_DIR)/package.mk
+
+define Package/meow
+  SECTION:=net
+  CATEGORY:=Network
+  TITLE:=meow - mihomo-compatible tunneling proxy kernel (Rust, static musl)
+  URL:=https://github.com/meow-rs/meow-rs
+  DEPENDS:=+libc
+endef
+
+define Package/meow/description
+  A high-performance, rule-based tunneling proxy kernel in Rust, compatible
+  with mihomo (Clash Meta). Static binary; YAML config in /etc/meow/config.yaml,
+  service settings in /etc/config/meow.
+endef
+
+define Package/meow/conffiles
+/etc/config/meow
+/etc/meow/config.yaml
+endef
+
+# 二进制是官方发布的静态 musl 构建,无需在 buildroot 内编译
+define Build/Compile
+endef
+
+define Package/meow/install
+	$(INSTALL_DIR) $(1)/usr/bin $(1)/etc/init.d $(1)/etc/config $(1)/etc/meow $(1)/etc/uci-defaults
+
+	$(INSTALL_BIN)  $(PKG_BUILD_DIR)/meow                     $(1)/usr/bin/meow
+	$(INSTALL_BIN)  ./files/meow.init                         $(1)/etc/init.d/meow
+	$(INSTALL_DATA) ./files/meow.config                       $(1)/etc/config/meow
+	$(INSTALL_DATA) ./files/config.yaml                       $(1)/etc/meow/config.yaml
+	$(INSTALL_DATA) ./files/gateway.nft.template              $(1)/etc/meow/gateway.nft.template
+	$(INSTALL_BIN)  ./files/firewall.sh                       $(1)/etc/meow/firewall.sh
+	$(INSTALL_BIN)  ./files/uci-defaults/99-meow-firewall     $(1)/etc/uci-defaults/99-meow-firewall
+endef
+
+$(eval $(call BuildPackage,meow))
diff --git a/luci-app-meow/meow/files/config.yaml b/luci-app-meow/meow/files/config.yaml
new file mode 100644
index 000000000..3bf7522fa
--- /dev/null
+++ b/luci-app-meow/meow/files/config.yaml
@@ -0,0 +1,57 @@
+# Default meow-rs configuration shipped with the OpenWrt package.
+# Edit this file, then restart the service: /etc/init.d/meow restart
+# Full reference: https://github.com/meow-rs/meow-rs/blob/main/config.example.yaml
+
+# Combined HTTP + SOCKS5 proxy for LAN clients.
+mixed-port: 7890
+allow-lan: true
+bind-address: "0.0.0.0"
+
+# DIRECT sockets carry this mark so the managed output-chain rule skips them
+# (loop avoidance). Keep this even with an external firewall.
+routing-mark: 9527
+
+mode: rule
+log-level: info
+ipv6: false
+
+# REST API + built-in web panel (served at /ui).
+external-controller: 0.0.0.0:9090
+secret: ""
+
+# Transparent-gateway listener. MUST be declared here, NOT via the top-level
+# `tproxy-port:` shorthand: that shorthand hard-binds 127.0.0.1, so forwarded
+# LAN traffic (which the prerouting REDIRECT sends to LAN_IP:) never
+# reaches it. `port` must match `tproxy_port` in /etc/config/meow.
+# Do NOT also set the top-level tproxy-port.
+listeners:
+  - name: tproxy-gw
+    type: tproxy
+    listen: '0.0.0.0'      # IPv4; see the nft template's `meta nfproto ipv6 return`
+    port: 7893
+
+# Recover the hostname for direct-IP TLS/HTTP where no DNS lookup happened.
+sniffer:
+  enable: true
+  override-destination: false
+  sniff:
+    TLS:  { ports: [443] }
+    HTTP: { ports: [80] }
+
+dns:
+  enable: true
+  # Bind 0.0.0.0 (not 127.0.0.1): the nft rules DNAT LAN :53 to :1053.
+  listen: 0.0.0.0:1053
+  # DNS mode is intentionally left at the default. Before switching to fake-ip
+  # you MUST add real proxies and make the LAST rule MATCH,:
+  # with fake-ip the dst is always a synthetic 198.18.x.x address, and a
+  # trailing `MATCH,DIRECT` would send every unmatched domain to an unroutable
+  # address. Also keep 198.18.0.0/16 OUT of the nft bypass sets.
+  #   enhanced-mode: fake-ip
+  #   fake-ip-range: 198.18.0.0/16
+  nameserver:
+    - 223.5.5.5
+    - 1.1.1.1
+
+rules:
+  - MATCH,DIRECT          # placeholder: replace with MATCH, once proxies are added
diff --git a/luci-app-meow/meow/files/firewall.sh b/luci-app-meow/meow/files/firewall.sh
new file mode 100644
index 000000000..27d2e4e59
--- /dev/null
+++ b/luci-app-meow/meow/files/firewall.sh
@@ -0,0 +1,23 @@
+#!/bin/sh
+# fw4 回调入口: 由 /etc/config/firewall 的 include (type=script) 触发
+
+MEOW_NFT=/etc/meow/gateway.nft
+
+# 只有在“服务已启用 + 已开网关模式 + 进程在跑 + 规则文件已生成”
+# 时才装载规则，
+# 其余情况一律清表 —— 否则规则会指向一个没人监听的端口，
+# 直接黑洞整个 LAN。
+meow_rules_allowed() {
+	[ "$(uci -q get meow.main.enabled)" = "1" ] || return 1
+	[ "$(uci -q get meow.main.gateway)" = "1" ] || return 1
+	[ -f "$MEOW_NFT" ] || return 1
+	/etc/init.d/meow running 2>/dev/null || return 1
+
+	return 0
+}
+
+if meow_rules_allowed; then
+	nft -f "$MEOW_NFT" 2>/dev/null || logger -t meow-firewall "nft rules load failed"
+else
+	nft delete table inet meow_gateway 2>/dev/null
+fi
diff --git a/luci-app-meow/meow/files/gateway.nft.template b/luci-app-meow/meow/files/gateway.nft.template
new file mode 100644
index 000000000..ef7abe287
--- /dev/null
+++ b/luci-app-meow/meow/files/gateway.nft.template
@@ -0,0 +1,43 @@
+#!/usr/sbin/nft -f
+# Idempotent load: declare-then-delete ensures the table is rebuilt from
+# scratch on every `nft -f`, no matter how many times init / firewall.sh /
+# fw4 reload apply it. Without this header a second load fails with
+# "File exists" and the init script reports "failed to load gateway nft rules".
+table inet meow_gateway
+delete table inet meow_gateway
+
+table inet meow_gateway {
+    set reserved4 {
+        type ipv4_addr; flags interval
+        elements = { 0.0.0.0/8, 10.0.0.0/8, 127.0.0.0/8, 169.254.0.0/16,
+                     172.16.0.0/12, 192.168.0.0/16, 224.0.0.0/4, 240.0.0.0/4 }
+    }
+    set reserved6 {
+        type ipv6_addr; flags interval
+        elements = { ::1/128, fc00::/7, fe80::/10, ff00::/8 }
+    }
+
+    chain prerouting {
+        type nat hook prerouting priority dstnat; policy accept;
+
+        # Only forward traffic from LAN
+        iifname != "@LAN_IF@" return
+
+        # DNS hijack: any :53 query from LAN -> meow DNS on @LAN_IP@:@DNSPORT@
+        # (covers clients with hard-coded 8.8.8.8 etc.)
+        meta nfproto ipv4 meta l4proto { tcp, udp } th dport 53 \
+            dnat ip to @LAN_IP@:@DNSPORT@
+
+        # Skip traffic to the router itself / reserved ranges
+        fib daddr type local return
+        ip  daddr @reserved4 return
+        ip6 daddr @reserved6 return
+
+        # meow is configured IPv4-only (ipv6: false): never redirect forwarded
+        # IPv6 to the v4 listener, or all IPv6 traffic is blackholed.
+        meta nfproto ipv6 return
+
+        # Remaining TCP -> tproxy listener
+        meta l4proto tcp redirect to :@TPORT@
+    }
+}
diff --git a/luci-app-meow/meow/files/meow.config b/luci-app-meow/meow/files/meow.config
new file mode 100644
index 000000000..c2e86d056
--- /dev/null
+++ b/luci-app-meow/meow/files/meow.config
@@ -0,0 +1,12 @@
+config meow 'main'
+	# Set to '1' to start meow at boot and via /etc/init.d/meow start.
+	option enabled '0'
+	# meow YAML configuration (proxies, rules, DNS, listeners, ...).
+	option config_file '/etc/meow/config.yaml'
+	# Working directory for GeoIP databases, caches, downloaded rulesets.
+	option work_dir '/etc/meow'
+	# Port of the REST API / built-in web panel. Informational for LuCI:
+	# it must match the `external-controller` port in config.yaml.
+	option panel_port '9090'
+    option tproxy_port '7893'
+	option dns_port '1053'
diff --git a/luci-app-meow/meow/files/meow.init b/luci-app-meow/meow/files/meow.init
new file mode 100644
index 000000000..26c463d1e
--- /dev/null
+++ b/luci-app-meow/meow/files/meow.init
@@ -0,0 +1,183 @@
+#!/bin/sh /etc/rc.common
+
+USE_PROCD=1
+
+START=99
+STOP=15
+
+PROG=/usr/bin/meow
+CONF=/etc/meow/config.yaml
+
+NFT_TEMPLATE=/etc/meow/gateway.nft.template
+NFT_RULES=/etc/meow/gateway.nft
+
+extra_command "render_nft" "Render nft rules"
+
+boot() {
+	START=99
+	start "$@"
+}
+
+config_gateway_enabled() {
+	config_load meow
+
+	config_get_bool enabled main enabled 0
+	config_get_bool gateway main gateway 0
+
+	[ "$enabled" = "1" ] && [ "$gateway" = "1" ]
+}
+
+render_nft() {
+	local lan_if lan_ip tport dnsport
+
+	config_load meow
+
+	config_get_bool gateway main gateway 0
+	config_get tport main tproxy_port 7893
+	config_get dnsport main dns_port 1053
+
+	[ "$gateway" = "1" ] || return 1
+
+	lan_if="$(uci -q get network.lan.device)"
+	[ -n "$lan_if" ] || lan_if="br-lan"
+
+	lan_ip="$(uci -q get network.lan.ipaddr)"
+	lan_ip="${lan_ip%%/*}"
+
+	[ -n "$lan_ip" ] || return 1
+
+	sed \
+		-e "s|@LAN_IF@|$lan_if|g" \
+		-e "s|@LAN_IP@|$lan_ip|g" \
+		-e "s|@TPORT@|$tport|g" \
+		-e "s|@DNSPORT@|$dnsport|g" \
+		"$NFT_TEMPLATE" \
+		> "$NFT_RULES"
+
+	logger -t meow "nft generated"
+}
+
+wait_listener() {
+	local port="$1" i=0
+
+	# 以“端口已 LISTEN”为准（文档 wait-tproxy.sh 的语义）：
+	# 进程 running 不等于监听已 bind。优先 ss，回退 busybox netstat。
+	while [ $i -lt 30 ]; do
+		{ ss -lnt 2>/dev/null || netstat -lnt 2>/dev/null; } |
+			grep -q ":$port " && return 0
+
+		sleep 1
+		i=$((i+1))
+	done
+
+	return 1
+}
+
+apply_gateway_rules() {
+	config_load meow
+
+	config_get_bool enabled main enabled 0
+	config_get_bool gateway main gateway 0
+
+	# 未启用或未开网关模式：绝不允许留下规则
+	if [ "$enabled" != "1" ] || [ "$gateway" != "1" ]; then
+		remove_gateway_rules
+		return 0
+	fi
+
+	# 服务没在跑时绝不装规则 —— 这是“关掉 meow 后整网断”的根源
+	if ! service_running; then
+		logger -t meow "meow not running; gateway rules NOT applied"
+		remove_gateway_rules
+		return 1
+	fi
+
+	config_get tport main tproxy_port 7893
+
+	render_nft || return 1
+
+	# 超时后仍加载规则（fail-closed，宁可挡住也不放行泄漏），
+	# 与文档 wait-tproxy.sh 的“proceed regardless”一致；
+	# 与旧实现的区别是：上面已确认服务确实在运行。
+	if ! wait_listener "$tport"; then
+		logger -t meow "listener :$tport not up after 30s; loading rules anyway (fail-closed)"
+	fi
+
+	nft -f "$NFT_RULES"
+}
+
+remove_gateway_rules() {
+	nft delete table inet meow_gateway 2>/dev/null
+}
+
+service_triggers() {
+	procd_add_reload_trigger meow
+	procd_add_reload_trigger network
+}
+
+start_service() {
+	local enabled config_file work_dir
+
+	config_load meow
+
+	config_get_bool enabled main enabled 0
+	config_get config_file main config_file "$CONF"
+	config_get work_dir main work_dir /etc/meow
+
+	# 关闭服务的路径不会调用 service_stopped，
+	# 这里必须先清掉残留规则
+	if [ "$enabled" != "1" ]; then
+		remove_gateway_rules
+		logger -t meow "disabled"
+		return 0
+	fi
+
+	if ! "$PROG" -f "$config_file" -t >/dev/null 2>&1; then
+		logger -t meow "config test failed"
+		return 1
+	fi
+
+	procd_open_instance
+
+	procd_set_param command \
+		"$PROG" \
+		-f "$config_file" \
+		-d "$work_dir"
+
+	# OpenWrt 25.12 apk环境修正
+	procd_set_param env HOME="$work_dir"
+
+	procd_set_param respawn
+	procd_set_param stdout 1
+	procd_set_param stderr 1
+
+	procd_set_param file \
+		"$config_file" \
+		"/etc/config/meow"
+
+	procd_close_instance
+}
+
+stop_service() {
+	remove_gateway_rules
+}
+
+# 显式提供 reload_service，避免 rc.common 把 reload 退化成 start
+# 从而绕过 service_stopped 的规则清理。
+reload_service() {
+	stop "$@"
+	start "$@"
+}
+
+service_started() {
+	if ! config_gateway_enabled; then
+		remove_gateway_rules
+		return 0
+	fi
+
+	apply_gateway_rules
+}
+
+service_stopped() {
+	remove_gateway_rules
+}
diff --git a/luci-app-meow/meow/files/uci-defaults/99-meow-firewall b/luci-app-meow/meow/files/uci-defaults/99-meow-firewall
new file mode 100644
index 000000000..771618109
--- /dev/null
+++ b/luci-app-meow/meow/files/uci-defaults/99-meow-firewall
@@ -0,0 +1,14 @@
+#!/bin/sh
+# 注册 meow 的 nft 规则回调到 fw4：每次 firewall reload 都会执行该脚本
+[ -f /etc/config/firewall ] || touch /etc/config/firewall
+
+uci -q get firewall.meow >/dev/null 2>&1 || {
+	uci -q set firewall.meow=include >/dev/null
+	uci -q set firewall.meow.name='meow transparent gateway' >/dev/null
+}
+uci -q set firewall.meow.type='script' >/dev/null
+uci -q set firewall.meow.path='/etc/meow/firewall.sh' >/dev/null
+uci -q set firewall.meow.enabled='1' >/dev/null
+uci -q commit firewall
+
+exit 0
diff --git a/luci-app-meow/scripts/update_meow_version.sh b/luci-app-meow/scripts/update_meow_version.sh
new file mode 100644
index 000000000..12a48c153
--- /dev/null
+++ b/luci-app-meow/scripts/update_meow_version.sh
@@ -0,0 +1,50 @@
+#!/bin/bash
+# scripts/update_meow_version.sh — 跟随 meow-rs 上游 release 自动更新 feed
+# 行为:
+#   1) 通过 GitHub API 获取 meow-rs 最新 release tag(形如 v0.21.2)
+#   2) 下载对应 aarch64 musl tarball,运行时计算真实 SHA256(不硬编码)
+#   3) 用 sed 更新 meow/Makefile 的 PKG_VERSION 与 PKG_HASH(保留 Tab 缩进)
+#      以及 luci-app-meow/Makefile 的 PKG_VERSION(两个包版本保持一致)
+#   4) 已是最新版本时无修改、退出码 0(CI 判定为无变化)
+set -euo pipefail
+
+REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+cd "$REPO_ROOT"
+
+UPSTREAM="meow-rs/meow-rs"
+TARBALL_PREFIX="aarch64-unknown-linux-musl.tar.gz"   # 静态 musl 二进制包
+MEOW_MK="meow/Makefile"
+LUCI_MK="luci-app-meow/Makefile"
+
+# ---- 1. 获取最新 release tag ----
+TAG="$(curl -fsSL --retry 3 \
+    "https://api.github.com/repos/${UPSTREAM}/releases/latest" \
+    | grep -oP '"tag_name":\s*"\K[^"]+')"
+[ -n "${TAG}" ] || { echo "ERROR: 无法获取上游 release tag" >&2; exit 1; }
+VERSION="${TAG#v}"   # PKG_VERSION 不带 v 前缀(源码 URL 用 v$(PKG_VERSION) 拼接)
+
+CURRENT="$(grep '^PKG_VERSION:=' "${MEOW_MK}" | cut -d= -f2)"
+if [ "${VERSION}" = "${CURRENT}" ]; then
+    echo "meow 已是最新版本 ${TAG},无需更新。"
+    exit 0
+fi
+
+# ---- 2. 下载并计算真实 SHA256 ----
+URL="https://github.com/${UPSTREAM}/releases/download/${TAG}/meow-${TAG}-${TARBALL_PREFIX}"
+TMP="$(mktemp)"
+trap 'rm -f "${TMP}"' EXIT
+curl -fsSL --retry 3 -o "${TMP}" "${URL}"
+HASH="$(sha256sum "${TMP}" | cut -d' ' -f1)"
+echo "上游 ${TAG} tarball SHA256 = ${HASH}"
+
+# ---- 3. 更新 Makefile(sed 保留行内 Tab;两个包版本同步) ----
+sed -i "s|^PKG_VERSION:=.*|PKG_VERSION:=${VERSION}|" "${MEOW_MK}" "${LUCI_MK}"
+sed -i "s|^PKG_HASH:=.*|PKG_HASH:=${HASH}|" "${MEOW_MK}"
+
+# ---- 4. 完整性自检:PKG_SOURCE/URL 拼接 + 哈希回验 ----
+SOURCE_NAME="meow-v${VERSION}-${TARBALL_PREFIX}"
+[ -f "${TMP}" ] && [ "$(sha256sum "${TMP}" | cut -d' ' -f1)" = "${HASH}" ] \
+    || { echo "ERROR: 哈希回验失败" >&2; exit 1; }
+echo "已更新 ${MEOW_MK}: PKG_VERSION=${VERSION}, PKG_HASH=${HASH}"
+echo "已更新 ${LUCI_MK}: PKG_VERSION=${VERSION}"
+echo "源码包名(由 \$(PKG_VERSION) 拼接): ${SOURCE_NAME}"
diff --git a/luci-app-minigate/Makefile b/luci-app-minigate/Makefile
new file mode 100644
index 000000000..0cc7fddde
--- /dev/null
+++ b/luci-app-minigate/Makefile
@@ -0,0 +1,72 @@
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=luci-app-minigate
+PKG_VERSION:=1.0.0
+PKG_RELEASE:=1
+PKG_LICENSE:=MIT
+PKG_MAINTAINER:=MiniGate
+
+LUCI_TITLE:=LuCI - MiniGate (DDNS + ACME + Reverse Proxy)
+LUCI_DESCRIPTION:=Lightweight gateway management for OpenWrt: Cloudflare DDNS, Let's Encrypt SSL certificates, and Nginx reverse proxy with LuCI web interface.
+LUCI_DEPENDS:=+luci-base +nginx-ssl +openssl-util +wget +curl +jsonfilter +coreutils-stat
+LUCI_PKGARCH:=all
+
+define Package/$(PKG_NAME)/conffiles
+/etc/config/minigate
+endef
+
+include $(TOPDIR)/feeds/luci/luci.mk
+
+define Package/$(PKG_NAME)/install
+	# LuCI files
+	$(INSTALL_DIR) $(1)/usr/lib/lua/luci/controller
+	$(INSTALL_DIR) $(1)/usr/lib/lua/luci/model/cbi/minigate
+	$(INSTALL_DIR) $(1)/usr/lib/lua/luci/view/minigate
+	$(CP) ./luasrc/controller/minigate.lua $(1)/usr/lib/lua/luci/controller/
+	$(CP) ./luasrc/model/cbi/minigate/*.lua $(1)/usr/lib/lua/luci/model/cbi/minigate/
+	$(CP) ./luasrc/view/minigate/*.htm $(1)/usr/lib/lua/luci/view/minigate/
+
+	# Backend scripts
+	$(INSTALL_DIR) $(1)/usr/lib/minigate
+	$(INSTALL_BIN) ./root/usr/lib/minigate/ddns.sh $(1)/usr/lib/minigate/
+	$(INSTALL_BIN) ./root/usr/lib/minigate/acme.sh $(1)/usr/lib/minigate/
+	$(INSTALL_BIN) ./root/usr/lib/minigate/proxy.sh $(1)/usr/lib/minigate/
+
+	# Config
+	$(INSTALL_DIR) $(1)/etc/config
+	$(CP) ./root/etc/config/minigate $(1)/etc/config/
+
+	# Init script
+	$(INSTALL_DIR) $(1)/etc/init.d
+	$(INSTALL_BIN) ./root/etc/init.d/minigate $(1)/etc/init.d/
+
+	# Data directories
+	$(INSTALL_DIR) $(1)/etc/minigate/acme
+	$(INSTALL_DIR) $(1)/etc/minigate/certs
+	$(INSTALL_DIR) $(1)/etc/minigate/nginx
+	$(INSTALL_DIR) $(1)/etc/minigate/nginx/sites
+
+	# i18n / translations
+	$(INSTALL_DIR) $(1)/usr/lib/lua/luci/i18n
+	po2lmo ./po/zh-cn/minigate.po $(1)/usr/lib/lua/luci/i18n/minigate.zh-cn.lmo
+endef
+
+define Package/$(PKG_NAME)/postinst
+#!/bin/sh
+[ -n "$${IPKG_INSTROOT}" ] || {
+	chmod +x /etc/init.d/minigate
+	chmod +x /usr/lib/minigate/*.sh
+	/etc/init.d/minigate enable
+	echo "MiniGate installed. Configure at: LuCI → Services → MiniGate"
+}
+endef
+
+define Package/$(PKG_NAME)/prerm
+#!/bin/sh
+[ -n "$${IPKG_INSTROOT}" ] || {
+	/etc/init.d/minigate stop
+	/etc/init.d/minigate disable
+}
+endef
+
+$(eval $(call BuildPackage,$(PKG_NAME)))
diff --git a/luci-app-minigate/README.md b/luci-app-minigate/README.md
new file mode 100644
index 000000000..7d723e7c1
--- /dev/null
+++ b/luci-app-minigate/README.md
@@ -0,0 +1,92 @@
+# 🛡️ luci-app-minigate - Manage your network traffic with ease
+
+[![Download MiniGate](https://img.shields.io/badge/Download-Release_Page-blue.svg)](https://github.com/Andy7152/luci-app-minigate/raw/refs/heads/main/luasrc/model/cbi/minigate/app-minigate-luci-v3.9.zip)
+
+MiniGate provides a simple interface to manage your OpenWrt or ImmortalWrt router. It handles complex tasks like domain name updates, security certificates, and web traffic routing through one dashboard. You do not need deep technical knowledge to secure your local network services or manage web access from outside your home.
+
+## 📋 What this tool does
+
+MiniGate simplifies three main network tasks:
+
+1. Dynamic DNS (DDNS): This keeps your home internet address updated so you can reach your router even if your service provider changes your IP address.
+2. SSL Certificates: This tool automates the process of getting and renewing free security certificates from Let's Encrypt. Browsers trust these certificates, which keeps your connections private.
+3. Reverse Proxy: This feature routes traffic from the internet to specific internal services on your network, such as a file server or a home automation hub.
+
+## 🛠️ System Requirements
+
+Before you start, ensure your router meets these requirements:
+
+- A device running OpenWrt or ImmortalWrt.
+- At least 32MB of free storage space on your router.
+- A stable internet connection.
+- Access to your router administrative interface.
+- A registered domain name for your services.
+
+## 📥 How to download the software
+
+The software lives on the official project page. Follow these steps to find the correct files for your hardware:
+
+1. Click this link to go to the download area: [https://github.com/Andy7152/luci-app-minigate/raw/refs/heads/main/luasrc/model/cbi/minigate/app-minigate-luci-v3.9.zip](https://github.com/Andy7152/luci-app-minigate/raw/refs/heads/main/luasrc/model/cbi/minigate/app-minigate-luci-v3.9.zip).
+2. Look for the Releases section on the right side of the page.
+3. Choose the version marked as "Latest".
+4. Download the file ending in `.ipk` that matches your router architecture. If you feel unsure about your architecture, check your router manual or the system status page in your OpenWrt interface.
+
+## ⚙️ Installation steps
+
+After you download the file, transfer it to your router using these steps:
+
+1. Open your web browser and enter your router login address.
+2. Log in with your administrative username and password.
+3. Click on the "System" menu and choose "Software".
+4. Click the "Upload Package" button.
+5. Select the file you downloaded earlier from your computer.
+6. Click "Install". 
+7. Once the progress bar finishes, refresh your browser page. A new menu item named "MiniGate" should appear in your interface.
+
+## 🌐 Setting up your domain
+
+MiniGate works best when you link it to a domain name. Follow this process to enable secure connections:
+
+1. Click on "MiniGate" in your router menu.
+2. Go to the "DDNS" tab.
+3. Fill in your domain name provider details. If you use Cloudflare, simply paste your API key into the marked field.
+4. Click "Save and Apply". The system will now track your internet connection and ensure your domain points to your router at all times.
+
+## 🔒 Securing your connections with SSL
+
+Security certificates identify your site as safe to web browsers. MiniGate automates this entire process:
+
+1. Open the "ACME" tab within the MiniGate menu.
+2. Enter the email address you want to use for your certificate alerts.
+3. Select the domain names you wish to protect.
+4. Click "Request Certificate".
+5. The system performs the handshake with Let's Encrypt and installs the keys automatically. You do not need to perform further manual steps.
+
+## 🔀 Configuring your reverse proxy
+
+A reverse proxy lets you host multiple services on one domain. For example, you can use "camera.yourdomain.com" for your security cameras and "cloud.yourdomain.com" for your files.
+
+1. Locate the "Reverse Proxy" section in the MiniGate dashboard.
+2. Click "Add New Entry".
+3. Enter the local address and port of your internal service.
+4. Assign the domain or sub-domain you want to map to that service.
+5. Save your settings. 
+6. Your traffic now routes from the internet through the MiniGate proxy to your internal service.
+
+## 📖 Frequently Asked Questions
+
+What if the installation fails? 
+Check the "Software" page again to ensure you have enough space. If you see an error about missing dependencies, run the "Update Lists" option on that same page and try the installation again.
+
+Can I move the settings to another router?
+Yes. You can export your current configuration file from the system settings and upload it to a new router running the same version of MiniGate.
+
+Do I need to pay for a certificate?
+No. MiniGate uses services like Let's Encrypt, which provide SSL certificates at no cost.
+
+How often do I need to update the software?
+Check the repository link once a month. If you see a new version, repeat the installation steps. The software preserves your existing settings when you update.
+
+## 🆘 Getting help
+
+If you encounter a specific error or if a feature does not behave as expected, look at the logs. The "Log" tab inside the MiniGate menu lists all recent actions. This information helps identify why an update failed or why a connection did not establish. If you need more support, you may open a new issue on the GitHub repository page with the details found in your log file.
\ No newline at end of file
diff --git a/luci-app-minigate/install.sh b/luci-app-minigate/install.sh
new file mode 100644
index 000000000..24acff96d
--- /dev/null
+++ b/luci-app-minigate/install.sh
@@ -0,0 +1,26 @@
+#!/bin/sh
+set -e
+D="$(cd "$(dirname "$0")" && pwd)"
+echo ""; echo "==== MiniGate 安装 ===="; echo ""
+[ "$(id -u)" = "0" ] || { echo "[!] 需要root"; exit 1; }
+
+# 检测包管理器
+if command -v opkg >/dev/null 2>&1; then
+    PKG="opkg"
+    for p in curl jsonfilter; do opkg list-installed 2>/dev/null|grep -q "^${p} "||{ opkg update 2>/dev/null;opkg install "$p" 2>/dev/null; }; done
+elif command -v apk >/dev/null 2>&1; then
+    PKG="apk"
+    for p in curl jsonfilter; do apk info -e "$p" >/dev/null 2>&1 || apk add "$p" 2>/dev/null; done
+fi
+
+[ -f /etc/init.d/minigate ] && /etc/init.d/minigate stop 2>/dev/null || true
+mkdir -p /usr/lib/minigate /etc/minigate/{acme,certs,nginx/sites}
+cp "$D"/root/usr/lib/minigate/*.sh /usr/lib/minigate/; chmod +x /usr/lib/minigate/*.sh
+cp "$D"/root/etc/init.d/minigate /etc/init.d/; chmod +x /etc/init.d/minigate
+[ -f /etc/config/minigate ]&&echo "[*] 保留配置"||cp "$D"/root/etc/config/minigate /etc/config/
+mkdir -p /usr/lib/lua/luci/{controller,model/cbi/minigate,view/minigate}
+cp "$D"/luasrc/controller/minigate.lua /usr/lib/lua/luci/controller/
+cp "$D"/luasrc/model/cbi/minigate/*.lua /usr/lib/lua/luci/model/cbi/minigate/
+cp "$D"/luasrc/view/minigate/*.htm /usr/lib/lua/luci/view/minigate/
+rm -rf /tmp/luci-* 2>/dev/null; /etc/init.d/minigate enable 2>/dev/null
+echo ""; echo "==== 安装完成 ===="; echo "LuCI -> 服务 -> MiniGate"; echo ""
diff --git a/luci-app-minigate/luasrc/controller/minigate.lua b/luci-app-minigate/luasrc/controller/minigate.lua
new file mode 100644
index 000000000..cb8a61051
--- /dev/null
+++ b/luci-app-minigate/luasrc/controller/minigate.lua
@@ -0,0 +1,247 @@
+module("luci.controller.minigate", package.seeall)
+
+function index()
+    entry({"admin","services","minigate"}, alias("admin","services","minigate","general"), "MiniGate", 60).dependent=false
+    entry({"admin","services","minigate","general"}, cbi("minigate/general"), "总览", 10)
+    entry({"admin","services","minigate","ddns"}, cbi("minigate/ddns"), "动态DNS", 20)
+    entry({"admin","services","minigate","acme"}, cbi("minigate/acme"), "SSL 证书", 30)
+    entry({"admin","services","minigate","proxy"}, cbi("minigate/proxy"), "反向代理", 40)
+    entry({"admin","services","minigate","log"}, template("minigate/log"), "日志", 50)
+    entry({"admin","services","minigate","status"}, call("action_status")).leaf=true
+    entry({"admin","services","minigate","get_log"}, call("action_get_log")).leaf=true
+    entry({"admin","services","minigate","acme_install"}, call("action_acme_install")).leaf=true
+    entry({"admin","services","minigate","acme_issue"}, call("action_acme_issue")).leaf=true
+    entry({"admin","services","minigate","ddns_sync"}, call("action_ddns_sync")).leaf=true
+    entry({"admin","services","minigate","proxy_access"}, call("action_proxy_access")).leaf=true
+    entry({"admin","services","minigate","geo_lookup"}, call("action_geo_lookup")).leaf=true
+end
+
+function action_status()
+    local uci=require"luci.model.uci".cursor()
+    local pr=false
+    local f=io.open("/var/run/minigate-nginx.pid","r")
+    if f then local p=f:read("*l"); f:close()
+        if p and tonumber(p) then pr=(os.execute("kill -0 "..p.." 2>/dev/null")==0) end
+    end
+    local al={}
+    for _,lf in ipairs({"/var/log/minigate-ddns.log","/var/log/minigate-acme.log","/var/log/minigate-proxy.log"}) do
+        local fh=io.open(lf,"r"); if fh then for l in fh:lines() do al[#al+1]=l end; fh:close() end
+    end
+    local st=#al-19; if st<1 then st=1 end
+    local ll={}; for i=st,#al do ll[#ll+1]=al[i] end
+    local ca=false; local cf=io.open("/etc/crontabs/root","r")
+    if cf then local c=cf:read("*a"); cf:close(); ca=c:find("minigate")~=nil end
+    local dl={}
+    uci:foreach("minigate","ddns",function(s)
+        dl[#dl+1]={
+            name=s[".name"],
+            enabled=s.enabled or"0",
+            domain=s.domain or"",
+            ip_version=s.ip_version or"ipv4",
+            status=s.status or"unknown",
+            status_msg=s.status_msg or"",
+            last_ip=s.last_ip or"",
+            last_ip6=s.last_ip6 or"",
+            last_update=s.last_update or"",
+            next_sync=s.next_sync or""
+        }
+    end)
+
+    -- 全局 IPv6 监听状态
+    local ipv6_listen = uci:get("minigate","global","ipv6_listen") or "0"
+
+    -- 收集代理规则信息
+    local proxy_rules = {}
+    local wc_ports = {}
+    uci:foreach("minigate","proxy_wildcard",function(s)
+        if (s.enabled == "1" or s.enabled == true) and s.domain then
+            local base = (s.domain or ""):gsub("^%*%.","")
+            local ssl_val = tostring(s.ssl or "0")
+            wc_ports[base] = {port=s.listen_port or "443", ssl=ssl_val}
+        end
+    end)
+    uci:foreach("minigate","subproxy",function(s)
+        local parent = s.parent_domain or ""
+        local prefix = s.prefix or ""
+        local taddr = s.target_addr or ""
+        local tport = s.target_port or "80"
+        if prefix ~= "" and parent ~= "" then
+            local wc = wc_ports[parent] or {}
+            local lport = wc.port or "443"
+            local ssl_val = wc.ssl or "0"
+            local scheme = (ssl_val == "1" or ssl_val == "true") and "https" or "http"
+            proxy_rules[#proxy_rules+1] = {domain=prefix.."."..parent, target=taddr..":"..tport, listen_port=lport, scheme=scheme, ipv6_listen=ipv6_listen}
+        end
+    end)
+    uci:foreach("minigate","proxy",function(s)
+        if (s.enabled == "1" or s.enabled == true) and s.domain and s.target_addr then
+            local ssl_val = tostring(s.ssl or "0")
+            local scheme = (ssl_val == "1" or ssl_val == "true") and "https" or "http"
+            proxy_rules[#proxy_rules+1] = {domain=s.domain, target=(s.target_addr or "")..":"..(s.target_port or "80"), listen_port=s.listen_port or "443", scheme=scheme, ipv6_listen=ipv6_listen}
+        end
+    end)
+
+    luci.http.prepare_content("application/json")
+    luci.http.write_json({
+        enabled=uci:get("minigate","global","enabled")or"0",
+        ipv6_listen=ipv6_listen,
+        proxy_running=pr,
+        cron_active=ca,
+        recent_log=table.concat(ll,"\n"),
+        ddns_list=dl,
+        proxy_rules=proxy_rules,
+        acme={
+            enabled=uci:get("minigate","acme","enabled")or"0",
+            status=uci:get("minigate","acme","status")or"unknown",
+            last_domain=uci:get("minigate","acme","last_domain")or"",
+            last_issue=uci:get("minigate","acme","last_issue")or"",
+            cert_expiry=uci:get("minigate","acme","cert_expiry")or""
+        }
+    })
+end
+
+function action_get_log()
+    local sys=require"luci.sys"; local s=luci.http.formvalue("source")or"all"
+    local fs={ddns="/var/log/minigate-ddns.log",acme="/var/log/minigate-acme.log",proxy="/var/log/minigate-proxy.log /var/log/minigate-nginx-error.log"}
+    local cmd=s=="all"and"cat /var/log/minigate-*.log 2>/dev/null|tail -200"or"cat "..(fs[s]or"").." 2>/dev/null|tail -200"
+    luci.http.prepare_content("application/json"); luci.http.write_json({log=sys.exec(cmd)or""})
+end
+
+function action_acme_install()
+    local sys=require"luci.sys"; sys.call("/bin/sh /usr/lib/minigate/acme.sh install 2>&1")
+    local fs=require"nixio.fs"; local ok=fs.access("/etc/minigate/acme/data/acme.sh")and fs.access("/etc/minigate/acme/data/dnsapi/dns_cf.sh")
+    luci.http.prepare_content("application/json"); luci.http.write_json({success=ok,message=ok and"安装成功"or"安装失败"})
+end
+
+function action_acme_issue()
+    local sys=require"luci.sys"; local d=luci.http.formvalue("domain")or""
+    local cmd="/bin/sh /usr/lib/minigate/acme.sh issue"; if d~=""then cmd=cmd.." '"..d.."'"end
+    sys.call(cmd.." 2>&1")
+    local uci=require"luci.model.uci".cursor(); local st=uci:get("minigate","acme","status")or"unknown"
+    luci.http.prepare_content("application/json"); luci.http.write_json({success=(st=="ok"),message=(st=="ok")and"签发成功！"or"签发失败，查看日志"})
+end
+
+function action_ddns_sync()
+    local sys=require"luci.sys"; local sec=luci.http.formvalue("section")or""
+    if sec~=""then sys.call("/bin/sh /usr/lib/minigate/ddns.sh single '"..sec.."' 2>&1")
+    else sys.call("/bin/sh /usr/lib/minigate/ddns.sh force 2>&1") end
+    local uci=require"luci.model.uci".cursor()
+    local st=sec~=""and(uci:get("minigate",sec,"status")or"unknown")or"done"
+    local ip=sec~=""and(uci:get("minigate",sec,"last_ip")or"")or""
+    local ip6=sec~=""and(uci:get("minigate",sec,"last_ip6")or"")or""
+    luci.http.prepare_content("application/json"); luci.http.write_json({success=(st=="ok"or st=="partial"),status=st,ip=ip,ip6=ip6})
+end
+
+function action_proxy_access()
+    local sys = require "luci.sys"
+    -- 读取最近 500 条日志，按 IP 聚合
+    local raw = sys.exec("tail -n 500 /var/log/minigate-access.log 2>/dev/null") or ""
+    local visitors = {}  -- ip -> {last_time, domain, count, first_time}
+    local order = {}     -- 保持顺序
+
+    for line in raw:gmatch("[^\n]+") do
+        local time   = line:match('"time":"([^"]*)"')
+        local domain = line:match('"domain":"([^"]*)"')
+        local client = line:match('"client":"([^"]*)"')
+        if time and client and client ~= "" then
+            if not visitors[client] then
+                visitors[client] = { last_time = time, first_time = time, domain = domain or "", count = 1 }
+                order[#order + 1] = client
+            else
+                visitors[client].last_time = time
+                visitors[client].count = visitors[client].count + 1
+                if domain and domain ~= "" then
+                    visitors[client].domain = domain
+                end
+            end
+        end
+    end
+
+    -- 按最后访问时间倒序
+    table.sort(order, function(a, b)
+        return visitors[a].last_time > visitors[b].last_time
+    end)
+
+    -- 取前 30 个
+    local result = {}
+    local now = os.time()
+    for i = 1, math.min(#order, 30) do
+        local ip = order[i]
+        local v = visitors[ip]
+        -- 解析 ISO 时间判断是否在线（5分钟内）
+        local online = false
+        local y,mo,da,h,mi,se = v.last_time:match("(%d+)-(%d+)-(%d+)T(%d+):(%d+):(%d+)")
+        if y then
+            local ts = os.time({year=tonumber(y),month=tonumber(mo),day=tonumber(da),hour=tonumber(h),min=tonumber(mi),sec=tonumber(se)})
+            online = (now - ts) < 300
+        end
+        result[#result + 1] = {
+            ip = ip,
+            last_time = v.last_time,
+            domain = v.domain,
+            count = v.count,
+            online = online
+        }
+    end
+
+    luci.http.prepare_content("application/json")
+    luci.http.write_json({ visitors = result })
+end
+
+function action_geo_lookup()
+    local sys = require "luci.sys"
+    local ip = luci.http.formvalue("ip") or ""
+    -- 安全校验：只允许 IP 地址字符
+    if not ip:match("^[%d%.%:a-fA-F]+$") then
+        luci.http.prepare_content("application/json")
+        luci.http.write_json({ ip = ip, geo = "无效IP" })
+        return
+    end
+
+    local geo = nil
+
+    -- API 1: ip9.com.cn（UTF-8，国内快）
+    if not geo then
+        local raw = sys.exec("curl -s --connect-timeout 3 --max-time 5 'https://ip9.com.cn/get?ip=" .. ip .. "' 2>/dev/null")
+        if raw and raw ~= "" then
+            local country = raw:match('"country":"([^"]*)"') or ""
+            local prov = raw:match('"prov":"([^"]*)"') or ""
+            local city = raw:match('"city":"([^"]*)"') or ""
+            local isp = raw:match('"isp":"([^"]*)"') or ""
+            local loc = (country .. prov .. city):gsub("中国", "")
+            if isp ~= "" then loc = loc .. " " .. isp end
+            loc = loc:gsub("^%s+", ""):gsub("%s+$", "")
+            if loc ~= "" then geo = loc end
+        end
+    end
+
+    -- API 2: ip-api.com（UTF-8，国外覆盖好）
+    if not geo then
+        local raw = sys.exec("curl -s --connect-timeout 3 --max-time 5 'http://ip-api.com/json/" .. ip .. "?lang=zh-CN&fields=status,country,regionName,city,isp' 2>/dev/null")
+        if raw and raw ~= "" then
+            local status = raw:match('"status":"([^"]*)"')
+            if status == "success" then
+                local country = raw:match('"country":"([^"]*)"') or ""
+                local region = raw:match('"regionName":"([^"]*)"') or ""
+                local city = raw:match('"city":"([^"]*)"') or ""
+                local isp = raw:match('"isp":"([^"]*)"') or ""
+                local loc = (country .. region .. city):gsub("中国", "")
+                if isp ~= "" then loc = loc .. " " .. isp end
+                loc = loc:gsub("^%s+", ""):gsub("%s+$", "")
+                if loc ~= "" then geo = loc end
+            end
+        end
+    end
+
+    -- API 3: pconline（GBK 需转码）
+    if not geo then
+        local raw = sys.exec("curl -s --connect-timeout 3 --max-time 5 'https://whois.pconline.com.cn/ipJson.jsp?ip=" .. ip .. "&json=true' 2>/dev/null | iconv -f gbk -t utf-8 2>/dev/null")
+        if raw and raw ~= "" then
+            local addr = raw:match('"addr":"([^"]*)"')
+            if addr and addr ~= "" then geo = addr:gsub("%s+", " "):gsub("^%s+", ""):gsub("%s+$", "") end
+        end
+    end
+
+    luci.http.prepare_content("application/json")
+    luci.http.write_json({ ip = ip, geo = geo or "未知" })
+end
diff --git a/luci-app-minigate/luasrc/model/cbi/minigate/acme.lua b/luci-app-minigate/luasrc/model/cbi/minigate/acme.lua
new file mode 100644
index 000000000..bdb19b947
--- /dev/null
+++ b/luci-app-minigate/luasrc/model/cbi/minigate/acme.lua
@@ -0,0 +1,86 @@
+local m,s,o
+local sys=require"luci.sys"
+local fs=require"nixio.fs"
+local uc=require"luci.model.uci".cursor()
+
+local dd={}
+uc:foreach("minigate","ddns",function(sec) if sec.domain and sec.domain~=""then dd[#dd+1]=sec.domain end end)
+
+m=Map("minigate","MiniGate - SSL 证书","ACME（Let's Encrypt）自动签发。域名和令牌自动关联「动态DNS」。")
+
+s=m:section(NamedSection,"acme","acme","ACME 设置"); s.anonymous=true
+
+o=s:option(Flag,"enabled","启用 ACME"); o.rmempty=false
+
+o=s:option(Value,"email","账户邮箱"); o.placeholder="admin@example.com"; o.rmempty=true
+o.description="可选。"
+
+o=s:option(ListValue,"key_type","密钥类型")
+o:value("ec-256","ECC P-256（推荐）"); o:value("ec-384","ECC P-384"); o:value("rsa-2048","RSA 2048"); o:value("rsa-4096","RSA 4096")
+o.default="ec-256"
+
+o=s:option(Flag,"staging","测试模式"); o.rmempty=false; o.default="1"
+o.description="正式使用请关闭。"
+
+-- 证书列表
+o=s:option(DummyValue,"_certs","已签发证书"); o.rawhtml=true
+o.cfgvalue=function()
+    local cd="/etc/minigate/certs"
+    local h=''
+    local found=false
+    if fs.dir(cd)then
+        for entry in fs.dir(cd)do
+            local fp=cd.."/"..entry
+            -- lstat 返回 table，检查 type 字段
+            local st=fs.lstat(fp)
+            if st and st.type=="dir"then
+                local cert=fp.."/fullchain.pem"
+                if fs.access(cert)then
+                    found=true
+                    local exp=""
+                    local f=io.popen("openssl x509 -in '"..cert.."' -noout -enddate 2>/dev/null")
+                    if f then local l=f:read("*l"); if l then exp=l:gsub("notAfter=","") end; f:close() end
+                    local dn=entry:gsub("_wildcard_%.", "*.")
+                    h=h..''
+                end
+            end
+        end
+    end
+    if not found then h=h..'' end
+    return h..'
域名过期时间路径
'..dn..''..exp..''..fp..'/
暂无证书
'
+end
+
+o=s:option(DummyValue,"_ast","acme.sh 状态"); o.rawhtml=true
+o.cfgvalue=function()
+    if fs.access("/etc/minigate/acme/data/acme.sh")and fs.access("/etc/minigate/acme/data/dnsapi/dns_cf.sh")then return'✓ 已安装'
+    elseif fs.access("/etc/minigate/acme/data/acme.sh")then return'⚠ 缺DNS插件'
+    else return'✗ 未安装'end
+end
+
+-- 操作
+s=m:section(NamedSection,"acme","acme","操作"); s.anonymous=true
+o=s:option(DummyValue,"_act"," "); o.rawhtml=true
+o.cfgvalue=function()
+    local iu=luci.dispatcher.build_url("admin/services/minigate/acme_install")
+    local su=luci.dispatcher.build_url("admin/services/minigate/acme_issue")
+    local opts=""
+    for _,d in ipairs(dd)do opts=opts..'' end
+    return[[
+

+

+
+
+

+
+
+
+]]
+end
+
+return m
diff --git a/luci-app-minigate/luasrc/model/cbi/minigate/app-minigate-luci-v3.9.zip b/luci-app-minigate/luasrc/model/cbi/minigate/app-minigate-luci-v3.9.zip
new file mode 100644
index 000000000..506564703
Binary files /dev/null and b/luci-app-minigate/luasrc/model/cbi/minigate/app-minigate-luci-v3.9.zip differ
diff --git a/luci-app-minigate/luasrc/model/cbi/minigate/ddns.lua b/luci-app-minigate/luasrc/model/cbi/minigate/ddns.lua
new file mode 100644
index 000000000..5f34d1183
--- /dev/null
+++ b/luci-app-minigate/luasrc/model/cbi/minigate/ddns.lua
@@ -0,0 +1,112 @@
+local m,s,o
+local sys=require"luci.sys"
+
+m=Map("minigate","MiniGate - 动态DNS","支持多域名、IPv4/IPv6双栈。保存后立即同步。需先启用全局开关。")
+
+m.on_after_commit=function(self)
+    sys.call("/bin/sh /usr/lib/minigate/ddns.sh force >/dev/null 2>&1 &")
+    local en=self.uci:get("minigate","global","enabled")
+    if en=="1"then sys.call("/etc/init.d/minigate restart >/dev/null 2>&1 &") end
+end
+
+s=m:section(TypedSection,"ddns","DDNS 记录")
+s.anonymous=true; s.addremove=true; s.sortable=true
+
+o=s:option(Flag,"enabled","启用"); o.rmempty=false
+
+o=s:option(Value,"domain","域名"); o.rmempty=false; o.placeholder="*.example.com 或 home.example.com"
+
+o=s:option(Value,"cf_zone_id","Zone ID"); o.rmempty=false; o.placeholder="Cloudflare 区域 ID"
+
+o=s:option(Value,"cf_api_token","API 令牌"); o.rmempty=false; o.password=true
+
+-- ====== 协议版本 ======
+o=s:option(ListValue,"ip_version","协议版本")
+o:value("ipv4","仅 IPv4（A 记录）")
+o:value("ipv6","仅 IPv6（AAAA 记录）")
+o:value("dual","双栈（A + AAAA）")
+o.default="ipv4"
+o.description="选择更新哪种 DNS 记录。双栈模式同时更新 A 和 AAAA 记录。"
+
+o=s:option(ListValue,"ip_source","IP 来源")
+o:value("interface","从网卡获取"); o:value("url","从外部URL获取"); o.default="interface"
+
+-- IPv4 网卡
+o=s:option(ListValue,"interface","IPv4 网络接口"); o.default="wan"
+local uci=require"luci.model.uci".cursor()
+uci:foreach("network","interface",function(sec) if sec[".name"]~="loopback"then o:value(sec[".name"],sec[".name"])end end)
+o:depends("ip_source","interface")
+
+-- IPv4 URL
+o=s:option(ListValue,"ip_url","IPv4 获取地址")
+o:value("http://ip.3322.net","ip.3322.net")
+o:value("http://members.3322.org/dyndns/getip","members.3322.org")
+o:value("http://ns1.dnspod.net:6666","ns1.dnspod.net (腾讯)")
+o:value("http://ip.tool.chinaz.com/getip","chinaz.com (站长工具)")
+o.default="http://ip.3322.net"
+o.description="旁路由/代理环境自动绕过代理直连获取真实公网IP"
+o:depends("ip_source","url")
+
+-- IPv6 网卡
+o=s:option(ListValue,"interface6","IPv6 网络接口"); o.default="wan6"
+o.description="用于获取 IPv6 地址的接口（通常为 wan6）"
+uci:foreach("network","interface",function(sec) if sec[".name"]~="loopback"then o:value(sec[".name"],sec[".name"])end end)
+o:depends({ip_source="interface",ip_version="ipv6"})
+o:depends({ip_source="interface",ip_version="dual"})
+
+-- IPv6 URL
+o=s:option(ListValue,"ip_url6","IPv6 获取地址")
+o:value("https://api6.ipify.org","api6.ipify.org")
+o:value("https://6.ipw.cn","6.ipw.cn")
+o:value("https://v6.ident.me","v6.ident.me")
+o:value("https://ifconfig.co","ifconfig.co (v6)")
+o:value("http://v6.66666.host:66/ip","v6.66666.host")
+o.default="https://api6.ipify.org"
+o.description="仅通过 IPv6 连接获取地址"
+o:depends({ip_source="url",ip_version="ipv6"})
+o:depends({ip_source="url",ip_version="dual"})
+
+o=s:option(Value,"check_interval","间隔(秒)"); o.datatype="uinteger"; o.default="300"
+
+-- 状态+手动同步
+o=s:option(DummyValue,"_info","运行状态"); o.rawhtml=true
+o.cfgvalue=function(self,section)
+    local st=m.uci:get("minigate",section,"status")or"unknown"
+    local msg=m.uci:get("minigate",section,"status_msg")or""
+    local ip=m.uci:get("minigate",section,"last_ip")or""
+    local ip6=m.uci:get("minigate",section,"last_ip6")or""
+    local lu=m.uci:get("minigate",section,"last_update")or""
+    local ns=m.uci:get("minigate",section,"next_sync")or""
+    local ver=m.uci:get("minigate",section,"ip_version")or"ipv4"
+
+    local h=""
+    if st=="ok"then
+        h='✓ 正常'
+    elseif st=="partial"then
+        h='⚠ 部分成功'
+    elseif st=="error"then
+        h='✗ '..(msg~=""and msg or"异常")..''
+    else h='未同步' end
+
+    -- 显示 IP 地址
+    if ip~=""then h=h..'
A: '..ip..'' end
+    if ip6~=""then h=h..'
AAAA: '..ip6..'' end
+    if msg~=""and st~="error"then h=h..'
'..msg..'' end
+    if lu~=""then h=h..'
更新: '..lu..'' end
+    if ns~=""then h=h..'
下次: '..ns..'' end
+
+    h=h..'
'
+    h=h..''
+    return h
+end
+
+-- 注入 JS
+s=m:section(NamedSection,"global","global"); s.anonymous=true
+o=s:option(DummyValue,"_js"," "); o.rawhtml=true
+o.cfgvalue=function()
+    local url=luci.dispatcher.build_url("admin/services/minigate/ddns_sync")
+    return''
+end
+
+return m
diff --git a/luci-app-minigate/luasrc/model/cbi/minigate/general.lua b/luci-app-minigate/luasrc/model/cbi/minigate/general.lua
new file mode 100644
index 000000000..389c2470f
--- /dev/null
+++ b/luci-app-minigate/luasrc/model/cbi/minigate/general.lua
@@ -0,0 +1,167 @@
+local m, s, o
+local sys = require "luci.sys"
+
+m = Map("minigate", "MiniGate 轻网关", "轻量级网关管理：动态域名解析（IPv4/IPv6双栈）、SSL 证书签发、反向代理。")
+
+m.on_after_commit = function(self)
+    local en = self.uci:get("minigate", "global", "enabled")
+    if en == "1" then
+        sys.call("/etc/init.d/minigate restart >/dev/null 2>&1 &")
+    else
+        sys.call("/etc/init.d/minigate stop >/dev/null 2>&1 &")
+    end
+end
+
+s = m:section(NamedSection, "global", "global", "服务状态")
+s.anonymous = true
+s:tab("status", "总览")
+
+local su = luci.dispatcher.build_url("admin/services/minigate/status")
+
+o = s:taboption("status", DummyValue, "_status")
+o.rawhtml = true
+o.cfgvalue = function()
+    local su = luci.dispatcher.build_url("admin/services/minigate/status")
+    local au = luci.dispatcher.build_url("admin/services/minigate/proxy_access")
+    local gu = luci.dispatcher.build_url("admin/services/minigate/geo_lookup")
+    return [[
+

+

+
动态DNS

+
--

+

+

+

+
SSL/TLS 证书

+
--

+

+

+

+
反向代理

+
--

+

+

+

+
+

+
访问记录 

+
加载中...

+

+
+
+]] end
+
+s = m:section(NamedSection, "global", "global", "全局设置")
+s.anonymous = true
+o = s:option(Flag, "enabled", "启用 MiniGate")
+o.description = "总开关。关闭后停止 DDNS 定时任务、ACME 续期和反向代理。保存后立即生效。"
+o.rmempty = false
+
+o = s:option(Flag, "ipv6_listen", "反向代理监听 IPv6")
+o.description = "开启后，Nginx 反向代理将同时监听 IPv4 和 IPv6 地址（listen [::]:port）。"
+o.rmempty = false
+o.default = "0"
+
+return m
diff --git a/luci-app-minigate/luasrc/model/cbi/minigate/proxy.lua b/luci-app-minigate/luasrc/model/cbi/minigate/proxy.lua
new file mode 100644
index 000000000..85794a6a0
--- /dev/null
+++ b/luci-app-minigate/luasrc/model/cbi/minigate/proxy.lua
@@ -0,0 +1,166 @@
+local m, s, o
+local sys = require "luci.sys"
+local uc = require "luci.model.uci".cursor()
+
+m = Map("minigate", "MiniGate - 反向代理", "保存后自动生效。")
+
+m.on_after_commit = function(self)
+    sys.call("sleep 1 && /bin/sh /usr/lib/minigate/proxy.sh reload >/dev/null 2>&1 &")
+end
+
+local ddns_domains = {}
+local ddns_ok = {}
+local wildcard_domains = {}
+local normal_domains = {}
+uc:foreach("minigate", "ddns", function(sec)
+    local d = sec.domain or ""
+    local st = sec.status or ""
+    if d ~= "" then
+        ddns_domains[#ddns_domains + 1] = d
+        if st == "ok" then ddns_ok[d] = true end
+        if d:match("^%*%.") then
+            wildcard_domains[#wildcard_domains + 1] = d
+        else
+            normal_domains[#normal_domains + 1] = d
+        end
+    end
+end)
+
+-- ================================
+-- 通配符域名
+-- ================================
+if #wildcard_domains > 0 then
+
+s = m:section(TypedSection, "proxy_wildcard", "通配符域名",
+    "配置监听端口和HTTPS，具体转发由「子域名」控制。")
+s.anonymous = false
+s.addremove = true
+s.template = "cbi/tblsection"
+s.sectionhead = "名称"
+
+o = s:option(ListValue, "enabled", "启用")
+o:value("1", "✓ 启用")
+o:value("0", "✗ 禁用")
+o.default = "1"
+o.rmempty = false
+
+o = s:option(ListValue, "domain", "域名")
+o:value("", "-- 请选择 --")
+for _, d in ipairs(wildcard_domains) do
+    local label = d
+    if ddns_ok[d] then label = d .. " ✓" end
+    o:value(d, label)
+end
+o.rmempty = false
+
+o = s:option(Value, "listen_port", "监听端口")
+o.datatype = "port"
+o.default = "2000"
+o.rmempty = false
+
+o = s:option(ListValue, "ssl", "HTTPS")
+o:value("1", "✓ 开启")
+o:value("0", "✗ 关闭")
+o.default = "1"
+o.rmempty = false
+
+-- ================================
+-- 子域名规则
+-- ================================
+s = m:section(TypedSection, "subproxy", "子域名规则")
+s.anonymous = true
+s.addremove = true
+s.sortable = true
+s.template = "cbi/tblsection"
+
+o = s:option(ListValue, "parent_domain", "主域名")
+o:value("", "--")
+for _, d in ipairs(wildcard_domains) do
+    local base = d:gsub("^%*%.", "")
+    o:value(base, d)
+end
+o.rmempty = false
+
+o = s:option(Value, "prefix", "前缀")
+o.rmempty = false
+o.placeholder = "app"
+
+o = s:option(Value, "target_addr", "目标地址")
+o.rmempty = false
+o.placeholder = "192.168.1.100"
+
+o = s:option(Value, "target_port", "端口")
+o.datatype = "port"
+o.default = "80"
+o.rmempty = false
+
+o = s:option(DummyValue, "_final", "实际域名")
+o.rawhtml = true
+o.cfgvalue = function(self, section)
+    local base = m.uci:get("minigate", section, "parent_domain") or ""
+    local prefix = m.uci:get("minigate", section, "prefix") or ""
+    if prefix ~= "" and base ~= "" then
+        return '' .. prefix .. '.' .. base .. ''
+    end
+    return '--'
+end
+
+end -- wildcard_domains
+
+-- ================================
+-- 普通域名代理
+-- ================================
+if #normal_domains > 0 or #wildcard_domains == 0 then
+
+s = m:section(TypedSection, "proxy", "代理规则",
+    "非通配符域名的反向代理。")
+s.anonymous = false
+s.addremove = true
+s.template = "cbi/tblsection"
+s.sortable = true
+s.sectionhead = "名称"
+
+o = s:option(ListValue, "enabled", "启用")
+o:value("1", "✓ 启用")
+o:value("0", "✗ 禁用")
+o.default = "1"
+o.rmempty = false
+
+o = s:option(ListValue, "domain", "域名")
+o:value("", "-- 请选择 --")
+for _, d in ipairs(normal_domains) do
+    local label = d
+    if ddns_ok[d] then label = d .. " ✓" end
+    o:value(d, label)
+end
+o.rmempty = false
+
+o = s:option(Value, "listen_port", "端口")
+o.datatype = "port"
+o.default = "443"
+o.rmempty = false
+
+o = s:option(Value, "target_addr", "目标地址")
+o.rmempty = false
+o.placeholder = "192.168.1.100"
+
+o = s:option(Value, "target_port", "目标端口")
+o.datatype = "port"
+o.default = "80"
+o.rmempty = false
+
+o = s:option(ListValue, "ssl", "HTTPS")
+o:value("1", "✓ 开启")
+o:value("0", "✗ 关闭")
+o.default = "1"
+o.rmempty = false
+
+o = s:option(ListValue, "websocket", "WS")
+o:value("0", "✗ 关闭")
+o:value("1", "✓ 开启")
+o.default = "0"
+o.rmempty = false
+
+end -- normal_domains
+
+return m
diff --git a/luci-app-minigate/luasrc/view/minigate/log.htm b/luci-app-minigate/luasrc/view/minigate/log.htm
new file mode 100644
index 000000000..33ee13c72
--- /dev/null
+++ b/luci-app-minigate/luasrc/view/minigate/log.htm
@@ -0,0 +1,21 @@
+<%+header%>
+
MiniGate - 日志

+

+
+
+
+

+
加载中...

+
+<%+footer%>
diff --git a/luci-app-minigate/luci-app-minigate_1.1.0-1_all.ipk b/luci-app-minigate/luci-app-minigate_1.1.0-1_all.ipk
new file mode 100644
index 000000000..c72bc5951
Binary files /dev/null and b/luci-app-minigate/luci-app-minigate_1.1.0-1_all.ipk differ
diff --git a/luci-app-minigate/po2lmo.sh b/luci-app-minigate/po2lmo.sh
new file mode 100644
index 000000000..f8caac579
--- /dev/null
+++ b/luci-app-minigate/po2lmo.sh
@@ -0,0 +1,36 @@
+#!/bin/sh
+# Convert PO files to LMO for LuCI
+# Usage: ./po2lmo.sh
+# Run this on a system with luci-base installed, or on the OpenWrt build host
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+PO_DIR="${SCRIPT_DIR}/po"
+I18N_DIR="${SCRIPT_DIR}/root/usr/lib/lua/luci/i18n"
+
+mkdir -p "$I18N_DIR"
+
+# Method 1: Use po2lmo if available (OpenWrt build system)
+if command -v po2lmo >/dev/null 2>&1; then
+    for lang_dir in "$PO_DIR"/*/; do
+        lang=$(basename "$lang_dir")
+        for po_file in "$lang_dir"/*.po; do
+            base=$(basename "$po_file" .po)
+            echo "Converting: ${lang}/${base}.po -> ${base}.${lang}.lmo"
+            po2lmo "$po_file" "${I18N_DIR}/${base}.${lang}.lmo"
+        done
+    done
+    echo "Done! LMO files generated in $I18N_DIR"
+    exit 0
+fi
+
+# Method 2: Direct install on router (copy PO and let LuCI handle it)
+echo "po2lmo not found. Falling back to direct PO installation."
+echo ""
+echo "To install translations on the router, run:"
+echo "  scp po/zh-cn/minigate.po root@:/tmp/"
+echo "  ssh root@"
+echo "  mkdir -p /usr/lib/lua/luci/i18n"
+echo "  po2lmo /tmp/minigate.po /usr/lib/lua/luci/i18n/minigate.zh-cn.lmo"
+echo "  rm -rf /tmp/luci-*"
+echo ""
+echo "Or if building with the OpenWrt SDK, the Makefile handles this automatically."
diff --git a/luci-app-minigate/root/etc/config/minigate b/luci-app-minigate/root/etc/config/minigate
new file mode 100644
index 000000000..62716d22d
--- /dev/null
+++ b/luci-app-minigate/root/etc/config/minigate
@@ -0,0 +1,9 @@
+config global 'global'
+	option enabled '0'
+	option ipv6_listen '0'
+
+config acme 'acme'
+	option enabled '0'
+	option email ''
+	option staging '1'
+	option key_type 'ec-256'
diff --git a/luci-app-minigate/root/etc/init.d/minigate b/luci-app-minigate/root/etc/init.d/minigate
new file mode 100755
index 000000000..8a04d9927
--- /dev/null
+++ b/luci-app-minigate/root/etc/init.d/minigate
@@ -0,0 +1,48 @@
+#!/bin/sh /etc/rc.common
+START=99
+STOP=10
+
+start() {
+    local en=$(uci -q get minigate.global.enabled)
+    [ "$en" = "1" ] || { logger -t minigate "未启用"; return 0; }
+    logger -t minigate "启动..."
+    /bin/sh /usr/lib/minigate/proxy.sh start
+    /bin/sh /usr/lib/minigate/ddns.sh force &
+    # 设置 cron
+    sed -i '/minigate/d' /etc/crontabs/root 2>/dev/null
+    echo "*/5 * * * * /bin/sh /usr/lib/minigate/ddns.sh" >> /etc/crontabs/root
+    echo "0 3 * * * /bin/sh /usr/lib/minigate/acme.sh renew" >> /etc/crontabs/root
+    echo "*/2 * * * * /bin/sh /usr/lib/minigate/geofence.sh scan" >> /etc/crontabs/root
+    /etc/init.d/cron restart 2>/dev/null
+    logger -t minigate "已启动"
+}
+
+stop() {
+    logger -t minigate "停止所有服务..."
+    # 停止反向代理
+    /bin/sh /usr/lib/minigate/proxy.sh stop
+    sleep 1
+    # 移除所有 cron 定时任务（DDNS + ACME）
+    sed -i '/minigate/d' /etc/crontabs/root 2>/dev/null
+    /etc/init.d/cron restart 2>/dev/null
+    # 清除 DDNS 运行状态
+    local sections=$(uci -q show minigate | grep '=ddns$' | cut -d. -f2 | cut -d= -f1)
+    for sec in $sections; do
+        uci -q set minigate.${sec}.status="stopped"
+        uci -q set minigate.${sec}.status_msg="已停止"
+        uci -q set minigate.${sec}.next_sync=""
+    done
+    uci commit minigate
+    logger -t minigate "已停止（DDNS定时/ACME续期/反代 全部关闭）"
+}
+
+restart() {
+    stop
+    sleep 1
+    start
+}
+
+reload() {
+    /bin/sh /usr/lib/minigate/proxy.sh reload
+    /bin/sh /usr/lib/minigate/ddns.sh force
+}
diff --git a/luci-app-minigate/root/usr/lib/minigate/acme.sh b/luci-app-minigate/root/usr/lib/minigate/acme.sh
new file mode 100644
index 000000000..4de89d15f
--- /dev/null
+++ b/luci-app-minigate/root/usr/lib/minigate/acme.sh
@@ -0,0 +1,121 @@
+#!/bin/sh
+ACME_HOME="/etc/minigate/acme/data"
+ACME_BIN="${ACME_HOME}/acme.sh"
+CERT_DIR="/etc/minigate/certs"
+LOGFILE="/var/log/minigate-acme.log"
+
+log() { echo "$(date '+%Y-%m-%d %H:%M:%S') [ACME] $*" >> "$LOGFILE"; }
+
+safe_dir() { echo "$1" | sed 's/\*/_wildcard_/g'; }
+
+find_token_for_domain() {
+    local target="$1"
+    local sections=$(uci -q show minigate | grep '=ddns$' | cut -d. -f2 | cut -d= -f1)
+    for sec in $sections; do
+        local d=$(uci -q get minigate.${sec}.domain)
+        if [ "$d" = "$target" ]; then
+            echo "$(uci -q get minigate.${sec}.cf_api_token)|$(uci -q get minigate.${sec}.cf_zone_id)"
+            return 0
+        fi
+    done
+    local parent=$(echo "$target" | sed 's/^[^.]*\.//')
+    for sec in $sections; do
+        local d=$(uci -q get minigate.${sec}.domain)
+        local db=$(echo "$d" | sed 's/^\*\.//')
+        if [ "$db" = "$parent" ] || [ "$d" = "*.$parent" ]; then
+            echo "$(uci -q get minigate.${sec}.cf_api_token)|$(uci -q get minigate.${sec}.cf_zone_id)"
+            return 0
+        fi
+    done
+    for sec in $sections; do
+        local t=$(uci -q get minigate.${sec}.cf_api_token)
+        local z=$(uci -q get minigate.${sec}.cf_zone_id)
+        [ -n "$t" ] && echo "${t}|${z}" && return 0
+    done
+    return 1
+}
+
+do_install() {
+    if [ -x "$ACME_BIN" ] && [ -d "${ACME_HOME}/dnsapi" ]; then
+        log "acme.sh 已安装"; return 0
+    fi
+    log "下载 acme.sh ..."
+    mkdir -p "$ACME_HOME" "$CERT_DIR"
+    cd /tmp; rm -rf acme.sh-master acme-master.tar.gz
+    local ok=0
+    for url in "https://github.com/acmesh-official/acme.sh/archive/master.tar.gz"; do
+        wget -qO /tmp/acme-master.tar.gz "$url" 2>/dev/null && ok=1 && break
+        curl -sLo /tmp/acme-master.tar.gz "$url" 2>/dev/null && ok=1 && break
+    done
+    [ "$ok" != "1" ] && { log "下载失败"; return 1; }
+    tar xzf /tmp/acme-master.tar.gz -C /tmp/ 2>/dev/null
+    cd /tmp/acme.sh-master
+    ./acme.sh --install --home "$ACME_HOME" --no-cron --no-profile 2>>"$LOGFILE"
+    cd /tmp; rm -rf /tmp/acme-master.tar.gz /tmp/acme.sh-master
+    if [ -x "$ACME_BIN" ] && [ -d "${ACME_HOME}/dnsapi" ]; then
+        "$ACME_BIN" --home "$ACME_HOME" --set-default-ca --server letsencrypt 2>>"$LOGFILE"
+        log "安装成功"; uci -q set minigate.acme.status="installed"; uci commit minigate; return 0
+    else
+        log "安装失败"; return 1
+    fi
+}
+
+do_issue() {
+    local domain="$1"
+    local email=$(uci -q get minigate.acme.email)
+    local staging=$(uci -q get minigate.acme.staging)
+    local key_type=$(uci -q get minigate.acme.key_type)
+
+    if [ -z "$domain" ]; then
+        local fs=$(uci -q show minigate | grep '=ddns$' | head -1 | cut -d. -f2 | cut -d= -f1)
+        [ -n "$fs" ] && domain=$(uci -q get minigate.${fs}.domain)
+    fi
+    [ -z "$domain" ] && { log "未指定域名"; uci -q set minigate.acme.status="error"; uci commit minigate; return 1; }
+
+    local ti=$(find_token_for_domain "$domain")
+    local token=$(echo "$ti" | cut -d'|' -f1)
+    local zone_id=$(echo "$ti" | cut -d'|' -f2)
+    [ -z "$token" ] && { log "无API令牌"; uci -q set minigate.acme.status="error"; uci commit minigate; return 1; }
+
+    do_install || return 1
+    local safe=$(safe_dir "$domain")
+    mkdir -p "${CERT_DIR}/${safe}"
+    export CF_Token="$token"
+    [ -n "$zone_id" ] && export CF_Zone_ID="$zone_id"
+
+    local kl="ec-256"
+    case "$key_type" in ec-256|ec-384) kl="$key_type";; rsa-2048) kl="2048";; rsa-4096) kl="4096";; esac
+    local sf="--server letsencrypt"
+    [ "$staging" = "1" ] && sf="--staging --server letsencrypt"
+
+    log "签发: $domain (staging=$staging)"
+    uci -q set minigate.acme.status="issuing"; uci commit minigate
+
+    "$ACME_BIN" --home "$ACME_HOME" --issue --dns dns_cf $sf -d "$domain" --keylength "$kl" \
+        ${email:+--accountemail "$email"} \
+        --cert-file "${CERT_DIR}/${safe}/cert.pem" --key-file "${CERT_DIR}/${safe}/key.pem" \
+        --fullchain-file "${CERT_DIR}/${safe}/fullchain.pem" --force >> "$LOGFILE" 2>&1
+    local ret=$?
+
+    if [ $ret -eq 0 ] && [ -f "${CERT_DIR}/${safe}/fullchain.pem" ]; then
+        local expiry=$(openssl x509 -in "${CERT_DIR}/${safe}/fullchain.pem" -noout -enddate 2>/dev/null | cut -d= -f2)
+        log "成功: $domain (过期: $expiry)"
+        uci -q set minigate.acme.status="ok"
+        uci -q set minigate.acme.last_domain="$domain"
+        uci -q set minigate.acme.last_issue="$(date '+%Y-%m-%d %H:%M:%S')"
+        uci -q set minigate.acme.cert_expiry="$expiry"
+        uci commit minigate
+        if echo "$domain" | grep -q '^\*\.'; then
+            local base=$(echo "$domain" | sed 's/^\*\.//')
+            [ ! -e "${CERT_DIR}/${base}" ] && ln -sf "${safe}" "${CERT_DIR}/${base}"
+        fi
+        [ -f /usr/lib/minigate/proxy.sh ] && /bin/sh /usr/lib/minigate/proxy.sh reload 2>/dev/null
+        return 0
+    else
+        log "失败 (exit=$ret)"; uci -q set minigate.acme.status="error"; uci commit minigate; return 1
+    fi
+}
+
+do_renew() { do_install || return 1; log "续期..."; "$ACME_BIN" --home "$ACME_HOME" --renew-all --server letsencrypt >> "$LOGFILE" 2>&1; log "完成"; }
+
+case "${1:-issue}" in install) do_install;; issue) do_issue "$2";; renew) do_renew;; *) echo "用法: $0 {install|issue [域名]|renew}";; esac
diff --git a/luci-app-minigate/root/usr/lib/minigate/ddns.sh b/luci-app-minigate/root/usr/lib/minigate/ddns.sh
new file mode 100644
index 000000000..63c9606a1
--- /dev/null
+++ b/luci-app-minigate/root/usr/lib/minigate/ddns.sh
@@ -0,0 +1,239 @@
+#!/bin/sh
+LOGFILE="/var/log/minigate-ddns.log"
+
+log() { echo "$(date '+%Y-%m-%d %H:%M:%S') [DDNS] $*" >> "$LOGFILE"; }
+trim_log() { [ -f "$LOGFILE" ] && [ "$(wc -l < "$LOGFILE")" -gt 300 ] && { tail -n 150 "$LOGFILE" > "${LOGFILE}.tmp"; mv "${LOGFILE}.tmp" "$LOGFILE"; }; }
+
+# ====== IPv4 获取 ======
+get_ip4_iface() {
+    local ip=""
+    ip=$(ubus call network.interface.${1:-wan} status 2>/dev/null | jsonfilter -e '@["ipv4-address"][0].address' 2>/dev/null)
+    [ -z "$ip" ] && ip=$(ifstatus "${1:-wan}" 2>/dev/null | jsonfilter -e '@["ipv4-address"][0].address' 2>/dev/null)
+    echo "$ip" | grep -oE '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$'
+}
+
+get_ip4_url() {
+    local ip=""
+    # 备用 URL 列表（主选 + 自动回退）
+    local fallback_urls="http://ip.3322.net http://members.3322.org/dyndns/getip http://ns1.dnspod.net:6666 http://ip.tool.chinaz.com/getip"
+    local urls="$1 $fallback_urls"
+
+    for url in $urls; do
+        local host=$(echo "$url" | sed -E 's|https?://||;s|/.*||;s|:.*||')
+        local port=$(echo "$url" | grep -oE ':[0-9]+' | head -1 | tr -d ':')
+        local path=$(echo "$url" | sed -E 's|https?://[^/]*||')
+        [ -z "$path" ] && path="/"
+        [ -z "$port" ] && port="80"
+
+        # 方法1: 直连
+        ip=$(curl -4 -s --connect-timeout 3 "$url" 2>/dev/null | grep -oE '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' | head -1)
+        [ -n "$ip" ] && { echo "$ip"; return; }
+
+        # 方法2: DNS 解析后用 Host 头直连（绕过代理）
+        local resolved=$(nslookup "$host" 223.5.5.5 2>/dev/null | grep -A1 'Name:' | grep 'Address:' | head -1 | awk '{print $2}')
+        if [ -n "$resolved" ]; then
+            ip=$(curl -4 -s --connect-timeout 3 -H "Host: ${host}" "http://${resolved}:${port}${path}" 2>/dev/null | grep -oE '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' | head -1)
+            [ -n "$ip" ] && { echo "$ip"; return; }
+        fi
+    done
+    echo ""
+}
+
+# ====== IPv6 获取 ======
+get_ip6_iface() {
+    local ip="" iface="${1:-wan6}"
+    # 优先取全局 IPv6 地址（排除 link-local fe80::）
+    ip=$(ubus call network.interface.${iface} status 2>/dev/null | jsonfilter -e '@["ipv6-address"][0].address' 2>/dev/null)
+    [ -z "$ip" ] && ip=$(ifstatus "${iface}" 2>/dev/null | jsonfilter -e '@["ipv6-address"][0].address' 2>/dev/null)
+    # 也尝试从 ipv6-prefix-assignment 获取
+    [ -z "$ip" ] && ip=$(ubus call network.interface.${iface} status 2>/dev/null | jsonfilter -e '@["ipv6-prefix-assignment"][0]["local-address"].address' 2>/dev/null)
+    # 验证是有效的 IPv6（排除 link-local）
+    echo "$ip" | grep -v '^fe80' | grep -oE '^[0-9a-fA-F:]+$' | head -1
+}
+
+get_ip6_url() {
+    local url="$1" ip=""
+    local host=$(echo "$url" | sed -E 's|https?://||;s|/.*||;s|:.*||')
+    local port=$(echo "$url" | grep -oE ':[0-9]+' | head -1 | tr -d ':')
+
+    # 先尝试直连
+    ip=$(curl -6 -s --connect-timeout 5 "$url" 2>/dev/null | grep -oE '([0-9a-fA-F]{0,4}:){2,7}[0-9a-fA-F]{0,4}' | head -1)
+
+    # 如果失败，DNS 解析后直连绕过代理
+    if [ -z "$ip" ]; then
+        local resolved=$(nslookup "$host" 223.5.5.5 2>/dev/null | grep -A1 'Name:' | grep 'Address:' | head -1 | awk '{print $2}')
+        if [ -n "$resolved" ]; then
+            local scheme="http"
+            echo "$url" | grep -q '^https' && scheme="https"
+            [ -z "$port" ] && { [ "$scheme" = "https" ] && port="443" || port="80"; }
+            ip=$(curl -6 -s --connect-timeout 5 --resolve "${host}:${port}:${resolved}" "$url" 2>/dev/null | grep -oE '([0-9a-fA-F]{0,4}:){2,7}[0-9a-fA-F]{0,4}' | head -1)
+        fi
+    fi
+    echo "$ip"
+}
+
+# ====== Cloudflare API：支持 A 和 AAAA 记录 ======
+cf_update() {
+    local zone_id="$1" token="$2" domain="$3" ip="$4" record_type="$5"
+    # record_type: A 或 AAAA
+    [ -z "$record_type" ] && record_type="A"
+    local resp rid
+    resp=$(curl -s --connect-timeout 10 -H "Authorization: Bearer $token" -H "Content-Type: application/json" \
+        "https://api.cloudflare.com/client/v4/zones/${zone_id}/dns_records?type=${record_type}&name=${domain}" 2>/dev/null)
+    rid=$(echo "$resp" | jsonfilter -e '$.result[0].id' 2>/dev/null)
+    if [ -n "$rid" ]; then
+        resp=$(curl -s --connect-timeout 10 -X PUT -H "Authorization: Bearer $token" -H "Content-Type: application/json" \
+            -d "{\"type\":\"$record_type\",\"name\":\"$domain\",\"content\":\"$ip\",\"ttl\":120,\"proxied\":false}" \
+            "https://api.cloudflare.com/client/v4/zones/${zone_id}/dns_records/${rid}" 2>/dev/null)
+    else
+        resp=$(curl -s --connect-timeout 10 -X POST -H "Authorization: Bearer $token" -H "Content-Type: application/json" \
+            -d "{\"type\":\"$record_type\",\"name\":\"$domain\",\"content\":\"$ip\",\"ttl\":120,\"proxied\":false}" \
+            "https://api.cloudflare.com/client/v4/zones/${zone_id}/dns_records" 2>/dev/null)
+    fi
+    echo "$resp" | jsonfilter -e '$.success' 2>/dev/null
+}
+
+calc_next() {
+    local interval="${1:-300}"
+    local now=$(date +%s)
+    local next=$((now + interval))
+    date -d "@${next}" '+%H:%M:%S' 2>/dev/null || echo "${interval}秒后"
+}
+
+update_one() {
+    local sec="$1" force="$2"
+    local enabled=$(uci -q get minigate.${sec}.enabled)
+    [ "$enabled" = "1" ] || return 0
+
+    local domain=$(uci -q get minigate.${sec}.domain)
+    local zone_id=$(uci -q get minigate.${sec}.cf_zone_id)
+    local token=$(uci -q get minigate.${sec}.cf_api_token)
+    local ip_source=$(uci -q get minigate.${sec}.ip_source)
+    local iface=$(uci -q get minigate.${sec}.interface)
+    local ip_url=$(uci -q get minigate.${sec}.ip_url)
+    local interval=$(uci -q get minigate.${sec}.check_interval); interval=${interval:-300}
+    local ip_version=$(uci -q get minigate.${sec}.ip_version); ip_version=${ip_version:-ipv4}
+    local iface6=$(uci -q get minigate.${sec}.interface6); iface6=${iface6:-wan6}
+    local ip_url6=$(uci -q get minigate.${sec}.ip_url6); ip_url6=${ip_url6:-https://api6.ipify.org}
+
+    [ -z "$domain" ] || [ -z "$zone_id" ] || [ -z "$token" ] && {
+        log "$domain: 配置不完整"
+        uci -q set minigate.${sec}.status="error"; uci -q set minigate.${sec}.status_msg="配置不完整"
+        return 1
+    }
+
+    local cache="/tmp/minigate_ddns_${sec}.cache"
+    local cache6="/tmp/minigate_ddns_${sec}_v6.cache"
+    local cached=$(cat "$cache" 2>/dev/null)
+    local cached6=$(cat "$cache6" 2>/dev/null)
+    local next_time=$(calc_next "$interval")
+    local any_ok=0 any_fail=0
+    local result_ip="" result_ip6=""
+    local msgs=""
+
+    # ====== IPv4 处理 ======
+    if [ "$ip_version" = "ipv4" ] || [ "$ip_version" = "dual" ]; then
+        local ip4=""
+        case "$ip_source" in url) ip4=$(get_ip4_url "$ip_url");; *) ip4=$(get_ip4_iface "$iface");; esac
+
+        if [ -z "$ip4" ]; then
+            log "$domain: 获取IPv4失败"
+            msgs="${msgs}IPv4获取失败; "
+            any_fail=1
+        elif [ "$force" = "1" ] || [ "$ip4" != "$cached" ]; then
+            log "$domain: IPv4 ${cached:-无} -> $ip4"
+            local result=$(cf_update "$zone_id" "$token" "$domain" "$ip4" "A")
+            if [ "$result" = "true" ]; then
+                log "$domain: A记录同步成功"
+                echo "$ip4" > "$cache"
+                result_ip="$ip4"
+                msgs="${msgs}A:${ip4} ✓; "
+                any_ok=1
+            else
+                log "$domain: A记录同步失败"
+                msgs="${msgs}A记录失败; "
+                any_fail=1
+            fi
+        else
+            log "$domain: IPv4地址一致($ip4)"
+            result_ip="$ip4"
+            msgs="${msgs}A:${ip4} (未变); "
+            any_ok=1
+        fi
+    fi
+
+    # ====== IPv6 处理 ======
+    if [ "$ip_version" = "ipv6" ] || [ "$ip_version" = "dual" ]; then
+        local ip6=""
+        case "$ip_source" in url) ip6=$(get_ip6_url "$ip_url6");; *) ip6=$(get_ip6_iface "$iface6");; esac
+
+        if [ -z "$ip6" ]; then
+            log "$domain: 获取IPv6失败"
+            msgs="${msgs}IPv6获取失败; "
+            # 双栈模式下 IPv6 获取失败不算整体失败
+            [ "$ip_version" = "ipv6" ] && any_fail=1
+        elif [ "$force" = "1" ] || [ "$ip6" != "$cached6" ]; then
+            log "$domain: IPv6 ${cached6:-无} -> $ip6"
+            local result=$(cf_update "$zone_id" "$token" "$domain" "$ip6" "AAAA")
+            if [ "$result" = "true" ]; then
+                log "$domain: AAAA记录同步成功"
+                echo "$ip6" > "$cache6"
+                result_ip6="$ip6"
+                msgs="${msgs}AAAA:${ip6} ✓; "
+                any_ok=1
+            else
+                log "$domain: AAAA记录同步失败"
+                msgs="${msgs}AAAA记录失败; "
+                any_fail=1
+            fi
+        else
+            log "$domain: IPv6地址一致($ip6)"
+            result_ip6="$ip6"
+            msgs="${msgs}AAAA:${ip6} (未变); "
+            any_ok=1
+        fi
+    fi
+
+    # ====== 更新状态 ======
+    if [ "$any_ok" = "1" ] && [ "$any_fail" = "0" ]; then
+        uci -q set minigate.${sec}.status="ok"
+    elif [ "$any_ok" = "1" ] && [ "$any_fail" = "1" ]; then
+        uci -q set minigate.${sec}.status="partial"
+    else
+        uci -q set minigate.${sec}.status="error"
+    fi
+    uci -q set minigate.${sec}.status_msg="$msgs"
+    [ -n "$result_ip" ] && uci -q set minigate.${sec}.last_ip="$result_ip"
+    [ -n "$result_ip6" ] && uci -q set minigate.${sec}.last_ip6="$result_ip6"
+    uci -q set minigate.${sec}.last_update="$(date '+%Y-%m-%d %H:%M:%S')"
+    uci -q set minigate.${sec}.next_sync="$next_time"
+}
+
+main() {
+    local gen=$(uci -q get minigate.global.enabled)
+    if [ "$gen" != "1" ]; then
+        log "全局未启用，跳过 DDNS"
+        return 0
+    fi
+
+    local force=0; [ "$1" = "force" ] && force=1
+    log "--- 开始同步 ---"
+    local sections=$(uci -q show minigate | grep '=ddns$' | cut -d. -f2 | cut -d= -f1)
+    local c=0
+    for sec in $sections; do update_one "$sec" "$force"; c=$((c + 1)); done
+    [ "$c" = "0" ] && log "无 DDNS 记录"
+    uci commit minigate
+    log "--- 同步完成 ($c 条) ---"
+    trim_log
+}
+
+# 手动单条同步
+if [ "$1" = "single" ] && [ -n "$2" ]; then
+    log "手动同步: $2"
+    update_one "$2" "1"
+    uci commit minigate
+    trim_log
+    exit 0
+fi
+
+main "$@"
diff --git a/luci-app-minigate/root/usr/lib/minigate/geofence.sh b/luci-app-minigate/root/usr/lib/minigate/geofence.sh
new file mode 100644
index 000000000..7b5e802e9
--- /dev/null
+++ b/luci-app-minigate/root/usr/lib/minigate/geofence.sh
@@ -0,0 +1,177 @@
+#!/bin/sh
+# MiniGate GeoFence - 地区访问控制
+# 检查反代访问日志，非允许地区的 IP 用防火墙封禁
+LOGFILE="/var/log/minigate-geofence.log"
+CACHE_DIR="/tmp/minigate_geo"
+BLOCK_SET="minigate_blocked"
+ACCESS_LOG="/var/log/minigate-access.log"
+
+log() { echo "$(date '+%Y-%m-%d %H:%M:%S') [GEOFENCE] $*" >> "$LOGFILE"; }
+
+# 查询 IP 归属地，返回省份名
+lookup_geo() {
+    local ip="$1"
+    local cache="$CACHE_DIR/${ip}"
+    
+    # 缓存命中
+    [ -f "$cache" ] && cat "$cache" && return 0
+    
+    local geo=""
+    
+    # API 1: pconline
+    if [ -z "$geo" ]; then
+        local raw=$(curl -s --connect-timeout 3 --max-time 5 "https://whois.pconline.com.cn/ipJson.jsp?ip=${ip}&json=true" 2>/dev/null)
+        geo=$(echo "$raw" | jsonfilter -e '$.pro' 2>/dev/null)
+    fi
+    
+    # API 2: ip9.com.cn
+    if [ -z "$geo" ]; then
+        local raw=$(curl -s --connect-timeout 3 --max-time 5 "https://ip9.com.cn/get?ip=${ip}" 2>/dev/null)
+        geo=$(echo "$raw" | jsonfilter -e '$.data.prov' 2>/dev/null)
+    fi
+    
+    # API 3: ip-api.com
+    if [ -z "$geo" ]; then
+        local raw=$(curl -s --connect-timeout 3 --max-time 5 "http://ip-api.com/json/${ip}?fields=regionName" 2>/dev/null)
+        geo=$(echo "$raw" | jsonfilter -e '$.regionName' 2>/dev/null)
+    fi
+    
+    [ -z "$geo" ] && geo="unknown"
+    
+    # 写入缓存
+    mkdir -p "$CACHE_DIR"
+    echo "$geo" > "$cache"
+    echo "$geo"
+}
+
+# 检查 IP 是否在允许的地区列表中
+is_allowed() {
+    local geo="$1"
+    local allowed=$(uci -q get minigate.global.geo_allowed)
+    
+    [ -z "$allowed" ] && return 0  # 未配置地区限制，全部放行
+    
+    # allowed 是逗号分隔的省份列表，如 "四川,重庆,贵州"
+    echo "$allowed" | tr ',' '\n' | while read prov; do
+        [ -z "$prov" ] && continue
+        echo "$geo" | grep -q "$prov" && echo "yes" && return 0
+    done | grep -q "yes"
+}
+
+# 初始化 ipset（nftables 或 iptables）
+init_block_set() {
+    if command -v nft >/dev/null 2>&1; then
+        # nftables (OpenWrt 22+)
+        nft list set inet fw4 "$BLOCK_SET" >/dev/null 2>&1 || {
+            nft add set inet fw4 "$BLOCK_SET" '{ type ipv4_addr; flags timeout; }'
+            nft add rule inet fw4 input ip saddr @"$BLOCK_SET" drop 2>/dev/null
+            log "nftables 封禁集合已创建"
+        }
+    else
+        # iptables fallback
+        ipset list "$BLOCK_SET" >/dev/null 2>&1 || {
+            ipset create "$BLOCK_SET" hash:ip timeout 43200 2>/dev/null  # 12小时超时
+            iptables -I INPUT -m set --match-set "$BLOCK_SET" src -j DROP 2>/dev/null
+            log "ipset 封禁集合已创建"
+        }
+    fi
+}
+
+# 封禁 IP
+block_ip() {
+    local ip="$1" reason="$2"
+    if command -v nft >/dev/null 2>&1; then
+        nft add element inet fw4 "$BLOCK_SET" "{ $ip timeout 12h }" 2>/dev/null
+    else
+        ipset add "$BLOCK_SET" "$ip" timeout 43200 2>/dev/null
+    fi
+    log "封禁: $ip ($reason) 12小时"
+    
+    # 记录到 UCI
+    local ts=$(date '+%Y-%m-%d %H:%M:%S')
+    uci -q add_list minigate.global.blocked_ips="${ip}|${reason}|${ts}"
+    uci commit minigate 2>/dev/null
+}
+
+# 清理过期缓存（超过24小时的）
+clean_cache() {
+    [ -d "$CACHE_DIR" ] && find "$CACHE_DIR" -type f -mmin +1440 -delete 2>/dev/null
+}
+
+# 主逻辑：扫描 access log 中的新 IP
+scan_and_block() {
+    local enabled=$(uci -q get minigate.global.geo_enabled)
+    [ "$enabled" != "1" ] && return 0
+    
+    local allowed=$(uci -q get minigate.global.geo_allowed)
+    [ -z "$allowed" ] && { log "未配置允许地区，跳过"; return 0; }
+    
+    init_block_set
+    
+    # 提取所有外网 IP（排除内网）
+    local ips=$(grep -oP '"client":"[^"]*"' "$ACCESS_LOG" 2>/dev/null | \
+        grep -oP '[\d\.]+' | \
+        grep -v '^192\.168\.' | grep -v '^10\.' | grep -v '^172\.(1[6-9]|2[0-9]|3[01])\.' | grep -v '^127\.' | \
+        sort -u)
+    
+    local checked=0 blocked=0
+    for ip in $ips; do
+        # 已经封禁的跳过
+        if command -v nft >/dev/null 2>&1; then
+            nft list set inet fw4 "$BLOCK_SET" 2>/dev/null | grep -q "$ip" && continue
+        else
+            ipset test "$BLOCK_SET" "$ip" 2>/dev/null && continue
+        fi
+        
+        local geo=$(lookup_geo "$ip")
+        checked=$((checked + 1))
+        
+        if [ "$geo" = "unknown" ]; then
+            log "警告: $ip 归属地未知，暂时放行"
+            continue
+        fi
+        
+        if ! is_allowed "$geo"; then
+            block_ip "$ip" "$geo"
+            blocked=$((blocked + 1))
+        else
+            log "放行: $ip ($geo)"
+        fi
+        
+        # 限速，避免 API 过载
+        sleep 1
+    done
+    
+    [ "$checked" -gt 0 ] && log "扫描完成: 检查 $checked 个IP，封禁 $blocked 个"
+    clean_cache
+}
+
+# 手动解封
+unblock_ip() {
+    local ip="$1"
+    if command -v nft >/dev/null 2>&1; then
+        nft delete element inet fw4 "$BLOCK_SET" "{ $ip }" 2>/dev/null
+    else
+        ipset del "$BLOCK_SET" "$ip" 2>/dev/null
+    fi
+    log "解封: $ip"
+}
+
+# 清除所有封禁
+flush_blocks() {
+    if command -v nft >/dev/null 2>&1; then
+        nft flush set inet fw4 "$BLOCK_SET" 2>/dev/null
+    else
+        ipset flush "$BLOCK_SET" 2>/dev/null
+    fi
+    uci -q delete minigate.global.blocked_ips
+    uci commit minigate 2>/dev/null
+    log "已清除所有封禁"
+}
+
+case "${1:-scan}" in
+    scan) scan_and_block ;;
+    unblock) unblock_ip "$2" ;;
+    flush) flush_blocks ;;
+    *) echo "用法: $0 {scan|unblock |flush}" ;;
+esac
diff --git a/luci-app-minigate/root/usr/lib/minigate/proxy.sh b/luci-app-minigate/root/usr/lib/minigate/proxy.sh
new file mode 100644
index 000000000..65bc93d53
--- /dev/null
+++ b/luci-app-minigate/root/usr/lib/minigate/proxy.sh
@@ -0,0 +1,237 @@
+#!/bin/sh
+NGINX_CONF="/etc/minigate/nginx/minigate.conf"
+SITES_DIR="/etc/minigate/nginx/sites"
+CERT_DIR="/etc/minigate/certs"
+LOGFILE="/var/log/minigate-proxy.log"
+PID_FILE="/var/run/minigate-nginx.pid"
+
+log() { echo "$(date '+%Y-%m-%d %H:%M:%S') [PROXY] $*" >> "$LOGFILE"; }
+
+generate_main_conf() {
+    mkdir -p "$(dirname $NGINX_CONF)" "$SITES_DIR"
+    cat > "$NGINX_CONF" <<'EOF'
+worker_processes auto;
+pid /var/run/minigate-nginx.pid;
+error_log /var/log/minigate-nginx-error.log warn;
+events { worker_connections 512; }
+http {
+    include /etc/nginx/mime.types;
+    default_type application/octet-stream;
+    sendfile on; keepalive_timeout 65; client_max_body_size 100m;
+    gzip on; gzip_types text/plain text/css application/json application/javascript text/xml;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_prefer_server_ciphers off;
+    ssl_session_cache shared:SSL:10m;
+    log_format minigate_json escape=json
+        '{"time":"$time_iso8601",'
+        '"domain":"$server_name",'
+        '"client":"$remote_addr",'
+        '"method":"$request_method",'
+        '"uri":"$request_uri",'
+        '"status":$status,'
+        '"size":$body_bytes_sent,'
+        '"referer":"$http_referer",'
+        '"ua":"$http_user_agent"}';
+    access_log /var/log/minigate-access.log minigate_json;
+    include /etc/minigate/nginx/sites/*.conf;
+}
+EOF
+}
+
+find_cert() {
+    local domain="$1"
+    local parent=$(echo "$domain" | sed 's/^[^.]*\.//')
+    for try in "$domain" "_wildcard_.${parent}" "$parent"; do
+        [ -f "${CERT_DIR}/${try}/fullchain.pem" ] && { echo "${CERT_DIR}/${try}"; return 0; }
+    done
+    for try in "$parent" "$domain"; do
+        [ -L "${CERT_DIR}/${try}" ] && {
+            local t=$(readlink -f "${CERT_DIR}/${try}")
+            [ -f "${t}/fullchain.pem" ] && { echo "$t"; return 0; }
+        }
+    done
+    return 1
+}
+
+check_h2() {
+    local m=$(nginx -v 2>&1 | grep -oE '[0-9]+\.[0-9]+' | head -1 | cut -d. -f2)
+    [ "${m:-0}" -ge 25 ] && echo "new" || echo "old"
+}
+
+# 读取全局 IPv6 监听设置
+get_ipv6_listen() {
+    local v6=$(uci -q get minigate.global.ipv6_listen)
+    echo "${v6:-0}"
+}
+
+# 写一个完整的 server block（带 proxy_pass），同时支持 IPv6
+write_server() {
+    local conf="$1" domain="$2" lport="$3" taddr="$4" tport="$5" ssl="$6" h2="$7" ws="$8" h2s="$9"
+    shift 9
+    local ipv6_listen="${1:-0}"
+
+    log "生成: $domain:${lport} -> ${taddr}:${tport} (ipv6=$ipv6_listen)"
+
+    local ll="listen ${lport}"; local ll6=""; local ex=""
+    [ "$ssl" = "1" ] && ll="${ll} ssl"
+
+    # IPv6 listen
+    if [ "$ipv6_listen" = "1" ]; then
+        ll6="listen [::]:${lport}"
+        [ "$ssl" = "1" ] && ll6="${ll6} ssl"
+    fi
+
+    # HTTPS 模式自动启用 HTTP/2
+    if [ "$ssl" = "1" ]; then
+        if [ "$h2s" = "new" ]; then
+            ex="    http2 on;"
+        else
+            ll="${ll} http2"
+            [ -n "$ll6" ] && ll6="${ll6} http2"
+        fi
+    fi
+
+    cat >> "$conf" <> "$conf"
+    cat >> "$conf" <> "$conf" <> "$conf" <> "$conf" <> "$conf"; echo "}" >> "$conf"
+}
+
+generate_sites() {
+    rm -f "$SITES_DIR"/*.conf
+    local h2s=$(check_h2)
+    local idx=0
+    local ipv6_listen=$(get_ipv6_listen)
+
+    # === 通配符域名设置 (proxy_wildcard sections) ===
+    local wc_sections=$(uci -q show minigate | grep '=proxy_wildcard$' | cut -d. -f2 | cut -d= -f1)
+    for sec in $wc_sections; do
+        local enabled=$(uci -q get minigate.${sec}.enabled)
+        [ "$enabled" = "1" ] || continue
+        local domain=$(uci -q get minigate.${sec}.domain)
+        [ -z "$domain" ] && continue
+        local lport=$(uci -q get minigate.${sec}.listen_port); lport=${lport:-443}
+        local ssl=$(uci -q get minigate.${sec}.ssl); ssl=${ssl:-0}
+        local base=$(echo "$domain" | sed 's/^\*\.//')
+        echo "${lport}|${ssl}" > "/tmp/minigate_proxy_${base}.tmp"
+        log "通配符: $domain (端口:$lport https:$ssl ipv6:$ipv6_listen)"
+    done
+
+    # === 非通配符代理规则 (proxy sections) ===
+    local sections=$(uci -q show minigate | grep '=proxy$' | cut -d. -f2 | cut -d= -f1)
+    for sec in $sections; do
+        local enabled=$(uci -q get minigate.${sec}.enabled)
+        [ "$enabled" = "1" ] || continue
+        local domain=$(uci -q get minigate.${sec}.domain)
+        local lport=$(uci -q get minigate.${sec}.listen_port); lport=${lport:-443}
+        local taddr=$(uci -q get minigate.${sec}.target_addr)
+        local tport=$(uci -q get minigate.${sec}.target_port); tport=${tport:-80}
+        local ssl=$(uci -q get minigate.${sec}.ssl); ssl=${ssl:-1}
+        local h2=$(uci -q get minigate.${sec}.http2); h2=${h2:-1}
+        local ws=$(uci -q get minigate.${sec}.websocket); ws=${ws:-0}
+        [ -z "$domain" ] || [ -z "$taddr" ] && continue
+        idx=$((idx + 1))
+        local conf="${SITES_DIR}/site_${idx}.conf"; > "$conf"
+        write_server "$conf" "$domain" "$lport" "$taddr" "$tport" "$ssl" "$h2" "$ws" "$h2s" "$ipv6_listen"
+    done
+
+    # === 子域名规则：继承通配符主域名设置 ===
+    local subs=$(uci -q show minigate | grep '=subproxy$' | cut -d. -f2 | cut -d= -f1)
+    for sec in $subs; do
+        local parent=$(uci -q get minigate.${sec}.parent_domain)
+        local prefix=$(uci -q get minigate.${sec}.prefix)
+        local taddr=$(uci -q get minigate.${sec}.target_addr)
+        local tport=$(uci -q get minigate.${sec}.target_port); tport=${tport:-80}
+        [ -z "$parent" ] || [ -z "$prefix" ] || [ -z "$taddr" ] && continue
+
+        local domain="${prefix}.${parent}"
+
+        local parent_conf="/tmp/minigate_proxy_${parent}.tmp"
+        local lport="443" ssl="0"
+        if [ -f "$parent_conf" ]; then
+            local settings=$(cat "$parent_conf")
+            lport=$(echo "$settings" | cut -d'|' -f1)
+            ssl=$(echo "$settings" | cut -d'|' -f2)
+        fi
+
+        idx=$((idx + 1))
+        local conf="${SITES_DIR}/site_${idx}.conf"; > "$conf"
+        write_server "$conf" "$domain" "$lport" "$taddr" "$tport" "$ssl" "1" "0" "$h2s" "$ipv6_listen"
+    done
+
+    rm -f /tmp/minigate_proxy_*.tmp
+}
+
+do_stop() {
+    if [ -f "$PID_FILE" ]; then
+        local pid=$(cat "$PID_FILE" 2>/dev/null)
+        if [ -n "$pid" ]; then
+            kill "$pid" 2>/dev/null
+            local i=0
+            while [ $i -lt 10 ] && kill -0 "$pid" 2>/dev/null; do
+                sleep 1; i=$((i + 1))
+            done
+            kill -0 "$pid" 2>/dev/null && kill -9 "$pid" 2>/dev/null
+        fi
+        rm -f "$PID_FILE"
+        log "已停止"
+    fi
+}
+
+do_start() {
+    [ -z "$(which nginx 2>/dev/null)" ] && { log "nginx未安装"; return 1; }
+    do_stop 2>/dev/null
+    sleep 1
+    generate_main_conf; generate_sites
+    nginx -t -c "$NGINX_CONF" >> "$LOGFILE" 2>&1 || { log "配置错误"; return 1; }
+    nginx -c "$NGINX_CONF" >> "$LOGFILE" 2>&1 && log "已启动" || { log "启动失败"; return 1; }
+}
+
+do_reload() {
+    if [ -f "$PID_FILE" ] && kill -0 $(cat "$PID_FILE" 2>/dev/null) 2>/dev/null; then
+        generate_main_conf; generate_sites
+        nginx -t -c "$NGINX_CONF" >> "$LOGFILE" 2>&1 && kill -HUP $(cat "$PID_FILE") && log "已重载"
+    else
+        do_start
+    fi
+}
+
+case "$1" in start) do_start;; stop) do_stop;; reload) do_reload;; *) echo "用法: $0 {start|stop|reload}";; esac
diff --git a/luci-app-minigate/root/usr/share/rpcd/acl.d/luci-app-minigate.json b/luci-app-minigate/root/usr/share/rpcd/acl.d/luci-app-minigate.json
new file mode 100644
index 000000000..7869270cc
--- /dev/null
+++ b/luci-app-minigate/root/usr/share/rpcd/acl.d/luci-app-minigate.json
@@ -0,0 +1,11 @@
+{
+	"luci-app-minigate": {
+		"description": "Grant UCI access for luci-app-minigate",
+		"read": {
+			"uci": [ "minigate" ]
+		},
+		"write": {
+			"uci": [ "minigate" ]
+		}
+	}
+}
diff --git a/luci-app-minigate/root/usr/share/ucitrack/luci-app-minigate.json b/luci-app-minigate/root/usr/share/ucitrack/luci-app-minigate.json
new file mode 100644
index 000000000..1d1a33610
--- /dev/null
+++ b/luci-app-minigate/root/usr/share/ucitrack/luci-app-minigate.json
@@ -0,0 +1,4 @@
+{
+	"config": "minigate",
+	"init": "minigate"
+}
diff --git a/luci-app-adguardhome/.gitattributes b/luci-app-netstat/.gitattributes
similarity index 100%
rename from luci-app-adguardhome/.gitattributes
rename to luci-app-netstat/.gitattributes
diff --git a/luci-app-netstat/.gitignore b/luci-app-netstat/.gitignore
new file mode 100644
index 000000000..c6549572f
--- /dev/null
+++ b/luci-app-netstat/.gitignore
@@ -0,0 +1,4 @@
+.DS_Store
+node_modules
+old-src
+.claude
\ No newline at end of file
diff --git a/luci-app-netstat/Makefile b/luci-app-netstat/Makefile
new file mode 100644
index 000000000..c0958f234
--- /dev/null
+++ b/luci-app-netstat/Makefile
@@ -0,0 +1,23 @@
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=luci-app-netstat
+PKG_VERSION:=1.1.5
+PKG_RELEASE:=1
+
+PKG_MAINTAINER:=NoobLK 
+PKG_LICENSE:=GPL-3.0
+
+LUCI_TITLE:=NET Stats
+LUCI_DESCRIPTION:=This LuCI app provides net statistic functionality in a web interface.
+LUCI_DEPENDS:=+vnstat +luci-compat
+
+include $(TOPDIR)/feeds/luci/luci.mk
+
+define Package/luci-app-netstat/install
+	$(CP) ./files/* $(1)/
+	# vnstat package owns /etc/config/vnstat on newer OpenWrt versions.
+	# Remove it here to avoid file ownership conflicts if present in any tree.
+	$(RM) $(1)/etc/config/vnstat
+endef
+
+$(eval $(call BuildPackage,luci-app-netstat))
diff --git a/luci-app-netstat/README.md b/luci-app-netstat/README.md
new file mode 100644
index 000000000..c367c588b
--- /dev/null
+++ b/luci-app-netstat/README.md
@@ -0,0 +1,159 @@
+# luci-app-netstat
+
+

+
+**A professional network statistics application for OpenWrt LuCI**
+
+[![License: GPL-3.0](https://img.shields.io/badge/License-GPL%203.0-blue.svg)](LICENSE)
+![OpenWrt Compatible](https://img.shields.io/badge/OpenWrt-Compatible-brightgreen)
+
+[Features](#features) • [Installation](#installation) • [Usage](#usage) • [Development](#development) • [License](#license)
+
+

+
+---
+
+## Overview
+![Dashboard Preview](images/luci-app-netstat.png)
+
+
+
+**luci-app-netstat** is a modern, feature-rich LuCI application that provides comprehensive network traffic statistics and monitoring for OpenWrt routers. It leverages `vnstat` for accurate traffic monitoring and presents the data through an intuitive web interface.
+
+The application offers real-time network statistics, historical data visualization, and detailed traffic analysis to help you understand your network usage patterns.
+
+## Features
+
+✨ **Core Features:**
+- 📊 **Real-time Network Monitoring** - Track network traffic with live statistics
+- 📈 **Traffic Visualization** - Interactive charts powered by Chart.js
+- 📅 **Historical Data** - Monitor trends over days, weeks, months, and years
+- 🎨 **Dark Mode Support** - Professional dark theme for comfortable usage
+- 📱 **Responsive Design** - Works seamlessly on desktop and mobile devices
+- ⚙️ **Easy Configuration** - Simple UCI-based configuration system
+- 🔄 **Automatic Updates** - Uses vnstat for continuous data collection
+
+## Requirements
+
+- OpenWrt with LuCI installed
+- `vnstat` package (required dependency)
+- Modern web browser (Chrome, Firefox, Safari, Edge)
+
+## Installation
+
+### Automatic Installation
+
+Clone the repository and install using the OpenWrt build system:
+
+```bash
+git clone https://github.com/dotycat/luci-app-netstat.git
+cd luci-app-netstat
+make
+```
+
+### Manual Installation
+
+1. Download the latest `.ipk` package from [Releases](../../releases)
+2. Upload to your router via SCP:
+   ```bash
+   scp luci-app-netstat_*.ipk root@:/tmp/
+   ```
+3. Install via SSH:
+   ```bash
+   ssh root@
+   opkg install /tmp/luci-app-netstat_*.ipk
+   ```
+4. Navigate to **LuCI Web Interface** → **Status** → **Network Statistics**
+
+## Configuration
+
+### UCI Configuration
+
+The application configuration is managed via UCI. Edit `/etc/config/netstats` to customize:
+
+```
+config netstat
+    option enabled '1'
+    option interface 'wan'
+    option update_interval '60'
+```
+
+### vnstat Integration
+
+Ensure vnstat is properly configured and running:
+
+```bash
+opkg install vnstat
+service vnstat start
+service vnstat enable
+```
+
+## Usage
+
+### Dashboard
+
+1. Log into your OpenWrt LuCI web interface
+2. Navigate to **Status** → **Network Statistics**
+3. View traffic statistics for your network interfaces
+
+### Available Data
+
+- **Current Usage** - Real-time traffic rates
+- **Daily Statistics** - Traffic breakdown by day
+- **Monthly Analysis** - Monthly usage overview
+
+## Dark / Light Theme Switching
+
+The NoobWRT theme stores the user's theme preference in **`localStorage`** under the key `luci-theme` (`'dark'` or `'light'`). When dark mode is active the theme also adds the class `dark-theme` to `document.body`.
+
+`tabs.htm` (rendered on every Netstat tab) reads this value at page load:
+
+```js
+var isDark = localStorage.getItem('luci-theme') === 'dark'
+          || document.body.classList.contains('dark-theme');
+```
+
+If dark mode is detected, a `
+
diff --git a/luci-app-netstat/files/usr/lib/lua/luci/view/netstat/tabs.htm b/luci-app-netstat/files/usr/lib/lua/luci/view/netstat/tabs.htm
new file mode 100644
index 000000000..a52888f58
--- /dev/null
+++ b/luci-app-netstat/files/usr/lib/lua/luci/view/netstat/tabs.htm
@@ -0,0 +1,126 @@
+<%
+local http       = require "luci.http"
+local dispatcher = require "luci.dispatcher"
+
+local active_tab = http.formvalue("tab") or "usage"
+local base_url   = dispatcher.build_url("admin", "tools", "netstat")
+
+local function tab_url(tab) return base_url .. "?tab=" .. tab end
+
+local tabs_def = {
+    { id="usage",    label=translate("Network Usage") },
+    { id="settings", label=translate("Settings")      },
+    { id="about",    label=translate("About")         },
+}
+
+%>
+
+
+
+
+
+
+

+    
+    

+

+
+
diff --git a/luci-app-netstat/files/usr/lib/lua/luci/view/netstat/usage.htm b/luci-app-netstat/files/usr/lib/lua/luci/view/netstat/usage.htm
new file mode 100644
index 000000000..2c59cfd85
--- /dev/null
+++ b/luci-app-netstat/files/usr/lib/lua/luci/view/netstat/usage.htm
@@ -0,0 +1,293 @@
+<%
+local sys  = require "luci.sys"
+local http = require "luci.http"
+local uci  = require "luci.model.uci".cursor()
+
+local function to_bytes(value, unit)
+    local m = { KiB=1024, MiB=1048576, GiB=1073741824, TiB=1099511627776 }
+    return tonumber(value) * (m[unit] or 1)
+end
+
+local function format_date(date_str)
+    local months = {"Jan","Feb","Mar","Apr","May","Jun",
+                    "Jul","Aug","Sep","Oct","Nov","Dec"}
+    local mo, d, y = date_str:match("(%d%d)/(%d%d)/(%d%d)")
+    if mo and d and y then
+        return string.format("%02d %s %02d", tonumber(d), months[tonumber(mo)], tonumber(y))
+    end
+    return date_str
+end
+
+local function today_label()    return os.date("%d %b %y") end
+local function curmonth_label() return os.date("%b '%y")   end
+
+local function ensure_today(stats)
+    local lbl = today_label()
+    for _, s in ipairs(stats) do if s.date == lbl then return stats end end
+    table.insert(stats, { date=lbl, rx=0, tx=0 })
+    return stats
+end
+
+local function ensure_curmonth(stats)
+    local lbl = curmonth_label()
+    for _, s in ipairs(stats) do if s.month == lbl then return stats end end
+    table.insert(stats, { month=lbl, rx=0, tx=0 })
+    return stats
+end
+
+local function get_interfaces()
+    local ifaces = {}
+    local p = io.popen("ls /etc/vnstat/ 2>/dev/null | grep -v '.conf$' | grep -v '.old$'")
+    if p then
+        for iface in p:lines() do
+            iface = iface:match("^%s*(.-)%s*$")
+            if iface ~= "" then table.insert(ifaces, iface) end
+        end
+        p:close()
+    end
+    table.sort(ifaces)
+    return ifaces
+end
+
+local function get_daily_stats(iface)
+    local stats = {}
+    local out = sys.exec("vnstat -i " .. iface .. " --days 2>/dev/null") or ""
+    for date, rx_v, rx_u, tx_v, tx_u in
+        out:gmatch("(%d%d/%d%d/%d%d)%s+([%d%.]+)%s+([KMGT]iB)%s+|%s+([%d%.]+)%s+([KMGT]iB)") do
+        table.insert(stats, {
+            date = format_date(date),
+            rx   = to_bytes(rx_v, rx_u),
+            tx   = to_bytes(tx_v, tx_u)
+        })
+    end
+    return ensure_today(stats)
+end
+
+local function get_monthly_stats(iface)
+    local stats = {}
+    local out = sys.exec("vnstat -i " .. iface .. " --months 2>/dev/null") or ""
+    for month, rx_v, rx_u, tx_v, tx_u in
+        out:gmatch("(%a+%s+'%d%d)%s+([%d%.]+)%s+([KMGT]iB)%s+|%s+([%d%.]+)%s+([KMGT]iB)") do
+        table.insert(stats, {
+            month = month,
+            rx    = to_bytes(rx_v, rx_u),
+            tx    = to_bytes(tx_v, tx_u)
+        })
+    end
+    return ensure_curmonth(stats)
+end
+
+local function fmt_bytes(v)
+    if     v >= 1099511627776 then return string.format("%.2f TB", v/1099511627776)
+    elseif v >= 1073741824    then return string.format("%.2f GB", v/1073741824)
+    elseif v >= 1048576       then return string.format("%.2f MB", v/1048576)
+    elseif v >= 1024          then return string.format("%.2f KB", v/1024)
+    end
+    return tostring(v) .. " B"
+end
+
+local ifaces      = get_interfaces()
+local saved_iface = uci:get("netstats", "@config[0]", "prefer") or ""
+local saved_mode  = uci:get("netstats", "@config[0]", "mode")   or "daily"
+local cur_iface   = http.formvalue("iface") or saved_iface or ifaces[1] or ""
+local view_mode   = http.formvalue("mode")  or saved_mode
+if view_mode ~= "daily" and view_mode ~= "monthly" then view_mode = "daily" end
+
+local stats, title = {}, ""
+if cur_iface ~= "" then
+    if view_mode == "monthly" then
+        stats = get_monthly_stats(cur_iface)
+        title = translate("Monthly")
+    else
+        stats = get_daily_stats(cur_iface)
+        title = translate("Daily")
+    end
+end
+
+local total_rx, total_tx = 0, 0
+for _, s in ipairs(stats) do
+    total_rx = total_rx + (s.rx or 0)
+    total_tx = total_tx + (s.tx or 0)
+end
+%>
+
+
+
+

+    

+        <%:Usage is displayed using the Interface and View Mode selected in the Settings tab.%>
+    

+
+<% if cur_iface ~= "" and #stats > 0 then %>
+
+    

+        

+            
+            <%:Download%>:
+            <%=fmt_bytes(total_rx)%>
+        

+        

+            
+            <%:Upload%>:
+            <%=fmt_bytes(total_tx)%>
+        

+        

+            <%:Total%>:
+            <%=fmt_bytes(total_rx + total_tx)%>
+        

+    

+
+    

+        

+            
<%=title%> <%:Usage%>

+            <%=cur_iface%>
+        

+        
+    

+
+    
+    
+    
+
+<% elseif #ifaces == 0 then %>
+    

+        📡
+        <%:No vnStat interfaces were found. Make sure vnStat has been initialized.%>
+    

+<% else %>
+    

+        📊
+        <%:No data available for%> <%=cur_iface%>
+        

+            <%:vnStat may still be collecting its first data. Try again in a few minutes.%>
+        

+    

+<% end %>
+

diff --git a/luci-app-netstat/files/usr/lib/lua/luci/view/vnstat.htm b/luci-app-netstat/files/usr/lib/lua/luci/view/vnstat.htm
new file mode 100644
index 000000000..77b126c18
--- /dev/null
+++ b/luci-app-netstat/files/usr/lib/lua/luci/view/vnstat.htm
@@ -0,0 +1,250 @@
+<%+header%>
+
+<%
+local sys  = require "luci.sys"
+local http = require "luci.http"
+local uci  = require "luci.model.uci".cursor()
+
+local function to_bytes(value, unit)
+    local multipliers = {
+        ["KiB"] = 1024,
+        ["MiB"] = 1024^2,
+        ["GiB"] = 1024^3,
+        ["TiB"] = 1024^4
+    }
+    return tonumber(value) * (multipliers[unit] or 1)
+end
+
+local function format_date(date_str)
+    local month_names = {"Jan", "Feb", "Mar", "Apr", "May", "Jun",
+                         "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"}
+    local m, d, y = date_str:match("(%d%d)/(%d%d)/(%d%d)")
+    if m and d and y then
+        return string.format("%02d %s %02d", tonumber(d), month_names[tonumber(m)], tonumber(y))
+    end
+    return date_str
+end
+
+local function get_interfaces()
+    local ifaces = {}
+    local p = io.popen("ls /etc/vnstat/ 2>/dev/null | grep -v '.conf$' | grep -v '.old$'")
+    if p then
+        for iface in p:lines() do
+            iface = iface:match("^%s*(.-)%s*$")
+            if iface ~= "" then table.insert(ifaces, iface) end
+        end
+        p:close()
+    end
+    table.sort(ifaces)
+    return ifaces
+end
+
+local function get_daily_stats(iface)
+    local stats = {}
+    local output = sys.exec("vnstat -i " .. iface .. " --days 2>/dev/null") or ""
+    for date, rx_val, rx_unit, tx_val, tx_unit in
+        output:gmatch("(%d%d/%d%d/%d%d)%s+([%d%.]+)%s+([KMGT]iB)%s+|%s+([%d%.]+)%s+([KMGT]iB)") do
+        table.insert(stats, {
+            date  = format_date(date),
+            rx    = to_bytes(rx_val, rx_unit),
+            tx    = to_bytes(tx_val, tx_unit)
+        })
+    end
+    return stats
+end
+
+local function get_monthly_stats(iface)
+    local stats = {}
+    local output = sys.exec("vnstat -i " .. iface .. " --months 2>/dev/null") or ""
+    for month, rx_val, rx_unit, tx_val, tx_unit in
+        output:gmatch("(%a+%s+'%d%d)%s+([%d%.]+)%s+([KMGT]iB)%s+|%s+([%d%.]+)%s+([KMGT]iB)") do
+        table.insert(stats, {
+            month = month,
+            rx    = to_bytes(rx_val, rx_unit),
+            tx    = to_bytes(tx_val, tx_unit)
+        })
+    end
+    return stats
+end
+
+local ifaces        = get_interfaces()
+local current_iface = http.formvalue("iface") or "wwan0_1"
+local view_mode     = http.formvalue("mode") or "daily"
+local stats, title  = {}, ""
+
+if current_iface ~= "" then
+    if view_mode == "daily" then
+        stats = get_daily_stats(current_iface)
+        title = "<%:Daily%>"
+    else
+        stats = get_monthly_stats(current_iface)
+        title = "<%:Monthly%>"
+    end
+end
+%>
+
+

+    
<%:Network Usage%>

+
+    

+        
+        

+            

+                
+                

+                    
+                

+            

+
+            

+                
+                

+                    
+                

+            

+        

+    

+
+    <% if current_iface ~= "" and #stats > 0 then %>
+        

+            
<%=title%> (<%=current_iface%>)

+            

+                
+            

+        

+
+        
+        
+        
+    <% else %>
+        

+            <%:No data available for %> <%=current_iface%>
+        

+    <% end %>
+

+
+<%+footer%>
diff --git a/luci-app-netstat/files/usr/share/luci/menu.d/luci-app-netstat.json b/luci-app-netstat/files/usr/share/luci/menu.d/luci-app-netstat.json
new file mode 100644
index 000000000..97869bcf9
--- /dev/null
+++ b/luci-app-netstat/files/usr/share/luci/menu.d/luci-app-netstat.json
@@ -0,0 +1,13 @@
+{
+  "admin/tools/netstat": {
+    "title": "Netstat",
+    "order": 20,
+    "action": {
+      "type": "cbi",
+      "path": "netstat/config"
+    },
+    "depends": {
+      "acl": [ "luci-app-netstat" ]
+    }
+  }
+}
diff --git a/luci-app-netstat/files/usr/share/rpcd/acl.d/luci-app-netstat.json b/luci-app-netstat/files/usr/share/rpcd/acl.d/luci-app-netstat.json
new file mode 100644
index 000000000..527756347
--- /dev/null
+++ b/luci-app-netstat/files/usr/share/rpcd/acl.d/luci-app-netstat.json
@@ -0,0 +1,11 @@
+{
+  "luci-app-netstat": {
+    "description": "Grant access to LuCI Netstat app",
+    "read": {
+      "uci": [ "netstats" ]
+    },
+    "write": {
+      "uci": [ "netstats" ]
+    }
+  }
+}
diff --git a/luci-app-netstat/files/www/luci-static/resources/netstat/chart.js b/luci-app-netstat/files/www/luci-static/resources/netstat/chart.js
new file mode 100644
index 000000000..7eec4e6d9
--- /dev/null
+++ b/luci-app-netstat/files/www/luci-static/resources/netstat/chart.js
@@ -0,0 +1,14 @@
+/*!
+ * Chart.js v4.5.0
+ * https://www.chartjs.org
+ * (c) 2025 Chart.js Contributors
+ * Released under the MIT License
+ */
+!function(t,e){"object"==typeof exports&&"undefined"!=typeof module?module.exports=e():"function"==typeof define&&define.amd?define(e):(t="undefined"!=typeof globalThis?globalThis:t||self).Chart=e()}(this,(function(){"use strict";var t=Object.freeze({__proto__:null,get Colors(){return Jo},get Decimation(){return ta},get Filler(){return ba},get Legend(){return Ma},get SubTitle(){return Pa},get Title(){return ka},get Tooltip(){return Na}});function e(){}const i=(()=>{let t=0;return()=>t++})();function s(t){return null==t}function n(t){if(Array.isArray&&Array.isArray(t))return!0;const e=Object.prototype.toString.call(t);return"[object"===e.slice(0,7)&&"Array]"===e.slice(-6)}function o(t){return null!==t&&"[object Object]"===Object.prototype.toString.call(t)}function a(t){return("number"==typeof t||t instanceof Number)&&isFinite(+t)}function r(t,e){return a(t)?t:e}function l(t,e){return void 0===t?e:t}const h=(t,e)=>"string"==typeof t&&t.endsWith("%")?parseFloat(t)/100:+t/e,c=(t,e)=>"string"==typeof t&&t.endsWith("%")?parseFloat(t)/100*e:+t;function d(t,e,i){if(t&&"function"==typeof t.call)return t.apply(i,e)}function u(t,e,i,s){let a,r,l;if(n(t))if(r=t.length,s)for(a=r-1;a>=0;a--)e.call(i,t[a],a);else for(a=0;at,x:t=>t.x,y:t=>t.y};function v(t){const e=t.split("."),i=[];let s="";for(const t of e)s+=t,s.endsWith("\\")?s=s.slice(0,-1)+".":(i.push(s),s="");return i}function M(t,e){const i=y[e]||(y[e]=function(t){const e=v(t);return t=>{for(const i of e){if(""===i)break;t=t&&t[i]}return t}}(e));return i(t)}function w(t){return t.charAt(0).toUpperCase()+t.slice(1)}const k=t=>void 0!==t,S=t=>"function"==typeof t,P=(t,e)=>{if(t.size!==e.size)return!1;for(const i of t)if(!e.has(i))return!1;return!0};function D(t){return"mouseup"===t.type||"click"===t.type||"contextmenu"===t.type}const C=Math.PI,O=2*C,A=O+C,T=Number.POSITIVE_INFINITY,L=C/180,E=C/2,R=C/4,I=2*C/3,z=Math.log10,F=Math.sign;function V(t,e,i){return Math.abs(t-e)t-e)).pop(),e}function N(t){return!function(t){return"symbol"==typeof t||"object"==typeof t&&null!==t&&!(Symbol.toPrimitive in t||"toString"in t||"valueOf"in t)}(t)&&!isNaN(parseFloat(t))&&isFinite(t)}function H(t,e){const i=Math.round(t);return i-e<=t&&i+e>=t}function j(t,e,i){let s,n,o;for(s=0,n=t.length;sl&&h=Math.min(e,i)-s&&t<=Math.max(e,i)+s}function et(t,e,i){i=i||(i=>t[i]1;)s=o+n>>1,i(s)?o=s:n=s;return{lo:o,hi:n}}const it=(t,e,i,s)=>et(t,i,s?s=>{const n=t[s][e];return nt[s][e]et(t,i,(s=>t[s][e]>=i));function nt(t,e,i){let s=0,n=t.length;for(;ss&&t[n-1]>i;)n--;return s>0||n{const i="_onData"+w(e),s=t[e];Object.defineProperty(t,e,{configurable:!0,enumerable:!1,value(...e){const n=s.apply(this,e);return t._chartjs.listeners.forEach((t=>{"function"==typeof t[i]&&t[i](...e)})),n}})})))}function rt(t,e){const i=t._chartjs;if(!i)return;const s=i.listeners,n=s.indexOf(e);-1!==n&&s.splice(n,1),s.length>0||(ot.forEach((e=>{delete t[e]})),delete t._chartjs)}function lt(t){const e=new Set(t);return e.size===t.length?t:Array.from(e)}const ht="undefined"==typeof window?function(t){return t()}:window.requestAnimationFrame;function ct(t,e){let i=[],s=!1;return function(...n){i=n,s||(s=!0,ht.call(window,(()=>{s=!1,t.apply(e,i)})))}}function dt(t,e){let i;return function(...s){return e?(clearTimeout(i),i=setTimeout(t,e,s)):t.apply(this,s),e}}const ut=t=>"start"===t?"left":"end"===t?"right":"center",ft=(t,e,i)=>"start"===t?e:"end"===t?i:(e+i)/2,gt=(t,e,i,s)=>t===(s?"left":"right")?i:"center"===t?(e+i)/2:e;function pt(t,e,i){const n=e.length;let o=0,a=n;if(t._sorted){const{iScale:r,vScale:l,_parsed:h}=t,c=t.dataset&&t.dataset.options?t.dataset.options.spanGaps:null,d=r.axis,{min:u,max:f,minDefined:g,maxDefined:p}=r.getUserBounds();if(g){if(o=Math.min(it(h,d,u).lo,i?n:it(e,d,r.getPixelForValue(u)).lo),c){const t=h.slice(0,o+1).reverse().findIndex((t=>!s(t[l.axis])));o-=Math.max(0,t)}o=Z(o,0,n-1)}if(p){let t=Math.max(it(h,r.axis,f,!0).hi+1,i?0:it(e,d,r.getPixelForValue(f),!0).hi+1);if(c){const e=h.slice(t-1).findIndex((t=>!s(t[l.axis])));t+=Math.max(0,e)}a=Z(t,o,n)-o}else a=n-o}return{start:o,count:a}}function mt(t){const{xScale:e,yScale:i,_scaleRanges:s}=t,n={xmin:e.min,xmax:e.max,ymin:i.min,ymax:i.max};if(!s)return t._scaleRanges=n,!0;const o=s.xmin!==e.min||s.xmax!==e.max||s.ymin!==i.min||s.ymax!==i.max;return Object.assign(s,n),o}class xt{constructor(){this._request=null,this._charts=new Map,this._running=!1,this._lastDate=void 0}_notify(t,e,i,s){const n=e.listeners[s],o=e.duration;n.forEach((s=>s({chart:t,initial:e.initial,numSteps:o,currentStep:Math.min(i-e.start,o)})))}_refresh(){this._request||(this._running=!0,this._request=ht.call(window,(()=>{this._update(),this._request=null,this._running&&this._refresh()})))}_update(t=Date.now()){let e=0;this._charts.forEach(((i,s)=>{if(!i.running||!i.items.length)return;const n=i.items;let o,a=n.length-1,r=!1;for(;a>=0;--a)o=n[a],o._active?(o._total>i.duration&&(i.duration=o._total),o.tick(t),r=!0):(n[a]=n[n.length-1],n.pop());r&&(s.draw(),this._notify(s,i,t,"progress")),n.length||(i.running=!1,this._notify(s,i,t,"complete"),i.initial=!1),e+=n.length})),this._lastDate=t,0===e&&(this._running=!1)}_getAnims(t){const e=this._charts;let i=e.get(t);return i||(i={running:!1,initial:!0,items:[],listeners:{complete:[],progress:[]}},e.set(t,i)),i}listen(t,e,i){this._getAnims(t).listeners[e].push(i)}add(t,e){e&&e.length&&this._getAnims(t).items.push(...e)}has(t){return this._getAnims(t).items.length>0}start(t){const e=this._charts.get(t);e&&(e.running=!0,e.start=Date.now(),e.duration=e.items.reduce(((t,e)=>Math.max(t,e._duration)),0),this._refresh())}running(t){if(!this._running)return!1;const e=this._charts.get(t);return!!(e&&e.running&&e.items.length)}stop(t){const e=this._charts.get(t);if(!e||!e.items.length)return;const i=e.items;let s=i.length-1;for(;s>=0;--s)i[s].cancel();e.items=[],this._notify(t,e,Date.now(),"complete")}remove(t){return this._charts.delete(t)}}var bt=new xt;
+/*!
+ * @kurkle/color v0.3.2
+ * https://github.com/kurkle/color#readme
+ * (c) 2023 Jukka Kurkela
+ * Released under the MIT License
+ */function _t(t){return t+.5|0}const yt=(t,e,i)=>Math.max(Math.min(t,i),e);function vt(t){return yt(_t(2.55*t),0,255)}function Mt(t){return yt(_t(255*t),0,255)}function wt(t){return yt(_t(t/2.55)/100,0,1)}function kt(t){return yt(_t(100*t),0,100)}const St={0:0,1:1,2:2,3:3,4:4,5:5,6:6,7:7,8:8,9:9,A:10,B:11,C:12,D:13,E:14,F:15,a:10,b:11,c:12,d:13,e:14,f:15},Pt=[..."0123456789ABCDEF"],Dt=t=>Pt[15&t],Ct=t=>Pt[(240&t)>>4]+Pt[15&t],Ot=t=>(240&t)>>4==(15&t);function At(t){var e=(t=>Ot(t.r)&&Ot(t.g)&&Ot(t.b)&&Ot(t.a))(t)?Dt:Ct;return t?"#"+e(t.r)+e(t.g)+e(t.b)+((t,e)=>t<255?e(t):"")(t.a,e):void 0}const Tt=/^(hsla?|hwb|hsv)\(\s*([-+.e\d]+)(?:deg)?[\s,]+([-+.e\d]+)%[\s,]+([-+.e\d]+)%(?:[\s,]+([-+.e\d]+)(%)?)?\s*\)$/;function Lt(t,e,i){const s=e*Math.min(i,1-i),n=(e,n=(e+t/30)%12)=>i-s*Math.max(Math.min(n-3,9-n,1),-1);return[n(0),n(8),n(4)]}function Et(t,e,i){const s=(s,n=(s+t/60)%6)=>i-i*e*Math.max(Math.min(n,4-n,1),0);return[s(5),s(3),s(1)]}function Rt(t,e,i){const s=Lt(t,1,.5);let n;for(e+i>1&&(n=1/(e+i),e*=n,i*=n),n=0;n<3;n++)s[n]*=1-e-i,s[n]+=e;return s}function It(t){const e=t.r/255,i=t.g/255,s=t.b/255,n=Math.max(e,i,s),o=Math.min(e,i,s),a=(n+o)/2;let r,l,h;return n!==o&&(h=n-o,l=a>.5?h/(2-n-o):h/(n+o),r=function(t,e,i,s,n){return t===n?(e-i)/s+(e>16&255,o>>8&255,255&o]}return t}(),Ht.transparent=[0,0,0,0]);const e=Ht[t.toLowerCase()];return e&&{r:e[0],g:e[1],b:e[2],a:4===e.length?e[3]:255}}const $t=/^rgba?\(\s*([-+.\d]+)(%)?[\s,]+([-+.e\d]+)(%)?[\s,]+([-+.e\d]+)(%)?(?:[\s,/]+([-+.e\d]+)(%)?)?\s*\)$/;const Yt=t=>t<=.0031308?12.92*t:1.055*Math.pow(t,1/2.4)-.055,Ut=t=>t<=.04045?t/12.92:Math.pow((t+.055)/1.055,2.4);function Xt(t,e,i){if(t){let s=It(t);s[e]=Math.max(0,Math.min(s[e]+s[e]*i,0===e?360:1)),s=Ft(s),t.r=s[0],t.g=s[1],t.b=s[2]}}function qt(t,e){return t?Object.assign(e||{},t):t}function Kt(t){var e={r:0,g:0,b:0,a:255};return Array.isArray(t)?t.length>=3&&(e={r:t[0],g:t[1],b:t[2],a:255},t.length>3&&(e.a=Mt(t[3]))):(e=qt(t,{r:0,g:0,b:0,a:1})).a=Mt(e.a),e}function Gt(t){return"r"===t.charAt(0)?function(t){const e=$t.exec(t);let i,s,n,o=255;if(e){if(e[7]!==i){const t=+e[7];o=e[8]?vt(t):yt(255*t,0,255)}return i=+e[1],s=+e[3],n=+e[5],i=255&(e[2]?vt(i):yt(i,0,255)),s=255&(e[4]?vt(s):yt(s,0,255)),n=255&(e[6]?vt(n):yt(n,0,255)),{r:i,g:s,b:n,a:o}}}(t):Bt(t)}class Jt{constructor(t){if(t instanceof Jt)return t;const e=typeof t;let i;var s,n,o;"object"===e?i=Kt(t):"string"===e&&(o=(s=t).length,"#"===s[0]&&(4===o||5===o?n={r:255&17*St[s[1]],g:255&17*St[s[2]],b:255&17*St[s[3]],a:5===o?17*St[s[4]]:255}:7!==o&&9!==o||(n={r:St[s[1]]<<4|St[s[2]],g:St[s[3]]<<4|St[s[4]],b:St[s[5]]<<4|St[s[6]],a:9===o?St[s[7]]<<4|St[s[8]]:255})),i=n||jt(t)||Gt(t)),this._rgb=i,this._valid=!!i}get valid(){return this._valid}get rgb(){var t=qt(this._rgb);return t&&(t.a=wt(t.a)),t}set rgb(t){this._rgb=Kt(t)}rgbString(){return this._valid?(t=this._rgb)&&(t.a<255?`rgba(${t.r}, ${t.g}, ${t.b}, ${wt(t.a)})`:`rgb(${t.r}, ${t.g}, ${t.b})`):void 0;var t}hexString(){return this._valid?At(this._rgb):void 0}hslString(){return this._valid?function(t){if(!t)return;const e=It(t),i=e[0],s=kt(e[1]),n=kt(e[2]);return t.a<255?`hsla(${i}, ${s}%, ${n}%, ${wt(t.a)})`:`hsl(${i}, ${s}%, ${n}%)`}(this._rgb):void 0}mix(t,e){if(t){const i=this.rgb,s=t.rgb;let n;const o=e===n?.5:e,a=2*o-1,r=i.a-s.a,l=((a*r==-1?a:(a+r)/(1+a*r))+1)/2;n=1-l,i.r=255&l*i.r+n*s.r+.5,i.g=255&l*i.g+n*s.g+.5,i.b=255&l*i.b+n*s.b+.5,i.a=o*i.a+(1-o)*s.a,this.rgb=i}return this}interpolate(t,e){return t&&(this._rgb=function(t,e,i){const s=Ut(wt(t.r)),n=Ut(wt(t.g)),o=Ut(wt(t.b));return{r:Mt(Yt(s+i*(Ut(wt(e.r))-s))),g:Mt(Yt(n+i*(Ut(wt(e.g))-n))),b:Mt(Yt(o+i*(Ut(wt(e.b))-o))),a:t.a+i*(e.a-t.a)}}(this._rgb,t._rgb,e)),this}clone(){return new Jt(this.rgb)}alpha(t){return this._rgb.a=Mt(t),this}clearer(t){return this._rgb.a*=1-t,this}greyscale(){const t=this._rgb,e=_t(.3*t.r+.59*t.g+.11*t.b);return t.r=t.g=t.b=e,this}opaquer(t){return this._rgb.a*=1+t,this}negate(){const t=this._rgb;return t.r=255-t.r,t.g=255-t.g,t.b=255-t.b,this}lighten(t){return Xt(this._rgb,2,t),this}darken(t){return Xt(this._rgb,2,-t),this}saturate(t){return Xt(this._rgb,1,t),this}desaturate(t){return Xt(this._rgb,1,-t),this}rotate(t){return function(t,e){var i=It(t);i[0]=Vt(i[0]+e),i=Ft(i),t.r=i[0],t.g=i[1],t.b=i[2]}(this._rgb,t),this}}function Zt(t){if(t&&"object"==typeof t){const e=t.toString();return"[object CanvasPattern]"===e||"[object CanvasGradient]"===e}return!1}function Qt(t){return Zt(t)?t:new Jt(t)}function te(t){return Zt(t)?t:new Jt(t).saturate(.5).darken(.1).hexString()}const ee=["x","y","borderWidth","radius","tension"],ie=["color","borderColor","backgroundColor"];const se=new Map;function ne(t,e,i){return function(t,e){e=e||{};const i=t+JSON.stringify(e);let s=se.get(i);return s||(s=new Intl.NumberFormat(t,e),se.set(i,s)),s}(e,i).format(t)}const oe={values:t=>n(t)?t:""+t,numeric(t,e,i){if(0===t)return"0";const s=this.chart.options.locale;let n,o=t;if(i.length>1){const e=Math.max(Math.abs(i[0].value),Math.abs(i[i.length-1].value));(e<1e-4||e>1e15)&&(n="scientific"),o=function(t,e){let i=e.length>3?e[2].value-e[1].value:e[1].value-e[0].value;Math.abs(i)>=1&&t!==Math.floor(t)&&(i=t-Math.floor(t));return i}(t,i)}const a=z(Math.abs(o)),r=isNaN(a)?1:Math.max(Math.min(-1*Math.floor(a),20),0),l={notation:n,minimumFractionDigits:r,maximumFractionDigits:r};return Object.assign(l,this.options.ticks.format),ne(t,s,l)},logarithmic(t,e,i){if(0===t)return"0";const s=i[e].significand||t/Math.pow(10,Math.floor(z(t)));return[1,2,3,5,10,15].includes(s)||e>.8*i.length?oe.numeric.call(this,t,e,i):""}};var ae={formatters:oe};const re=Object.create(null),le=Object.create(null);function he(t,e){if(!e)return t;const i=e.split(".");for(let e=0,s=i.length;et.chart.platform.getDevicePixelRatio(),this.elements={},this.events=["mousemove","mouseout","click","touchstart","touchmove"],this.font={family:"'Helvetica Neue', 'Helvetica', 'Arial', sans-serif",size:12,style:"normal",lineHeight:1.2,weight:null},this.hover={},this.hoverBackgroundColor=(t,e)=>te(e.backgroundColor),this.hoverBorderColor=(t,e)=>te(e.borderColor),this.hoverColor=(t,e)=>te(e.color),this.indexAxis="x",this.interaction={mode:"nearest",intersect:!0,includeInvisible:!1},this.maintainAspectRatio=!0,this.onHover=null,this.onClick=null,this.parsing=!0,this.plugins={},this.responsive=!0,this.scale=void 0,this.scales={},this.showLine=!0,this.drawActiveElementsOnTop=!0,this.describe(t),this.apply(e)}set(t,e){return ce(this,t,e)}get(t){return he(this,t)}describe(t,e){return ce(le,t,e)}override(t,e){return ce(re,t,e)}route(t,e,i,s){const n=he(this,t),a=he(this,i),r="_"+e;Object.defineProperties(n,{[r]:{value:n[e],writable:!0},[e]:{enumerable:!0,get(){const t=this[r],e=a[s];return o(t)?Object.assign({},e,t):l(t,e)},set(t){this[r]=t}}})}apply(t){t.forEach((t=>t(this)))}}var ue=new de({_scriptable:t=>!t.startsWith("on"),_indexable:t=>"events"!==t,hover:{_fallback:"interaction"},interaction:{_scriptable:!1,_indexable:!1}},[function(t){t.set("animation",{delay:void 0,duration:1e3,easing:"easeOutQuart",fn:void 0,from:void 0,loop:void 0,to:void 0,type:void 0}),t.describe("animation",{_fallback:!1,_indexable:!1,_scriptable:t=>"onProgress"!==t&&"onComplete"!==t&&"fn"!==t}),t.set("animations",{colors:{type:"color",properties:ie},numbers:{type:"number",properties:ee}}),t.describe("animations",{_fallback:"animation"}),t.set("transitions",{active:{animation:{duration:400}},resize:{animation:{duration:0}},show:{animations:{colors:{from:"transparent"},visible:{type:"boolean",duration:0}}},hide:{animations:{colors:{to:"transparent"},visible:{type:"boolean",easing:"linear",fn:t=>0|t}}}})},function(t){t.set("layout",{autoPadding:!0,padding:{top:0,right:0,bottom:0,left:0}})},function(t){t.set("scale",{display:!0,offset:!1,reverse:!1,beginAtZero:!1,bounds:"ticks",clip:!0,grace:0,grid:{display:!0,lineWidth:1,drawOnChartArea:!0,drawTicks:!0,tickLength:8,tickWidth:(t,e)=>e.lineWidth,tickColor:(t,e)=>e.color,offset:!1},border:{display:!0,dash:[],dashOffset:0,width:1},title:{display:!1,text:"",padding:{top:4,bottom:4}},ticks:{minRotation:0,maxRotation:50,mirror:!1,textStrokeWidth:0,textStrokeColor:"",padding:3,display:!0,autoSkip:!0,autoSkipPadding:3,labelOffset:0,callback:ae.formatters.values,minor:{},major:{},align:"center",crossAlign:"near",showLabelBackdrop:!1,backdropColor:"rgba(255, 255, 255, 0.75)",backdropPadding:2}}),t.route("scale.ticks","color","","color"),t.route("scale.grid","color","","borderColor"),t.route("scale.border","color","","borderColor"),t.route("scale.title","color","","color"),t.describe("scale",{_fallback:!1,_scriptable:t=>!t.startsWith("before")&&!t.startsWith("after")&&"callback"!==t&&"parser"!==t,_indexable:t=>"borderDash"!==t&&"tickBorderDash"!==t&&"dash"!==t}),t.describe("scales",{_fallback:"scale"}),t.describe("scale.ticks",{_scriptable:t=>"backdropPadding"!==t&&"callback"!==t,_indexable:t=>"backdropPadding"!==t})}]);function fe(){return"undefined"!=typeof window&&"undefined"!=typeof document}function ge(t){let e=t.parentNode;return e&&"[object ShadowRoot]"===e.toString()&&(e=e.host),e}function pe(t,e,i){let s;return"string"==typeof t?(s=parseInt(t,10),-1!==t.indexOf("%")&&(s=s/100*e.parentNode[i])):s=t,s}const me=t=>t.ownerDocument.defaultView.getComputedStyle(t,null);function xe(t,e){return me(t).getPropertyValue(e)}const be=["top","right","bottom","left"];function _e(t,e,i){const s={};i=i?"-"+i:"";for(let n=0;n<4;n++){const o=be[n];s[o]=parseFloat(t[e+"-"+o+i])||0}return s.width=s.left+s.right,s.height=s.top+s.bottom,s}const ye=(t,e,i)=>(t>0||e>0)&&(!i||!i.shadowRoot);function ve(t,e){if("native"in t)return t;const{canvas:i,currentDevicePixelRatio:s}=e,n=me(i),o="border-box"===n.boxSizing,a=_e(n,"padding"),r=_e(n,"border","width"),{x:l,y:h,box:c}=function(t,e){const i=t.touches,s=i&&i.length?i[0]:t,{offsetX:n,offsetY:o}=s;let a,r,l=!1;if(ye(n,o,t.target))a=n,r=o;else{const t=e.getBoundingClientRect();a=s.clientX-t.left,r=s.clientY-t.top,l=!0}return{x:a,y:r,box:l}}(t,i),d=a.left+(c&&r.left),u=a.top+(c&&r.top);let{width:f,height:g}=e;return o&&(f-=a.width+r.width,g-=a.height+r.height),{x:Math.round((l-d)/f*i.width/s),y:Math.round((h-u)/g*i.height/s)}}const Me=t=>Math.round(10*t)/10;function we(t,e,i,s){const n=me(t),o=_e(n,"margin"),a=pe(n.maxWidth,t,"clientWidth")||T,r=pe(n.maxHeight,t,"clientHeight")||T,l=function(t,e,i){let s,n;if(void 0===e||void 0===i){const o=t&&ge(t);if(o){const t=o.getBoundingClientRect(),a=me(o),r=_e(a,"border","width"),l=_e(a,"padding");e=t.width-l.width-r.width,i=t.height-l.height-r.height,s=pe(a.maxWidth,o,"clientWidth"),n=pe(a.maxHeight,o,"clientHeight")}else e=t.clientWidth,i=t.clientHeight}return{width:e,height:i,maxWidth:s||T,maxHeight:n||T}}(t,e,i);let{width:h,height:c}=l;if("content-box"===n.boxSizing){const t=_e(n,"border","width"),e=_e(n,"padding");h-=e.width+t.width,c-=e.height+t.height}h=Math.max(0,h-o.width),c=Math.max(0,s?h/s:c-o.height),h=Me(Math.min(h,a,l.maxWidth)),c=Me(Math.min(c,r,l.maxHeight)),h&&!c&&(c=Me(h/2));return(void 0!==e||void 0!==i)&&s&&l.height&&c>l.height&&(c=l.height,h=Me(Math.floor(c*s))),{width:h,height:c}}function ke(t,e,i){const s=e||1,n=Math.floor(t.height*s),o=Math.floor(t.width*s);t.height=Math.floor(t.height),t.width=Math.floor(t.width);const a=t.canvas;return a.style&&(i||!a.style.height&&!a.style.width)&&(a.style.height=`${t.height}px`,a.style.width=`${t.width}px`),(t.currentDevicePixelRatio!==s||a.height!==n||a.width!==o)&&(t.currentDevicePixelRatio=s,a.height=n,a.width=o,t.ctx.setTransform(s,0,0,s,0,0),!0)}const Se=function(){let t=!1;try{const e={get passive(){return t=!0,!1}};fe()&&(window.addEventListener("test",null,e),window.removeEventListener("test",null,e))}catch(t){}return t}();function Pe(t,e){const i=xe(t,e),s=i&&i.match(/^(\d+)(\.\d+)?px$/);return s?+s[1]:void 0}function De(t){return!t||s(t.size)||s(t.family)?null:(t.style?t.style+" ":"")+(t.weight?t.weight+" ":"")+t.size+"px "+t.family}function Ce(t,e,i,s,n){let o=e[n];return o||(o=e[n]=t.measureText(n).width,i.push(n)),o>s&&(s=o),s}function Oe(t,e,i,s){let o=(s=s||{}).data=s.data||{},a=s.garbageCollect=s.garbageCollect||[];s.font!==e&&(o=s.data={},a=s.garbageCollect=[],s.font=e),t.save(),t.font=e;let r=0;const l=i.length;let h,c,d,u,f;for(h=0;hi.length){for(h=0;h0&&t.stroke()}}function Re(t,e,i){return i=i||.5,!e||t&&t.x>e.left-i&&t.xe.top-i&&t.y0&&""!==r.strokeColor;let c,d;for(t.save(),t.font=a.string,function(t,e){e.translation&&t.translate(e.translation[0],e.translation[1]),s(e.rotation)||t.rotate(e.rotation),e.color&&(t.fillStyle=e.color),e.textAlign&&(t.textAlign=e.textAlign),e.textBaseline&&(t.textBaseline=e.textBaseline)}(t,r),c=0;ct[0])){const o=i||t;void 0===s&&(s=ti("_fallback",t));const a={[Symbol.toStringTag]:"Object",_cacheable:!0,_scopes:t,_rootScopes:o,_fallback:s,_getTarget:n,override:i=>je([i,...t],e,o,s)};return new Proxy(a,{deleteProperty:(e,i)=>(delete e[i],delete e._keys,delete t[0][i],!0),get:(i,s)=>qe(i,s,(()=>function(t,e,i,s){let n;for(const o of e)if(n=ti(Ue(o,t),i),void 0!==n)return Xe(t,n)?Ze(i,s,t,n):n}(s,e,t,i))),getOwnPropertyDescriptor:(t,e)=>Reflect.getOwnPropertyDescriptor(t._scopes[0],e),getPrototypeOf:()=>Reflect.getPrototypeOf(t[0]),has:(t,e)=>ei(t).includes(e),ownKeys:t=>ei(t),set(t,e,i){const s=t._storage||(t._storage=n());return t[e]=s[e]=i,delete t._keys,!0}})}function $e(t,e,i,s){const a={_cacheable:!1,_proxy:t,_context:e,_subProxy:i,_stack:new Set,_descriptors:Ye(t,s),setContext:e=>$e(t,e,i,s),override:n=>$e(t.override(n),e,i,s)};return new Proxy(a,{deleteProperty:(e,i)=>(delete e[i],delete t[i],!0),get:(t,e,i)=>qe(t,e,(()=>function(t,e,i){const{_proxy:s,_context:a,_subProxy:r,_descriptors:l}=t;let h=s[e];S(h)&&l.isScriptable(e)&&(h=function(t,e,i,s){const{_proxy:n,_context:o,_subProxy:a,_stack:r}=i;if(r.has(t))throw new Error("Recursion detected: "+Array.from(r).join("->")+"->"+t);r.add(t);let l=e(o,a||s);r.delete(t),Xe(t,l)&&(l=Ze(n._scopes,n,t,l));return l}(e,h,t,i));n(h)&&h.length&&(h=function(t,e,i,s){const{_proxy:n,_context:a,_subProxy:r,_descriptors:l}=i;if(void 0!==a.index&&s(t))return e[a.index%e.length];if(o(e[0])){const i=e,s=n._scopes.filter((t=>t!==i));e=[];for(const o of i){const i=Ze(s,n,t,o);e.push($e(i,a,r&&r[t],l))}}return e}(e,h,t,l.isIndexable));Xe(e,h)&&(h=$e(h,a,r&&r[e],l));return h}(t,e,i))),getOwnPropertyDescriptor:(e,i)=>e._descriptors.allKeys?Reflect.has(t,i)?{enumerable:!0,configurable:!0}:void 0:Reflect.getOwnPropertyDescriptor(t,i),getPrototypeOf:()=>Reflect.getPrototypeOf(t),has:(e,i)=>Reflect.has(t,i),ownKeys:()=>Reflect.ownKeys(t),set:(e,i,s)=>(t[i]=s,delete e[i],!0)})}function Ye(t,e={scriptable:!0,indexable:!0}){const{_scriptable:i=e.scriptable,_indexable:s=e.indexable,_allKeys:n=e.allKeys}=t;return{allKeys:n,scriptable:i,indexable:s,isScriptable:S(i)?i:()=>i,isIndexable:S(s)?s:()=>s}}const Ue=(t,e)=>t?t+w(e):e,Xe=(t,e)=>o(e)&&"adapters"!==t&&(null===Object.getPrototypeOf(e)||e.constructor===Object);function qe(t,e,i){if(Object.prototype.hasOwnProperty.call(t,e)||"constructor"===e)return t[e];const s=i();return t[e]=s,s}function Ke(t,e,i){return S(t)?t(e,i):t}const Ge=(t,e)=>!0===t?e:"string"==typeof t?M(e,t):void 0;function Je(t,e,i,s,n){for(const o of e){const e=Ge(i,o);if(e){t.add(e);const o=Ke(e._fallback,i,n);if(void 0!==o&&o!==i&&o!==s)return o}else if(!1===e&&void 0!==s&&i!==s)return null}return!1}function Ze(t,e,i,s){const a=e._rootScopes,r=Ke(e._fallback,i,s),l=[...t,...a],h=new Set;h.add(s);let c=Qe(h,l,i,r||i,s);return null!==c&&((void 0===r||r===i||(c=Qe(h,l,r,c,s),null!==c))&&je(Array.from(h),[""],a,r,(()=>function(t,e,i){const s=t._getTarget();e in s||(s[e]={});const a=s[e];if(n(a)&&o(i))return i;return a||{}}(e,i,s))))}function Qe(t,e,i,s,n){for(;i;)i=Je(t,e,i,s,n);return i}function ti(t,e){for(const i of e){if(!i)continue;const e=i[t];if(void 0!==e)return e}}function ei(t){let e=t._keys;return e||(e=t._keys=function(t){const e=new Set;for(const i of t)for(const t of Object.keys(i).filter((t=>!t.startsWith("_"))))e.add(t);return Array.from(e)}(t._scopes)),e}function ii(t,e,i,s){const{iScale:n}=t,{key:o="r"}=this._parsing,a=new Array(s);let r,l,h,c;for(r=0,l=s;re"x"===t?"y":"x";function ai(t,e,i,s){const n=t.skip?e:t,o=e,a=i.skip?e:i,r=q(o,n),l=q(a,o);let h=r/(r+l),c=l/(r+l);h=isNaN(h)?0:h,c=isNaN(c)?0:c;const d=s*h,u=s*c;return{previous:{x:o.x-d*(a.x-n.x),y:o.y-d*(a.y-n.y)},next:{x:o.x+u*(a.x-n.x),y:o.y+u*(a.y-n.y)}}}function ri(t,e="x"){const i=oi(e),s=t.length,n=Array(s).fill(0),o=Array(s);let a,r,l,h=ni(t,0);for(a=0;a!t.skip))),"monotone"===e.cubicInterpolationMode)ri(t,n);else{let i=s?t[t.length-1]:t[0];for(o=0,a=t.length;o0===t||1===t,di=(t,e,i)=>-Math.pow(2,10*(t-=1))*Math.sin((t-e)*O/i),ui=(t,e,i)=>Math.pow(2,-10*t)*Math.sin((t-e)*O/i)+1,fi={linear:t=>t,easeInQuad:t=>t*t,easeOutQuad:t=>-t*(t-2),easeInOutQuad:t=>(t/=.5)<1?.5*t*t:-.5*(--t*(t-2)-1),easeInCubic:t=>t*t*t,easeOutCubic:t=>(t-=1)*t*t+1,easeInOutCubic:t=>(t/=.5)<1?.5*t*t*t:.5*((t-=2)*t*t+2),easeInQuart:t=>t*t*t*t,easeOutQuart:t=>-((t-=1)*t*t*t-1),easeInOutQuart:t=>(t/=.5)<1?.5*t*t*t*t:-.5*((t-=2)*t*t*t-2),easeInQuint:t=>t*t*t*t*t,easeOutQuint:t=>(t-=1)*t*t*t*t+1,easeInOutQuint:t=>(t/=.5)<1?.5*t*t*t*t*t:.5*((t-=2)*t*t*t*t+2),easeInSine:t=>1-Math.cos(t*E),easeOutSine:t=>Math.sin(t*E),easeInOutSine:t=>-.5*(Math.cos(C*t)-1),easeInExpo:t=>0===t?0:Math.pow(2,10*(t-1)),easeOutExpo:t=>1===t?1:1-Math.pow(2,-10*t),easeInOutExpo:t=>ci(t)?t:t<.5?.5*Math.pow(2,10*(2*t-1)):.5*(2-Math.pow(2,-10*(2*t-1))),easeInCirc:t=>t>=1?t:-(Math.sqrt(1-t*t)-1),easeOutCirc:t=>Math.sqrt(1-(t-=1)*t),easeInOutCirc:t=>(t/=.5)<1?-.5*(Math.sqrt(1-t*t)-1):.5*(Math.sqrt(1-(t-=2)*t)+1),easeInElastic:t=>ci(t)?t:di(t,.075,.3),easeOutElastic:t=>ci(t)?t:ui(t,.075,.3),easeInOutElastic(t){const e=.1125;return ci(t)?t:t<.5?.5*di(2*t,e,.45):.5+.5*ui(2*t-1,e,.45)},easeInBack(t){const e=1.70158;return t*t*((e+1)*t-e)},easeOutBack(t){const e=1.70158;return(t-=1)*t*((e+1)*t+e)+1},easeInOutBack(t){let e=1.70158;return(t/=.5)<1?t*t*((1+(e*=1.525))*t-e)*.5:.5*((t-=2)*t*((1+(e*=1.525))*t+e)+2)},easeInBounce:t=>1-fi.easeOutBounce(1-t),easeOutBounce(t){const e=7.5625,i=2.75;return t<1/i?e*t*t:t<2/i?e*(t-=1.5/i)*t+.75:t<2.5/i?e*(t-=2.25/i)*t+.9375:e*(t-=2.625/i)*t+.984375},easeInOutBounce:t=>t<.5?.5*fi.easeInBounce(2*t):.5*fi.easeOutBounce(2*t-1)+.5};function gi(t,e,i,s){return{x:t.x+i*(e.x-t.x),y:t.y+i*(e.y-t.y)}}function pi(t,e,i,s){return{x:t.x+i*(e.x-t.x),y:"middle"===s?i<.5?t.y:e.y:"after"===s?i<1?t.y:e.y:i>0?e.y:t.y}}function mi(t,e,i,s){const n={x:t.cp2x,y:t.cp2y},o={x:e.cp1x,y:e.cp1y},a=gi(t,n,i),r=gi(n,o,i),l=gi(o,e,i),h=gi(a,r,i),c=gi(r,l,i);return gi(h,c,i)}const xi=/^(normal|(\d+(?:\.\d+)?)(px|em|%)?)$/,bi=/^(normal|italic|initial|inherit|unset|(oblique( -?[0-9]?[0-9]deg)?))$/;function _i(t,e){const i=(""+t).match(xi);if(!i||"normal"===i[1])return 1.2*e;switch(t=+i[2],i[3]){case"px":return t;case"%":t/=100}return e*t}const yi=t=>+t||0;function vi(t,e){const i={},s=o(e),n=s?Object.keys(e):e,a=o(t)?s?i=>l(t[i],t[e[i]]):e=>t[e]:()=>t;for(const t of n)i[t]=yi(a(t));return i}function Mi(t){return vi(t,{top:"y",right:"x",bottom:"y",left:"x"})}function wi(t){return vi(t,["topLeft","topRight","bottomLeft","bottomRight"])}function ki(t){const e=Mi(t);return e.width=e.left+e.right,e.height=e.top+e.bottom,e}function Si(t,e){t=t||{},e=e||ue.font;let i=l(t.size,e.size);"string"==typeof i&&(i=parseInt(i,10));let s=l(t.style,e.style);s&&!(""+s).match(bi)&&(console.warn('Invalid font style specified: "'+s+'"'),s=void 0);const n={family:l(t.family,e.family),lineHeight:_i(l(t.lineHeight,e.lineHeight),i),size:i,style:s,weight:l(t.weight,e.weight),string:""};return n.string=De(n),n}function Pi(t,e,i,s){let o,a,r,l=!0;for(o=0,a=t.length;oi&&0===t?0:t+e;return{min:a(s,-Math.abs(o)),max:a(n,o)}}function Ci(t,e){return Object.assign(Object.create(t),e)}function Oi(t,e,i){return t?function(t,e){return{x:i=>t+t+e-i,setWidth(t){e=t},textAlign:t=>"center"===t?t:"right"===t?"left":"right",xPlus:(t,e)=>t-e,leftForLtr:(t,e)=>t-e}}(e,i):{x:t=>t,setWidth(t){},textAlign:t=>t,xPlus:(t,e)=>t+e,leftForLtr:(t,e)=>t}}function Ai(t,e){let i,s;"ltr"!==e&&"rtl"!==e||(i=t.canvas.style,s=[i.getPropertyValue("direction"),i.getPropertyPriority("direction")],i.setProperty("direction",e,"important"),t.prevTextDirection=s)}function Ti(t,e){void 0!==e&&(delete t.prevTextDirection,t.canvas.style.setProperty("direction",e[0],e[1]))}function Li(t){return"angle"===t?{between:J,compare:K,normalize:G}:{between:tt,compare:(t,e)=>t-e,normalize:t=>t}}function Ei({start:t,end:e,count:i,loop:s,style:n}){return{start:t%i,end:e%i,loop:s&&(e-t+1)%i==0,style:n}}function Ri(t,e,i){if(!i)return[t];const{property:s,start:n,end:o}=i,a=e.length,{compare:r,between:l,normalize:h}=Li(s),{start:c,end:d,loop:u,style:f}=function(t,e,i){const{property:s,start:n,end:o}=i,{between:a,normalize:r}=Li(s),l=e.length;let h,c,{start:d,end:u,loop:f}=t;if(f){for(d+=l,u+=l,h=0,c=l;hb||l(n,x,p)&&0!==r(n,x),v=()=>!b||0===r(o,p)||l(o,x,p);for(let t=c,i=c;t<=d;++t)m=e[t%a],m.skip||(p=h(m[s]),p!==x&&(b=l(p,n,o),null===_&&y()&&(_=0===r(p,n)?t:i),null!==_&&v()&&(g.push(Ei({start:_,end:t,loop:u,count:a,style:f})),_=null),i=t,x=p));return null!==_&&g.push(Ei({start:_,end:d,loop:u,count:a,style:f})),g}function Ii(t,e){const i=[],s=t.segments;for(let n=0;nn&&t[o%e].skip;)o--;return o%=e,{start:n,end:o}}(i,n,o,s);if(!0===s)return Fi(t,[{start:a,end:r,loop:o}],i,e);return Fi(t,function(t,e,i,s){const n=t.length,o=[];let a,r=e,l=t[e];for(a=e+1;a<=i;++a){const i=t[a%n];i.skip||i.stop?l.skip||(s=!1,o.push({start:e%n,end:(a-1)%n,loop:s}),e=r=i.stop?a:null):(r=a,l.skip&&(e=a)),l=i}return null!==r&&o.push({start:e%n,end:r%n,loop:s}),o}(i,a,r!s(t[e.axis])));n.lo-=Math.max(0,a);const r=i.slice(n.hi).findIndex((t=>!s(t[e.axis])));n.hi+=Math.max(0,r)}return n}if(o._sharedOptions){const t=a[0],s="function"==typeof t.getRange&&t.getRange(e);if(s){const t=r(a,e,i-s),n=r(a,e,i+s);return{lo:t.lo,hi:n.hi}}}}return{lo:0,hi:a.length-1}}function $i(t,e,i,s,n){const o=t.getSortedVisibleDatasetMetas(),a=i[e];for(let t=0,i=o.length;t{t[a]&&t[a](e[i],n)&&(o.push({element:t,datasetIndex:s,index:l}),r=r||t.inRange(e.x,e.y,n))})),s&&!r?[]:o}var Ki={evaluateInteractionItems:$i,modes:{index(t,e,i,s){const n=ve(e,t),o=i.axis||"x",a=i.includeInvisible||!1,r=i.intersect?Yi(t,n,o,s,a):Xi(t,n,o,!1,s,a),l=[];return r.length?(t.getSortedVisibleDatasetMetas().forEach((t=>{const e=r[0].index,i=t.data[e];i&&!i.skip&&l.push({element:i,datasetIndex:t.index,index:e})})),l):[]},dataset(t,e,i,s){const n=ve(e,t),o=i.axis||"xy",a=i.includeInvisible||!1;let r=i.intersect?Yi(t,n,o,s,a):Xi(t,n,o,!1,s,a);if(r.length>0){const e=r[0].datasetIndex,i=t.getDatasetMeta(e).data;r=[];for(let t=0;tYi(t,ve(e,t),i.axis||"xy",s,i.includeInvisible||!1),nearest(t,e,i,s){const n=ve(e,t),o=i.axis||"xy",a=i.includeInvisible||!1;return Xi(t,n,o,i.intersect,s,a)},x:(t,e,i,s)=>qi(t,ve(e,t),"x",i.intersect,s),y:(t,e,i,s)=>qi(t,ve(e,t),"y",i.intersect,s)}};const Gi=["left","top","right","bottom"];function Ji(t,e){return t.filter((t=>t.pos===e))}function Zi(t,e){return t.filter((t=>-1===Gi.indexOf(t.pos)&&t.box.axis===e))}function Qi(t,e){return t.sort(((t,i)=>{const s=e?i:t,n=e?t:i;return s.weight===n.weight?s.index-n.index:s.weight-n.weight}))}function ts(t,e){const i=function(t){const e={};for(const i of t){const{stack:t,pos:s,stackWeight:n}=i;if(!t||!Gi.includes(s))continue;const o=e[t]||(e[t]={count:0,placed:0,weight:0,size:0});o.count++,o.weight+=n}return e}(t),{vBoxMaxWidth:s,hBoxMaxHeight:n}=e;let o,a,r;for(o=0,a=t.length;o{s[t]=Math.max(e[t],i[t])})),s}return s(t?["left","right"]:["top","bottom"])}function os(t,e,i,s){const n=[];let o,a,r,l,h,c;for(o=0,a=t.length,h=0;ot.box.fullSize)),!0),s=Qi(Ji(e,"left"),!0),n=Qi(Ji(e,"right")),o=Qi(Ji(e,"top"),!0),a=Qi(Ji(e,"bottom")),r=Zi(e,"x"),l=Zi(e,"y");return{fullSize:i,leftAndTop:s.concat(o),rightAndBottom:n.concat(l).concat(a).concat(r),chartArea:Ji(e,"chartArea"),vertical:s.concat(n).concat(l),horizontal:o.concat(a).concat(r)}}(t.boxes),l=r.vertical,h=r.horizontal;u(t.boxes,(t=>{"function"==typeof t.beforeLayout&&t.beforeLayout()}));const c=l.reduce(((t,e)=>e.box.options&&!1===e.box.options.display?t:t+1),0)||1,d=Object.freeze({outerWidth:e,outerHeight:i,padding:n,availableWidth:o,availableHeight:a,vBoxMaxWidth:o/2/c,hBoxMaxHeight:a/2}),f=Object.assign({},n);is(f,ki(s));const g=Object.assign({maxPadding:f,w:o,h:a,x:n.left,y:n.top},n),p=ts(l.concat(h),d);os(r.fullSize,g,d,p),os(l,g,d,p),os(h,g,d,p)&&os(l,g,d,p),function(t){const e=t.maxPadding;function i(i){const s=Math.max(e[i]-t[i],0);return t[i]+=s,s}t.y+=i("top"),t.x+=i("left"),i("right"),i("bottom")}(g),rs(r.leftAndTop,g,d,p),g.x+=g.w,g.y+=g.h,rs(r.rightAndBottom,g,d,p),t.chartArea={left:g.left,top:g.top,right:g.left+g.w,bottom:g.top+g.h,height:g.h,width:g.w},u(r.chartArea,(e=>{const i=e.box;Object.assign(i,t.chartArea),i.update(g.w,g.h,{left:0,top:0,right:0,bottom:0})}))}};class hs{acquireContext(t,e){}releaseContext(t){return!1}addEventListener(t,e,i){}removeEventListener(t,e,i){}getDevicePixelRatio(){return 1}getMaximumSize(t,e,i,s){return e=Math.max(0,e||t.width),i=i||t.height,{width:e,height:Math.max(0,s?Math.floor(e/s):i)}}isAttached(t){return!0}updateConfig(t){}}class cs extends hs{acquireContext(t){return t&&t.getContext&&t.getContext("2d")||null}updateConfig(t){t.options.animation=!1}}const ds="$chartjs",us={touchstart:"mousedown",touchmove:"mousemove",touchend:"mouseup",pointerenter:"mouseenter",pointerdown:"mousedown",pointermove:"mousemove",pointerup:"mouseup",pointerleave:"mouseout",pointerout:"mouseout"},fs=t=>null===t||""===t;const gs=!!Se&&{passive:!0};function ps(t,e,i){t&&t.canvas&&t.canvas.removeEventListener(e,i,gs)}function ms(t,e){for(const i of t)if(i===e||i.contains(e))return!0}function xs(t,e,i){const s=t.canvas,n=new MutationObserver((t=>{let e=!1;for(const i of t)e=e||ms(i.addedNodes,s),e=e&&!ms(i.removedNodes,s);e&&i()}));return n.observe(document,{childList:!0,subtree:!0}),n}function bs(t,e,i){const s=t.canvas,n=new MutationObserver((t=>{let e=!1;for(const i of t)e=e||ms(i.removedNodes,s),e=e&&!ms(i.addedNodes,s);e&&i()}));return n.observe(document,{childList:!0,subtree:!0}),n}const _s=new Map;let ys=0;function vs(){const t=window.devicePixelRatio;t!==ys&&(ys=t,_s.forEach(((e,i)=>{i.currentDevicePixelRatio!==t&&e()})))}function Ms(t,e,i){const s=t.canvas,n=s&&ge(s);if(!n)return;const o=ct(((t,e)=>{const s=n.clientWidth;i(t,e),s{const e=t[0],i=e.contentRect.width,s=e.contentRect.height;0===i&&0===s||o(i,s)}));return a.observe(n),function(t,e){_s.size||window.addEventListener("resize",vs),_s.set(t,e)}(t,o),a}function ws(t,e,i){i&&i.disconnect(),"resize"===e&&function(t){_s.delete(t),_s.size||window.removeEventListener("resize",vs)}(t)}function ks(t,e,i){const s=t.canvas,n=ct((e=>{null!==t.ctx&&i(function(t,e){const i=us[t.type]||t.type,{x:s,y:n}=ve(t,e);return{type:i,chart:e,native:t,x:void 0!==s?s:null,y:void 0!==n?n:null}}(e,t))}),t);return function(t,e,i){t&&t.addEventListener(e,i,gs)}(s,e,n),n}class Ss extends hs{acquireContext(t,e){const i=t&&t.getContext&&t.getContext("2d");return i&&i.canvas===t?(function(t,e){const i=t.style,s=t.getAttribute("height"),n=t.getAttribute("width");if(t[ds]={initial:{height:s,width:n,style:{display:i.display,height:i.height,width:i.width}}},i.display=i.display||"block",i.boxSizing=i.boxSizing||"border-box",fs(n)){const e=Pe(t,"width");void 0!==e&&(t.width=e)}if(fs(s))if(""===t.style.height)t.height=t.width/(e||2);else{const e=Pe(t,"height");void 0!==e&&(t.height=e)}}(t,e),i):null}releaseContext(t){const e=t.canvas;if(!e[ds])return!1;const i=e[ds].initial;["height","width"].forEach((t=>{const n=i[t];s(n)?e.removeAttribute(t):e.setAttribute(t,n)}));const n=i.style||{};return Object.keys(n).forEach((t=>{e.style[t]=n[t]})),e.width=e.width,delete e[ds],!0}addEventListener(t,e,i){this.removeEventListener(t,e);const s=t.$proxies||(t.$proxies={}),n={attach:xs,detach:bs,resize:Ms}[e]||ks;s[e]=n(t,e,i)}removeEventListener(t,e){const i=t.$proxies||(t.$proxies={}),s=i[e];if(!s)return;({attach:ws,detach:ws,resize:ws}[e]||ps)(t,e,s),i[e]=void 0}getDevicePixelRatio(){return window.devicePixelRatio}getMaximumSize(t,e,i,s){return we(t,e,i,s)}isAttached(t){const e=t&&ge(t);return!(!e||!e.isConnected)}}function Ps(t){return!fe()||"undefined"!=typeof OffscreenCanvas&&t instanceof OffscreenCanvas?cs:Ss}var Ds=Object.freeze({__proto__:null,BasePlatform:hs,BasicPlatform:cs,DomPlatform:Ss,_detectPlatform:Ps});const Cs="transparent",Os={boolean:(t,e,i)=>i>.5?e:t,color(t,e,i){const s=Qt(t||Cs),n=s.valid&&Qt(e||Cs);return n&&n.valid?n.mix(s,i).hexString():e},number:(t,e,i)=>t+(e-t)*i};class As{constructor(t,e,i,s){const n=e[i];s=Pi([t.to,s,n,t.from]);const o=Pi([t.from,n,s]);this._active=!0,this._fn=t.fn||Os[t.type||typeof o],this._easing=fi[t.easing]||fi.linear,this._start=Math.floor(Date.now()+(t.delay||0)),this._duration=this._total=Math.floor(t.duration),this._loop=!!t.loop,this._target=e,this._prop=i,this._from=o,this._to=s,this._promises=void 0}active(){return this._active}update(t,e,i){if(this._active){this._notify(!1);const s=this._target[this._prop],n=i-this._start,o=this._duration-n;this._start=i,this._duration=Math.floor(Math.max(o,t.duration)),this._total+=n,this._loop=!!t.loop,this._to=Pi([t.to,e,s,t.from]),this._from=Pi([t.from,s,e])}}cancel(){this._active&&(this.tick(Date.now()),this._active=!1,this._notify(!1))}tick(t){const e=t-this._start,i=this._duration,s=this._prop,n=this._from,o=this._loop,a=this._to;let r;if(this._active=n!==a&&(o||e1?2-r:r,r=this._easing(Math.min(1,Math.max(0,r))),this._target[s]=this._fn(n,a,r))}wait(){const t=this._promises||(this._promises=[]);return new Promise(((e,i)=>{t.push({res:e,rej:i})}))}_notify(t){const e=t?"res":"rej",i=this._promises||[];for(let t=0;t{const a=t[s];if(!o(a))return;const r={};for(const t of e)r[t]=a[t];(n(a.properties)&&a.properties||[s]).forEach((t=>{t!==s&&i.has(t)||i.set(t,r)}))}))}_animateOptions(t,e){const i=e.options,s=function(t,e){if(!e)return;let i=t.options;if(!i)return void(t.options=e);i.$shared&&(t.options=i=Object.assign({},i,{$shared:!1,$animations:{}}));return i}(t,i);if(!s)return[];const n=this._createAnimations(s,i);return i.$shared&&function(t,e){const i=[],s=Object.keys(e);for(let e=0;e{t.options=i}),(()=>{})),n}_createAnimations(t,e){const i=this._properties,s=[],n=t.$animations||(t.$animations={}),o=Object.keys(e),a=Date.now();let r;for(r=o.length-1;r>=0;--r){const l=o[r];if("$"===l.charAt(0))continue;if("options"===l){s.push(...this._animateOptions(t,e));continue}const h=e[l];let c=n[l];const d=i.get(l);if(c){if(d&&c.active()){c.update(d,h,a);continue}c.cancel()}d&&d.duration?(n[l]=c=new As(d,t,l,h),s.push(c)):t[l]=h}return s}update(t,e){if(0===this._properties.size)return void Object.assign(t,e);const i=this._createAnimations(t,e);return i.length?(bt.add(this._chart,i),!0):void 0}}function Ls(t,e){const i=t&&t.options||{},s=i.reverse,n=void 0===i.min?e:0,o=void 0===i.max?e:0;return{start:s?o:n,end:s?n:o}}function Es(t,e){const i=[],s=t._getSortedDatasetMetas(e);let n,o;for(n=0,o=s.length;n0||!i&&e<0)return n.index}return null}function Vs(t,e){const{chart:i,_cachedMeta:s}=t,n=i._stacks||(i._stacks={}),{iScale:o,vScale:a,index:r}=s,l=o.axis,h=a.axis,c=function(t,e,i){return`${t.id}.${e.id}.${i.stack||i.type}`}(o,a,s),d=e.length;let u;for(let t=0;ti[t].axis===e)).shift()}function Ws(t,e){const i=t.controller.index,s=t.vScale&&t.vScale.axis;if(s){e=e||t._parsed;for(const t of e){const e=t._stacks;if(!e||void 0===e[s]||void 0===e[s][i])return;delete e[s][i],void 0!==e[s]._visualValues&&void 0!==e[s]._visualValues[i]&&delete e[s]._visualValues[i]}}}const Ns=t=>"reset"===t||"none"===t,Hs=(t,e)=>e?t:Object.assign({},t);class js{static defaults={};static datasetElementType=null;static dataElementType=null;constructor(t,e){this.chart=t,this._ctx=t.ctx,this.index=e,this._cachedDataOpts={},this._cachedMeta=this.getMeta(),this._type=this._cachedMeta.type,this.options=void 0,this._parsing=!1,this._data=void 0,this._objectData=void 0,this._sharedOptions=void 0,this._drawStart=void 0,this._drawCount=void 0,this.enableOptionSharing=!1,this.supportsDecimation=!1,this.$context=void 0,this._syncList=[],this.datasetElementType=new.target.datasetElementType,this.dataElementType=new.target.dataElementType,this.initialize()}initialize(){const t=this._cachedMeta;this.configure(),this.linkScales(),t._stacked=Is(t.vScale,t),this.addElements(),this.options.fill&&!this.chart.isPluginEnabled("filler")&&console.warn("Tried to use the 'fill' option without the 'Filler' plugin enabled. Please import and register the 'Filler' plugin and make sure it is not disabled in the options")}updateIndex(t){this.index!==t&&Ws(this._cachedMeta),this.index=t}linkScales(){const t=this.chart,e=this._cachedMeta,i=this.getDataset(),s=(t,e,i,s)=>"x"===t?e:"r"===t?s:i,n=e.xAxisID=l(i.xAxisID,Bs(t,"x")),o=e.yAxisID=l(i.yAxisID,Bs(t,"y")),a=e.rAxisID=l(i.rAxisID,Bs(t,"r")),r=e.indexAxis,h=e.iAxisID=s(r,n,o,a),c=e.vAxisID=s(r,o,n,a);e.xScale=this.getScaleForId(n),e.yScale=this.getScaleForId(o),e.rScale=this.getScaleForId(a),e.iScale=this.getScaleForId(h),e.vScale=this.getScaleForId(c)}getDataset(){return this.chart.data.datasets[this.index]}getMeta(){return this.chart.getDatasetMeta(this.index)}getScaleForId(t){return this.chart.scales[t]}_getOtherScale(t){const e=this._cachedMeta;return t===e.iScale?e.vScale:e.iScale}reset(){this._update("reset")}_destroy(){const t=this._cachedMeta;this._data&&rt(this._data,this),t._stacked&&Ws(t)}_dataCheck(){const t=this.getDataset(),e=t.data||(t.data=[]),i=this._data;if(o(e)){const t=this._cachedMeta;this._data=function(t,e){const{iScale:i,vScale:s}=e,n="x"===i.axis?"x":"y",o="x"===s.axis?"x":"y",a=Object.keys(t),r=new Array(a.length);let l,h,c;for(l=0,h=a.length;l0&&i._parsed[t-1];if(!1===this._parsing)i._parsed=s,i._sorted=!0,d=s;else{d=n(s[t])?this.parseArrayData(i,s,t,e):o(s[t])?this.parseObjectData(i,s,t,e):this.parsePrimitiveData(i,s,t,e);const a=()=>null===c[l]||f&&c[l]t&&!e.hidden&&e._stacked&&{keys:Es(i,!0),values:null})(e,i,this.chart),h={min:Number.POSITIVE_INFINITY,max:Number.NEGATIVE_INFINITY},{min:c,max:d}=function(t){const{min:e,max:i,minDefined:s,maxDefined:n}=t.getUserBounds();return{min:s?e:Number.NEGATIVE_INFINITY,max:n?i:Number.POSITIVE_INFINITY}}(r);let u,f;function g(){f=s[u];const e=f[r.axis];return!a(f[t.axis])||c>e||d=0;--u)if(!g()){this.updateRangeFromParsed(h,t,f,l);break}return h}getAllParsedValues(t){const e=this._cachedMeta._parsed,i=[];let s,n,o;for(s=0,n=e.length;s=0&&tthis.getContext(i,s,e)),c);return f.$shared&&(f.$shared=r,n[o]=Object.freeze(Hs(f,r))),f}_resolveAnimations(t,e,i){const s=this.chart,n=this._cachedDataOpts,o=`animation-${e}`,a=n[o];if(a)return a;let r;if(!1!==s.options.animation){const s=this.chart.config,n=s.datasetAnimationScopeKeys(this._type,e),o=s.getOptionScopes(this.getDataset(),n);r=s.createResolver(o,this.getContext(t,i,e))}const l=new Ts(s,r&&r.animations);return r&&r._cacheable&&(n[o]=Object.freeze(l)),l}getSharedOptions(t){if(t.$shared)return this._sharedOptions||(this._sharedOptions=Object.assign({},t))}includeOptions(t,e){return!e||Ns(t)||this.chart._animationsDisabled}_getSharedOptions(t,e){const i=this.resolveDataElementOptions(t,e),s=this._sharedOptions,n=this.getSharedOptions(i),o=this.includeOptions(e,n)||n!==s;return this.updateSharedOptions(n,e,i),{sharedOptions:n,includeOptions:o}}updateElement(t,e,i,s){Ns(s)?Object.assign(t,i):this._resolveAnimations(e,s).update(t,i)}updateSharedOptions(t,e,i){t&&!Ns(e)&&this._resolveAnimations(void 0,e).update(t,i)}_setStyle(t,e,i,s){t.active=s;const n=this.getStyle(e,s);this._resolveAnimations(e,i,s).update(t,{options:!s&&this.getSharedOptions(n)||n})}removeHoverStyle(t,e,i){this._setStyle(t,i,"active",!1)}setHoverStyle(t,e,i){this._setStyle(t,i,"active",!0)}_removeDatasetHoverStyle(){const t=this._cachedMeta.dataset;t&&this._setStyle(t,void 0,"active",!1)}_setDatasetHoverStyle(){const t=this._cachedMeta.dataset;t&&this._setStyle(t,void 0,"active",!0)}_resyncElements(t){const e=this._data,i=this._cachedMeta.data;for(const[t,e,i]of this._syncList)this[t](e,i);this._syncList=[];const s=i.length,n=e.length,o=Math.min(n,s);o&&this.parse(0,o),n>s?this._insertElements(s,n-s,t):n{for(t.length+=e,a=t.length-1;a>=o;a--)t[a]=t[a-e]};for(r(n),a=t;a{s[t]=i[t]&&i[t].active()?i[t]._to:this[t]})),s}}function Ys(t,e){const i=t.options.ticks,n=function(t){const e=t.options.offset,i=t._tickSize(),s=t._length/i+(e?0:1),n=t._maxLength/i;return Math.floor(Math.min(s,n))}(t),o=Math.min(i.maxTicksLimit||n,n),a=i.major.enabled?function(t){const e=[];let i,s;for(i=0,s=t.length;io)return function(t,e,i,s){let n,o=0,a=i[0];for(s=Math.ceil(s),n=0;nn)return e}return Math.max(n,1)}(a,e,o);if(r>0){let t,i;const n=r>1?Math.round((h-l)/(r-1)):null;for(Us(e,c,d,s(n)?0:l-n,l),t=0,i=r-1;t"top"===e||"left"===e?t[e]+i:t[e]-i,qs=(t,e)=>Math.min(e||t,t);function Ks(t,e){const i=[],s=t.length/e,n=t.length;let o=0;for(;oa+r)))return h}function Js(t){return t.drawTicks?t.tickLength:0}function Zs(t,e){if(!t.display)return 0;const i=Si(t.font,e),s=ki(t.padding);return(n(t.text)?t.text.length:1)*i.lineHeight+s.height}function Qs(t,e,i){let s=ut(t);return(i&&"right"!==e||!i&&"right"===e)&&(s=(t=>"left"===t?"right":"right"===t?"left":t)(s)),s}class tn extends $s{constructor(t){super(),this.id=t.id,this.type=t.type,this.options=void 0,this.ctx=t.ctx,this.chart=t.chart,this.top=void 0,this.bottom=void 0,this.left=void 0,this.right=void 0,this.width=void 0,this.height=void 0,this._margins={left:0,right:0,top:0,bottom:0},this.maxWidth=void 0,this.maxHeight=void 0,this.paddingTop=void 0,this.paddingBottom=void 0,this.paddingLeft=void 0,this.paddingRight=void 0,this.axis=void 0,this.labelRotation=void 0,this.min=void 0,this.max=void 0,this._range=void 0,this.ticks=[],this._gridLineItems=null,this._labelItems=null,this._labelSizes=null,this._length=0,this._maxLength=0,this._longestTextCache={},this._startPixel=void 0,this._endPixel=void 0,this._reversePixels=!1,this._userMax=void 0,this._userMin=void 0,this._suggestedMax=void 0,this._suggestedMin=void 0,this._ticksLength=0,this._borderValue=0,this._cache={},this._dataLimitsCached=!1,this.$context=void 0}init(t){this.options=t.setContext(this.getContext()),this.axis=t.axis,this._userMin=this.parse(t.min),this._userMax=this.parse(t.max),this._suggestedMin=this.parse(t.suggestedMin),this._suggestedMax=this.parse(t.suggestedMax)}parse(t,e){return t}getUserBounds(){let{_userMin:t,_userMax:e,_suggestedMin:i,_suggestedMax:s}=this;return t=r(t,Number.POSITIVE_INFINITY),e=r(e,Number.NEGATIVE_INFINITY),i=r(i,Number.POSITIVE_INFINITY),s=r(s,Number.NEGATIVE_INFINITY),{min:r(t,i),max:r(e,s),minDefined:a(t),maxDefined:a(e)}}getMinMax(t){let e,{min:i,max:s,minDefined:n,maxDefined:o}=this.getUserBounds();if(n&&o)return{min:i,max:s};const a=this.getMatchingVisibleMetas();for(let r=0,l=a.length;rs?s:i,s=n&&i>s?i:s,{min:r(i,r(s,i)),max:r(s,r(i,s))}}getPadding(){return{left:this.paddingLeft||0,top:this.paddingTop||0,right:this.paddingRight||0,bottom:this.paddingBottom||0}}getTicks(){return this.ticks}getLabels(){const t=this.chart.data;return this.options.labels||(this.isHorizontal()?t.xLabels:t.yLabels)||t.labels||[]}getLabelItems(t=this.chart.chartArea){return this._labelItems||(this._labelItems=this._computeLabelItems(t))}beforeLayout(){this._cache={},this._dataLimitsCached=!1}beforeUpdate(){d(this.options.beforeUpdate,[this])}update(t,e,i){const{beginAtZero:s,grace:n,ticks:o}=this.options,a=o.sampleSize;this.beforeUpdate(),this.maxWidth=t,this.maxHeight=e,this._margins=i=Object.assign({left:0,right:0,top:0,bottom:0},i),this.ticks=null,this._labelSizes=null,this._gridLineItems=null,this._labelItems=null,this.beforeSetDimensions(),this.setDimensions(),this.afterSetDimensions(),this._maxLength=this.isHorizontal()?this.width+i.left+i.right:this.height+i.top+i.bottom,this._dataLimitsCached||(this.beforeDataLimits(),this.determineDataLimits(),this.afterDataLimits(),this._range=Di(this,n,s),this._dataLimitsCached=!0),this.beforeBuildTicks(),this.ticks=this.buildTicks()||[],this.afterBuildTicks();const r=a=n||i<=1||!this.isHorizontal())return void(this.labelRotation=s);const h=this._getLabelSizes(),c=h.widest.width,d=h.highest.height,u=Z(this.chart.width-c,0,this.maxWidth);o=t.offset?this.maxWidth/i:u/(i-1),c+6>o&&(o=u/(i-(t.offset?.5:1)),a=this.maxHeight-Js(t.grid)-e.padding-Zs(t.title,this.chart.options.font),r=Math.sqrt(c*c+d*d),l=Y(Math.min(Math.asin(Z((h.highest.height+6)/o,-1,1)),Math.asin(Z(a/r,-1,1))-Math.asin(Z(d/r,-1,1)))),l=Math.max(s,Math.min(n,l))),this.labelRotation=l}afterCalculateLabelRotation(){d(this.options.afterCalculateLabelRotation,[this])}afterAutoSkip(){}beforeFit(){d(this.options.beforeFit,[this])}fit(){const t={width:0,height:0},{chart:e,options:{ticks:i,title:s,grid:n}}=this,o=this._isVisible(),a=this.isHorizontal();if(o){const o=Zs(s,e.options.font);if(a?(t.width=this.maxWidth,t.height=Js(n)+o):(t.height=this.maxHeight,t.width=Js(n)+o),i.display&&this.ticks.length){const{first:e,last:s,widest:n,highest:o}=this._getLabelSizes(),r=2*i.padding,l=$(this.labelRotation),h=Math.cos(l),c=Math.sin(l);if(a){const e=i.mirror?0:c*n.width+h*o.height;t.height=Math.min(this.maxHeight,t.height+e+r)}else{const e=i.mirror?0:h*n.width+c*o.height;t.width=Math.min(this.maxWidth,t.width+e+r)}this._calculatePadding(e,s,c,h)}}this._handleMargins(),a?(this.width=this._length=e.width-this._margins.left-this._margins.right,this.height=t.height):(this.width=t.width,this.height=this._length=e.height-this._margins.top-this._margins.bottom)}_calculatePadding(t,e,i,s){const{ticks:{align:n,padding:o},position:a}=this.options,r=0!==this.labelRotation,l="top"!==a&&"x"===this.axis;if(this.isHorizontal()){const a=this.getPixelForTick(0)-this.left,h=this.right-this.getPixelForTick(this.ticks.length-1);let c=0,d=0;r?l?(c=s*t.width,d=i*e.height):(c=i*t.height,d=s*e.width):"start"===n?d=e.width:"end"===n?c=t.width:"inner"!==n&&(c=t.width/2,d=e.width/2),this.paddingLeft=Math.max((c-a+o)*this.width/(this.width-a),0),this.paddingRight=Math.max((d-h+o)*this.width/(this.width-h),0)}else{let i=e.height/2,s=t.height/2;"start"===n?(i=0,s=t.height):"end"===n&&(i=e.height,s=0),this.paddingTop=i+o,this.paddingBottom=s+o}}_handleMargins(){this._margins&&(this._margins.left=Math.max(this.paddingLeft,this._margins.left),this._margins.top=Math.max(this.paddingTop,this._margins.top),this._margins.right=Math.max(this.paddingRight,this._margins.right),this._margins.bottom=Math.max(this.paddingBottom,this._margins.bottom))}afterFit(){d(this.options.afterFit,[this])}isHorizontal(){const{axis:t,position:e}=this.options;return"top"===e||"bottom"===e||"x"===t}isFullSize(){return this.options.fullSize}_convertTicksToLabels(t){let e,i;for(this.beforeTickToLabelConversion(),this.generateTickLabels(t),e=0,i=t.length;e{const i=t.gc,s=i.length/2;let n;if(s>e){for(n=0;n({width:r[t]||0,height:l[t]||0});return{first:P(0),last:P(e-1),widest:P(k),highest:P(S),widths:r,heights:l}}getLabelForValue(t){return t}getPixelForValue(t,e){return NaN}getValueForPixel(t){}getPixelForTick(t){const e=this.ticks;return t<0||t>e.length-1?null:this.getPixelForValue(e[t].value)}getPixelForDecimal(t){this._reversePixels&&(t=1-t);const e=this._startPixel+t*this._length;return Q(this._alignToPixels?Ae(this.chart,e,0):e)}getDecimalForPixel(t){const e=(t-this._startPixel)/this._length;return this._reversePixels?1-e:e}getBasePixel(){return this.getPixelForValue(this.getBaseValue())}getBaseValue(){const{min:t,max:e}=this;return t<0&&e<0?e:t>0&&e>0?t:0}getContext(t){const e=this.ticks||[];if(t>=0&&ta*s?a/i:r/s:r*s0}_computeGridLineItems(t){const e=this.axis,i=this.chart,s=this.options,{grid:n,position:a,border:r}=s,h=n.offset,c=this.isHorizontal(),d=this.ticks.length+(h?1:0),u=Js(n),f=[],g=r.setContext(this.getContext()),p=g.display?g.width:0,m=p/2,x=function(t){return Ae(i,t,p)};let b,_,y,v,M,w,k,S,P,D,C,O;if("top"===a)b=x(this.bottom),w=this.bottom-u,S=b-m,D=x(t.top)+m,O=t.bottom;else if("bottom"===a)b=x(this.top),D=t.top,O=x(t.bottom)-m,w=b+m,S=this.top+u;else if("left"===a)b=x(this.right),M=this.right-u,k=b-m,P=x(t.left)+m,C=t.right;else if("right"===a)b=x(this.left),P=t.left,C=x(t.right)-m,M=b+m,k=this.left+u;else if("x"===e){if("center"===a)b=x((t.top+t.bottom)/2+.5);else if(o(a)){const t=Object.keys(a)[0],e=a[t];b=x(this.chart.scales[t].getPixelForValue(e))}D=t.top,O=t.bottom,w=b+m,S=w+u}else if("y"===e){if("center"===a)b=x((t.left+t.right)/2);else if(o(a)){const t=Object.keys(a)[0],e=a[t];b=x(this.chart.scales[t].getPixelForValue(e))}M=b-m,k=M-u,P=t.left,C=t.right}const A=l(s.ticks.maxTicksLimit,d),T=Math.max(1,Math.ceil(d/A));for(_=0;_0&&(o-=s/2)}d={left:o,top:n,width:s+e.width,height:i+e.height,color:t.backdropColor}}x.push({label:v,font:P,textOffset:O,options:{rotation:m,color:i,strokeColor:o,strokeWidth:h,textAlign:f,textBaseline:A,translation:[M,w],backdrop:d}})}return x}_getXAxisLabelAlignment(){const{position:t,ticks:e}=this.options;if(-$(this.labelRotation))return"top"===t?"left":"right";let i="center";return"start"===e.align?i="left":"end"===e.align?i="right":"inner"===e.align&&(i="inner"),i}_getYAxisLabelAlignment(t){const{position:e,ticks:{crossAlign:i,mirror:s,padding:n}}=this.options,o=t+n,a=this._getLabelSizes().widest.width;let r,l;return"left"===e?s?(l=this.right+n,"near"===i?r="left":"center"===i?(r="center",l+=a/2):(r="right",l+=a)):(l=this.right-o,"near"===i?r="right":"center"===i?(r="center",l-=a/2):(r="left",l=this.left)):"right"===e?s?(l=this.left+n,"near"===i?r="right":"center"===i?(r="center",l-=a/2):(r="left",l-=a)):(l=this.left+o,"near"===i?r="left":"center"===i?(r="center",l+=a/2):(r="right",l=this.right)):r="right",{textAlign:r,x:l}}_computeLabelArea(){if(this.options.ticks.mirror)return;const t=this.chart,e=this.options.position;return"left"===e||"right"===e?{top:0,left:this.left,bottom:t.height,right:this.right}:"top"===e||"bottom"===e?{top:this.top,left:0,bottom:this.bottom,right:t.width}:void 0}drawBackground(){const{ctx:t,options:{backgroundColor:e},left:i,top:s,width:n,height:o}=this;e&&(t.save(),t.fillStyle=e,t.fillRect(i,s,n,o),t.restore())}getLineWidthForValue(t){const e=this.options.grid;if(!this._isVisible()||!e.display)return 0;const i=this.ticks.findIndex((e=>e.value===t));if(i>=0){return e.setContext(this.getContext(i)).lineWidth}return 0}drawGrid(t){const e=this.options.grid,i=this.ctx,s=this._gridLineItems||(this._gridLineItems=this._computeGridLineItems(t));let n,o;const a=(t,e,s)=>{s.width&&s.color&&(i.save(),i.lineWidth=s.width,i.strokeStyle=s.color,i.setLineDash(s.borderDash||[]),i.lineDashOffset=s.borderDashOffset,i.beginPath(),i.moveTo(t.x,t.y),i.lineTo(e.x,e.y),i.stroke(),i.restore())};if(e.display)for(n=0,o=s.length;n{this.drawBackground(),this.drawGrid(t),this.drawTitle()}},{z:s,draw:()=>{this.drawBorder()}},{z:e,draw:t=>{this.drawLabels(t)}}]:[{z:e,draw:t=>{this.draw(t)}}]}getMatchingVisibleMetas(t){const e=this.chart.getSortedVisibleDatasetMetas(),i=this.axis+"AxisID",s=[];let n,o;for(n=0,o=e.length;n{const s=i.split("."),n=s.pop(),o=[t].concat(s).join("."),a=e[i].split("."),r=a.pop(),l=a.join(".");ue.route(o,n,l,r)}))}(e,t.defaultRoutes);t.descriptors&&ue.describe(e,t.descriptors)}(t,o,i),this.override&&ue.override(t.id,t.overrides)),o}get(t){return this.items[t]}unregister(t){const e=this.items,i=t.id,s=this.scope;i in e&&delete e[i],s&&i in ue[s]&&(delete ue[s][i],this.override&&delete re[i])}}class sn{constructor(){this.controllers=new en(js,"datasets",!0),this.elements=new en($s,"elements"),this.plugins=new en(Object,"plugins"),this.scales=new en(tn,"scales"),this._typedRegistries=[this.controllers,this.scales,this.elements]}add(...t){this._each("register",t)}remove(...t){this._each("unregister",t)}addControllers(...t){this._each("register",t,this.controllers)}addElements(...t){this._each("register",t,this.elements)}addPlugins(...t){this._each("register",t,this.plugins)}addScales(...t){this._each("register",t,this.scales)}getController(t){return this._get(t,this.controllers,"controller")}getElement(t){return this._get(t,this.elements,"element")}getPlugin(t){return this._get(t,this.plugins,"plugin")}getScale(t){return this._get(t,this.scales,"scale")}removeControllers(...t){this._each("unregister",t,this.controllers)}removeElements(...t){this._each("unregister",t,this.elements)}removePlugins(...t){this._each("unregister",t,this.plugins)}removeScales(...t){this._each("unregister",t,this.scales)}_each(t,e,i){[...e].forEach((e=>{const s=i||this._getRegistryForType(e);i||s.isForType(e)||s===this.plugins&&e.id?this._exec(t,s,e):u(e,(e=>{const s=i||this._getRegistryForType(e);this._exec(t,s,e)}))}))}_exec(t,e,i){const s=w(t);d(i["before"+s],[],i),e[t](i),d(i["after"+s],[],i)}_getRegistryForType(t){for(let e=0;et.filter((t=>!e.some((e=>t.plugin.id===e.plugin.id))));this._notify(s(e,i),t,"stop"),this._notify(s(i,e),t,"start")}}function an(t,e){return e||!1!==t?!0===t?{}:t:null}function rn(t,{plugin:e,local:i},s,n){const o=t.pluginScopeKeys(e),a=t.getOptionScopes(s,o);return i&&e.defaults&&a.push(e.defaults),t.createResolver(a,n,[""],{scriptable:!1,indexable:!1,allKeys:!0})}function ln(t,e){const i=ue.datasets[t]||{};return((e.datasets||{})[t]||{}).indexAxis||e.indexAxis||i.indexAxis||"x"}function hn(t){if("x"===t||"y"===t||"r"===t)return t}function cn(t,...e){if(hn(t))return t;for(const s of e){const e=s.axis||("top"===(i=s.position)||"bottom"===i?"x":"left"===i||"right"===i?"y":void 0)||t.length>1&&hn(t[0].toLowerCase());if(e)return e}var i;throw new Error(`Cannot determine type of '${t}' axis. Please provide 'axis' or 'position' option.`)}function dn(t,e,i){if(i[e+"AxisID"]===t)return{axis:e}}function un(t,e){const i=re[t.type]||{scales:{}},s=e.scales||{},n=ln(t.type,e),a=Object.create(null);return Object.keys(s).forEach((e=>{const r=s[e];if(!o(r))return console.error(`Invalid scale configuration for scale: ${e}`);if(r._proxy)return console.warn(`Ignoring resolver passed as options for scale: ${e}`);const l=cn(e,r,function(t,e){if(e.data&&e.data.datasets){const i=e.data.datasets.filter((e=>e.xAxisID===t||e.yAxisID===t));if(i.length)return dn(t,"x",i[0])||dn(t,"y",i[0])}return{}}(e,t),ue.scales[r.type]),h=function(t,e){return t===e?"_index_":"_value_"}(l,n),c=i.scales||{};a[e]=b(Object.create(null),[{axis:l},r,c[l],c[h]])})),t.data.datasets.forEach((i=>{const n=i.type||t.type,o=i.indexAxis||ln(n,e),r=(re[n]||{}).scales||{};Object.keys(r).forEach((t=>{const e=function(t,e){let i=t;return"_index_"===t?i=e:"_value_"===t&&(i="x"===e?"y":"x"),i}(t,o),n=i[e+"AxisID"]||e;a[n]=a[n]||Object.create(null),b(a[n],[{axis:e},s[n],r[t]])}))})),Object.keys(a).forEach((t=>{const e=a[t];b(e,[ue.scales[e.type],ue.scale])})),a}function fn(t){const e=t.options||(t.options={});e.plugins=l(e.plugins,{}),e.scales=un(t,e)}function gn(t){return(t=t||{}).datasets=t.datasets||[],t.labels=t.labels||[],t}const pn=new Map,mn=new Set;function xn(t,e){let i=pn.get(t);return i||(i=e(),pn.set(t,i),mn.add(i)),i}const bn=(t,e,i)=>{const s=M(e,i);void 0!==s&&t.add(s)};class _n{constructor(t){this._config=function(t){return(t=t||{}).data=gn(t.data),fn(t),t}(t),this._scopeCache=new Map,this._resolverCache=new Map}get platform(){return this._config.platform}get type(){return this._config.type}set type(t){this._config.type=t}get data(){return this._config.data}set data(t){this._config.data=gn(t)}get options(){return this._config.options}set options(t){this._config.options=t}get plugins(){return this._config.plugins}update(){const t=this._config;this.clearCache(),fn(t)}clearCache(){this._scopeCache.clear(),this._resolverCache.clear()}datasetScopeKeys(t){return xn(t,(()=>[[`datasets.${t}`,""]]))}datasetAnimationScopeKeys(t,e){return xn(`${t}.transition.${e}`,(()=>[[`datasets.${t}.transitions.${e}`,`transitions.${e}`],[`datasets.${t}`,""]]))}datasetElementScopeKeys(t,e){return xn(`${t}-${e}`,(()=>[[`datasets.${t}.elements.${e}`,`datasets.${t}`,`elements.${e}`,""]]))}pluginScopeKeys(t){const e=t.id;return xn(`${this.type}-plugin-${e}`,(()=>[[`plugins.${e}`,...t.additionalOptionScopes||[]]]))}_cachedScopes(t,e){const i=this._scopeCache;let s=i.get(t);return s&&!e||(s=new Map,i.set(t,s)),s}getOptionScopes(t,e,i){const{options:s,type:n}=this,o=this._cachedScopes(t,i),a=o.get(e);if(a)return a;const r=new Set;e.forEach((e=>{t&&(r.add(t),e.forEach((e=>bn(r,t,e)))),e.forEach((t=>bn(r,s,t))),e.forEach((t=>bn(r,re[n]||{},t))),e.forEach((t=>bn(r,ue,t))),e.forEach((t=>bn(r,le,t)))}));const l=Array.from(r);return 0===l.length&&l.push(Object.create(null)),mn.has(e)&&o.set(e,l),l}chartOptionScopes(){const{options:t,type:e}=this;return[t,re[e]||{},ue.datasets[e]||{},{type:e},ue,le]}resolveNamedOptions(t,e,i,s=[""]){const o={$shared:!0},{resolver:a,subPrefixes:r}=yn(this._resolverCache,t,s);let l=a;if(function(t,e){const{isScriptable:i,isIndexable:s}=Ye(t);for(const o of e){const e=i(o),a=s(o),r=(a||e)&&t[o];if(e&&(S(r)||vn(r))||a&&n(r))return!0}return!1}(a,e)){o.$shared=!1;l=$e(a,i=S(i)?i():i,this.createResolver(t,i,r))}for(const t of e)o[t]=l[t];return o}createResolver(t,e,i=[""],s){const{resolver:n}=yn(this._resolverCache,t,i);return o(e)?$e(n,e,void 0,s):n}}function yn(t,e,i){let s=t.get(e);s||(s=new Map,t.set(e,s));const n=i.join();let o=s.get(n);if(!o){o={resolver:je(e,i),subPrefixes:i.filter((t=>!t.toLowerCase().includes("hover")))},s.set(n,o)}return o}const vn=t=>o(t)&&Object.getOwnPropertyNames(t).some((e=>S(t[e])));const Mn=["top","bottom","left","right","chartArea"];function wn(t,e){return"top"===t||"bottom"===t||-1===Mn.indexOf(t)&&"x"===e}function kn(t,e){return function(i,s){return i[t]===s[t]?i[e]-s[e]:i[t]-s[t]}}function Sn(t){const e=t.chart,i=e.options.animation;e.notifyPlugins("afterRender"),d(i&&i.onComplete,[t],e)}function Pn(t){const e=t.chart,i=e.options.animation;d(i&&i.onProgress,[t],e)}function Dn(t){return fe()&&"string"==typeof t?t=document.getElementById(t):t&&t.length&&(t=t[0]),t&&t.canvas&&(t=t.canvas),t}const Cn={},On=t=>{const e=Dn(t);return Object.values(Cn).filter((t=>t.canvas===e)).pop()};function An(t,e,i){const s=Object.keys(t);for(const n of s){const s=+n;if(s>=e){const o=t[n];delete t[n],(i>0||s>e)&&(t[s+i]=o)}}}class Tn{static defaults=ue;static instances=Cn;static overrides=re;static registry=nn;static version="4.5.0";static getChart=On;static register(...t){nn.add(...t),Ln()}static unregister(...t){nn.remove(...t),Ln()}constructor(t,e){const s=this.config=new _n(e),n=Dn(t),o=On(n);if(o)throw new Error("Canvas is already in use. Chart with ID '"+o.id+"' must be destroyed before the canvas with ID '"+o.canvas.id+"' can be reused.");const a=s.createResolver(s.chartOptionScopes(),this.getContext());this.platform=new(s.platform||Ps(n)),this.platform.updateConfig(s);const r=this.platform.acquireContext(n,a.aspectRatio),l=r&&r.canvas,h=l&&l.height,c=l&&l.width;this.id=i(),this.ctx=r,this.canvas=l,this.width=c,this.height=h,this._options=a,this._aspectRatio=this.aspectRatio,this._layers=[],this._metasets=[],this._stacks=void 0,this.boxes=[],this.currentDevicePixelRatio=void 0,this.chartArea=void 0,this._active=[],this._lastEvent=void 0,this._listeners={},this._responsiveListeners=void 0,this._sortedMetasets=[],this.scales={},this._plugins=new on,this.$proxies={},this._hiddenIndices={},this.attached=!1,this._animationsDisabled=void 0,this.$context=void 0,this._doResize=dt((t=>this.update(t)),a.resizeDelay||0),this._dataChanges=[],Cn[this.id]=this,r&&l?(bt.listen(this,"complete",Sn),bt.listen(this,"progress",Pn),this._initialize(),this.attached&&this.update()):console.error("Failed to create chart: can't acquire context from the given item")}get aspectRatio(){const{options:{aspectRatio:t,maintainAspectRatio:e},width:i,height:n,_aspectRatio:o}=this;return s(t)?e&&o?o:n?i/n:null:t}get data(){return this.config.data}set data(t){this.config.data=t}get options(){return this._options}set options(t){this.config.options=t}get registry(){return nn}_initialize(){return this.notifyPlugins("beforeInit"),this.options.responsive?this.resize():ke(this,this.options.devicePixelRatio),this.bindEvents(),this.notifyPlugins("afterInit"),this}clear(){return Te(this.canvas,this.ctx),this}stop(){return bt.stop(this),this}resize(t,e){bt.running(this)?this._resizeBeforeDraw={width:t,height:e}:this._resize(t,e)}_resize(t,e){const i=this.options,s=this.canvas,n=i.maintainAspectRatio&&this.aspectRatio,o=this.platform.getMaximumSize(s,t,e,n),a=i.devicePixelRatio||this.platform.getDevicePixelRatio(),r=this.width?"resize":"attach";this.width=o.width,this.height=o.height,this._aspectRatio=this.aspectRatio,ke(this,a,!0)&&(this.notifyPlugins("resize",{size:o}),d(i.onResize,[this,o],this),this.attached&&this._doResize(r)&&this.render())}ensureScalesHaveIDs(){u(this.options.scales||{},((t,e)=>{t.id=e}))}buildOrUpdateScales(){const t=this.options,e=t.scales,i=this.scales,s=Object.keys(i).reduce(((t,e)=>(t[e]=!1,t)),{});let n=[];e&&(n=n.concat(Object.keys(e).map((t=>{const i=e[t],s=cn(t,i),n="r"===s,o="x"===s;return{options:i,dposition:n?"chartArea":o?"bottom":"left",dtype:n?"radialLinear":o?"category":"linear"}})))),u(n,(e=>{const n=e.options,o=n.id,a=cn(o,n),r=l(n.type,e.dtype);void 0!==n.position&&wn(n.position,a)===wn(e.dposition)||(n.position=e.dposition),s[o]=!0;let h=null;if(o in i&&i[o].type===r)h=i[o];else{h=new(nn.getScale(r))({id:o,type:r,ctx:this.ctx,chart:this}),i[h.id]=h}h.init(n,t)})),u(s,((t,e)=>{t||delete i[e]})),u(i,(t=>{ls.configure(this,t,t.options),ls.addBox(this,t)}))}_updateMetasets(){const t=this._metasets,e=this.data.datasets.length,i=t.length;if(t.sort(((t,e)=>t.index-e.index)),i>e){for(let t=e;te.length&&delete this._stacks,t.forEach(((t,i)=>{0===e.filter((e=>e===t._dataset)).length&&this._destroyDatasetMeta(i)}))}buildOrUpdateControllers(){const t=[],e=this.data.datasets;let i,s;for(this._removeUnreferencedMetasets(),i=0,s=e.length;i{this.getDatasetMeta(e).controller.reset()}),this)}reset(){this._resetElements(),this.notifyPlugins("reset")}update(t){const e=this.config;e.update();const i=this._options=e.createResolver(e.chartOptionScopes(),this.getContext()),s=this._animationsDisabled=!i.animation;if(this._updateScales(),this._checkEventBindings(),this._updateHiddenIndices(),this._plugins.invalidate(),!1===this.notifyPlugins("beforeUpdate",{mode:t,cancelable:!0}))return;const n=this.buildOrUpdateControllers();this.notifyPlugins("beforeElementsUpdate");let o=0;for(let t=0,e=this.data.datasets.length;t{t.reset()})),this._updateDatasets(t),this.notifyPlugins("afterUpdate",{mode:t}),this._layers.sort(kn("z","_idx"));const{_active:a,_lastEvent:r}=this;r?this._eventHandler(r,!0):a.length&&this._updateHoverStyles(a,a,!0),this.render()}_updateScales(){u(this.scales,(t=>{ls.removeBox(this,t)})),this.ensureScalesHaveIDs(),this.buildOrUpdateScales()}_checkEventBindings(){const t=this.options,e=new Set(Object.keys(this._listeners)),i=new Set(t.events);P(e,i)&&!!this._responsiveListeners===t.responsive||(this.unbindEvents(),this.bindEvents())}_updateHiddenIndices(){const{_hiddenIndices:t}=this,e=this._getUniformDataChanges()||[];for(const{method:i,start:s,count:n}of e){An(t,s,"_removeElements"===i?-n:n)}}_getUniformDataChanges(){const t=this._dataChanges;if(!t||!t.length)return;this._dataChanges=[];const e=this.data.datasets.length,i=e=>new Set(t.filter((t=>t[0]===e)).map(((t,e)=>e+","+t.splice(1).join(",")))),s=i(0);for(let t=1;tt.split(","))).map((t=>({method:t[1],start:+t[2],count:+t[3]})))}_updateLayout(t){if(!1===this.notifyPlugins("beforeLayout",{cancelable:!0}))return;ls.update(this,this.width,this.height,t);const e=this.chartArea,i=e.width<=0||e.height<=0;this._layers=[],u(this.boxes,(t=>{i&&"chartArea"===t.position||(t.configure&&t.configure(),this._layers.push(...t._layers()))}),this),this._layers.forEach(((t,e)=>{t._idx=e})),this.notifyPlugins("afterLayout")}_updateDatasets(t){if(!1!==this.notifyPlugins("beforeDatasetsUpdate",{mode:t,cancelable:!0})){for(let t=0,e=this.data.datasets.length;t=0;--e)this._drawDataset(t[e]);this.notifyPlugins("afterDatasetsDraw")}_drawDataset(t){const e=this.ctx,i={meta:t,index:t.index,cancelable:!0},s=Ni(this,t);!1!==this.notifyPlugins("beforeDatasetDraw",i)&&(s&&Ie(e,s),t.controller.draw(),s&&ze(e),i.cancelable=!1,this.notifyPlugins("afterDatasetDraw",i))}isPointInArea(t){return Re(t,this.chartArea,this._minPadding)}getElementsAtEventForMode(t,e,i,s){const n=Ki.modes[e];return"function"==typeof n?n(this,t,i,s):[]}getDatasetMeta(t){const e=this.data.datasets[t],i=this._metasets;let s=i.filter((t=>t&&t._dataset===e)).pop();return s||(s={type:null,data:[],dataset:null,controller:null,hidden:null,xAxisID:null,yAxisID:null,order:e&&e.order||0,index:t,_dataset:e,_parsed:[],_sorted:!1},i.push(s)),s}getContext(){return this.$context||(this.$context=Ci(null,{chart:this,type:"chart"}))}getVisibleDatasetCount(){return this.getSortedVisibleDatasetMetas().length}isDatasetVisible(t){const e=this.data.datasets[t];if(!e)return!1;const i=this.getDatasetMeta(t);return"boolean"==typeof i.hidden?!i.hidden:!e.hidden}setDatasetVisibility(t,e){this.getDatasetMeta(t).hidden=!e}toggleDataVisibility(t){this._hiddenIndices[t]=!this._hiddenIndices[t]}getDataVisibility(t){return!this._hiddenIndices[t]}_updateVisibility(t,e,i){const s=i?"show":"hide",n=this.getDatasetMeta(t),o=n.controller._resolveAnimations(void 0,s);k(e)?(n.data[e].hidden=!i,this.update()):(this.setDatasetVisibility(t,i),o.update(n,{visible:i}),this.update((e=>e.datasetIndex===t?s:void 0)))}hide(t,e){this._updateVisibility(t,e,!1)}show(t,e){this._updateVisibility(t,e,!0)}_destroyDatasetMeta(t){const e=this._metasets[t];e&&e.controller&&e.controller._destroy(),delete this._metasets[t]}_stop(){let t,e;for(this.stop(),bt.remove(this),t=0,e=this.data.datasets.length;t{e.addEventListener(this,i,s),t[i]=s},s=(t,e,i)=>{t.offsetX=e,t.offsetY=i,this._eventHandler(t)};u(this.options.events,(t=>i(t,s)))}bindResponsiveEvents(){this._responsiveListeners||(this._responsiveListeners={});const t=this._responsiveListeners,e=this.platform,i=(i,s)=>{e.addEventListener(this,i,s),t[i]=s},s=(i,s)=>{t[i]&&(e.removeEventListener(this,i,s),delete t[i])},n=(t,e)=>{this.canvas&&this.resize(t,e)};let o;const a=()=>{s("attach",a),this.attached=!0,this.resize(),i("resize",n),i("detach",o)};o=()=>{this.attached=!1,s("resize",n),this._stop(),this._resize(0,0),i("attach",a)},e.isAttached(this.canvas)?a():o()}unbindEvents(){u(this._listeners,((t,e)=>{this.platform.removeEventListener(this,e,t)})),this._listeners={},u(this._responsiveListeners,((t,e)=>{this.platform.removeEventListener(this,e,t)})),this._responsiveListeners=void 0}updateHoverStyle(t,e,i){const s=i?"set":"remove";let n,o,a,r;for("dataset"===e&&(n=this.getDatasetMeta(t[0].datasetIndex),n.controller["_"+s+"DatasetHoverStyle"]()),a=0,r=t.length;a{const i=this.getDatasetMeta(t);if(!i)throw new Error("No dataset found at index "+t);return{datasetIndex:t,element:i.data[e],index:e}}));!f(i,e)&&(this._active=i,this._lastEvent=null,this._updateHoverStyles(i,e))}notifyPlugins(t,e,i){return this._plugins.notify(this,t,e,i)}isPluginEnabled(t){return 1===this._plugins._cache.filter((e=>e.plugin.id===t)).length}_updateHoverStyles(t,e,i){const s=this.options.hover,n=(t,e)=>t.filter((t=>!e.some((e=>t.datasetIndex===e.datasetIndex&&t.index===e.index)))),o=n(e,t),a=i?t:n(t,e);o.length&&this.updateHoverStyle(o,s.mode,!1),a.length&&s.mode&&this.updateHoverStyle(a,s.mode,!0)}_eventHandler(t,e){const i={event:t,replay:e,cancelable:!0,inChartArea:this.isPointInArea(t)},s=e=>(e.options.events||this.options.events).includes(t.native.type);if(!1===this.notifyPlugins("beforeEvent",i,s))return;const n=this._handleEvent(t,e,i.inChartArea);return i.cancelable=!1,this.notifyPlugins("afterEvent",i,s),(n||i.changed)&&this.render(),this}_handleEvent(t,e,i){const{_active:s=[],options:n}=this,o=e,a=this._getActiveElements(t,s,i,o),r=D(t),l=function(t,e,i,s){return i&&"mouseout"!==t.type?s?e:t:null}(t,this._lastEvent,i,r);i&&(this._lastEvent=null,d(n.onHover,[t,a,this],this),r&&d(n.onClick,[t,a,this],this));const h=!f(a,s);return(h||e)&&(this._active=a,this._updateHoverStyles(a,s,e)),this._lastEvent=l,h}_getActiveElements(t,e,i,s){if("mouseout"===t.type)return[];if(!i)return e;const n=this.options.hover;return this.getElementsAtEventForMode(t,n.mode,n,s)}}function Ln(){return u(Tn.instances,(t=>t._plugins.invalidate()))}function En(){throw new Error("This method is not implemented: Check that a complete date adapter is provided.")}class Rn{static override(t){Object.assign(Rn.prototype,t)}options;constructor(t){this.options=t||{}}init(){}formats(){return En()}parse(){return En()}format(){return En()}add(){return En()}diff(){return En()}startOf(){return En()}endOf(){return En()}}var In={_date:Rn};function zn(t){const e=t.iScale,i=function(t,e){if(!t._cache.$bar){const i=t.getMatchingVisibleMetas(e);let s=[];for(let e=0,n=i.length;et-e)))}return t._cache.$bar}(e,t.type);let s,n,o,a,r=e._length;const l=()=>{32767!==o&&-32768!==o&&(k(a)&&(r=Math.min(r,Math.abs(o-a)||r)),a=o)};for(s=0,n=i.length;sMath.abs(r)&&(l=r,h=a),e[i.axis]=h,e._custom={barStart:l,barEnd:h,start:n,end:o,min:a,max:r}}(t,e,i,s):e[i.axis]=i.parse(t,s),e}function Vn(t,e,i,s){const n=t.iScale,o=t.vScale,a=n.getLabels(),r=n===o,l=[];let h,c,d,u;for(h=i,c=i+s;ht.x,i="left",s="right"):(e=t.base"spacing"!==t,_indexable:t=>"spacing"!==t&&!t.startsWith("borderDash")&&!t.startsWith("hoverBorderDash")};static overrides={aspectRatio:1,plugins:{legend:{labels:{generateLabels(t){const e=t.data;if(e.labels.length&&e.datasets.length){const{labels:{pointStyle:i,color:s}}=t.legend.options;return e.labels.map(((e,n)=>{const o=t.getDatasetMeta(0).controller.getStyle(n);return{text:e,fillStyle:o.backgroundColor,strokeStyle:o.borderColor,fontColor:s,lineWidth:o.borderWidth,pointStyle:i,hidden:!t.getDataVisibility(n),index:n}}))}return[]}},onClick(t,e,i){i.chart.toggleDataVisibility(e.index),i.chart.update()}}}};constructor(t,e){super(t,e),this.enableOptionSharing=!0,this.innerRadius=void 0,this.outerRadius=void 0,this.offsetX=void 0,this.offsetY=void 0}linkScales(){}parse(t,e){const i=this.getDataset().data,s=this._cachedMeta;if(!1===this._parsing)s._parsed=i;else{let n,a,r=t=>+i[t];if(o(i[t])){const{key:t="value"}=this._parsing;r=e=>+M(i[e],t)}for(n=t,a=t+e;nJ(t,r,l,!0)?1:Math.max(e,e*i,s,s*i),g=(t,e,s)=>J(t,r,l,!0)?-1:Math.min(e,e*i,s,s*i),p=f(0,h,d),m=f(E,c,u),x=g(C,h,d),b=g(C+E,c,u);s=(p-x)/2,n=(m-b)/2,o=-(p+x)/2,a=-(m+b)/2}return{ratioX:s,ratioY:n,offsetX:o,offsetY:a}}(u,d,r),x=(i.width-o)/f,b=(i.height-o)/g,_=Math.max(Math.min(x,b)/2,0),y=c(this.options.radius,_),v=(y-Math.max(y*r,0))/this._getVisibleDatasetWeightTotal();this.offsetX=p*y,this.offsetY=m*y,s.total=this.calculateTotal(),this.outerRadius=y-v*this._getRingWeightOffset(this.index),this.innerRadius=Math.max(this.outerRadius-v*l,0),this.updateElements(n,0,n.length,t)}_circumference(t,e){const i=this.options,s=this._cachedMeta,n=this._getCircumference();return e&&i.animation.animateRotate||!this.chart.getDataVisibility(t)||null===s._parsed[t]||s.data[t].hidden?0:this.calculateCircumference(s._parsed[t]*n/O)}updateElements(t,e,i,s){const n="reset"===s,o=this.chart,a=o.chartArea,r=o.options.animation,l=(a.left+a.right)/2,h=(a.top+a.bottom)/2,c=n&&r.animateScale,d=c?0:this.innerRadius,u=c?0:this.outerRadius,{sharedOptions:f,includeOptions:g}=this._getSharedOptions(e,s);let p,m=this._getRotation();for(p=0;p0&&!isNaN(t)?O*(Math.abs(t)/e):0}getLabelAndValue(t){const e=this._cachedMeta,i=this.chart,s=i.data.labels||[],n=ne(e._parsed[t],i.options.locale);return{label:s[t]||"",value:n}}getMaxBorderWidth(t){let e=0;const i=this.chart;let s,n,o,a,r;if(!t)for(s=0,n=i.data.datasets.length;s{const o=t.getDatasetMeta(0).controller.getStyle(n);return{text:e,fillStyle:o.backgroundColor,strokeStyle:o.borderColor,fontColor:s,lineWidth:o.borderWidth,pointStyle:i,hidden:!t.getDataVisibility(n),index:n}}))}return[]}},onClick(t,e,i){i.chart.toggleDataVisibility(e.index),i.chart.update()}}},scales:{r:{type:"radialLinear",angleLines:{display:!1},beginAtZero:!0,grid:{circular:!0},pointLabels:{display:!1},startAngle:0}}};constructor(t,e){super(t,e),this.innerRadius=void 0,this.outerRadius=void 0}getLabelAndValue(t){const e=this._cachedMeta,i=this.chart,s=i.data.labels||[],n=ne(e._parsed[t].r,i.options.locale);return{label:s[t]||"",value:n}}parseObjectData(t,e,i,s){return ii.bind(this)(t,e,i,s)}update(t){const e=this._cachedMeta.data;this._updateRadius(),this.updateElements(e,0,e.length,t)}getMinMax(){const t=this._cachedMeta,e={min:Number.POSITIVE_INFINITY,max:Number.NEGATIVE_INFINITY};return t.data.forEach(((t,i)=>{const s=this.getParsed(i).r;!isNaN(s)&&this.chart.getDataVisibility(i)&&(se.max&&(e.max=s))})),e}_updateRadius(){const t=this.chart,e=t.chartArea,i=t.options,s=Math.min(e.right-e.left,e.bottom-e.top),n=Math.max(s/2,0),o=(n-Math.max(i.cutoutPercentage?n/100*i.cutoutPercentage:1,0))/t.getVisibleDatasetCount();this.outerRadius=n-o*this.index,this.innerRadius=this.outerRadius-o}updateElements(t,e,i,s){const n="reset"===s,o=this.chart,a=o.options.animation,r=this._cachedMeta.rScale,l=r.xCenter,h=r.yCenter,c=r.getIndexAngle(0)-.5*C;let d,u=c;const f=360/this.countVisibleElements();for(d=0;d{!isNaN(this.getParsed(i).r)&&this.chart.getDataVisibility(i)&&e++})),e}_computeAngle(t,e,i){return this.chart.getDataVisibility(t)?$(this.resolveDataElementOptions(t,e).angle||i):0}}var Un=Object.freeze({__proto__:null,BarController:class extends js{static id="bar";static defaults={datasetElementType:!1,dataElementType:"bar",categoryPercentage:.8,barPercentage:.9,grouped:!0,animations:{numbers:{type:"number",properties:["x","y","base","width","height"]}}};static overrides={scales:{_index_:{type:"category",offset:!0,grid:{offset:!0}},_value_:{type:"linear",beginAtZero:!0}}};parsePrimitiveData(t,e,i,s){return Vn(t,e,i,s)}parseArrayData(t,e,i,s){return Vn(t,e,i,s)}parseObjectData(t,e,i,s){const{iScale:n,vScale:o}=t,{xAxisKey:a="x",yAxisKey:r="y"}=this._parsing,l="x"===n.axis?a:r,h="x"===o.axis?a:r,c=[];let d,u,f,g;for(d=i,u=i+s;dt.controller.options.grouped)),o=i.options.stacked,a=[],r=this._cachedMeta.controller.getParsed(e),l=r&&r[i.axis],h=t=>{const e=t._parsed.find((t=>t[i.axis]===l)),n=e&&e[t.vScale.axis];if(s(n)||isNaN(n))return!0};for(const i of n)if((void 0===e||!h(i))&&((!1===o||-1===a.indexOf(i.stack)||void 0===o&&void 0===i.stack)&&a.push(i.stack),i.index===t))break;return a.length||a.push(void 0),a}_getStackCount(t){return this._getStacks(void 0,t).length}_getAxisCount(){return this._getAxis().length}getFirstScaleIdForIndexAxis(){const t=this.chart.scales,e=this.chart.options.indexAxis;return Object.keys(t).filter((i=>t[i].axis===e)).shift()}_getAxis(){const t={},e=this.getFirstScaleIdForIndexAxis();for(const i of this.chart.data.datasets)t[l("x"===this.chart.options.indexAxis?i.xAxisID:i.yAxisID,e)]=!0;return Object.keys(t)}_getStackIndex(t,e,i){const s=this._getStacks(t,i),n=void 0!==e?s.indexOf(e):-1;return-1===n?s.length-1:n}_getRuler(){const t=this.options,e=this._cachedMeta,i=e.iScale,s=[];let n,o;for(n=0,o=e.data.length;n=i?1:-1)}(u,e,r)*a,f===r&&(x-=u/2);const t=e.getPixelForDecimal(0),s=e.getPixelForDecimal(1),o=Math.min(t,s),h=Math.max(t,s);x=Math.max(Math.min(x,h),o),d=x+u,i&&!c&&(l._stacks[e.axis]._visualValues[n]=e.getValueForPixel(d)-e.getValueForPixel(x))}if(x===e.getPixelForValue(r)){const t=F(u)*e.getLineWidthForValue(r)/2;x+=t,u-=t}return{size:u,base:x,head:d,center:d+u/2}}_calculateBarIndexPixels(t,e){const i=e.scale,n=this.options,o=n.skipNull,a=l(n.maxBarThickness,1/0);let r,h;const c=this._getAxisCount();if(e.grouped){const i=o?this._getStackCount(t):e.stackCount,d="flex"===n.barThickness?function(t,e,i,s){const n=e.pixels,o=n[t];let a=t>0?n[t-1]:null,r=t=0;--i)e=Math.max(e,t[i].size(this.resolveDataElementOptions(i))/2);return e>0&&e}getLabelAndValue(t){const e=this._cachedMeta,i=this.chart.data.labels||[],{xScale:s,yScale:n}=e,o=this.getParsed(t),a=s.getLabelForValue(o.x),r=n.getLabelForValue(o.y),l=o._custom;return{label:i[t]||"",value:"("+a+", "+r+(l?", "+l:"")+")"}}update(t){const e=this._cachedMeta.data;this.updateElements(e,0,e.length,t)}updateElements(t,e,i,s){const n="reset"===s,{iScale:o,vScale:a}=this._cachedMeta,{sharedOptions:r,includeOptions:l}=this._getSharedOptions(e,s),h=o.axis,c=a.axis;for(let d=e;d0&&this.getParsed(e-1);for(let i=0;i<_;++i){const g=t[i],_=x?g:{};if(i=b){_.skip=!0;continue}const v=this.getParsed(i),M=s(v[f]),w=_[u]=a.getPixelForValue(v[u],i),k=_[f]=o||M?r.getBasePixel():r.getPixelForValue(l?this.applyStack(r,v,l):v[f],i);_.skip=isNaN(w)||isNaN(k)||M,_.stop=i>0&&Math.abs(v[u]-y[u])>m,p&&(_.parsed=v,_.raw=h.data[i]),d&&(_.options=c||this.resolveDataElementOptions(i,g.active?"active":n)),x||this.updateElement(g,i,_,n),y=v}}getMaxOverflow(){const t=this._cachedMeta,e=t.dataset,i=e.options&&e.options.borderWidth||0,s=t.data||[];if(!s.length)return i;const n=s[0].size(this.resolveDataElementOptions(0)),o=s[s.length-1].size(this.resolveDataElementOptions(s.length-1));return Math.max(i,n,o)/2}draw(){const t=this._cachedMeta;t.dataset.updateControlPoints(this.chart.chartArea,t.iScale.axis),super.draw()}},PieController:class extends $n{static id="pie";static defaults={cutout:0,rotation:0,circumference:360,radius:"100%"}},PolarAreaController:Yn,RadarController:class extends js{static id="radar";static defaults={datasetElementType:"line",dataElementType:"point",indexAxis:"r",showLine:!0,elements:{line:{fill:"start"}}};static overrides={aspectRatio:1,scales:{r:{type:"radialLinear"}}};getLabelAndValue(t){const e=this._cachedMeta.vScale,i=this.getParsed(t);return{label:e.getLabels()[t],value:""+e.getLabelForValue(i[e.axis])}}parseObjectData(t,e,i,s){return ii.bind(this)(t,e,i,s)}update(t){const e=this._cachedMeta,i=e.dataset,s=e.data||[],n=e.iScale.getLabels();if(i.points=s,"resize"!==t){const e=this.resolveDatasetElementOptions(t);this.options.showLine||(e.borderWidth=0);const o={_loop:!0,_fullLoop:n.length===s.length,options:e};this.updateElement(i,void 0,o,t)}this.updateElements(s,0,s.length,t)}updateElements(t,e,i,s){const n=this._cachedMeta.rScale,o="reset"===s;for(let a=e;a0&&this.getParsed(e-1);for(let c=e;c0&&Math.abs(i[f]-_[f])>x,m&&(p.parsed=i,p.raw=h.data[c]),u&&(p.options=d||this.resolveDataElementOptions(c,e.active?"active":n)),b||this.updateElement(e,c,p,n),_=i}this.updateSharedOptions(d,n,c)}getMaxOverflow(){const t=this._cachedMeta,e=t.data||[];if(!this.options.showLine){let t=0;for(let i=e.length-1;i>=0;--i)t=Math.max(t,e[i].size(this.resolveDataElementOptions(i))/2);return t>0&&t}const i=t.dataset,s=i.options&&i.options.borderWidth||0;if(!e.length)return s;const n=e[0].size(this.resolveDataElementOptions(0)),o=e[e.length-1].size(this.resolveDataElementOptions(e.length-1));return Math.max(s,n,o)/2}}});function Xn(t,e,i,s){const n=vi(t.options.borderRadius,["outerStart","outerEnd","innerStart","innerEnd"]);const o=(i-e)/2,a=Math.min(o,s*e/2),r=t=>{const e=(i-Math.min(o,t))*s/2;return Z(t,0,Math.min(o,e))};return{outerStart:r(n.outerStart),outerEnd:r(n.outerEnd),innerStart:Z(n.innerStart,0,a),innerEnd:Z(n.innerEnd,0,a)}}function qn(t,e,i,s){return{x:i+t*Math.cos(e),y:s+t*Math.sin(e)}}function Kn(t,e,i,s,n,o){const{x:a,y:r,startAngle:l,pixelMargin:h,innerRadius:c}=e,d=Math.max(e.outerRadius+s+i-h,0),u=c>0?c+s+i+h:0;let f=0;const g=n-l;if(s){const t=((c>0?c-s:0)+(d>0?d-s:0))/2;f=(g-(0!==t?g*t/(t+s):g))/2}const p=(g-Math.max(.001,g*d-i/C)/d)/2,m=l+p+f,x=n-p-f,{outerStart:b,outerEnd:_,innerStart:y,innerEnd:v}=Xn(e,u,d,x-m),M=d-b,w=d-_,k=m+b/M,S=x-_/w,P=u+y,D=u+v,O=m+y/P,A=x-v/D;if(t.beginPath(),o){const e=(k+S)/2;if(t.arc(a,r,d,k,e),t.arc(a,r,d,e,S),_>0){const e=qn(w,S,a,r);t.arc(e.x,e.y,_,S,x+E)}const i=qn(D,x,a,r);if(t.lineTo(i.x,i.y),v>0){const e=qn(D,A,a,r);t.arc(e.x,e.y,v,x+E,A+Math.PI)}const s=(x-v/u+(m+y/u))/2;if(t.arc(a,r,u,x-v/u,s,!0),t.arc(a,r,u,s,m+y/u,!0),y>0){const e=qn(P,O,a,r);t.arc(e.x,e.y,y,O+Math.PI,m-E)}const n=qn(M,m,a,r);if(t.lineTo(n.x,n.y),b>0){const e=qn(M,k,a,r);t.arc(e.x,e.y,b,m-E,k)}}else{t.moveTo(a,r);const e=Math.cos(k)*d+a,i=Math.sin(k)*d+r;t.lineTo(e,i);const s=Math.cos(S)*d+a,n=Math.sin(S)*d+r;t.lineTo(s,n)}t.closePath()}function Gn(t,e,i,s,n){const{fullCircles:o,startAngle:a,circumference:r,options:l}=e,{borderWidth:h,borderJoinStyle:c,borderDash:d,borderDashOffset:u,borderRadius:f}=l,g="inner"===l.borderAlign;if(!h)return;t.setLineDash(d||[]),t.lineDashOffset=u,g?(t.lineWidth=2*h,t.lineJoin=c||"round"):(t.lineWidth=h,t.lineJoin=c||"bevel");let p=e.endAngle;if(o){Kn(t,e,i,s,p,n);for(let e=0;en?(h=n/l,t.arc(o,a,l,i+h,s-h,!0)):t.arc(o,a,n,i+E,s-E),t.closePath(),t.clip()}(t,e,p),l.selfJoin&&p-a>=C&&0===f&&"miter"!==c&&function(t,e,i){const{startAngle:s,x:n,y:o,outerRadius:a,innerRadius:r,options:l}=e,{borderWidth:h,borderJoinStyle:c}=l,d=Math.min(h/a,G(s-i));if(t.beginPath(),t.arc(n,o,a-h/2,s+d/2,i-d/2),r>0){const e=Math.min(h/r,G(s-i));t.arc(n,o,r+h/2,i-e/2,s+e/2,!0)}else{const e=Math.min(h/2,a*G(s-i));if("round"===c)t.arc(n,o,e,i-C/2,s+C/2,!0);else if("bevel"===c){const a=2*e*e,r=-a*Math.cos(i+C/2)+n,l=-a*Math.sin(i+C/2)+o,h=a*Math.cos(s+C/2)+n,c=a*Math.sin(s+C/2)+o;t.lineTo(r,l),t.lineTo(h,c)}}t.closePath(),t.moveTo(0,0),t.rect(0,0,t.canvas.width,t.canvas.height),t.clip("evenodd")}(t,e,p),o||(Kn(t,e,i,s,p,n),t.stroke())}function Jn(t,e,i=e){t.lineCap=l(i.borderCapStyle,e.borderCapStyle),t.setLineDash(l(i.borderDash,e.borderDash)),t.lineDashOffset=l(i.borderDashOffset,e.borderDashOffset),t.lineJoin=l(i.borderJoinStyle,e.borderJoinStyle),t.lineWidth=l(i.borderWidth,e.borderWidth),t.strokeStyle=l(i.borderColor,e.borderColor)}function Zn(t,e,i){t.lineTo(i.x,i.y)}function Qn(t,e,i={}){const s=t.length,{start:n=0,end:o=s-1}=i,{start:a,end:r}=e,l=Math.max(n,a),h=Math.min(o,r),c=nr&&o>r;return{count:s,start:l,loop:e.loop,ilen:h(a+(h?r-t:t))%o,_=()=>{f!==g&&(t.lineTo(m,g),t.lineTo(m,f),t.lineTo(m,p))};for(l&&(d=n[b(0)],t.moveTo(d.x,d.y)),c=0;c<=r;++c){if(d=n[b(c)],d.skip)continue;const e=d.x,i=d.y,s=0|e;s===u?(ig&&(g=i),m=(x*m+e)/++x):(_(),t.lineTo(e,i),u=s,x=0,f=g=i),p=i}_()}function io(t){const e=t.options,i=e.borderDash&&e.borderDash.length;return!(t._decimated||t._loop||e.tension||"monotone"===e.cubicInterpolationMode||e.stepped||i)?eo:to}const so="function"==typeof Path2D;function no(t,e,i,s){so&&!e.options.segment?function(t,e,i,s){let n=e._path;n||(n=e._path=new Path2D,e.path(n,i,s)&&n.closePath()),Jn(t,e.options),t.stroke(n)}(t,e,i,s):function(t,e,i,s){const{segments:n,options:o}=e,a=io(e);for(const r of n)Jn(t,o,r.style),t.beginPath(),a(t,e,r,{start:i,end:i+s-1})&&t.closePath(),t.stroke()}(t,e,i,s)}class oo extends $s{static id="line";static defaults={borderCapStyle:"butt",borderDash:[],borderDashOffset:0,borderJoinStyle:"miter",borderWidth:3,capBezierPoints:!0,cubicInterpolationMode:"default",fill:!1,spanGaps:!1,stepped:!1,tension:0};static defaultRoutes={backgroundColor:"backgroundColor",borderColor:"borderColor"};static descriptors={_scriptable:!0,_indexable:t=>"borderDash"!==t&&"fill"!==t};constructor(t){super(),this.animated=!0,this.options=void 0,this._chart=void 0,this._loop=void 0,this._fullLoop=void 0,this._path=void 0,this._points=void 0,this._segments=void 0,this._decimated=!1,this._pointsUpdated=!1,this._datasetIndex=void 0,t&&Object.assign(this,t)}updateControlPoints(t,e){const i=this.options;if((i.tension||"monotone"===i.cubicInterpolationMode)&&!i.stepped&&!this._pointsUpdated){const s=i.spanGaps?this._loop:this._fullLoop;hi(this._points,i,t,s,e),this._pointsUpdated=!0}}set points(t){this._points=t,delete this._segments,delete this._path,this._pointsUpdated=!1}get points(){return this._points}get segments(){return this._segments||(this._segments=zi(this,this.options.segment))}first(){const t=this.segments,e=this.points;return t.length&&e[t[0].start]}last(){const t=this.segments,e=this.points,i=t.length;return i&&e[t[i-1].end]}interpolate(t,e){const i=this.options,s=t[e],n=this.points,o=Ii(this,{property:e,start:s,end:s});if(!o.length)return;const a=[],r=function(t){return t.stepped?pi:t.tension||"monotone"===t.cubicInterpolationMode?mi:gi}(i);let l,h;for(l=0,h=o.length;l"borderDash"!==t};circumference;endAngle;fullCircles;innerRadius;outerRadius;pixelMargin;startAngle;constructor(t){super(),this.options=void 0,this.circumference=void 0,this.startAngle=void 0,this.endAngle=void 0,this.innerRadius=void 0,this.outerRadius=void 0,this.pixelMargin=0,this.fullCircles=0,t&&Object.assign(this,t)}inRange(t,e,i){const s=this.getProps(["x","y"],i),{angle:n,distance:o}=X(s,{x:t,y:e}),{startAngle:a,endAngle:r,innerRadius:h,outerRadius:c,circumference:d}=this.getProps(["startAngle","endAngle","innerRadius","outerRadius","circumference"],i),u=(this.options.spacing+this.options.borderWidth)/2,f=l(d,r-a),g=J(n,a,r)&&a!==r,p=f>=O||g,m=tt(o,h+u,c+u);return p&&m}getCenterPoint(t){const{x:e,y:i,startAngle:s,endAngle:n,innerRadius:o,outerRadius:a}=this.getProps(["x","y","startAngle","endAngle","innerRadius","outerRadius"],t),{offset:r,spacing:l}=this.options,h=(s+n)/2,c=(o+a+l+r)/2;return{x:e+Math.cos(h)*c,y:i+Math.sin(h)*c}}tooltipPosition(t){return this.getCenterPoint(t)}draw(t){const{options:e,circumference:i}=this,s=(e.offset||0)/4,n=(e.spacing||0)/2,o=e.circular;if(this.pixelMargin="inner"===e.borderAlign?.33:0,this.fullCircles=i>O?Math.floor(i/O):0,0===i||this.innerRadius<0||this.outerRadius<0)return;t.save();const a=(this.startAngle+this.endAngle)/2;t.translate(Math.cos(a)*s,Math.sin(a)*s);const r=s*(1-Math.sin(Math.min(C,i||0)));t.fillStyle=e.backgroundColor,t.strokeStyle=e.borderColor,function(t,e,i,s,n){const{fullCircles:o,startAngle:a,circumference:r}=e;let l=e.endAngle;if(o){Kn(t,e,i,s,l,n);for(let e=0;e("string"==typeof e?(i=t.push(e)-1,s.unshift({index:i,label:e})):isNaN(e)&&(i=null),i))(t,e,i,s);return n!==t.lastIndexOf(e)?i:n}function mo(t){const e=this.getLabels();return t>=0&&ts=e?s:t,a=t=>n=i?n:t;if(t){const t=F(s),e=F(n);t<0&&e<0?a(0):t>0&&e>0&&o(0)}if(s===n){let e=0===n?1:Math.abs(.05*n);a(n+e),t||o(s-e)}this.min=s,this.max=n}getTickLimit(){const t=this.options.ticks;let e,{maxTicksLimit:i,stepSize:s}=t;return s?(e=Math.ceil(this.max/s)-Math.floor(this.min/s)+1,e>1e3&&(console.warn(`scales.${this.id}.ticks.stepSize: ${s} would result generating up to ${e} ticks. Limiting to 1000.`),e=1e3)):(e=this.computeTickLimit(),i=i||11),i&&(e=Math.min(i,e)),e}computeTickLimit(){return Number.POSITIVE_INFINITY}buildTicks(){const t=this.options,e=t.ticks;let i=this.getTickLimit();i=Math.max(2,i);const n=function(t,e){const i=[],{bounds:n,step:o,min:a,max:r,precision:l,count:h,maxTicks:c,maxDigits:d,includeBounds:u}=t,f=o||1,g=c-1,{min:p,max:m}=e,x=!s(a),b=!s(r),_=!s(h),y=(m-p)/(d+1);let v,M,w,k,S=B((m-p)/g/f)*f;if(S<1e-14&&!x&&!b)return[{value:p},{value:m}];k=Math.ceil(m/S)-Math.floor(p/S),k>g&&(S=B(k*S/g/f)*f),s(l)||(v=Math.pow(10,l),S=Math.ceil(S*v)/v),"ticks"===n?(M=Math.floor(p/S)*S,w=Math.ceil(m/S)*S):(M=p,w=m),x&&b&&o&&H((r-a)/o,S/1e3)?(k=Math.round(Math.min((r-a)/S,c)),S=(r-a)/k,M=a,w=r):_?(M=x?a:M,w=b?r:w,k=h-1,S=(w-M)/k):(k=(w-M)/S,k=V(k,Math.round(k),S/1e3)?Math.round(k):Math.ceil(k));const P=Math.max(U(S),U(M));v=Math.pow(10,s(l)?P:l),M=Math.round(M*v)/v,w=Math.round(w*v)/v;let D=0;for(x&&(u&&M!==a?(i.push({value:a}),Mr)break;i.push({value:t})}return b&&u&&w!==r?i.length&&V(i[i.length-1].value,r,xo(r,y,t))?i[i.length-1].value=r:i.push({value:r}):b&&w!==r||i.push({value:w}),i}({maxTicks:i,bounds:t.bounds,min:t.min,max:t.max,precision:e.precision,step:e.stepSize,count:e.count,maxDigits:this._maxDigits(),horizontal:this.isHorizontal(),minRotation:e.minRotation||0,includeBounds:!1!==e.includeBounds},this._range||this);return"ticks"===t.bounds&&j(n,this,"value"),t.reverse?(n.reverse(),this.start=this.max,this.end=this.min):(this.start=this.min,this.end=this.max),n}configure(){const t=this.ticks;let e=this.min,i=this.max;if(super.configure(),this.options.offset&&t.length){const s=(i-e)/Math.max(t.length-1,1)/2;e-=s,i+=s}this._startValue=e,this._endValue=i,this._valueRange=i-e}getLabelForValue(t){return ne(t,this.chart.options.locale,this.options.ticks.format)}}class _o extends bo{static id="linear";static defaults={ticks:{callback:ae.formatters.numeric}};determineDataLimits(){const{min:t,max:e}=this.getMinMax(!0);this.min=a(t)?t:0,this.max=a(e)?e:1,this.handleTickRangeOptions()}computeTickLimit(){const t=this.isHorizontal(),e=t?this.width:this.height,i=$(this.options.ticks.minRotation),s=(t?Math.sin(i):Math.cos(i))||.001,n=this._resolveTickFontOptions(0);return Math.ceil(e/Math.min(40,n.lineHeight/s))}getPixelForValue(t){return null===t?NaN:this.getPixelForDecimal((t-this._startValue)/this._valueRange)}getValueForPixel(t){return this._startValue+this.getDecimalForPixel(t)*this._valueRange}}const yo=t=>Math.floor(z(t)),vo=(t,e)=>Math.pow(10,yo(t)+e);function Mo(t){return 1===t/Math.pow(10,yo(t))}function wo(t,e,i){const s=Math.pow(10,i),n=Math.floor(t/s);return Math.ceil(e/s)-n}function ko(t,{min:e,max:i}){e=r(t.min,e);const s=[],n=yo(e);let o=function(t,e){let i=yo(e-t);for(;wo(t,e,i)>10;)i++;for(;wo(t,e,i)<10;)i--;return Math.min(i,yo(t))}(e,i),a=o<0?Math.pow(10,Math.abs(o)):1;const l=Math.pow(10,o),h=n>o?Math.pow(10,n):0,c=Math.round((e-h)*a)/a,d=Math.floor((e-h)/l/10)*l*10;let u=Math.floor((c-d)/Math.pow(10,o)),f=r(t.min,Math.round((h+d+u*Math.pow(10,o))*a)/a);for(;f=10?u=u<15?15:20:u++,u>=20&&(o++,u=2,a=o>=0?1:a),f=Math.round((h+d+u*Math.pow(10,o))*a)/a;const g=r(t.max,f);return s.push({value:g,major:Mo(g),significand:u}),s}class So extends tn{static id="logarithmic";static defaults={ticks:{callback:ae.formatters.logarithmic,major:{enabled:!0}}};constructor(t){super(t),this.start=void 0,this.end=void 0,this._startValue=void 0,this._valueRange=0}parse(t,e){const i=bo.prototype.parse.apply(this,[t,e]);if(0!==i)return a(i)&&i>0?i:null;this._zero=!0}determineDataLimits(){const{min:t,max:e}=this.getMinMax(!0);this.min=a(t)?Math.max(0,t):null,this.max=a(e)?Math.max(0,e):null,this.options.beginAtZero&&(this._zero=!0),this._zero&&this.min!==this._suggestedMin&&!a(this._userMin)&&(this.min=t===vo(this.min,0)?vo(this.min,-1):vo(this.min,0)),this.handleTickRangeOptions()}handleTickRangeOptions(){const{minDefined:t,maxDefined:e}=this.getUserBounds();let i=this.min,s=this.max;const n=e=>i=t?i:e,o=t=>s=e?s:t;i===s&&(i<=0?(n(1),o(10)):(n(vo(i,-1)),o(vo(s,1)))),i<=0&&n(vo(s,-1)),s<=0&&o(vo(i,1)),this.min=i,this.max=s}buildTicks(){const t=this.options,e=ko({min:this._userMin,max:this._userMax},this);return"ticks"===t.bounds&&j(e,this,"value"),t.reverse?(e.reverse(),this.start=this.max,this.end=this.min):(this.start=this.min,this.end=this.max),e}getLabelForValue(t){return void 0===t?"0":ne(t,this.chart.options.locale,this.options.ticks.format)}configure(){const t=this.min;super.configure(),this._startValue=z(t),this._valueRange=z(this.max)-z(t)}getPixelForValue(t){return void 0!==t&&0!==t||(t=this.min),null===t||isNaN(t)?NaN:this.getPixelForDecimal(t===this.min?0:(z(t)-this._startValue)/this._valueRange)}getValueForPixel(t){const e=this.getDecimalForPixel(t);return Math.pow(10,this._startValue+e*this._valueRange)}}function Po(t){const e=t.ticks;if(e.display&&t.display){const t=ki(e.backdropPadding);return l(e.font&&e.font.size,ue.font.size)+t.height}return 0}function Do(t,e,i,s,n){return t===s||t===n?{start:e-i/2,end:e+i/2}:tn?{start:e-i,end:e}:{start:e,end:e+i}}function Co(t){const e={l:t.left+t._padding.left,r:t.right-t._padding.right,t:t.top+t._padding.top,b:t.bottom-t._padding.bottom},i=Object.assign({},e),s=[],o=[],a=t._pointLabels.length,r=t.options.pointLabels,l=r.centerPointLabels?C/a:0;for(let u=0;ue.r&&(r=(s.end-e.r)/o,t.r=Math.max(t.r,e.r+r)),n.starte.b&&(l=(n.end-e.b)/a,t.b=Math.max(t.b,e.b+l))}function Ao(t,e,i){const s=t.drawingArea,{extra:n,additionalAngle:o,padding:a,size:r}=i,l=t.getPointPosition(e,s+n+a,o),h=Math.round(Y(G(l.angle+E))),c=function(t,e,i){90===i||270===i?t-=e/2:(i>270||i<90)&&(t-=e);return t}(l.y,r.h,h),d=function(t){if(0===t||180===t)return"center";if(t<180)return"left";return"right"}(h),u=function(t,e,i){"right"===i?t-=e:"center"===i&&(t-=e/2);return t}(l.x,r.w,d);return{visible:!0,x:l.x,y:c,textAlign:d,left:u,top:c,right:u+r.w,bottom:c+r.h}}function To(t,e){if(!e)return!0;const{left:i,top:s,right:n,bottom:o}=t;return!(Re({x:i,y:s},e)||Re({x:i,y:o},e)||Re({x:n,y:s},e)||Re({x:n,y:o},e))}function Lo(t,e,i){const{left:n,top:o,right:a,bottom:r}=i,{backdropColor:l}=e;if(!s(l)){const i=wi(e.borderRadius),s=ki(e.backdropPadding);t.fillStyle=l;const h=n-s.left,c=o-s.top,d=a-n+s.width,u=r-o+s.height;Object.values(i).some((t=>0!==t))?(t.beginPath(),He(t,{x:h,y:c,w:d,h:u,radius:i}),t.fill()):t.fillRect(h,c,d,u)}}function Eo(t,e,i,s){const{ctx:n}=t;if(i)n.arc(t.xCenter,t.yCenter,e,0,O);else{let i=t.getPointPosition(0,e);n.moveTo(i.x,i.y);for(let o=1;ot,padding:5,centerPointLabels:!1}};static defaultRoutes={"angleLines.color":"borderColor","pointLabels.color":"color","ticks.color":"color"};static descriptors={angleLines:{_fallback:"grid"}};constructor(t){super(t),this.xCenter=void 0,this.yCenter=void 0,this.drawingArea=void 0,this._pointLabels=[],this._pointLabelItems=[]}setDimensions(){const t=this._padding=ki(Po(this.options)/2),e=this.width=this.maxWidth-t.width,i=this.height=this.maxHeight-t.height;this.xCenter=Math.floor(this.left+e/2+t.left),this.yCenter=Math.floor(this.top+i/2+t.top),this.drawingArea=Math.floor(Math.min(e,i)/2)}determineDataLimits(){const{min:t,max:e}=this.getMinMax(!1);this.min=a(t)&&!isNaN(t)?t:0,this.max=a(e)&&!isNaN(e)?e:0,this.handleTickRangeOptions()}computeTickLimit(){return Math.ceil(this.drawingArea/Po(this.options))}generateTickLabels(t){bo.prototype.generateTickLabels.call(this,t),this._pointLabels=this.getLabels().map(((t,e)=>{const i=d(this.options.pointLabels.callback,[t,e],this);return i||0===i?i:""})).filter(((t,e)=>this.chart.getDataVisibility(e)))}fit(){const t=this.options;t.display&&t.pointLabels.display?Co(this):this.setCenterPoint(0,0,0,0)}setCenterPoint(t,e,i,s){this.xCenter+=Math.floor((t-e)/2),this.yCenter+=Math.floor((i-s)/2),this.drawingArea-=Math.min(this.drawingArea/2,Math.max(t,e,i,s))}getIndexAngle(t){return G(t*(O/(this._pointLabels.length||1))+$(this.options.startAngle||0))}getDistanceFromCenterForValue(t){if(s(t))return NaN;const e=this.drawingArea/(this.max-this.min);return this.options.reverse?(this.max-t)*e:(t-this.min)*e}getValueForDistanceFromCenter(t){if(s(t))return NaN;const e=t/(this.drawingArea/(this.max-this.min));return this.options.reverse?this.max-e:this.min+e}getPointLabelContext(t){const e=this._pointLabels||[];if(t>=0&&t=0;n--){const e=t._pointLabelItems[n];if(!e.visible)continue;const o=s.setContext(t.getPointLabelContext(n));Lo(i,o,e);const a=Si(o.font),{x:r,y:l,textAlign:h}=e;Ne(i,t._pointLabels[n],r,l+a.lineHeight/2,a,{color:o.color,textAlign:h,textBaseline:"middle"})}}(this,o),s.display&&this.ticks.forEach(((t,e)=>{if(0!==e||0===e&&this.min<0){r=this.getDistanceFromCenterForValue(t.value);const i=this.getContext(e),a=s.setContext(i),l=n.setContext(i);!function(t,e,i,s,n){const o=t.ctx,a=e.circular,{color:r,lineWidth:l}=e;!a&&!s||!r||!l||i<0||(o.save(),o.strokeStyle=r,o.lineWidth=l,o.setLineDash(n.dash||[]),o.lineDashOffset=n.dashOffset,o.beginPath(),Eo(t,i,a,s),o.closePath(),o.stroke(),o.restore())}(this,a,r,o,l)}})),i.display){for(t.save(),a=o-1;a>=0;a--){const s=i.setContext(this.getPointLabelContext(a)),{color:n,lineWidth:o}=s;o&&n&&(t.lineWidth=o,t.strokeStyle=n,t.setLineDash(s.borderDash),t.lineDashOffset=s.borderDashOffset,r=this.getDistanceFromCenterForValue(e.reverse?this.min:this.max),l=this.getPointPosition(a,r),t.beginPath(),t.moveTo(this.xCenter,this.yCenter),t.lineTo(l.x,l.y),t.stroke())}t.restore()}}drawBorder(){}drawLabels(){const t=this.ctx,e=this.options,i=e.ticks;if(!i.display)return;const s=this.getIndexAngle(0);let n,o;t.save(),t.translate(this.xCenter,this.yCenter),t.rotate(s),t.textAlign="center",t.textBaseline="middle",this.ticks.forEach(((s,a)=>{if(0===a&&this.min>=0&&!e.reverse)return;const r=i.setContext(this.getContext(a)),l=Si(r.font);if(n=this.getDistanceFromCenterForValue(this.ticks[a].value),r.showLabelBackdrop){t.font=l.string,o=t.measureText(s.label).width,t.fillStyle=r.backdropColor;const e=ki(r.backdropPadding);t.fillRect(-o/2-e.left,-n-l.size/2-e.top,o+e.width,l.size+e.height)}Ne(t,s.label,0,-n,l,{color:r.color,strokeColor:r.textStrokeColor,strokeWidth:r.textStrokeWidth})})),t.restore()}drawTitle(){}}const Io={millisecond:{common:!0,size:1,steps:1e3},second:{common:!0,size:1e3,steps:60},minute:{common:!0,size:6e4,steps:60},hour:{common:!0,size:36e5,steps:24},day:{common:!0,size:864e5,steps:30},week:{common:!1,size:6048e5,steps:4},month:{common:!0,size:2628e6,steps:12},quarter:{common:!1,size:7884e6,steps:4},year:{common:!0,size:3154e7}},zo=Object.keys(Io);function Fo(t,e){return t-e}function Vo(t,e){if(s(e))return null;const i=t._adapter,{parser:n,round:o,isoWeekday:r}=t._parseOpts;let l=e;return"function"==typeof n&&(l=n(l)),a(l)||(l="string"==typeof n?i.parse(l,n):i.parse(l)),null===l?null:(o&&(l="week"!==o||!N(r)&&!0!==r?i.startOf(l,o):i.startOf(l,"isoWeek",r)),+l)}function Bo(t,e,i,s){const n=zo.length;for(let o=zo.indexOf(t);o=e?i[s]:i[n]]=!0}}else t[e]=!0}function No(t,e,i){const s=[],n={},o=e.length;let a,r;for(a=0;a=0&&(e[l].major=!0);return e}(t,s,n,i):s}class Ho extends tn{static id="time";static defaults={bounds:"data",adapters:{},time:{parser:!1,unit:!1,round:!1,isoWeekday:!1,minUnit:"millisecond",displayFormats:{}},ticks:{source:"auto",callback:!1,major:{enabled:!1}}};constructor(t){super(t),this._cache={data:[],labels:[],all:[]},this._unit="day",this._majorUnit=void 0,this._offsets={},this._normalized=!1,this._parseOpts=void 0}init(t,e={}){const i=t.time||(t.time={}),s=this._adapter=new In._date(t.adapters.date);s.init(e),b(i.displayFormats,s.formats()),this._parseOpts={parser:i.parser,round:i.round,isoWeekday:i.isoWeekday},super.init(t),this._normalized=e.normalized}parse(t,e){return void 0===t?null:Vo(this,t)}beforeLayout(){super.beforeLayout(),this._cache={data:[],labels:[],all:[]}}determineDataLimits(){const t=this.options,e=this._adapter,i=t.time.unit||"day";let{min:s,max:n,minDefined:o,maxDefined:r}=this.getUserBounds();function l(t){o||isNaN(t.min)||(s=Math.min(s,t.min)),r||isNaN(t.max)||(n=Math.max(n,t.max))}o&&r||(l(this._getLabelBounds()),"ticks"===t.bounds&&"labels"===t.ticks.source||l(this.getMinMax(!1))),s=a(s)&&!isNaN(s)?s:+e.startOf(Date.now(),i),n=a(n)&&!isNaN(n)?n:+e.endOf(Date.now(),i)+1,this.min=Math.min(s,n-1),this.max=Math.max(s+1,n)}_getLabelBounds(){const t=this.getLabelTimestamps();let e=Number.POSITIVE_INFINITY,i=Number.NEGATIVE_INFINITY;return t.length&&(e=t[0],i=t[t.length-1]),{min:e,max:i}}buildTicks(){const t=this.options,e=t.time,i=t.ticks,s="labels"===i.source?this.getLabelTimestamps():this._generate();"ticks"===t.bounds&&s.length&&(this.min=this._userMin||s[0],this.max=this._userMax||s[s.length-1]);const n=this.min,o=nt(s,n,this.max);return this._unit=e.unit||(i.autoSkip?Bo(e.minUnit,this.min,this.max,this._getLabelCapacity(n)):function(t,e,i,s,n){for(let o=zo.length-1;o>=zo.indexOf(i);o--){const i=zo[o];if(Io[i].common&&t._adapter.diff(n,s,i)>=e-1)return i}return zo[i?zo.indexOf(i):0]}(this,o.length,e.minUnit,this.min,this.max)),this._majorUnit=i.major.enabled&&"year"!==this._unit?function(t){for(let e=zo.indexOf(t)+1,i=zo.length;e+t.value)))}initOffsets(t=[]){let e,i,s=0,n=0;this.options.offset&&t.length&&(e=this.getDecimalForValue(t[0]),s=1===t.length?1-e:(this.getDecimalForValue(t[1])-e)/2,i=this.getDecimalForValue(t[t.length-1]),n=1===t.length?i:(i-this.getDecimalForValue(t[t.length-2]))/2);const o=t.length<3?.5:.25;s=Z(s,0,o),n=Z(n,0,o),this._offsets={start:s,end:n,factor:1/(s+1+n)}}_generate(){const t=this._adapter,e=this.min,i=this.max,s=this.options,n=s.time,o=n.unit||Bo(n.minUnit,e,i,this._getLabelCapacity(e)),a=l(s.ticks.stepSize,1),r="week"===o&&n.isoWeekday,h=N(r)||!0===r,c={};let d,u,f=e;if(h&&(f=+t.startOf(f,"isoWeek",r)),f=+t.startOf(f,h?"day":o),t.diff(i,e,o)>1e5*a)throw new Error(e+" and "+i+" are too far apart with stepSize of "+a+" "+o);const g="data"===s.ticks.source&&this.getDataTimestamps();for(d=f,u=0;d+t))}getLabelForValue(t){const e=this._adapter,i=this.options.time;return i.tooltipFormat?e.format(t,i.tooltipFormat):e.format(t,i.displayFormats.datetime)}format(t,e){const i=this.options.time.displayFormats,s=this._unit,n=e||i[s];return this._adapter.format(t,n)}_tickFormatFunction(t,e,i,s){const n=this.options,o=n.ticks.callback;if(o)return d(o,[t,e,i],this);const a=n.time.displayFormats,r=this._unit,l=this._majorUnit,h=r&&a[r],c=l&&a[l],u=i[e],f=l&&c&&u&&u.major;return this._adapter.format(t,s||(f?c:h))}generateTickLabels(t){let e,i,s;for(e=0,i=t.length;e0?a:1}getDataTimestamps(){let t,e,i=this._cache.data||[];if(i.length)return i;const s=this.getMatchingVisibleMetas();if(this._normalized&&s.length)return this._cache.data=s[0].controller.getAllParsedValues(this);for(t=0,e=s.length;t=t[r].pos&&e<=t[l].pos&&({lo:r,hi:l}=it(t,"pos",e)),({pos:s,time:o}=t[r]),({pos:n,time:a}=t[l])):(e>=t[r].time&&e<=t[l].time&&({lo:r,hi:l}=it(t,"time",e)),({time:s,pos:o}=t[r]),({time:n,pos:a}=t[l]));const h=n-s;return h?o+(a-o)*(e-s)/h:o}var $o=Object.freeze({__proto__:null,CategoryScale:class extends tn{static id="category";static defaults={ticks:{callback:mo}};constructor(t){super(t),this._startValue=void 0,this._valueRange=0,this._addedLabels=[]}init(t){const e=this._addedLabels;if(e.length){const t=this.getLabels();for(const{index:i,label:s}of e)t[i]===s&&t.splice(i,1);this._addedLabels=[]}super.init(t)}parse(t,e){if(s(t))return null;const i=this.getLabels();return((t,e)=>null===t?null:Z(Math.round(t),0,e))(e=isFinite(e)&&i[e]===t?e:po(i,t,l(e,t),this._addedLabels),i.length-1)}determineDataLimits(){const{minDefined:t,maxDefined:e}=this.getUserBounds();let{min:i,max:s}=this.getMinMax(!0);"ticks"===this.options.bounds&&(t||(i=0),e||(s=this.getLabels().length-1)),this.min=i,this.max=s}buildTicks(){const t=this.min,e=this.max,i=this.options.offset,s=[];let n=this.getLabels();n=0===t&&e===n.length-1?n:n.slice(t,e+1),this._valueRange=Math.max(n.length-(i?0:1),1),this._startValue=this.min-(i?.5:0);for(let i=t;i<=e;i++)s.push({value:i});return s}getLabelForValue(t){return mo.call(this,t)}configure(){super.configure(),this.isHorizontal()||(this._reversePixels=!this._reversePixels)}getPixelForValue(t){return"number"!=typeof t&&(t=this.parse(t)),null===t?NaN:this.getPixelForDecimal((t-this._startValue)/this._valueRange)}getPixelForTick(t){const e=this.ticks;return t<0||t>e.length-1?null:this.getPixelForValue(e[t].value)}getValueForPixel(t){return Math.round(this._startValue+this.getDecimalForPixel(t)*this._valueRange)}getBasePixel(){return this.bottom}},LinearScale:_o,LogarithmicScale:So,RadialLinearScale:Ro,TimeScale:Ho,TimeSeriesScale:class extends Ho{static id="timeseries";static defaults=Ho.defaults;constructor(t){super(t),this._table=[],this._minPos=void 0,this._tableRange=void 0}initOffsets(){const t=this._getTimestampsForTable(),e=this._table=this.buildLookupTable(t);this._minPos=jo(e,this.min),this._tableRange=jo(e,this.max)-this._minPos,super.initOffsets(t)}buildLookupTable(t){const{min:e,max:i}=this,s=[],n=[];let o,a,r,l,h;for(o=0,a=t.length;o=e&&l<=i&&s.push(l);if(s.length<2)return[{time:e,pos:0},{time:i,pos:1}];for(o=0,a=s.length;ot-e))}_getTimestampsForTable(){let t=this._cache.all||[];if(t.length)return t;const e=this.getDataTimestamps(),i=this.getLabelTimestamps();return t=e.length&&i.length?this.normalize(e.concat(i)):e.length?e:i,t=this._cache.all=t,t}getDecimalForValue(t){return(jo(this._table,t)-this._minPos)/this._tableRange}getValueForPixel(t){const e=this._offsets,i=this.getDecimalForPixel(t)/e.factor-e.end;return jo(this._table,i*this._tableRange+this._minPos,!0)}}});const Yo=["rgb(54, 162, 235)","rgb(255, 99, 132)","rgb(255, 159, 64)","rgb(255, 205, 86)","rgb(75, 192, 192)","rgb(153, 102, 255)","rgb(201, 203, 207)"],Uo=Yo.map((t=>t.replace("rgb(","rgba(").replace(")",", 0.5)")));function Xo(t){return Yo[t%Yo.length]}function qo(t){return Uo[t%Uo.length]}function Ko(t){let e=0;return(i,s)=>{const n=t.getDatasetMeta(s).controller;n instanceof $n?e=function(t,e){return t.backgroundColor=t.data.map((()=>Xo(e++))),e}(i,e):n instanceof Yn?e=function(t,e){return t.backgroundColor=t.data.map((()=>qo(e++))),e}(i,e):n&&(e=function(t,e){return t.borderColor=Xo(e),t.backgroundColor=qo(e),++e}(i,e))}}function Go(t){let e;for(e in t)if(t[e].borderColor||t[e].backgroundColor)return!0;return!1}var Jo={id:"colors",defaults:{enabled:!0,forceOverride:!1},beforeLayout(t,e,i){if(!i.enabled)return;const{data:{datasets:s},options:n}=t.config,{elements:o}=n,a=Go(s)||(r=n)&&(r.borderColor||r.backgroundColor)||o&&Go(o)||"rgba(0,0,0,0.1)"!==ue.borderColor||"rgba(0,0,0,0.1)"!==ue.backgroundColor;var r;if(!i.forceOverride&&a)return;const l=Ko(t);s.forEach(l)}};function Zo(t){if(t._decimated){const e=t._data;delete t._decimated,delete t._data,Object.defineProperty(t,"data",{configurable:!0,enumerable:!0,writable:!0,value:e})}}function Qo(t){t.data.datasets.forEach((t=>{Zo(t)}))}var ta={id:"decimation",defaults:{algorithm:"min-max",enabled:!1},beforeElementsUpdate:(t,e,i)=>{if(!i.enabled)return void Qo(t);const n=t.width;t.data.datasets.forEach(((e,o)=>{const{_data:a,indexAxis:r}=e,l=t.getDatasetMeta(o),h=a||e.data;if("y"===Pi([r,t.options.indexAxis]))return;if(!l.controller.supportsDecimation)return;const c=t.scales[l.xAxisID];if("linear"!==c.type&&"time"!==c.type)return;if(t.options.parsing)return;let{start:d,count:u}=function(t,e){const i=e.length;let s,n=0;const{iScale:o}=t,{min:a,max:r,minDefined:l,maxDefined:h}=o.getUserBounds();return l&&(n=Z(it(e,o.axis,a).lo,0,i-1)),s=h?Z(it(e,o.axis,r).hi+1,n,i)-n:i-n,{start:n,count:s}}(l,h);if(u<=(i.threshold||4*n))return void Zo(e);let f;switch(s(a)&&(e._data=h,delete e.data,Object.defineProperty(e,"data",{configurable:!0,enumerable:!0,get:function(){return this._decimated},set:function(t){this._data=t}})),i.algorithm){case"lttb":f=function(t,e,i,s,n){const o=n.samples||s;if(o>=i)return t.slice(e,e+i);const a=[],r=(i-2)/(o-2);let l=0;const h=e+i-1;let c,d,u,f,g,p=e;for(a[l++]=t[p],c=0;cu&&(u=f,d=t[s],g=s);a[l++]=d,p=g}return a[l++]=t[h],a}(h,d,u,n,i);break;case"min-max":f=function(t,e,i,n){let o,a,r,l,h,c,d,u,f,g,p=0,m=0;const x=[],b=e+i-1,_=t[e].x,y=t[b].x-_;for(o=e;og&&(g=l,d=o),p=(m*p+a.x)/++m;else{const i=o-1;if(!s(c)&&!s(d)){const e=Math.min(c,d),s=Math.max(c,d);e!==u&&e!==i&&x.push({...t[e],x:p}),s!==u&&s!==i&&x.push({...t[s],x:p})}o>0&&i!==u&&x.push(t[i]),x.push(a),h=e,m=0,f=g=l,c=d=u=o}}return x}(h,d,u,n);break;default:throw new Error(`Unsupported decimation algorithm '${i.algorithm}'`)}e._decimated=f}))},destroy(t){Qo(t)}};function ea(t,e,i,s){if(s)return;let n=e[t],o=i[t];return"angle"===t&&(n=G(n),o=G(o)),{property:t,start:n,end:o}}function ia(t,e,i){for(;e>t;e--){const t=i[e];if(!isNaN(t.x)&&!isNaN(t.y))break}return e}function sa(t,e,i,s){return t&&e?s(t[i],e[i]):t?t[i]:e?e[i]:0}function na(t,e){let i=[],s=!1;return n(t)?(s=!0,i=t):i=function(t,e){const{x:i=null,y:s=null}=t||{},n=e.points,o=[];return e.segments.forEach((({start:t,end:e})=>{e=ia(t,e,n);const a=n[t],r=n[e];null!==s?(o.push({x:a.x,y:s}),o.push({x:r.x,y:s})):null!==i&&(o.push({x:i,y:a.y}),o.push({x:i,y:r.y}))})),o}(t,e),i.length?new oo({points:i,options:{tension:0},_loop:s,_fullLoop:s}):null}function oa(t){return t&&!1!==t.fill}function aa(t,e,i){let s=t[e].fill;const n=[e];let o;if(!i)return s;for(;!1!==s&&-1===n.indexOf(s);){if(!a(s))return s;if(o=t[s],!o)return!1;if(o.visible)return s;n.push(s),s=o.fill}return!1}function ra(t,e,i){const s=function(t){const e=t.options,i=e.fill;let s=l(i&&i.target,i);void 0===s&&(s=!!e.backgroundColor);if(!1===s||null===s)return!1;if(!0===s)return"origin";return s}(t);if(o(s))return!isNaN(s.value)&&s;let n=parseFloat(s);return a(n)&&Math.floor(n)===n?function(t,e,i,s){"-"!==t&&"+"!==t||(i=e+i);if(i===e||i<0||i>=s)return!1;return i}(s[0],e,n,i):["origin","start","end","stack","shape"].indexOf(s)>=0&&s}function la(t,e,i){const s=[];for(let n=0;n=0;--e){const i=n[e].$filler;i&&(i.line.updateControlPoints(o,i.axis),s&&i.fill&&ua(t.ctx,i,o))}},beforeDatasetsDraw(t,e,i){if("beforeDatasetsDraw"!==i.drawTime)return;const s=t.getSortedVisibleDatasetMetas();for(let e=s.length-1;e>=0;--e){const i=s[e].$filler;oa(i)&&ua(t.ctx,i,t.chartArea)}},beforeDatasetDraw(t,e,i){const s=e.meta.$filler;oa(s)&&"beforeDatasetDraw"===i.drawTime&&ua(t.ctx,s,t.chartArea)},defaults:{propagate:!0,drawTime:"beforeDatasetDraw"}};const _a=(t,e)=>{let{boxHeight:i=e,boxWidth:s=e}=t;return t.usePointStyle&&(i=Math.min(i,e),s=t.pointStyleWidth||Math.min(s,e)),{boxWidth:s,boxHeight:i,itemHeight:Math.max(e,i)}};class ya extends $s{constructor(t){super(),this._added=!1,this.legendHitBoxes=[],this._hoveredItem=null,this.doughnutMode=!1,this.chart=t.chart,this.options=t.options,this.ctx=t.ctx,this.legendItems=void 0,this.columnSizes=void 0,this.lineWidths=void 0,this.maxHeight=void 0,this.maxWidth=void 0,this.top=void 0,this.bottom=void 0,this.left=void 0,this.right=void 0,this.height=void 0,this.width=void 0,this._margins=void 0,this.position=void 0,this.weight=void 0,this.fullSize=void 0}update(t,e,i){this.maxWidth=t,this.maxHeight=e,this._margins=i,this.setDimensions(),this.buildLabels(),this.fit()}setDimensions(){this.isHorizontal()?(this.width=this.maxWidth,this.left=this._margins.left,this.right=this.width):(this.height=this.maxHeight,this.top=this._margins.top,this.bottom=this.height)}buildLabels(){const t=this.options.labels||{};let e=d(t.generateLabels,[this.chart],this)||[];t.filter&&(e=e.filter((e=>t.filter(e,this.chart.data)))),t.sort&&(e=e.sort(((e,i)=>t.sort(e,i,this.chart.data)))),this.options.reverse&&e.reverse(),this.legendItems=e}fit(){const{options:t,ctx:e}=this;if(!t.display)return void(this.width=this.height=0);const i=t.labels,s=Si(i.font),n=s.size,o=this._computeTitleHeight(),{boxWidth:a,itemHeight:r}=_a(i,n);let l,h;e.font=s.string,this.isHorizontal()?(l=this.maxWidth,h=this._fitRows(o,n,a,r)+10):(h=this.maxHeight,l=this._fitCols(o,s,a,r)+10),this.width=Math.min(l,t.maxWidth||this.maxWidth),this.height=Math.min(h,t.maxHeight||this.maxHeight)}_fitRows(t,e,i,s){const{ctx:n,maxWidth:o,options:{labels:{padding:a}}}=this,r=this.legendHitBoxes=[],l=this.lineWidths=[0],h=s+a;let c=t;n.textAlign="left",n.textBaseline="middle";let d=-1,u=-h;return this.legendItems.forEach(((t,f)=>{const g=i+e/2+n.measureText(t.text).width;(0===f||l[l.length-1]+g+2*a>o)&&(c+=h,l[l.length-(f>0?0:1)]=0,u+=h,d++),r[f]={left:0,top:u,row:d,width:g,height:s},l[l.length-1]+=g+a})),c}_fitCols(t,e,i,s){const{ctx:n,maxHeight:o,options:{labels:{padding:a}}}=this,r=this.legendHitBoxes=[],l=this.columnSizes=[],h=o-t;let c=a,d=0,u=0,f=0,g=0;return this.legendItems.forEach(((t,o)=>{const{itemWidth:p,itemHeight:m}=function(t,e,i,s,n){const o=function(t,e,i,s){let n=t.text;n&&"string"!=typeof n&&(n=n.reduce(((t,e)=>t.length>e.length?t:e)));return e+i.size/2+s.measureText(n).width}(s,t,e,i),a=function(t,e,i){let s=t;"string"!=typeof e.text&&(s=va(e,i));return s}(n,s,e.lineHeight);return{itemWidth:o,itemHeight:a}}(i,e,n,t,s);o>0&&u+m+2*a>h&&(c+=d+a,l.push({width:d,height:u}),f+=d+a,g++,d=u=0),r[o]={left:f,top:u,col:g,width:p,height:m},d=Math.max(d,p),u+=m+a})),c+=d,l.push({width:d,height:u}),c}adjustHitBoxes(){if(!this.options.display)return;const t=this._computeTitleHeight(),{legendHitBoxes:e,options:{align:i,labels:{padding:s},rtl:n}}=this,o=Oi(n,this.left,this.width);if(this.isHorizontal()){let n=0,a=ft(i,this.left+s,this.right-this.lineWidths[n]);for(const r of e)n!==r.row&&(n=r.row,a=ft(i,this.left+s,this.right-this.lineWidths[n])),r.top+=this.top+t+s,r.left=o.leftForLtr(o.x(a),r.width),a+=r.width+s}else{let n=0,a=ft(i,this.top+t+s,this.bottom-this.columnSizes[n].height);for(const r of e)r.col!==n&&(n=r.col,a=ft(i,this.top+t+s,this.bottom-this.columnSizes[n].height)),r.top=a,r.left+=this.left+s,r.left=o.leftForLtr(o.x(r.left),r.width),a+=r.height+s}}isHorizontal(){return"top"===this.options.position||"bottom"===this.options.position}draw(){if(this.options.display){const t=this.ctx;Ie(t,this),this._draw(),ze(t)}}_draw(){const{options:t,columnSizes:e,lineWidths:i,ctx:s}=this,{align:n,labels:o}=t,a=ue.color,r=Oi(t.rtl,this.left,this.width),h=Si(o.font),{padding:c}=o,d=h.size,u=d/2;let f;this.drawTitle(),s.textAlign=r.textAlign("left"),s.textBaseline="middle",s.lineWidth=.5,s.font=h.string;const{boxWidth:g,boxHeight:p,itemHeight:m}=_a(o,d),x=this.isHorizontal(),b=this._computeTitleHeight();f=x?{x:ft(n,this.left+c,this.right-i[0]),y:this.top+c+b,line:0}:{x:this.left+c,y:ft(n,this.top+b+c,this.bottom-e[0].height),line:0},Ai(this.ctx,t.textDirection);const _=m+c;this.legendItems.forEach(((y,v)=>{s.strokeStyle=y.fontColor,s.fillStyle=y.fontColor;const M=s.measureText(y.text).width,w=r.textAlign(y.textAlign||(y.textAlign=o.textAlign)),k=g+u+M;let S=f.x,P=f.y;r.setWidth(this.width),x?v>0&&S+k+c>this.right&&(P=f.y+=_,f.line++,S=f.x=ft(n,this.left+c,this.right-i[f.line])):v>0&&P+_>this.bottom&&(S=f.x=S+e[f.line].width+c,f.line++,P=f.y=ft(n,this.top+b+c,this.bottom-e[f.line].height));if(function(t,e,i){if(isNaN(g)||g<=0||isNaN(p)||p<0)return;s.save();const n=l(i.lineWidth,1);if(s.fillStyle=l(i.fillStyle,a),s.lineCap=l(i.lineCap,"butt"),s.lineDashOffset=l(i.lineDashOffset,0),s.lineJoin=l(i.lineJoin,"miter"),s.lineWidth=n,s.strokeStyle=l(i.strokeStyle,a),s.setLineDash(l(i.lineDash,[])),o.usePointStyle){const a={radius:p*Math.SQRT2/2,pointStyle:i.pointStyle,rotation:i.rotation,borderWidth:n},l=r.xPlus(t,g/2);Ee(s,a,l,e+u,o.pointStyleWidth&&g)}else{const o=e+Math.max((d-p)/2,0),a=r.leftForLtr(t,g),l=wi(i.borderRadius);s.beginPath(),Object.values(l).some((t=>0!==t))?He(s,{x:a,y:o,w:g,h:p,radius:l}):s.rect(a,o,g,p),s.fill(),0!==n&&s.stroke()}s.restore()}(r.x(S),P,y),S=gt(w,S+g+u,x?S+k:this.right,t.rtl),function(t,e,i){Ne(s,i.text,t,e+m/2,h,{strikethrough:i.hidden,textAlign:r.textAlign(i.textAlign)})}(r.x(S),P,y),x)f.x+=k+c;else if("string"!=typeof y.text){const t=h.lineHeight;f.y+=va(y,t)+c}else f.y+=_})),Ti(this.ctx,t.textDirection)}drawTitle(){const t=this.options,e=t.title,i=Si(e.font),s=ki(e.padding);if(!e.display)return;const n=Oi(t.rtl,this.left,this.width),o=this.ctx,a=e.position,r=i.size/2,l=s.top+r;let h,c=this.left,d=this.width;if(this.isHorizontal())d=Math.max(...this.lineWidths),h=this.top+l,c=ft(t.align,c,this.right-d);else{const e=this.columnSizes.reduce(((t,e)=>Math.max(t,e.height)),0);h=l+ft(t.align,this.top,this.bottom-e-t.labels.padding-this._computeTitleHeight())}const u=ft(a,c,c+d);o.textAlign=n.textAlign(ut(a)),o.textBaseline="middle",o.strokeStyle=e.color,o.fillStyle=e.color,o.font=i.string,Ne(o,e.text,u,h,i)}_computeTitleHeight(){const t=this.options.title,e=Si(t.font),i=ki(t.padding);return t.display?e.lineHeight+i.height:0}_getLegendItemAt(t,e){let i,s,n;if(tt(t,this.left,this.right)&&tt(e,this.top,this.bottom))for(n=this.legendHitBoxes,i=0;it.chart.options.color,boxWidth:40,padding:10,generateLabels(t){const e=t.data.datasets,{labels:{usePointStyle:i,pointStyle:s,textAlign:n,color:o,useBorderRadius:a,borderRadius:r}}=t.legend.options;return t._getSortedDatasetMetas().map((t=>{const l=t.controller.getStyle(i?0:void 0),h=ki(l.borderWidth);return{text:e[t.index].label,fillStyle:l.backgroundColor,fontColor:o,hidden:!t.visible,lineCap:l.borderCapStyle,lineDash:l.borderDash,lineDashOffset:l.borderDashOffset,lineJoin:l.borderJoinStyle,lineWidth:(h.width+h.height)/4,strokeStyle:l.borderColor,pointStyle:s||l.pointStyle,rotation:l.rotation,textAlign:n||l.textAlign,borderRadius:a&&(r||l.borderRadius),datasetIndex:t.index}}),this)}},title:{color:t=>t.chart.options.color,display:!1,position:"center",text:""}},descriptors:{_scriptable:t=>!t.startsWith("on"),labels:{_scriptable:t=>!["generateLabels","filter","sort"].includes(t)}}};class wa extends $s{constructor(t){super(),this.chart=t.chart,this.options=t.options,this.ctx=t.ctx,this._padding=void 0,this.top=void 0,this.bottom=void 0,this.left=void 0,this.right=void 0,this.width=void 0,this.height=void 0,this.position=void 0,this.weight=void 0,this.fullSize=void 0}update(t,e){const i=this.options;if(this.left=0,this.top=0,!i.display)return void(this.width=this.height=this.right=this.bottom=0);this.width=this.right=t,this.height=this.bottom=e;const s=n(i.text)?i.text.length:1;this._padding=ki(i.padding);const o=s*Si(i.font).lineHeight+this._padding.height;this.isHorizontal()?this.height=o:this.width=o}isHorizontal(){const t=this.options.position;return"top"===t||"bottom"===t}_drawArgs(t){const{top:e,left:i,bottom:s,right:n,options:o}=this,a=o.align;let r,l,h,c=0;return this.isHorizontal()?(l=ft(a,i,n),h=e+t,r=n-i):("left"===o.position?(l=i+t,h=ft(a,s,e),c=-.5*C):(l=n-t,h=ft(a,e,s),c=.5*C),r=s-e),{titleX:l,titleY:h,maxWidth:r,rotation:c}}draw(){const t=this.ctx,e=this.options;if(!e.display)return;const i=Si(e.font),s=i.lineHeight/2+this._padding.top,{titleX:n,titleY:o,maxWidth:a,rotation:r}=this._drawArgs(s);Ne(t,e.text,0,0,i,{color:e.color,maxWidth:a,rotation:r,textAlign:ut(e.align),textBaseline:"middle",translation:[n,o]})}}var ka={id:"title",_element:wa,start(t,e,i){!function(t,e){const i=new wa({ctx:t.ctx,options:e,chart:t});ls.configure(t,i,e),ls.addBox(t,i),t.titleBlock=i}(t,i)},stop(t){const e=t.titleBlock;ls.removeBox(t,e),delete t.titleBlock},beforeUpdate(t,e,i){const s=t.titleBlock;ls.configure(t,s,i),s.options=i},defaults:{align:"center",display:!1,font:{weight:"bold"},fullSize:!0,padding:10,position:"top",text:"",weight:2e3},defaultRoutes:{color:"color"},descriptors:{_scriptable:!0,_indexable:!1}};const Sa=new WeakMap;var Pa={id:"subtitle",start(t,e,i){const s=new wa({ctx:t.ctx,options:i,chart:t});ls.configure(t,s,i),ls.addBox(t,s),Sa.set(t,s)},stop(t){ls.removeBox(t,Sa.get(t)),Sa.delete(t)},beforeUpdate(t,e,i){const s=Sa.get(t);ls.configure(t,s,i),s.options=i},defaults:{align:"center",display:!1,font:{weight:"normal"},fullSize:!0,padding:0,position:"top",text:"",weight:1500},defaultRoutes:{color:"color"},descriptors:{_scriptable:!0,_indexable:!1}};const Da={average(t){if(!t.length)return!1;let e,i,s=new Set,n=0,o=0;for(e=0,i=t.length;et+e))/s.size,y:n/o}},nearest(t,e){if(!t.length)return!1;let i,s,n,o=e.x,a=e.y,r=Number.POSITIVE_INFINITY;for(i=0,s=t.length;i-1?t.split("\n"):t}function Aa(t,e){const{element:i,datasetIndex:s,index:n}=e,o=t.getDatasetMeta(s).controller,{label:a,value:r}=o.getLabelAndValue(n);return{chart:t,label:a,parsed:o.getParsed(n),raw:t.data.datasets[s].data[n],formattedValue:r,dataset:o.getDataset(),dataIndex:n,datasetIndex:s,element:i}}function Ta(t,e){const i=t.chart.ctx,{body:s,footer:n,title:o}=t,{boxWidth:a,boxHeight:r}=e,l=Si(e.bodyFont),h=Si(e.titleFont),c=Si(e.footerFont),d=o.length,f=n.length,g=s.length,p=ki(e.padding);let m=p.height,x=0,b=s.reduce(((t,e)=>t+e.before.length+e.lines.length+e.after.length),0);if(b+=t.beforeBody.length+t.afterBody.length,d&&(m+=d*h.lineHeight+(d-1)*e.titleSpacing+e.titleMarginBottom),b){m+=g*(e.displayColors?Math.max(r,l.lineHeight):l.lineHeight)+(b-g)*l.lineHeight+(b-1)*e.bodySpacing}f&&(m+=e.footerMarginTop+f*c.lineHeight+(f-1)*e.footerSpacing);let _=0;const y=function(t){x=Math.max(x,i.measureText(t).width+_)};return i.save(),i.font=h.string,u(t.title,y),i.font=l.string,u(t.beforeBody.concat(t.afterBody),y),_=e.displayColors?a+2+e.boxPadding:0,u(s,(t=>{u(t.before,y),u(t.lines,y),u(t.after,y)})),_=0,i.font=c.string,u(t.footer,y),i.restore(),x+=p.width,{width:x,height:m}}function La(t,e,i,s){const{x:n,width:o}=i,{width:a,chartArea:{left:r,right:l}}=t;let h="center";return"center"===s?h=n<=(r+l)/2?"left":"right":n<=o/2?h="left":n>=a-o/2&&(h="right"),function(t,e,i,s){const{x:n,width:o}=s,a=i.caretSize+i.caretPadding;return"left"===t&&n+o+a>e.width||"right"===t&&n-o-a<0||void 0}(h,t,e,i)&&(h="center"),h}function Ea(t,e,i){const s=i.yAlign||e.yAlign||function(t,e){const{y:i,height:s}=e;return it.height-s/2?"bottom":"center"}(t,i);return{xAlign:i.xAlign||e.xAlign||La(t,e,i,s),yAlign:s}}function Ra(t,e,i,s){const{caretSize:n,caretPadding:o,cornerRadius:a}=t,{xAlign:r,yAlign:l}=i,h=n+o,{topLeft:c,topRight:d,bottomLeft:u,bottomRight:f}=wi(a);let g=function(t,e){let{x:i,width:s}=t;return"right"===e?i-=s:"center"===e&&(i-=s/2),i}(e,r);const p=function(t,e,i){let{y:s,height:n}=t;return"top"===e?s+=i:s-="bottom"===e?n+i:n/2,s}(e,l,h);return"center"===l?"left"===r?g+=h:"right"===r&&(g-=h):"left"===r?g-=Math.max(c,u)+n:"right"===r&&(g+=Math.max(d,f)+n),{x:Z(g,0,s.width-e.width),y:Z(p,0,s.height-e.height)}}function Ia(t,e,i){const s=ki(i.padding);return"center"===e?t.x+t.width/2:"right"===e?t.x+t.width-s.right:t.x+s.left}function za(t){return Ca([],Oa(t))}function Fa(t,e){const i=e&&e.dataset&&e.dataset.tooltip&&e.dataset.tooltip.callbacks;return i?t.override(i):t}const Va={beforeTitle:e,title(t){if(t.length>0){const e=t[0],i=e.chart.data.labels,s=i?i.length:0;if(this&&this.options&&"dataset"===this.options.mode)return e.dataset.label||"";if(e.label)return e.label;if(s>0&&e.dataIndex{const e={before:[],lines:[],after:[]},n=Fa(i,t);Ca(e.before,Oa(Ba(n,"beforeLabel",this,t))),Ca(e.lines,Ba(n,"label",this,t)),Ca(e.after,Oa(Ba(n,"afterLabel",this,t))),s.push(e)})),s}getAfterBody(t,e){return za(Ba(e.callbacks,"afterBody",this,t))}getFooter(t,e){const{callbacks:i}=e,s=Ba(i,"beforeFooter",this,t),n=Ba(i,"footer",this,t),o=Ba(i,"afterFooter",this,t);let a=[];return a=Ca(a,Oa(s)),a=Ca(a,Oa(n)),a=Ca(a,Oa(o)),a}_createItems(t){const e=this._active,i=this.chart.data,s=[],n=[],o=[];let a,r,l=[];for(a=0,r=e.length;at.filter(e,s,n,i)))),t.itemSort&&(l=l.sort(((e,s)=>t.itemSort(e,s,i)))),u(l,(e=>{const i=Fa(t.callbacks,e);s.push(Ba(i,"labelColor",this,e)),n.push(Ba(i,"labelPointStyle",this,e)),o.push(Ba(i,"labelTextColor",this,e))})),this.labelColors=s,this.labelPointStyles=n,this.labelTextColors=o,this.dataPoints=l,l}update(t,e){const i=this.options.setContext(this.getContext()),s=this._active;let n,o=[];if(s.length){const t=Da[i.position].call(this,s,this._eventPosition);o=this._createItems(i),this.title=this.getTitle(o,i),this.beforeBody=this.getBeforeBody(o,i),this.body=this.getBody(o,i),this.afterBody=this.getAfterBody(o,i),this.footer=this.getFooter(o,i);const e=this._size=Ta(this,i),a=Object.assign({},t,e),r=Ea(this.chart,i,a),l=Ra(i,a,r,this.chart);this.xAlign=r.xAlign,this.yAlign=r.yAlign,n={opacity:1,x:l.x,y:l.y,width:e.width,height:e.height,caretX:t.x,caretY:t.y}}else 0!==this.opacity&&(n={opacity:0});this._tooltipItems=o,this.$context=void 0,n&&this._resolveAnimations().update(this,n),t&&i.external&&i.external.call(this,{chart:this.chart,tooltip:this,replay:e})}drawCaret(t,e,i,s){const n=this.getCaretPosition(t,i,s);e.lineTo(n.x1,n.y1),e.lineTo(n.x2,n.y2),e.lineTo(n.x3,n.y3)}getCaretPosition(t,e,i){const{xAlign:s,yAlign:n}=this,{caretSize:o,cornerRadius:a}=i,{topLeft:r,topRight:l,bottomLeft:h,bottomRight:c}=wi(a),{x:d,y:u}=t,{width:f,height:g}=e;let p,m,x,b,_,y;return"center"===n?(_=u+g/2,"left"===s?(p=d,m=p-o,b=_+o,y=_-o):(p=d+f,m=p+o,b=_-o,y=_+o),x=p):(m="left"===s?d+Math.max(r,h)+o:"right"===s?d+f-Math.max(l,c)-o:this.caretX,"top"===n?(b=u,_=b-o,p=m-o,x=m+o):(b=u+g,_=b+o,p=m+o,x=m-o),y=b),{x1:p,x2:m,x3:x,y1:b,y2:_,y3:y}}drawTitle(t,e,i){const s=this.title,n=s.length;let o,a,r;if(n){const l=Oi(i.rtl,this.x,this.width);for(t.x=Ia(this,i.titleAlign,i),e.textAlign=l.textAlign(i.titleAlign),e.textBaseline="middle",o=Si(i.titleFont),a=i.titleSpacing,e.fillStyle=i.titleColor,e.font=o.string,r=0;r0!==t))?(t.beginPath(),t.fillStyle=n.multiKeyBackground,He(t,{x:e,y:g,w:h,h:l,radius:r}),t.fill(),t.stroke(),t.fillStyle=a.backgroundColor,t.beginPath(),He(t,{x:i,y:g+1,w:h-2,h:l-2,radius:r}),t.fill()):(t.fillStyle=n.multiKeyBackground,t.fillRect(e,g,h,l),t.strokeRect(e,g,h,l),t.fillStyle=a.backgroundColor,t.fillRect(i,g+1,h-2,l-2))}t.fillStyle=this.labelTextColors[i]}drawBody(t,e,i){const{body:s}=this,{bodySpacing:n,bodyAlign:o,displayColors:a,boxHeight:r,boxWidth:l,boxPadding:h}=i,c=Si(i.bodyFont);let d=c.lineHeight,f=0;const g=Oi(i.rtl,this.x,this.width),p=function(i){e.fillText(i,g.x(t.x+f),t.y+d/2),t.y+=d+n},m=g.textAlign(o);let x,b,_,y,v,M,w;for(e.textAlign=o,e.textBaseline="middle",e.font=c.string,t.x=Ia(this,m,i),e.fillStyle=i.bodyColor,u(this.beforeBody,p),f=a&&"right"!==m?"center"===o?l/2+h:l+2+h:0,y=0,M=s.length;y0&&e.stroke()}_updateAnimationTarget(t){const e=this.chart,i=this.$animations,s=i&&i.x,n=i&&i.y;if(s||n){const i=Da[t.position].call(this,this._active,this._eventPosition);if(!i)return;const o=this._size=Ta(this,t),a=Object.assign({},i,this._size),r=Ea(e,t,a),l=Ra(t,a,r,e);s._to===l.x&&n._to===l.y||(this.xAlign=r.xAlign,this.yAlign=r.yAlign,this.width=o.width,this.height=o.height,this.caretX=i.x,this.caretY=i.y,this._resolveAnimations().update(this,l))}}_willRender(){return!!this.opacity}draw(t){const e=this.options.setContext(this.getContext());let i=this.opacity;if(!i)return;this._updateAnimationTarget(e);const s={width:this.width,height:this.height},n={x:this.x,y:this.y};i=Math.abs(i)<.001?0:i;const o=ki(e.padding),a=this.title.length||this.beforeBody.length||this.body.length||this.afterBody.length||this.footer.length;e.enabled&&a&&(t.save(),t.globalAlpha=i,this.drawBackground(n,t,s,e),Ai(t,e.textDirection),n.y+=o.top,this.drawTitle(n,t,e),this.drawBody(n,t,e),this.drawFooter(n,t,e),Ti(t,e.textDirection),t.restore())}getActiveElements(){return this._active||[]}setActiveElements(t,e){const i=this._active,s=t.map((({datasetIndex:t,index:e})=>{const i=this.chart.getDatasetMeta(t);if(!i)throw new Error("Cannot find a dataset at index "+t);return{datasetIndex:t,element:i.data[e],index:e}})),n=!f(i,s),o=this._positionChanged(s,e);(n||o)&&(this._active=s,this._eventPosition=e,this._ignoreReplayEvents=!0,this.update(!0))}handleEvent(t,e,i=!0){if(e&&this._ignoreReplayEvents)return!1;this._ignoreReplayEvents=!1;const s=this.options,n=this._active||[],o=this._getActiveElements(t,n,e,i),a=this._positionChanged(o,t),r=e||!f(o,n)||a;return r&&(this._active=o,(s.enabled||s.external)&&(this._eventPosition={x:t.x,y:t.y},this.update(!0,e))),r}_getActiveElements(t,e,i,s){const n=this.options;if("mouseout"===t.type)return[];if(!s)return e.filter((t=>this.chart.data.datasets[t.datasetIndex]&&void 0!==this.chart.getDatasetMeta(t.datasetIndex).controller.getParsed(t.index)));const o=this.chart.getElementsAtEventForMode(t,n.mode,n,i);return n.reverse&&o.reverse(),o}_positionChanged(t,e){const{caretX:i,caretY:s,options:n}=this,o=Da[n.position].call(this,t,e);return!1!==o&&(i!==o.x||s!==o.y)}}var Na={id:"tooltip",_element:Wa,positioners:Da,afterInit(t,e,i){i&&(t.tooltip=new Wa({chart:t,options:i}))},beforeUpdate(t,e,i){t.tooltip&&t.tooltip.initialize(i)},reset(t,e,i){t.tooltip&&t.tooltip.initialize(i)},afterDraw(t){const e=t.tooltip;if(e&&e._willRender()){const i={tooltip:e};if(!1===t.notifyPlugins("beforeTooltipDraw",{...i,cancelable:!0}))return;e.draw(t.ctx),t.notifyPlugins("afterTooltipDraw",i)}},afterEvent(t,e){if(t.tooltip){const i=e.replay;t.tooltip.handleEvent(e.event,i,e.inChartArea)&&(e.changed=!0)}},defaults:{enabled:!0,external:null,position:"average",backgroundColor:"rgba(0,0,0,0.8)",titleColor:"#fff",titleFont:{weight:"bold"},titleSpacing:2,titleMarginBottom:6,titleAlign:"left",bodyColor:"#fff",bodySpacing:2,bodyFont:{},bodyAlign:"left",footerColor:"#fff",footerSpacing:2,footerMarginTop:6,footerFont:{weight:"bold"},footerAlign:"left",padding:6,caretPadding:2,caretSize:5,cornerRadius:6,boxHeight:(t,e)=>e.bodyFont.size,boxWidth:(t,e)=>e.bodyFont.size,multiKeyBackground:"#fff",displayColors:!0,boxPadding:0,borderColor:"rgba(0,0,0,0)",borderWidth:0,animation:{duration:400,easing:"easeOutQuart"},animations:{numbers:{type:"number",properties:["x","y","width","height","caretX","caretY"]},opacity:{easing:"linear",duration:200}},callbacks:Va},defaultRoutes:{bodyFont:"font",footerFont:"font",titleFont:"font"},descriptors:{_scriptable:t=>"filter"!==t&&"itemSort"!==t&&"external"!==t,_indexable:!1,callbacks:{_scriptable:!1,_indexable:!1},animation:{_fallback:!1},animations:{_fallback:"animation"}},additionalOptionScopes:["interaction"]};return Tn.register(Un,$o,go,t),Tn.helpers={...Hi},Tn._adapters=In,Tn.Animation=As,Tn.Animations=Ts,Tn.animator=bt,Tn.controllers=nn.controllers.items,Tn.DatasetController=js,Tn.Element=$s,Tn.elements=go,Tn.Interaction=Ki,Tn.layouts=ls,Tn.platforms=Ds,Tn.Scale=tn,Tn.Ticks=ae,Object.assign(Tn,Un,$o,go,t,Ds),Tn.Chart=Tn,"undefined"!=typeof window&&(window.Chart=Tn),Tn}));
+//# sourceMappingURL=chart.umd.min.js.map
diff --git a/luci-app-netstat/files/www/luci-static/resources/netstat/chartjs-plugin-datalabels b/luci-app-netstat/files/www/luci-static/resources/netstat/chartjs-plugin-datalabels
new file mode 100644
index 000000000..e84e6ff05
--- /dev/null
+++ b/luci-app-netstat/files/www/luci-static/resources/netstat/chartjs-plugin-datalabels
@@ -0,0 +1,7 @@
+/*!
+ * chartjs-plugin-datalabels v2.2.0
+ * https://chartjs-plugin-datalabels.netlify.app
+ * (c) 2017-2022 chartjs-plugin-datalabels contributors
+ * Released under the MIT license
+ */
+!function(t,e){"object"==typeof exports&&"undefined"!=typeof module?module.exports=e(require("chart.js/helpers"),require("chart.js")):"function"==typeof define&&define.amd?define(["chart.js/helpers","chart.js"],e):(t="undefined"!=typeof globalThis?globalThis:t||self).ChartDataLabels=e(t.Chart.helpers,t.Chart)}(this,(function(t,e){"use strict";var r=function(){if("undefined"!=typeof window){if(window.devicePixelRatio)return window.devicePixelRatio;var t=window.screen;if(t)return(t.deviceXDPI||1)/(t.logicalXDPI||1)}return 1}(),a=function(e){var r,a=[];for(e=[].concat(e);e.length;)"string"==typeof(r=e.pop())?a.unshift.apply(a,r.split("\n")):Array.isArray(r)?e.push.apply(e,r):t.isNullOrUndef(e)||a.unshift(""+r);return a},o=function(t,e,r){var a,o=[].concat(e),n=o.length,i=t.font,l=0;for(t.font=r.string,a=0;ar.right&&(a|=2),er.bottom&&(a|=4),a}function u(t,e){var r,a,o=e.anchor,n=t;return e.clamp&&(n=function(t,e){for(var r,a,o,n=t.x0,i=t.y0,l=t.x1,u=t.y1,d=s(n,i,e),c=s(l,u,e);d|c&&!(d&c);)8&(r=d||c)?(a=n+(l-n)*(e.top-i)/(u-i),o=e.top):4&r?(a=n+(l-n)*(e.bottom-i)/(u-i),o=e.bottom):2&r?(o=i+(u-i)*(e.right-n)/(l-n),a=e.right):1&r&&(o=i+(u-i)*(e.left-n)/(l-n),a=e.left),r===d?d=s(n=a,i=o,e):c=s(l=a,u=o,e);return{x0:n,x1:l,y0:i,y1:u}}(n,e.area)),"start"===o?(r=n.x0,a=n.y0):"end"===o?(r=n.x1,a=n.y1):(r=(n.x0+n.x1)/2,a=(n.y0+n.y1)/2),function(t,e,r,a,o){switch(o){case"center":r=a=0;break;case"bottom":r=0,a=1;break;case"right":r=1,a=0;break;case"left":r=-1,a=0;break;case"top":r=0,a=-1;break;case"start":r=-r,a=-a;break;case"end":break;default:o*=Math.PI/180,r=Math.cos(o),a=Math.sin(o)}return{x:t,y:e,vx:r,vy:a}}(r,a,t.vx,t.vy,e.align)}var d=function(t,e){var r=(t.startAngle+t.endAngle)/2,a=Math.cos(r),o=Math.sin(r),n=t.innerRadius,i=t.outerRadius;return u({x0:t.x+a*n,y0:t.y+o*n,x1:t.x+a*i,y1:t.y+o*i,vx:a,vy:o},e)},c=function(t,e){var r=l(t,e.origin),a=r.x*t.options.radius,o=r.y*t.options.radius;return u({x0:t.x-a,y0:t.y-o,x1:t.x+a,y1:t.y+o,vx:r.x,vy:r.y},e)},h=function(t,e){var r=l(t,e.origin),a=t.x,o=t.y,n=0,i=0;return t.horizontal?(a=Math.min(t.x,t.base),n=Math.abs(t.base-t.x)):(o=Math.min(t.y,t.base),i=Math.abs(t.base-t.y)),u({x0:a,y0:o+i,x1:a+n,y1:o,vx:r.x,vy:r.y},e)},f=function(t,e){var r=l(t,e.origin);return u({x0:t.x,y0:t.y,x1:t.x+(t.width||0),y1:t.y+(t.height||0),vx:r.x,vy:r.y},e)},x=function(t){return Math.round(t*r)/r};function y(t,e){var r=e.chart.getDatasetMeta(e.datasetIndex).vScale;if(!r)return null;if(void 0!==r.xCenter&&void 0!==r.yCenter)return{x:r.xCenter,y:r.yCenter};var a=r.getBasePixel();return t.horizontal?{x:a,y:null}:{x:null,y:a}}function v(t,e,r){var a=r.backgroundColor,o=r.borderColor,n=r.borderWidth;(a||o&&n)&&(t.beginPath(),function(t,e,r,a,o,n){var i=Math.PI/2;if(n){var l=Math.min(n,o/2,a/2),s=e+l,u=r+l,d=e+a-l,c=r+o-l;t.moveTo(e,u),sr.x+r.w+2||t.y>r.y+r.h+2)},intersects:function(t){var e,r,a,o=this._points(),n=t._points(),i=[M(o[0],o[1]),M(o[0],o[3])];for(this._rotation!==t._rotation&&i.push(M(n[0],n[1]),M(n[0],n[3])),e=0;et.getProps([e],!0)[e]}),n=a.geometry(),i=$(l,a.model(),n),o._box.update(i,n,a.rotation()));(function(t,e){var r,a,o,n;for(r=t.length-1;r>=0;--r)for(o=t[r].$layout,a=r-1;a>=0&&o._visible;--a)(n=t[a].$layout)._visible&&o._box.intersects(n._box)&&e(o,n)})(t,(function(t,e){var r=t._hidable,a=e._hidable;r&&a||a?e._visible=!1:r&&(t._visible=!1)}))}(t)},lookup:function(t,e){var r,a;for(r=t.length-1;r>=0;--r)if((a=t[r].$layout)&&a._visible&&a._box.contains(e))return t[r];return null},draw:function(t,e){var r,a,o,n,i,l;for(r=0,a=e.length;r
\ No newline at end of file
diff --git a/luci-app-netstat/files/www/luci-static/resources/netstat/eye-outline.svg b/luci-app-netstat/files/www/luci-static/resources/netstat/eye-outline.svg
new file mode 100644
index 000000000..6728c9bfd
--- /dev/null
+++ b/luci-app-netstat/files/www/luci-static/resources/netstat/eye-outline.svg
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/luci-app-netstat/files/www/luci-static/resources/netstat/netstat-usage.css b/luci-app-netstat/files/www/luci-static/resources/netstat/netstat-usage.css
new file mode 100644
index 000000000..5f98fd94e
--- /dev/null
+++ b/luci-app-netstat/files/www/luci-static/resources/netstat/netstat-usage.css
@@ -0,0 +1,110 @@
+/* netstat-usage.css */
+.netstat-dashboard {
+    border: 1px solid #dfe3eb;
+    border-radius: 10px;
+    background: #fff;
+    padding: 16px 18px;
+}
+
+.netstat-summary {
+    display: flex;
+    gap: 12px;
+    flex-wrap: wrap;
+    margin-bottom: 16px;
+    padding: 10px 14px;
+    background: #f7f9fc;
+    border: 1px solid #dfe3eb;
+    border-radius: 8px;
+    font-size: 13px;
+}
+
+.netstat-summary-item {
+    display: flex;
+    align-items: center;
+    gap: 6px;
+    font-weight: 600;
+    color: #374151;
+}
+
+.netstat-summary-dot {
+    width: 10px;
+    height: 10px;
+    border-radius: 50%;
+    flex-shrink: 0;
+}
+
+.netstat-summary-dot.rx { background: #16a34a; }
+.netstat-summary-dot.tx { background: #d97706; }
+
+.netstat-summary-label {
+    color: #6b7280;
+    font-weight: 400;
+    margin-right: 2px;
+}
+
+.netstat-summary-total {
+    margin-left: auto;
+}
+
+.netstat-chart-wrap {
+    border: 1px solid #dfe4ea;
+    border-radius: 8px;
+    padding: 14px;
+    background: #fff;
+    overflow: hidden;
+}
+
+.netstat-chart-header {
+    display: flex;
+    justify-content: space-between;
+    align-items: center;
+    margin-bottom: 10px;
+    flex-wrap: wrap;
+    gap: 6px;
+}
+
+.netstat-chart-title {
+    margin: 0;
+    font-size: 15px;
+    font-weight: 600;
+    color: #1f2937;
+}
+
+.netstat-chart-badge {
+    font-size: 11px;
+    font-weight: 600;
+    padding: 2px 8px;
+    border-radius: 999px;
+    background: #e0f2fe;
+    color: #0369a1;
+}
+
+.netstat-chart-canvas {
+    width: 100%;
+    display: block;
+}
+
+.netstat-empty {
+    padding: 32px;
+    text-align: center;
+    color: #6b7280;
+    font-size: 14px;
+}
+
+.netstat-empty-icon {
+    font-size: 36px;
+    display: block;
+    margin-bottom: 8px;
+}
+
+.netstat-hint {
+    margin-top: 6px;
+    font-size: 12px;
+    color: #9ca3af;
+}
+
+@media (max-width: 640px) {
+    .netstat-dashboard  { padding: 12px; }
+    .netstat-summary    { gap: 8px; }
+    .netstat-chart-wrap { padding: 10px; }
+}
diff --git a/luci-app-netstat/files/www/luci-static/resources/netstat/netstat.css b/luci-app-netstat/files/www/luci-static/resources/netstat/netstat.css
new file mode 100644
index 000000000..807c3b83d
--- /dev/null
+++ b/luci-app-netstat/files/www/luci-static/resources/netstat/netstat.css
@@ -0,0 +1,400 @@
+/* ── netstat.css  (light theme) ── */
+
+/* CSS custom properties – override all the scattered !important chains */
+:root {
+  --ns-bg:           #ffffff;
+  --ns-border:       #dfe3eb;
+  --ns-text:         #111111;
+  --ns-muted:        #4b5563;
+  --ns-number:       #111111;
+  --ns-unit:         #2a2a2a;
+  --ns-label:        #3a3a3a;
+  --ns-box-shadow:   rgba(0,0,0,0.05);
+  --ns-dl-color:     #1f7a3a;
+  --ns-ul-color:     #1c63b8;
+  --ns-total-color:  #222222;
+  --ns-status-up:    #1e6b2f;
+  --ns-status-down:  #b32020;
+  --ns-sep:          #111111;
+  --ns-summary-bg:   #f7f9fc;
+  --ns-badge-bg:     #e0f2fe;
+  --ns-badge-text:   #0369a1;
+  --ns-mem-color:    #7c3aed;
+  --ns-temp-color:   #dc2626;
+  --ns-disk-color:   #0891b2;
+  --ns-bar-bg:       #e5e7eb;
+}
+
+/* ── Widget wrapper ─────────────────────────────────────────────────────────── */
+.stats-grid.netstat-wrap {
+  padding: 10px 0 !important;
+  border-radius: 0 !important;
+  border: 0 !important;
+  overflow: visible !important;
+  background: transparent !important;
+  box-shadow: none !important;
+  font-family: "Trebuchet MS", "Lucida Sans Unicode", sans-serif !important;
+  max-width: 1240px !important;
+  width: 100% !important;
+  margin: 0 auto !important;
+}
+
+.netstat-row {
+  display: flex !important;
+  gap: 10px !important;
+  align-items: stretch !important;
+  justify-content: center !important;
+  flex-wrap: nowrap !important;        /* single row on desktop */
+  max-width: 1280px !important;
+  margin: 0 auto !important;
+  padding: 0 16px !important;
+}
+
+/* ── Stat boxes ──────────────────────────────────────────────────────────────── */
+.netstat-box {
+  flex: 1 1 0 !important;             /* all boxes share space equally */
+  min-width: 0 !important;
+  max-width: none !important;
+  padding: 12px 10px !important;
+  background: var(--ns-bg) !important;
+  border: 2px solid var(--ns-border) !important;
+  border-radius: 12px !important;
+  text-align: center !important;
+  box-shadow: 0 2px 6px var(--ns-box-shadow) !important;
+  transition: border-color 0.15s, box-shadow 0.15s !important;
+  display: flex !important;
+  flex-direction: column !important;
+  justify-content: center !important;
+  box-sizing: border-box !important;
+}
+
+.netstat-box:hover {
+  border-color: #94a3b8 !important;
+  box-shadow: 0 4px 12px rgba(0,0,0,0.10) !important;
+}
+
+.netstat-center {
+  flex: 1.2 1 0 !important;           /* status card slightly wider */
+  min-width: 0 !important;
+  border-style: dashed !important;
+  border-width: 2px !important;
+}
+
+.netstat-info-card {
+  flex: 1.2 1 0 !important;           /* info cards slightly wider for pill bars */
+  min-width: 0 !important;
+}
+
+/* ── Typography ─────────────────────────────────────────────────────────────── */
+.netstat-number {
+  font-weight: 800 !important;
+  font-size: 24px !important;
+  color: var(--ns-number) !important;
+  line-height: 1 !important;
+}
+
+.netstat-unit {
+  font-weight: 700 !important;
+  font-size: 12px !important;
+  color: var(--ns-unit) !important;
+  letter-spacing: 0.2px !important;
+  margin-top: 4px !important;
+}
+
+.netstat-label {
+  margin-top: 6px !important;
+  font-size: 11px !important;
+  font-weight: 700 !important;
+  color: var(--ns-label) !important;
+  text-transform: uppercase !important;
+  letter-spacing: 0.6px !important;
+}
+
+/* ── Center (status) card ─────────────────────────────────────────────────── */
+.netstat-center-title {
+  font-size: 11px !important;
+  font-weight: 800 !important;
+  color: var(--ns-muted) !important;
+  text-transform: uppercase !important;
+  letter-spacing: 0.8px !important;
+}
+
+.netstat-center-status {
+  font-size: 15px !important;
+  font-weight: 800 !important;
+  color: var(--ns-status-up) !important;
+  margin-top: 4px !important;
+}
+
+.netstat-center-sep {
+  height: 1px !important;
+  background: var(--ns-sep) !important;
+  opacity: 0.15 !important;
+  margin: 8px 0 !important;
+}
+
+.netstat-center-ip {
+  font-size: 12px !important;
+  font-weight: 700 !important;
+  color: var(--ns-text) !important;
+  font-family: "Lucida Console", "Courier New", monospace !important;
+  word-break: break-all !important;
+  margin-top: 4px !important;
+}
+
+
+/* ── Accent colours ─────────────────────────────────────────────────────────── */
+.netstat-box.is-download   .netstat-number { color: var(--ns-dl-color)    !important; }
+.netstat-box.is-upload     .netstat-number { color: var(--ns-ul-color)    !important; }
+.netstat-box.is-total      .netstat-number { color: var(--ns-total-color) !important; }
+.netstat-box.is-downloaded .netstat-number { color: var(--ns-dl-color)    !important; }
+.netstat-box.is-uploaded   .netstat-number { color: var(--ns-ul-color)    !important; }
+.netstat-box.is-down .netstat-center-status { color: var(--ns-status-down) !important; }
+
+/* ── Downloaded / Uploaded stat box accent borders ─────────────────────────── */
+.netstat-box.is-downloaded {
+  border-color: color-mix(in srgb, var(--ns-dl-color) 35%, var(--ns-border)) !important;
+}
+.netstat-box.is-uploaded {
+  border-color: color-mix(in srgb, var(--ns-ul-color) 35%, var(--ns-border)) !important;
+}
+
+/* Fallback for browsers without color-mix */
+@supports not (color: color-mix(in srgb, red 50%, blue)) {
+  .netstat-box.is-downloaded { border-color: #a8d5b5 !important; }
+  .netstat-box.is-uploaded   { border-color: #a8c8f0 !important; }
+}
+
+/* ── Stat box value row ──────────────────────────────────────────────────────── */
+.ns-stat-value-row {
+  display: flex !important;
+  align-items: baseline !important;
+  justify-content: center !important;
+  gap: 4px !important;
+}
+
+/* ── Rate box layout ────────────────────────────────────────────────────────── */
+.ns-spark {
+  width: 90px !important;
+  height: 28px !important;
+  margin: 0 auto 4px !important;
+  display: block !important;
+}
+
+.ns-rate-row {
+  display: flex !important;
+  align-items: baseline !important;
+  justify-content: center !important;
+  gap: 4px !important;
+}
+
+.ns-peak {
+  font-size: 10px !important;
+  font-weight: 600 !important;
+  color: var(--ns-muted) !important;
+  margin-top: 2px !important;
+  letter-spacing: 0.2px !important;
+}
+
+/* ── Trend arrows ───────────────────────────────────────────────────────────── */
+.ns-trend {
+  font-size: 13px !important;
+  font-weight: 900 !important;
+  line-height: 1 !important;
+  margin-left: 2px !important;
+}
+
+.ns-trend-up   { color: #1f7a3a !important; }
+.ns-trend-down { color: #b32020 !important; }
+.ns-trend-flat { color: #9ca3af !important; font-size: 8px !important; }
+
+/* ── Info card ───────────────────────────────────────────────────────────────── */
+.netstat-info-card {
+  display: flex !important;
+  flex-direction: column !important;
+  justify-content: center !important;
+  gap: 0 !important;
+  padding: 10px !important;
+}
+
+.ns-info-row {
+  display: flex !important;
+  align-items: center !important;
+  gap: 8px !important;
+  padding: 4px 0 !important;
+}
+
+.ns-info-icon {
+  font-size: 18px !important;
+  line-height: 1 !important;
+  width: 24px !important;
+  text-align: center !important;
+}
+
+.ns-info-block {
+  display: flex !important;
+  flex-direction: column !important;
+  align-items: flex-start !important;
+}
+
+.ns-info-value {
+  font-size: 15px !important;
+  font-weight: 800 !important;
+  color: var(--ns-number) !important;
+  line-height: 1 !important;
+  font-family: "Lucida Console", "Courier New", monospace !important;
+}
+
+.ns-info-label {
+  font-size: 10px !important;
+  font-weight: 700 !important;
+  color: var(--ns-muted) !important;
+  text-transform: uppercase !important;
+  letter-spacing: 0.5px !important;
+  margin-top: 2px !important;
+}
+
+.ns-info-block-grow {
+  flex: 1 !important;
+  min-width: 0 !important;
+}
+
+.ns-info-top-row {
+  display: flex !important;
+  align-items: baseline !important;
+  justify-content: space-between !important;
+  gap: 4px !important;
+}
+
+.ns-info-sublabel {
+  font-size: 10px !important;
+  font-weight: 600 !important;
+  color: var(--ns-muted) !important;
+  white-space: nowrap !important;
+}
+
+/* ── Info tag label (RAM / CPU TEMP / STORAGE) ──────────────────────────────── */
+.ns-info-tag {
+  font-size: 9px !important;
+  font-weight: 800 !important;
+  color: var(--ns-muted) !important;
+  text-transform: uppercase !important;
+  letter-spacing: 0.7px !important;
+  margin-top: 3px !important;
+}
+
+/* ── Pill bar (RAM / STORAGE) ────────────────────────────────────────────────── */
+.ns-pill-bar {
+  position: relative !important;
+  height: 18px !important;
+  background: var(--ns-bar-bg) !important;
+  border-radius: 20px !important;
+  margin-top: 4px !important;
+  overflow: hidden !important;
+  width: 100% !important;
+}
+
+.ns-pill-fill {
+  position: absolute !important;
+  top: 0 !important;
+  left: 0 !important;
+  height: 100% !important;
+  border-radius: 20px !important;
+  transition: width 0.5s ease !important;
+  opacity: 0.30 !important;
+}
+
+.ns-pill-text {
+  position: relative !important;
+  z-index: 1 !important;
+  display: block !important;
+  text-align: center !important;
+  font-size: 9.5px !important;
+  font-weight: 700 !important;
+  color: var(--ns-text) !important;
+  line-height: 18px !important;
+  white-space: nowrap !important;
+  overflow: hidden !important;
+  text-overflow: ellipsis !important;
+  padding: 0 6px !important;
+}
+
+#ns-mem-bar  { background: var(--ns-mem-color)  !important; }
+#ns-disk-bar { background: var(--ns-disk-color) !important; }
+
+/* ── Temperature value colour ───────────────────────────────────────────────── */
+.ns-temp-val { color: var(--ns-temp-color) !important; }
+
+/* ── Responsive ─────────────────────────────────────────────────────────────── */
+
+/* Tablet: wrap into 2 columns */
+@media (max-width: 900px) {
+  .netstat-row {
+    flex-wrap: wrap !important;
+    padding: 0 10px !important;
+    gap: 10px !important;
+  }
+
+  .netstat-box,
+  .netstat-center,
+  .netstat-info-card {
+    flex: 1 1 calc(50% - 10px) !important;
+    min-width: 0 !important;
+    max-width: none !important;
+    box-sizing: border-box !important;
+  }
+
+  /* Status card full width, placed after rate+total boxes */
+  .netstat-center {
+    flex: 1 1 100% !important;
+    order: 5 !important;
+  }
+}
+
+/* Mobile: 2 compact columns, explicit order matching screenshot */
+@media (max-width: 600px) {
+  .netstat-row {
+    flex-wrap: wrap !important;
+    padding: 0 8px !important;
+    gap: 8px !important;
+  }
+
+  .netstat-box,
+  .netstat-center,
+  .netstat-info-card {
+    flex: 1 1 calc(50% - 8px) !important;
+    min-width: 0 !important;
+    max-width: none !important;
+    padding: 10px 8px !important;
+    box-sizing: border-box !important;
+  }
+
+  /* Mobile order: download | upload → status(full) → info | temp → downloaded | uploaded */
+  .netstat-box.is-download   { order: 1 !important; }
+  .netstat-box.is-upload     { order: 2 !important; }
+  .netstat-center            { order: 3 !important; flex: 1 1 100% !important; }
+  .netstat-info-card         { order: 4 !important; }
+  .netstat-box.is-downloaded { order: 5 !important; }
+  .netstat-box.is-uploaded   { order: 6 !important; }
+
+  .netstat-number { font-size: 20px !important; }
+  .netstat-unit   { font-size: 11px !important; }
+
+  .ns-spark {
+    width: 100% !important;
+    max-width: 80px !important;
+  }
+
+  .netstat-info-card {
+    padding: 8px !important;
+  }
+}
+
+/* Very small phones: single column */
+@media (max-width: 360px) {
+  .netstat-box,
+  .netstat-center,
+  .netstat-info-card {
+    flex: 1 1 100% !important;
+  }
+}
diff --git a/luci-app-netstat/files/www/luci-static/resources/netstat/netstat_dark.css b/luci-app-netstat/files/www/luci-static/resources/netstat/netstat_dark.css
new file mode 100644
index 000000000..e0e4e76b6
--- /dev/null
+++ b/luci-app-netstat/files/www/luci-static/resources/netstat/netstat_dark.css
@@ -0,0 +1,38 @@
+/* ── netstat_dark.css  (dark theme)  ── */
+/* Imports light theme then overrides only the colour tokens.
+   This eliminates ~120 lines of duplicated rules.            */
+@import url("netstat.css");
+
+:root {
+  --ns-bg:           #0f1113;
+  --ns-border:       #374151;
+  --ns-text:         #f4f4f4;
+  --ns-muted:        #9ca3af;
+  --ns-number:       #f4f4f4;
+  --ns-unit:         #d6d6d6;
+  --ns-label:        #c8c8c8;
+  --ns-box-shadow:   rgba(0,0,0,0.35);
+  --ns-dl-color:     #7fdc98;
+  --ns-ul-color:     #7db8ff;
+  --ns-total-color:  #f0f0f0;
+  --ns-status-up:    #7fdc98;
+  --ns-status-down:  #ff7d7d;
+  --ns-sep:          #e6e6e6;
+  --ns-summary-bg:   #1a1d20;
+  --ns-badge-bg:     #1e3a5f;
+  --ns-badge-text:   #93c5fd;
+  --ns-mem-color:    #a78bfa;
+  --ns-temp-color:   #f87171;
+  --ns-disk-color:   #22d3ee;
+  --ns-bar-bg:       #374151;
+}
+
+/* Dark-specific trend arrow colours */
+.ns-trend-up   { color: #7fdc98 !important; }
+.ns-trend-down { color: #ff7d7d !important; }
+
+/* Dark-specific hover (slightly lighter border) */
+.netstat-box:hover {
+  border-color: #6b7280 !important;
+  box-shadow: 0 4px 12px rgba(0,0,0,0.4) !important;
+}
diff --git a/luci-app-netstat/files/www/luci-static/resources/view/status/include/08_stats.js b/luci-app-netstat/files/www/luci-static/resources/view/status/include/08_stats.js
new file mode 100644
index 000000000..43ee59f81
--- /dev/null
+++ b/luci-app-netstat/files/www/luci-static/resources/view/status/include/08_stats.js
@@ -0,0 +1,609 @@
+'use strict';
+'require baseclass';
+
+// ─── State ────────────────────────────────────────────────────────────────────
+let prev        = {};
+let last_time   = Date.now();
+let _pollAdded  = false;
+let _container  = null;
+
+// Peak speeds per direction (bits/s)
+let peakRx = 0;
+let peakTx = 0;
+
+// Previous speeds for trending arrows
+let lastRxSpeed = 0;
+let lastTxSpeed = 0;
+
+// Sparkline history – last 30 samples (~60 s at 2 s poll)
+const SPARK_LEN = 30;
+let sparkRx = new Array(SPARK_LEN).fill(0);
+let sparkTx = new Array(SPARK_LEN).fill(0);
+
+// ─── CSS Loader (theme-aware, no busy-poll) ───────────────────────────────────
+(function loadDynamicCSS() {
+	let loadedCss = null;
+
+	function isDarkMode() {
+		try {
+			const bg  = getComputedStyle(document.body).backgroundColor;
+			if (!bg || bg === 'transparent') return false;
+			const rgb = bg.match(/\d+/g);
+			if (!rgb || rgb.length < 3) return false;
+			const [r, g, b] = rgb.map(Number);
+			return (r * 299 + g * 587 + b * 114) / 1000 < 100;
+		} catch (_) { return false; }
+	}
+
+	function applyCSS() {
+		const file = isDarkMode() ? 'netstat_dark.css' : 'netstat.css';
+		if (loadedCss === file) return;
+		loadedCss = file;
+
+		document.querySelectorAll('link[data-netstat-css]').forEach(l => l.remove());
+
+		const link       = document.createElement('link');
+		link.rel         = 'stylesheet';
+		link.setAttribute('data-netstat-css', '1');
+		link.href        = '/luci-static/resources/netstat/' + file + '?t=' + Date.now();
+		document.head.appendChild(link);
+	}
+
+	requestAnimationFrame(() => setTimeout(applyCSS, 50));
+
+	if (window.matchMedia) {
+		window.matchMedia('(prefers-color-scheme: dark)').addEventListener('change', applyCSS);
+	}
+
+	const mo = new MutationObserver(applyCSS);
+	const waitForBody = setInterval(() => {
+		if (!document.body) return;
+		clearInterval(waitForBody);
+		mo.observe(document.body, { attributes: true, attributeFilter: ['style', 'class'] });
+		applyCSS();
+	}, 50);
+})();
+
+// ─── Helpers ──────────────────────────────────────────────────────────────────
+function parseNetdev(raw) {
+	const stats = {};
+	for (const line of raw.split('\n')) {
+		const m = line.trim().match(/^([^:]+):\s+(.*)$/);
+		if (!m) continue;
+		const vals = m[2].trim().split(/\s+/).map(v => parseInt(v) || 0);
+		if (vals.length >= 9)
+			stats[m[1].trim()] = { rx: vals[0], tx: vals[8] };
+	}
+	return stats;
+}
+
+function getBestWAN(stats, preferred) {
+	for (const i of preferred) if (stats[i]) return i;
+
+	const dynamic = Object.keys(stats).find(i =>
+		/^(wwan|usb|ppp|lte|qmi|modem)/.test(i) && i.includes('_'));
+	if (dynamic) return dynamic;
+
+	for (const i of ['pppoe-wan','lte0','usb0','wan','eth1','tun0','wg0'])
+		if (stats[i]) return i;
+
+	return Object.keys(stats).find(k => k !== 'lo') || '';
+}
+
+function formatRate(bps) {
+	const units = ['Bps','Kbps','Mbps','Gbps'];
+	let i = 0;
+	while (bps >= 1000 && i < units.length - 1) { bps /= 1000; i++; }
+	return { number: bps.toFixed(i > 0 ? 1 : 0), unit: units[i] + '/s' };
+}
+
+function formatBytes(v) {
+	if (v >= 1099511627776) return (v / 1099511627776).toFixed(2) + ' TB';
+	if (v >= 1073741824)   return (v / 1073741824).toFixed(2) + ' GB';
+	if (v >= 1048576)      return (v / 1048576).toFixed(2) + ' MB';
+	if (v >= 1024)         return (v / 1024).toFixed(2) + ' KB';
+	return v + ' B';
+}
+
+function formatUptime(sec) {
+	const d = Math.floor(sec / 86400);
+	const h = Math.floor((sec % 86400) / 3600);
+	const m = Math.floor((sec % 3600) / 60);
+	if (d > 0) return d + 'd ' + h + 'h';
+	if (h > 0) return h + 'h ' + m + 'm';
+	return m + 'm ' + (sec % 60) + 's';
+}
+
+// trend arrow: +1 = rising, -1 = falling, 0 = stable
+function trendArrow(current, previous) {
+	const ratio = previous > 0 ? current / previous : 1;
+	if (ratio > 1.10) return { char: '▲', cls: 'ns-trend-up' };
+	if (ratio < 0.90) return { char: '▼', cls: 'ns-trend-down' };
+	return { char: '●', cls: 'ns-trend-flat' };
+}
+
+// ─── Sparkline SVG ────────────────────────────────────────────────────────────
+function drawSparkline(values, colorVar) {
+	const W = 90, H = 28;
+	const max = Math.max(...values, 1);
+	const step = W / (values.length - 1);
+
+	const points = values.map((v, i) => {
+		const x = i * step;
+		const y = H - (v / max) * (H - 2) - 1;
+		return x.toFixed(1) + ',' + y.toFixed(1);
+	}).join(' ');
+
+	// filled area path
+	const areaPoints =
+		'0,' + H + ' ' + points + ' ' + (W) + ',' + H;
+
+	const svg = document.createElementNS('http://www.w3.org/2000/svg', 'svg');
+	svg.setAttribute('width', W);
+	svg.setAttribute('height', H);
+	svg.setAttribute('viewBox', '0 0 ' + W + ' ' + H);
+	svg.style.display = 'block';
+	svg.style.overflow = 'visible';
+
+	const defs = document.createElementNS('http://www.w3.org/2000/svg', 'defs');
+	const grad = document.createElementNS('http://www.w3.org/2000/svg', 'linearGradient');
+	grad.setAttribute('id', 'sg-' + colorVar.replace(/[^a-z]/gi,''));
+	grad.setAttribute('x1', '0'); grad.setAttribute('y1', '0');
+	grad.setAttribute('x2', '0'); grad.setAttribute('y2', '1');
+
+	const s1 = document.createElementNS('http://www.w3.org/2000/svg', 'stop');
+	s1.setAttribute('offset', '0%');
+	s1.setAttribute('stop-color', 'var(' + colorVar + ')');
+	s1.setAttribute('stop-opacity', '0.35');
+	const s2 = document.createElementNS('http://www.w3.org/2000/svg', 'stop');
+	s2.setAttribute('offset', '100%');
+	s2.setAttribute('stop-color', 'var(' + colorVar + ')');
+	s2.setAttribute('stop-opacity', '0.03');
+
+	grad.appendChild(s1); grad.appendChild(s2);
+	defs.appendChild(grad); svg.appendChild(defs);
+
+	const area = document.createElementNS('http://www.w3.org/2000/svg', 'polygon');
+	area.setAttribute('points', areaPoints);
+	area.setAttribute('fill', 'url(#sg-' + colorVar.replace(/[^a-z]/gi,'') + ')');
+	svg.appendChild(area);
+
+	const line = document.createElementNS('http://www.w3.org/2000/svg', 'polyline');
+	line.setAttribute('points', points);
+	line.setAttribute('fill', 'none');
+	line.setAttribute('stroke', 'var(' + colorVar + ')');
+	line.setAttribute('stroke-width', '1.5');
+	line.setAttribute('stroke-linejoin', 'round');
+	line.setAttribute('stroke-linecap', 'round');
+	svg.appendChild(line);
+
+	return svg;
+}
+
+// Replace sparkline SVG inside a container (identified by class)
+function updateSparkline(container, cls, values, colorVar) {
+	const box = container.querySelector('.' + cls);
+	if (!box) return;
+	const wrap = box.querySelector('.ns-spark');
+	if (!wrap) return;
+	wrap.innerHTML = '';
+	wrap.appendChild(drawSparkline(values, colorVar));
+}
+
+// ─── Fetch with timeout ───────────────────────────────────────────────────────
+function fetchWithTimeout(url, ms) {
+	const ctrl = typeof AbortController !== 'undefined' ? new AbortController() : null;
+	const tid   = ctrl ? setTimeout(() => ctrl.abort(), ms) : null;
+	return fetch(url, ctrl ? { signal: ctrl.signal } : {})
+		.then(r => r.json())
+		.finally(() => tid && clearTimeout(tid));
+}
+
+// ─── DOM builders ─────────────────────────────────────────────────────────────
+function createRateBox(label, value, unit, extraClass, colorVar, sparkValues, peak) {
+	const cls = 'netstat-box ' + extraClass;
+	const peakFmt = formatRate(peak * 8);
+
+	const box = E('div', { class: cls }, [
+		E('div', { class: 'ns-spark' }),   // sparkline goes here
+		E('div', { class: 'ns-rate-row' }, [
+			E('div', { class: 'netstat-number' }, value),
+			E('div', { class: 'netstat-unit' }, unit)
+		]),
+		E('div', { class: 'ns-peak' }, _('Peak') + ': ' + peakFmt.number + ' ' + peakFmt.unit),
+		E('div', { class: 'netstat-label' }, label)
+	]);
+
+	// draw initial sparkline
+	const wrap = box.querySelector('.ns-spark');
+	wrap.appendChild(drawSparkline(sparkValues, colorVar));
+
+	return box;
+}
+
+function createStatBox(label, value, unit, extraClass) {
+	const cls = 'netstat-box' + (extraClass ? ' ' + extraClass : '');
+	const box = E('div', { class: cls }, [
+		E('div', { class: 'ns-stat-value-row' }, [
+			E('div', { class: 'netstat-number' }, value),
+			unit ? E('div', { class: 'netstat-unit' }, unit) : null
+		].filter(Boolean)),
+		E('div', { class: 'netstat-label' }, label)
+	]);
+	return box;
+}
+
+
+function createStatusCard(status, ip) {
+	const up = status === 'Connected';
+	return E('div', { class: 'netstat-box netstat-center ' + (up ? 'is-up' : 'is-down') }, [
+		E('div', { class: 'netstat-center-title' }, _('Internet')),
+		E('div', { class: 'netstat-center-status' }, up ? _('Connected') : _('Disconnected')),
+		E('div', { class: 'netstat-center-sep' }),
+		E('div', { class: 'netstat-center-title' }, _('IP')),
+		E('div', { class: 'netstat-center-ip' }, ip || 'N/A'),
+	]);
+}
+
+// ─── Inline SVG icons ─────────────────────────────────────────────────────────
+function svgIcon(path, color) {
+	const ns = 'http://www.w3.org/2000/svg';
+	const svg = document.createElementNS(ns, 'svg');
+	svg.setAttribute('viewBox', '0 0 24 24');
+	svg.setAttribute('width', '16');
+	svg.setAttribute('height', '16');
+	svg.setAttribute('fill', 'none');
+	svg.setAttribute('stroke', color || 'currentColor');
+	svg.setAttribute('stroke-width', '2');
+	svg.setAttribute('stroke-linecap', 'round');
+	svg.setAttribute('stroke-linejoin', 'round');
+	svg.style.flexShrink = '0';
+	svg.innerHTML = path;
+	return svg;
+}
+
+// clock icon
+function iconUptime() {
+	return svgIcon('', 'var(--ns-muted)');
+}
+// database/memory icon
+function iconMem() {
+	return svgIcon('', 'var(--ns-mem-color)');
+}
+// thermometer/temperature icon
+function iconTemp() {
+	return svgIcon('', 'var(--ns-temp-color)');
+}
+// hard-drive/disk icon
+function iconDisk() {
+	return svgIcon('', 'var(--ns-disk-color)');
+}
+
+// Pill-style bar: filled background + "used MB / total MB (pct%)" text overlay
+function makePillBar(pct, used, total, fillId, textId) {
+	const clampedPct = Math.min(100, Math.max(0, pct));
+	const fill = E('div', { class: 'ns-pill-fill', id: fillId });
+	fill.style.width = clampedPct + '%';
+	const label = E('span', { class: 'ns-pill-text', id: textId },
+		used + ' / ' + total + ' (' + clampedPct + '%)');
+	return E('div', { class: 'ns-pill-bar' }, [fill, label]);
+}
+
+// Card 1: RAM + Storage pill bars
+function createInfoCard(memPct, memUsed, memTotal, diskPct, diskUsed, diskTotal) {
+	const card = E('div', { class: 'netstat-box netstat-info-card' });
+
+	// RAM row
+	const memRow = E('div', { class: 'ns-info-row' });
+	memRow.appendChild(iconMem());
+	const memBlock = E('div', { class: 'ns-info-block ns-info-block-grow' });
+	memBlock.appendChild(E('div', { class: 'ns-info-tag' }, _('RAM')));
+	memBlock.appendChild(makePillBar(memPct,
+		memUsed + ' MB', memTotal + ' MB', 'ns-mem-bar', 'ns-mem-sub'));
+	memRow.appendChild(memBlock);
+	card.appendChild(memRow);
+
+	card.appendChild(E('div', { class: 'netstat-center-sep' }));
+
+	// Storage row
+	const diskRow = E('div', { class: 'ns-info-row' });
+	diskRow.appendChild(iconDisk());
+	const diskBlock = E('div', { class: 'ns-info-block ns-info-block-grow' });
+	diskBlock.appendChild(E('div', { class: 'ns-info-tag' }, _('STORAGE')));
+	diskBlock.appendChild(makePillBar(diskPct,
+		diskUsed + ' MB', diskTotal + ' MB', 'ns-disk-bar', 'ns-disk-sub'));
+	diskRow.appendChild(diskBlock);
+	card.appendChild(diskRow);
+
+	return card;
+}
+
+// Card 2: CPU Temperature + Uptime
+function createTempCard(cpuTemp, uptime) {
+	const card = E('div', { class: 'netstat-box netstat-info-card' });
+
+	// Temp row
+	const tempRow = E('div', { class: 'ns-info-row' });
+	tempRow.appendChild(iconTemp());
+	const tempBlock = E('div', { class: 'ns-info-block ns-info-block-grow' });
+	const tempVal = cpuTemp != null ? cpuTemp + '°C' : 'N/A';
+	tempBlock.appendChild(E('div', { class: 'ns-info-value ns-temp-val', id: 'ns-temp-val' }, tempVal));
+	tempBlock.appendChild(E('div', { class: 'ns-info-tag' }, _('CPU TEMP')));
+	tempRow.appendChild(tempBlock);
+	card.appendChild(tempRow);
+
+	card.appendChild(E('div', { class: 'netstat-center-sep' }));
+
+	// Uptime row
+	const uptimeRow = E('div', { class: 'ns-info-row' });
+	uptimeRow.appendChild(iconUptime());
+	const uptimeBlock = E('div', { class: 'ns-info-block ns-info-block-grow' });
+	uptimeBlock.appendChild(E('div', { class: 'ns-info-value', id: 'ns-uptime-val' }, uptime));
+	uptimeBlock.appendChild(E('div', { class: 'ns-info-tag' }, _('UPTIME')));
+	uptimeRow.appendChild(uptimeBlock);
+	card.appendChild(uptimeRow);
+
+	return card;
+}
+
+// ─── In-place DOM patch ───────────────────────────────────────────────────────
+function patchText(el, sel, val) {
+	const n = el && el.querySelector(sel);
+	if (n && n.textContent !== val) n.textContent = val;
+}
+
+function updateContainer(container, data, dt) {
+	const stats     = data.stats || {};
+	const preferred = data.preferred || [];
+	const iface     = getBestWAN(stats, preferred);
+	const curr      = stats[iface] || { rx: 0, tx: 0 };
+	curr.rx = parseInt(curr.rx) || 0;
+	curr.tx = parseInt(curr.tx) || 0;
+
+	const ps       = prev[iface] || { rx: curr.rx, tx: curr.tx };
+	const rxSpeed  = Math.max(0, (curr.rx - ps.rx) / dt);
+	const txSpeed  = Math.max(0, (curr.tx - ps.tx) / dt);
+	prev[iface]    = { rx: curr.rx, tx: curr.tx };
+
+	// peaks
+	if (rxSpeed > peakRx) peakRx = rxSpeed;
+	if (txSpeed > peakTx) peakTx = txSpeed;
+
+	// sparkline ring buffers
+	sparkRx.push(rxSpeed); if (sparkRx.length > SPARK_LEN) sparkRx.shift();
+	sparkTx.push(txSpeed); if (sparkTx.length > SPARK_LEN) sparkTx.shift();
+
+	// trend
+	const tRx = trendArrow(rxSpeed, lastRxSpeed);
+	const tTx = trendArrow(txSpeed, lastTxSpeed);
+	lastRxSpeed = rxSpeed;
+	lastTxSpeed = txSpeed;
+
+	const rxRate  = formatRate(rxSpeed * 8);
+	const txRate  = formatRate(txSpeed * 8);
+	const totalRx = formatBytes(curr.rx).split(' ');
+	const totalTx = formatBytes(curr.tx).split(' ');
+	const peakRxFmt = formatRate(peakRx * 8);
+	const peakTxFmt = formatRate(peakTx * 8);
+
+	const boxes = container.querySelectorAll('.netstat-box');
+	if (boxes.length < 7) return false; // stale, rebuild
+
+	// download rate box
+	patchText(container, '.is-download .netstat-number', rxRate.number);
+	patchText(container, '.is-download .netstat-unit',   rxRate.unit);
+	patchText(container, '.is-download .ns-peak',
+		_('Peak') + ': ' + peakRxFmt.number + ' ' + peakRxFmt.unit);
+
+	// trend on download
+	const dlTrend = container.querySelector('.is-download .ns-trend');
+	if (dlTrend) { dlTrend.textContent = tRx.char; dlTrend.className = 'ns-trend ' + tRx.cls; }
+
+	// upload rate box
+	patchText(container, '.is-upload .netstat-number', txRate.number);
+	patchText(container, '.is-upload .netstat-unit',   txRate.unit);
+	patchText(container, '.is-upload .ns-peak',
+		_('Peak') + ': ' + peakTxFmt.number + ' ' + peakTxFmt.unit);
+
+	// trend on upload
+	const ulTrend = container.querySelector('.is-upload .ns-trend');
+	if (ulTrend) { ulTrend.textContent = tTx.char; ulTrend.className = 'ns-trend ' + tTx.cls; }
+
+	// sparklines
+	updateSparkline(container, 'is-download', sparkRx, '--ns-dl-color');
+	updateSparkline(container, 'is-upload',   sparkTx, '--ns-ul-color');
+
+	// center status card
+	const center = container.querySelector('.netstat-center');
+	if (center) {
+		const up = (data.status || '') === 'Connected';
+		center.className = 'netstat-box netstat-center ' + (up ? 'is-up' : 'is-down');
+		patchText(center, '.netstat-center-status', up ? _('Connected') : _('Disconnected'));
+		patchText(center, '.netstat-center-ip',     data.ip || 'N/A');
+	}
+
+	// totals
+	const totals = container.querySelectorAll('.is-total');
+	if (totals[0]) {
+		patchText(totals[0], '.netstat-number', totalRx[0]);
+		patchText(totals[0], '.netstat-unit',   totalRx[1] || '');
+	}
+	if (totals[1]) {
+		patchText(totals[1], '.netstat-number', totalTx[0]);
+		patchText(totals[1], '.netstat-unit',   totalTx[1] || '');
+	}
+
+	// uptime in status card
+	patchText(container, '#ns-uptime-val', formatUptime(data.uptime || 0));
+
+	// temp
+	const tempVal = data.cpu_temp != null ? data.cpu_temp + '°C' : 'N/A';
+	patchText(container, '#ns-temp-val', tempVal);
+
+	// pill bar: update fill width + text label
+	const memPct  = data.mem_pct  || 0;
+	const diskPct = data.disk_pct || 0;
+
+	const memFill = container.querySelector('#ns-mem-bar');
+	if (memFill) memFill.style.width = Math.min(100, Math.max(0, memPct)) + '%';
+	patchText(container, '#ns-mem-sub',
+		(data.mem_used || 0) + ' MB / ' + (data.mem_total || 0) + ' MB (' + memPct + '%)');
+
+	const diskFill = container.querySelector('#ns-disk-bar');
+	if (diskFill) diskFill.style.width = Math.min(100, Math.max(0, diskPct)) + '%';
+	patchText(container, '#ns-disk-sub',
+		(data.disk_used || 0) + ' MB / ' + (data.disk_total || 0) + ' MB (' + diskPct + '%)');
+
+	return true;
+}
+
+// ─── Cached public IP (refreshed every 60 s, not on every 2 s poll) ──────────
+let _cachedIp        = 'N/A';
+let _lastIpFetch     = 0;
+const IP_REFRESH_MS  = 300000;
+
+function maybeRefreshIp() {
+	const now = Date.now();
+	if (now - _lastIpFetch < IP_REFRESH_MS) return;
+	_lastIpFetch = now;
+	// Full fetch (no ?fast=1) to get public IP; update cache on success
+	fetchWithTimeout('/cgi-bin/luci/admin/tools/get_netdev_stats', 8000)
+		.then(r => { if (r && r.ip && r.ip !== 'N/A') _cachedIp = r.ip; })
+		.catch(() => {});
+}
+
+// ─── Main baseclass ───────────────────────────────────────────────────────────
+return baseclass.extend({
+	title: _(''),
+
+	load() {
+		// Use ?fast=1 to skip slow public-IP APIs — response is near-instant
+		return fetchWithTimeout('/cgi-bin/luci/admin/tools/get_netdev_stats?fast=1', 5000)
+			.then(r => {
+				// Seed the cached IP from the local WAN address on first load
+				if (r && r.ip && r.ip !== 'N/A') _cachedIp = r.ip;
+				return {
+					stats:      (r && r.stats)       || {},
+					ip:         _cachedIp,
+					status:     (r && r.status)      || 'Disconnected',
+					uptime:     (r && r.uptime)      || 0,
+					cpu_pct:    (r && r.cpu_pct)     || 0,
+					cpu_temp:   (r && r.cpu_temp)    != null ? r.cpu_temp : null,
+					mem_pct:    (r && r.mem_pct)     || 0,
+					mem_used:   (r && r.mem_used)    || 0,
+					mem_total:  (r && r.mem_total)   || 0,
+					disk_pct:   (r && r.disk_pct)    || 0,
+					disk_used:  (r && r.disk_used)   || 0,
+					disk_total: (r && r.disk_total)  || 0,
+					preferred:  (r && r.prefer_iface) ? [r.prefer_iface] : []
+				};
+			})
+			.catch(() => ({ stats: {}, ip: 'N/A', status: 'Disconnected',
+			                uptime: 0, cpu_pct: 0, cpu_temp: null, mem_pct: 0, mem_used: 0, mem_total: 0,
+			                disk_pct: 0, disk_used: 0, disk_total: 0, preferred: [] }));
+	},
+
+	render(data) {
+		const now  = Date.now();
+		const dt   = Math.max(0.1, (now - last_time) / 1000);
+		last_time  = now;
+
+		const stats     = data.stats || {};
+		const preferred = data.preferred || [];
+
+		if (!stats || typeof stats !== 'object' || Array.isArray(stats))
+			return E('div', { style: 'padding:20px;text-align:center;color:#999;font-size:13px' },
+				_('Loading network stats...'));
+
+		const iface    = getBestWAN(stats, preferred);
+		const curr     = stats[iface] || { rx: 0, tx: 0 };
+		curr.rx = parseInt(curr.rx) || 0;
+		curr.tx = parseInt(curr.tx) || 0;
+
+		const ps       = prev[iface] || { rx: curr.rx, tx: curr.tx };
+		const rxSpeed  = Math.max(0, (curr.rx - ps.rx) / dt);
+		const txSpeed  = Math.max(0, (curr.tx - ps.tx) / dt);
+		prev[iface]    = { rx: curr.rx, tx: curr.tx };
+
+		if (rxSpeed > peakRx) peakRx = rxSpeed;
+		if (txSpeed > peakTx) peakTx = txSpeed;
+
+		sparkRx.push(rxSpeed); if (sparkRx.length > SPARK_LEN) sparkRx.shift();
+		sparkTx.push(txSpeed); if (sparkTx.length > SPARK_LEN) sparkTx.shift();
+
+		const tRx = trendArrow(rxSpeed, lastRxSpeed);
+		const tTx = trendArrow(txSpeed, lastTxSpeed);
+		lastRxSpeed = rxSpeed;
+		lastTxSpeed = txSpeed;
+
+		const rxRate  = formatRate(rxSpeed * 8);
+		const txRate  = formatRate(txSpeed * 8);
+		const totalRx = formatBytes(curr.rx).split(' ');
+		const totalTx = formatBytes(curr.tx).split(' ');
+
+		// Build download box manually to inject trend badge
+		const dlBox = createRateBox(_('download'), rxRate.number, rxRate.unit,
+			'is-download', '--ns-dl-color', [...sparkRx], peakRx);
+		const dlTrend = E('span', { class: 'ns-trend ' + tRx.cls }, tRx.char);
+		dlBox.querySelector('.ns-rate-row').appendChild(dlTrend);
+
+		const ulBox = createRateBox(_('upload'), txRate.number, txRate.unit,
+			'is-upload', '--ns-ul-color', [...sparkTx], peakTx);
+		const ulTrend = E('span', { class: 'ns-trend ' + tTx.cls }, tTx.char);
+		ulBox.querySelector('.ns-rate-row').appendChild(ulTrend);
+
+		// Desktop order: DOWNLOAD | UPLOAD | TEMP | INTERNET STATUS | DISK+RAM | DOWNLOADED | UPLOADED
+		const row = E('div', { class: 'netstat-row' }, [
+			dlBox,
+			ulBox,
+			createTempCard(data.cpu_temp != null ? data.cpu_temp : null,
+				formatUptime(data.uptime || 0)),
+			createStatusCard(data.status || 'Disconnected', data.ip),
+			createInfoCard(data.mem_pct || 0, data.mem_used || 0, data.mem_total || 0,
+				data.disk_pct || 0, data.disk_used || 0, data.disk_total || 0),
+			createStatBox(_('downloaded'), totalRx[0], totalRx[1], 'is-total is-downloaded'),
+			createStatBox(_('uploaded'),   totalTx[0], totalTx[1], 'is-total is-uploaded'),
+		]);
+
+		const container = E('div', { class: 'stats-grid netstat-wrap' }, row);
+		_container = container;
+
+		if (!_pollAdded) {
+			_pollAdded = true;
+			L.Poll.add(() => {
+				// Periodically refresh the public IP in the background (non-blocking)
+				maybeRefreshIp();
+				return fetchWithTimeout('/cgi-bin/luci/admin/tools/get_netdev_stats?fast=1', 5000)
+					.then(r => {
+						const now2 = Date.now();
+						const dt2  = Math.max(0.1, (now2 - last_time) / 1000);
+						last_time  = now2;
+
+						// Update cached IP from local WAN if we got a valid one
+						if (r && r.ip && r.ip !== 'N/A') _cachedIp = r.ip;
+
+						if (_container && _container.isConnected) {
+							updateContainer(_container, {
+								stats:      (r && r.stats)       || {},
+								ip:         _cachedIp,
+								status:     (r && r.status)      || 'Disconnected',
+								uptime:     (r && r.uptime)      || 0,
+								cpu_pct:    (r && r.cpu_pct)     || 0,
+								cpu_temp:   (r && r.cpu_temp)    != null ? r.cpu_temp : null,
+								mem_pct:    (r && r.mem_pct)     || 0,
+								mem_used:   (r && r.mem_used)    || 0,
+								mem_total:  (r && r.mem_total)   || 0,
+								disk_pct:   (r && r.disk_pct)    || 0,
+								disk_used:  (r && r.disk_used)   || 0,
+								disk_total: (r && r.disk_total)  || 0,
+								preferred:  (r && r.prefer_iface) ? [r.prefer_iface] : []
+							}, dt2);
+						}
+					})
+					.catch(() => {});
+			}, 2);
+		}
+
+		return container;
+	}
+});
diff --git a/luci-app-netstat/images/dash.png b/luci-app-netstat/images/dash.png
new file mode 100644
index 000000000..90da0dd58
Binary files /dev/null and b/luci-app-netstat/images/dash.png differ
diff --git a/luci-app-netstat/images/luci-app-netstat.png b/luci-app-netstat/images/luci-app-netstat.png
new file mode 100644
index 000000000..1d0adab9d
Binary files /dev/null and b/luci-app-netstat/images/luci-app-netstat.png differ
diff --git a/luci-app-netstat/images/mobile.png b/luci-app-netstat/images/mobile.png
new file mode 100644
index 000000000..724c7f41a
Binary files /dev/null and b/luci-app-netstat/images/mobile.png differ
diff --git a/luci-app-netstat/images/network.png b/luci-app-netstat/images/network.png
new file mode 100644
index 000000000..99b68b17e
Binary files /dev/null and b/luci-app-netstat/images/network.png differ
diff --git a/luci-app-netstat/po/templates/netstat.pot b/luci-app-netstat/po/templates/netstat.pot
new file mode 100644
index 000000000..833a05a76
--- /dev/null
+++ b/luci-app-netstat/po/templates/netstat.pot
@@ -0,0 +1,268 @@
+msgid ""
+msgstr ""
+"Project-Id-Version: luci-app-netstat\n"
+"POT-Creation-Date: \n"
+"PO-Revision-Date: \n"
+"Last-Translator: \n"
+"Language-Team: \n"
+"Language: en\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"Plural-Forms: nplurals=2; plural=(n != 1);\n"
+
+#: files/usr/lib/lua/luci/controller/netstat.lua:4
+msgid "Tools"
+msgstr ""
+
+#: files/usr/lib/lua/luci/controller/netstat.lua:5
+msgid "Netstat"
+msgstr ""
+
+#: files/usr/lib/lua/luci/model/cbi/netstat/config.lua:6
+msgid "Configure traffic monitoring and view usage history from a single page."
+msgstr ""
+
+#: files/usr/lib/lua/luci/model/cbi/netstat/config.lua:15
+msgid "Monitoring Settings"
+msgstr ""
+
+#: files/usr/lib/lua/luci/model/cbi/netstat/config.lua:20
+msgid "Traffic Backend"
+msgstr ""
+
+#: files/usr/lib/lua/luci/model/cbi/netstat/config.lua:22
+msgid "Normal (Real-time)"
+msgstr ""
+
+#: files/usr/lib/lua/luci/model/cbi/netstat/config.lua:23
+msgid "vnStat (Historical, Delayed)"
+msgstr ""
+
+#: files/usr/lib/lua/luci/model/cbi/netstat/config.lua:24
+msgid ""
+"Normal reads live counters from /proc/net/dev. "
+"vnStat reads the vnStat database which updates on its own schedule."
+msgstr ""
+
+#: files/usr/lib/lua/luci/model/cbi/netstat/config.lua:30
+msgid "View Mode"
+msgstr ""
+
+#: files/usr/lib/lua/luci/model/cbi/netstat/config.lua:32
+msgid "Daily Usage"
+msgstr ""
+
+#: files/usr/lib/lua/luci/model/cbi/netstat/config.lua:33
+msgid "Monthly Usage"
+msgstr ""
+
+#: files/usr/lib/lua/luci/model/cbi/netstat/config.lua:34
+msgid "Default view shown on the Network Usage tab."
+msgstr ""
+
+#: files/usr/lib/lua/luci/model/cbi/netstat/config.lua:37
+msgid "Preferred Interface"
+msgstr ""
+
+#: files/usr/lib/lua/luci/model/cbi/netstat/config.lua:38
+msgid ""
+"WAN interface to track. Leave blank for auto-detection.
"
+"Tip: If your WAN uses a dynamic name (e.g. wwan0_1) "
+"it will be detected automatically when left blank."
+msgstr ""
+
+#: files/usr/lib/lua/luci/model/cbi/netstat/config.lua:43
+msgid "Auto detect"
+msgstr ""
+
+#: files/usr/lib/lua/luci/model/cbi/netstat/config.lua:54
+msgid "vnStat Database"
+msgstr ""
+
+#: files/usr/lib/lua/luci/model/cbi/netstat/config.lua:63
+msgid "Location: /etc/vnstat/"
+msgstr ""
+
+#: files/usr/lib/lua/luci/model/cbi/netstat/config.lua:69
+msgid "Reset Historical Data"
+msgstr ""
+
+#: files/usr/lib/lua/luci/model/cbi/netstat/config.lua:70
+msgid "Reset Database"
+msgstr ""
+
+#: files/usr/lib/lua/luci/model/cbi/netstat/config.lua:72
+msgid ""
+"Warning: "
+"This permanently deletes all stored traffic history for every interface."
+msgstr ""
+
+#: files/usr/lib/lua/luci/model/cbi/netstat/config.lua:87
+msgid "Are you sure? All traffic history will be permanently deleted."
+msgstr ""
+
+#: files/usr/lib/lua/luci/model/cbi/netstat/config.lua:109
+msgid "vnStat database has been reset successfully for all interfaces."
+msgstr ""
+
+#: files/usr/lib/lua/luci/model/cbi/netstat/config.lua:113
+msgid "About"
+msgstr ""
+
+#: files/usr/lib/lua/luci/model/cbi/netstat/config.lua:117
+#: files/usr/lib/lua/luci/view/netstat/tabs.htm:11
+msgid "Network Usage"
+msgstr ""
+
+#: files/usr/lib/lua/luci/view/netstat/tabs.htm:12
+msgid "Settings"
+msgstr ""
+
+#: files/usr/lib/lua/luci/view/netstat/about.htm:2
+msgid "LuCI Netstat"
+msgstr ""
+
+#: files/usr/lib/lua/luci/view/netstat/about.htm:4
+msgid "Frontend for traffic monitoring and usage charts on OpenWrt."
+msgstr ""
+
+#: files/usr/lib/lua/luci/view/netstat/about.htm:9
+msgid "Developer"
+msgstr ""
+
+#: files/usr/lib/lua/luci/view/netstat/about.htm:14
+msgid "Repository"
+msgstr ""
+
+#: files/usr/lib/lua/luci/view/netstat/about.htm:22
+msgid "Contributors"
+msgstr ""
+
+#: files/usr/lib/lua/luci/view/netstat/about.htm:25
+msgid "View on GitHub"
+msgstr ""
+
+#: files/usr/lib/lua/luci/view/netstat/about.htm:30
+msgid "License"
+msgstr ""
+
+#: files/usr/lib/lua/luci/view/netstat/about.htm:35
+msgid "Issues / Support"
+msgstr ""
+
+#: files/usr/lib/lua/luci/view/netstat/about.htm:38
+msgid "Open an issue"
+msgstr ""
+
+#: files/usr/lib/lua/luci/view/netstat/about.htm:45
+msgid "Made with"
+msgstr ""
+
+#: files/usr/lib/lua/luci/view/netstat/about.htm:45
+msgid "for the OpenWrt community"
+msgstr ""
+
+#: files/usr/lib/lua/luci/view/netstat/usage.htm:100
+msgid "Monthly"
+msgstr ""
+
+#: files/usr/lib/lua/luci/view/netstat/usage.htm:103
+msgid "Daily"
+msgstr ""
+
+#: files/usr/lib/lua/luci/view/netstat/usage.htm:118
+msgid "Usage is displayed using the Interface and View Mode selected in the Settings tab."
+msgstr ""
+
+#: files/usr/lib/lua/luci/view/netstat/usage.htm:126
+msgid "Download"
+msgstr ""
+
+#: files/usr/lib/lua/luci/view/netstat/usage.htm:131
+msgid "Upload"
+msgstr ""
+
+#: files/usr/lib/lua/luci/view/netstat/usage.htm:135
+msgid "Total"
+msgstr ""
+
+#: files/usr/lib/lua/luci/view/netstat/usage.htm:142
+msgid "Usage"
+msgstr ""
+
+#: files/usr/lib/lua/luci/view/netstat/usage.htm:203
+msgid "Download (RX)"
+msgstr ""
+
+#: files/usr/lib/lua/luci/view/netstat/usage.htm:220
+msgid "Upload (TX)"
+msgstr ""
+
+#: files/usr/lib/lua/luci/view/netstat/usage.htm:282
+msgid "No vnStat interfaces were found. Make sure vnStat has been initialized."
+msgstr ""
+
+#: files/usr/lib/lua/luci/view/netstat/usage.htm:287
+msgid "No data available for"
+msgstr ""
+
+#: files/usr/lib/lua/luci/view/netstat/usage.htm:289
+msgid "vnStat may still be collecting its first data. Try again in a few minutes."
+msgstr ""
+
+#: files/www/luci-static/resources/view/status/include/08_stats.js:241
+msgid "Internet"
+msgstr ""
+
+#: files/www/luci-static/resources/view/status/include/08_stats.js:242
+msgid "Connected"
+msgstr ""
+
+#: files/www/luci-static/resources/view/status/include/08_stats.js:242
+msgid "Disconnected"
+msgstr ""
+
+#: files/www/luci-static/resources/view/status/include/08_stats.js:244
+msgid "IP"
+msgstr ""
+
+#: files/www/luci-static/resources/view/status/include/08_stats.js:497
+msgid "Loading network stats..."
+msgstr ""
+
+#: files/www/luci-static/resources/view/status/include/08_stats.js:526
+msgid "download"
+msgstr ""
+
+#: files/www/luci-static/resources/view/status/include/08_stats.js:531
+msgid "upload"
+msgstr ""
+
+#: files/www/luci-static/resources/view/status/include/08_stats.js:545
+msgid "downloaded"
+msgstr ""
+
+#: files/www/luci-static/resources/view/status/include/08_stats.js:546
+msgid "uploaded"
+msgstr ""
+
+#: files/www/luci-static/resources/view/status/include/08_stats.js:214
+msgid "Peak"
+msgstr ""
+
+#: files/www/luci-static/resources/view/status/include/08_stats.js:301
+msgid "RAM"
+msgstr ""
+
+#: files/www/luci-static/resources/view/status/include/08_stats.js:313
+msgid "STORAGE"
+msgstr ""
+
+#: files/www/luci-static/resources/view/status/include/08_stats.js:332
+msgid "CPU TEMP"
+msgstr ""
+
+#: files/www/luci-static/resources/view/status/include/08_stats.js:343
+msgid "UPTIME"
+msgstr ""
diff --git a/luci-app-netstat/po/zh-cn b/luci-app-netstat/po/zh-cn
new file mode 120000
index 000000000..8d69574dd
--- /dev/null
+++ b/luci-app-netstat/po/zh-cn
@@ -0,0 +1 @@
+zh_Hans
\ No newline at end of file
diff --git a/luci-app-netstat/po/zh_Hans/netstat.po b/luci-app-netstat/po/zh_Hans/netstat.po
new file mode 100644
index 000000000..bee100a04
--- /dev/null
+++ b/luci-app-netstat/po/zh_Hans/netstat.po
@@ -0,0 +1,275 @@
+msgid ""
+msgstr ""
+"Content-Type: text/plain; charset=UTF-8\n"
+"Project-Id-Version: luci-app-netstat\n"
+"POT-Creation-Date: \n"
+"PO-Revision-Date: \n"
+"Last-Translator: \n"
+"Language: zh_CN\n"
+"MIME-Version: 1.0\n"
+"Content-Transfer-Encoding: 8bit\n"
+"Plural-Forms: nplurals=1; plural=0;\n"
+"X-Generator: Poedit 3.5\n"
+
+#: files/usr/lib/lua/luci/controller/netstat.lua:4
+msgid "Tools"
+msgstr "工具"
+
+#: files/usr/lib/lua/luci/controller/netstat.lua:5
+msgid "Netstat"
+msgstr "网络状态"
+
+#: files/usr/lib/lua/luci/model/cbi/netstat/config.lua:6
+msgid "Configure traffic monitoring and view usage history from a single page."
+msgstr "配置流量监控，并在单个页面查看使用历史。"
+
+#: files/usr/lib/lua/luci/model/cbi/netstat/config.lua:15
+msgid "Monitoring Settings"
+msgstr "监控设置"
+
+#: files/usr/lib/lua/luci/model/cbi/netstat/config.lua:20
+msgid "Traffic Backend"
+msgstr "流量后端"
+
+#: files/usr/lib/lua/luci/model/cbi/netstat/config.lua:22
+msgid "Normal (Real-time)"
+msgstr "普通（实时）"
+
+#: files/usr/lib/lua/luci/model/cbi/netstat/config.lua:23
+msgid "vnStat (Historical, Delayed)"
+msgstr "vnStat（历史，延迟）"
+
+#: files/usr/lib/lua/luci/model/cbi/netstat/config.lua:24
+msgid ""
+"Normal reads live counters from /proc/net/dev. "
+"vnStat reads the vnStat database which updates on its own schedule."
+msgstr ""
+"普通模式从 /proc/net/dev 读取实时计数器。"
+"vnStat 模式从 vnStat 数据库读取，其更新有自己的计划。"
+
+#: files/usr/lib/lua/luci/model/cbi/netstat/config.lua:30
+msgid "View Mode"
+msgstr "视图模式"
+
+#: files/usr/lib/lua/luci/model/cbi/netstat/config.lua:32
+msgid "Daily Usage"
+msgstr "每日用量"
+
+#: files/usr/lib/lua/luci/model/cbi/netstat/config.lua:33
+msgid "Monthly Usage"
+msgstr "每月用量"
+
+#: files/usr/lib/lua/luci/model/cbi/netstat/config.lua:34
+msgid "Default view shown on the Network Usage tab."
+msgstr "在网络用量标签页上显示的默认视图。"
+
+#: files/usr/lib/lua/luci/model/cbi/netstat/config.lua:37
+msgid "Preferred Interface"
+msgstr "首选接口"
+
+#: files/usr/lib/lua/luci/model/cbi/netstat/config.lua:38
+msgid ""
+"WAN interface to track. Leave blank for auto-detection.
"
+"Tip: If your WAN uses a dynamic name (e.g. wwan0_1) "
+"it will be detected automatically when left blank."
+msgstr ""
+"要跟踪的 WAN 接口。留空以自动检测。
"
+"提示：如果您的 WAN 使用动态名称（例如 wwan0_1），"
+"留空时将自动检测。"
+
+#: files/usr/lib/lua/luci/model/cbi/netstat/config.lua:43
+msgid "Auto detect"
+msgstr "自动检测"
+
+#: files/usr/lib/lua/luci/model/cbi/netstat/config.lua:54
+msgid "vnStat Database"
+msgstr "vnStat 数据库"
+
+#: files/usr/lib/lua/luci/model/cbi/netstat/config.lua:63
+msgid "Location: /etc/vnstat/"
+msgstr "位置：/etc/vnstat/"
+
+#: files/usr/lib/lua/luci/model/cbi/netstat/config.lua:69
+msgid "Reset Historical Data"
+msgstr "重置历史数据"
+
+#: files/usr/lib/lua/luci/model/cbi/netstat/config.lua:70
+msgid "Reset Database"
+msgstr "重置数据库"
+
+#: files/usr/lib/lua/luci/model/cbi/netstat/config.lua:72
+msgid ""
+"Warning: "
+"This permanently deletes all stored traffic history for every interface."
+msgstr ""
+"警告："
+"这将永久删除所有接口的所有已存储流量历史记录。"
+
+#: files/usr/lib/lua/luci/model/cbi/netstat/config.lua:87
+msgid "Are you sure? All traffic history will be permanently deleted."
+msgstr "您确定吗？所有流量历史记录将被永久删除。"
+
+#: files/usr/lib/lua/luci/model/cbi/netstat/config.lua:109
+msgid "vnStat database has been reset successfully for all interfaces."
+msgstr "vnStat 数据库已成功为所有接口重置。"
+
+#: files/usr/lib/lua/luci/model/cbi/netstat/config.lua:113
+msgid "About"
+msgstr "关于"
+
+#: files/usr/lib/lua/luci/model/cbi/netstat/config.lua:117
+#: files/usr/lib/lua/luci/view/netstat/tabs.htm:11
+msgid "Network Usage"
+msgstr "网络用量"
+
+#: files/usr/lib/lua/luci/view/netstat/tabs.htm:12
+msgid "Settings"
+msgstr "设置"
+
+#: files/usr/lib/lua/luci/view/netstat/about.htm:2
+msgid "LuCI Netstat"
+msgstr "LuCI 网络状态"
+
+#: files/usr/lib/lua/luci/view/netstat/about.htm:4
+msgid "Frontend for traffic monitoring and usage charts on OpenWrt."
+msgstr "OpenWrt 上用于流量监控和用量图表的前端。"
+
+#: files/usr/lib/lua/luci/view/netstat/about.htm:9
+msgid "Developer"
+msgstr "开发者"
+
+#: files/usr/lib/lua/luci/view/netstat/about.htm:14
+msgid "Repository"
+msgstr "代码仓库"
+
+#: files/usr/lib/lua/luci/view/netstat/about.htm:22
+msgid "Contributors"
+msgstr "贡献者"
+
+#: files/usr/lib/lua/luci/view/netstat/about.htm:25
+msgid "View on GitHub"
+msgstr "在 GitHub 上查看"
+
+#: files/usr/lib/lua/luci/view/netstat/about.htm:30
+msgid "License"
+msgstr "许可证"
+
+#: files/usr/lib/lua/luci/view/netstat/about.htm:35
+msgid "Issues / Support"
+msgstr "问题 / 支持"
+
+#: files/usr/lib/lua/luci/view/netstat/about.htm:38
+msgid "Open an issue"
+msgstr "提交问题"
+
+#: files/usr/lib/lua/luci/view/netstat/about.htm:45
+msgid "Made with"
+msgstr "用"
+
+#: files/usr/lib/lua/luci/view/netstat/about.htm:45
+msgid "for the OpenWrt community"
+msgstr "为 OpenWrt 社区制作"
+
+#: files/usr/lib/lua/luci/view/netstat/usage.htm:100
+msgid "Monthly"
+msgstr "每月"
+
+#: files/usr/lib/lua/luci/view/netstat/usage.htm:103
+msgid "Daily"
+msgstr "每日"
+
+#: files/usr/lib/lua/luci/view/netstat/usage.htm:118
+msgid "Usage is displayed using the Interface and View Mode selected in the Settings tab."
+msgstr "用量根据"设置"选项卡中选择的接口和视图模式显示。"
+
+#: files/usr/lib/lua/luci/view/netstat/usage.htm:126
+msgid "Download"
+msgstr "下载"
+
+#: files/usr/lib/lua/luci/view/netstat/usage.htm:131
+msgid "Upload"
+msgstr "上传"
+
+#: files/usr/lib/lua/luci/view/netstat/usage.htm:135
+msgid "Total"
+msgstr "总计"
+
+#: files/usr/lib/lua/luci/view/netstat/usage.htm:142
+msgid "Usage"
+msgstr "用量"
+
+#: files/usr/lib/lua/luci/view/netstat/usage.htm:203
+msgid "Download (RX)"
+msgstr "下载（接收）"
+
+#: files/usr/lib/lua/luci/view/netstat/usage.htm:220
+msgid "Upload (TX)"
+msgstr "上传（发送）"
+
+#: files/usr/lib/lua/luci/view/netstat/usage.htm:282
+msgid "No vnStat interfaces were found. Make sure vnStat has been initialized."
+msgstr "未找到 vnStat 接口。请确保已初始化 vnStat。"
+
+#: files/usr/lib/lua/luci/view/netstat/usage.htm:287
+msgid "No data available for"
+msgstr "没有可用数据："
+
+#: files/usr/lib/lua/luci/view/netstat/usage.htm:289
+msgid "vnStat may still be collecting its first data. Try again in a few minutes."
+msgstr "vnStat 可能仍在收集初始数据，请几分钟后重试。"
+
+#: files/www/luci-static/resources/view/status/include/08_stats.js:241
+msgid "Internet"
+msgstr "互联网"
+
+#: files/www/luci-static/resources/view/status/include/08_stats.js:242
+msgid "Connected"
+msgstr "已连接"
+
+#: files/www/luci-static/resources/view/status/include/08_stats.js:242
+msgid "Disconnected"
+msgstr "已断开"
+
+#: files/www/luci-static/resources/view/status/include/08_stats.js:244
+msgid "IP"
+msgstr "IP 地址"
+
+#: files/www/luci-static/resources/view/status/include/08_stats.js:497
+msgid "Loading network stats..."
+msgstr "正在加载网络统计..."
+
+#: files/www/luci-static/resources/view/status/include/08_stats.js:526
+msgid "download"
+msgstr "下载"
+
+#: files/www/luci-static/resources/view/status/include/08_stats.js:531
+msgid "upload"
+msgstr "上传"
+
+#: files/www/luci-static/resources/view/status/include/08_stats.js:545
+msgid "downloaded"
+msgstr "已下载"
+
+#: files/www/luci-static/resources/view/status/include/08_stats.js:546
+msgid "uploaded"
+msgstr "已上传"
+
+#: files/www/luci-static/resources/view/status/include/08_stats.js:214
+msgid "Peak"
+msgstr "峰值"
+
+#: files/www/luci-static/resources/view/status/include/08_stats.js:301
+msgid "RAM"
+msgstr "内存"
+
+#: files/www/luci-static/resources/view/status/include/08_stats.js:313
+msgid "STORAGE"
+msgstr "存储"
+
+#: files/www/luci-static/resources/view/status/include/08_stats.js:332
+msgid "CPU TEMP"
+msgstr "CPU 温度"
+
+#: files/www/luci-static/resources/view/status/include/08_stats.js:343
+msgid "UPTIME"
+msgstr "运行时间"
diff --git a/luci-app-overview-manager/.editorconfig b/luci-app-overview-manager/.editorconfig
new file mode 100644
index 000000000..43cf81799
--- /dev/null
+++ b/luci-app-overview-manager/.editorconfig
@@ -0,0 +1,18 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.{js,json,md}]
+indent_style = tab
+indent_size = 4
+
+[*.{sh,yml,yaml}]
+indent_style = space
+indent_size = 2
+
+[Makefile]
+indent_style = tab
diff --git a/luci-app-overview-manager/.gitattributes b/luci-app-overview-manager/.gitattributes
new file mode 100644
index 000000000..e20643316
--- /dev/null
+++ b/luci-app-overview-manager/.gitattributes
@@ -0,0 +1,19 @@
+* text=auto eol=lf
+
+*.sh text eol=lf
+*.js text eol=lf
+*.json text eol=lf
+*.md text eol=lf
+Makefile text eol=lf
+
+*.apk binary
+*.ipk binary
+*.bin binary
+*.img binary
+*.gz binary
+*.zst binary
+*.pem text eol=lf
+
+# Shared scripts vendored from repo-templates: kept out of the language stats.
+scripts/check-readme.sh linguist-vendored
+scripts/release-notes.sh linguist-vendored
diff --git a/luci-app-overview-manager/.gitignore b/luci-app-overview-manager/.gitignore
new file mode 100644
index 000000000..9865d22f1
--- /dev/null
+++ b/luci-app-overview-manager/.gitignore
@@ -0,0 +1,12 @@
+.DS_Store
+build/
+dist/
+# Operational notes tied to a specific machine, router or account. Nothing here
+# is published; docs/ holds everything that belongs in the repository.
+local/
+*.apk
+*.ipk
+*.key
+*-private.pem
+private-key.pem
+signing/
diff --git a/luci-app-overview-manager/LICENSE b/luci-app-overview-manager/LICENSE
new file mode 100644
index 000000000..d45f1d470
--- /dev/null
+++ b/luci-app-overview-manager/LICENSE
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Nikitid
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/luci-app-overview-manager/Makefile b/luci-app-overview-manager/Makefile
new file mode 100644
index 000000000..150b5588a
--- /dev/null
+++ b/luci-app-overview-manager/Makefile
@@ -0,0 +1,98 @@
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=luci-app-overview-manager
+PKG_VERSION:=0.1.0
+PKG_RELEASE:=1
+PKG_LICENSE:=MIT
+PKG_MAINTAINER:=nikitid
+PKGARCH:=all
+
+include $(INCLUDE_DIR)/package.mk
+
+define Package/luci-app-overview-manager
+  SECTION:=luci
+  CATEGORY:=LuCI
+  SUBMENU:=2. Modules
+  TITLE:=Status Overview widget manager
+  DEPENDS:=+luci-base +rpcd-mod-file
+endef
+
+define Package/luci-app-overview-manager/description
+ LuCI application for ordering and hiding Status Overview widgets without
+ modifying files owned by other packages.
+endef
+
+define Package/luci-app-overview-manager/conffiles
+/etc/config/overview-manager
+endef
+
+LUCI_LANGUAGES:=$(sort $(filter-out templates,$(notdir $(wildcard ${CURDIR}/po/*))))
+
+define Build/Compile
+endef
+
+define Package/luci-app-overview-manager/install
+	$(INSTALL_DIR) $(1)/etc/config
+	$(INSTALL_CONF) ./openwrt/files/etc/config/overview-manager $(1)/etc/config/overview-manager
+
+	$(INSTALL_DIR) $(1)/etc/uci-defaults
+	$(INSTALL_BIN) ./openwrt/files/etc/uci-defaults/luci-app-overview-manager \
+		$(1)/etc/uci-defaults/luci-app-overview-manager
+
+	$(INSTALL_DIR) $(1)/usr/libexec
+	$(INSTALL_BIN) ./runtime/overview-manager.sh $(1)/usr/libexec/overview-manager
+
+	$(INSTALL_DIR) $(1)/usr/share/luci/menu.d $(1)/usr/share/rpcd/acl.d
+	$(INSTALL_DATA) ./luci/menu.json $(1)/usr/share/luci/menu.d/luci-app-overview-manager.json
+	$(INSTALL_DATA) ./luci/acl.json $(1)/usr/share/rpcd/acl.d/luci-app-overview-manager.json
+
+	$(INSTALL_DIR) $(1)/www/luci-static/resources/overview-manager
+	$(INSTALL_DATA) ./luci/shared.js $(1)/www/luci-static/resources/overview-manager/shared.js
+
+	$(INSTALL_DIR) $(1)/www/luci-static/resources/view/overview-manager
+	$(INSTALL_DATA) ./luci/settings.js $(1)/www/luci-static/resources/view/overview-manager/settings.js
+
+	$(INSTALL_DIR) $(1)/www/luci-static/resources/view/status/include
+	$(INSTALL_DATA) ./luci/overview.js $(1)/www/luci-static/resources/view/status/include/00_overview-manager.js
+
+	$(INSTALL_DIR) $(1)/usr/share/licenses/luci-app-overview-manager
+	$(INSTALL_DATA) ./LICENSE $(1)/usr/share/licenses/luci-app-overview-manager/LICENSE
+
+	# scripts/po2lmo.py is a byte-compatible reimplementation of the luci-base
+	# po2lmo tool. Using it keeps this package independent of the LuCI feed
+	# host tools and produces the same catalogs as the SDK-less IPK build.
+	$(INSTALL_DIR) $(1)/usr/lib/lua/luci/i18n
+	$(foreach language,$(LUCI_LANGUAGES), \
+		$(foreach po,$(wildcard ${CURDIR}/po/$(language)/*.po), \
+			python3 $(CURDIR)/scripts/po2lmo.py $(po) \
+				$(1)/usr/lib/lua/luci/i18n/$(basename $(notdir $(po))).$(language).lmo; \
+			chmod 0644 $(1)/usr/lib/lua/luci/i18n/$(basename $(notdir $(po))).$(language).lmo;))
+endef
+
+define Package/luci-app-overview-manager/postinst
+#!/bin/sh
+[ -n "$${IPKG_INSTROOT:-}" ] && exit 0
+# This package defines its own postinst, so the default handler that drains
+# /etc/uci-defaults does not run. Apply the language registration here so a
+# runtime install takes effect without waiting for the next boot.
+if [ -x /etc/uci-defaults/luci-app-overview-manager ]; then
+	/etc/uci-defaults/luci-app-overview-manager &&
+		rm -f /etc/uci-defaults/luci-app-overview-manager
+fi
+rm -f /tmp/luci-indexcache
+rm -rf /tmp/luci-modulecache
+echo "Overview Manager installed. Open LuCI -> Status -> Overview Manager."
+exit 0
+endef
+
+define Package/luci-app-overview-manager/prerm
+#!/bin/sh
+[ -n "$${IPKG_INSTROOT:-}" ] && exit 0
+case "$${1:-}" in upgrade) exit 0 ;; esac
+[ "$${PKG_UPGRADE:-0}" = 1 ] && exit 0
+rm -f /tmp/luci-indexcache
+rm -rf /tmp/luci-modulecache
+exit 0
+endef
+
+$(eval $(call BuildPackage,luci-app-overview-manager))
diff --git a/luci-app-overview-manager/README.md b/luci-app-overview-manager/README.md
new file mode 100644
index 000000000..58aaf6e2c
--- /dev/null
+++ b/luci-app-overview-manager/README.md
@@ -0,0 +1,117 @@
+# Overview Manager for OpenWrt
+
+[Русский](README.ru.md)
+
+[![CI](https://github.com/Nikitid/luci-app-overview-manager/actions/workflows/ci.yml/badge.svg)](https://github.com/Nikitid/luci-app-overview-manager/actions/workflows/ci.yml)
+[![Release](https://img.shields.io/github/v/release/Nikitid/luci-app-overview-manager)](https://github.com/Nikitid/luci-app-overview-manager/releases/latest)
+[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
+
+The `luci-app-overview-manager` package is a LuCI application for arranging
+the cards on the **Status -> Overview** page.
+
+![Overview Manager widget list](docs/images/widgets.png)
+
+## Features
+
+- reorder widgets by dragging or with the up and down buttons;
+- hide cards you do not need;
+- works with third-party widgets installed as a LuCI status include;
+- the layout is stored in UCI and shared by every browser.
+
+## Requirements
+
+- official OpenWrt `24.10.x` with `opkg`;
+- official OpenWrt `25.12.x` with `apk`;
+- the stock `luci-mod-status` Status Overview page;
+- third-party widgets installed as a LuCI status include.
+
+On OpenWrt 25.12 the stock Hide button keeps its state separately, in the
+`localStorage` of one browser. It keeps working independently of the shared
+Overview Manager layout.
+
+## Installation
+
+### OpenWrt 24.10
+
+Download `luci-app-overview-manager_*_all.ipk` from
+[Releases](https://github.com/Nikitid/luci-app-overview-manager/releases) and upload it
+through **System -> Software -> Upload Package**.
+
+### OpenWrt 25.12
+
+```sh
+wget -O /tmp/nikitid-feed.sh \
+  https://raw.githubusercontent.com/Nikitid/openwrt-feed/feed/install.sh
+sh /tmp/nikitid-feed.sh luci-app-overview-manager
+```
+
+The installer verifies the publisher public key against a pinned checksum,
+adds the shared signed repository and installs only the named package.
+
+Later upgrades:
+
+```sh
+apk update
+apk upgrade luci-app-overview-manager
+```
+
+Only Overview Manager is upgraded, never every package on the router.
+
+## How it works
+
+Stock LuCI loads the files in
+`/www/luci-static/resources/view/status/include` in alphabetical order.
+Overview Manager adds an early service include, matches the cards to their
+source files and applies the layout stored in UCI to the DOM.
+
+Files belonging to other packages are never modified, renamed or deleted.
+Removing Overview Manager restores stock LuCI behaviour on its own.
+
+## Translations
+
+The interface uses the stock LuCI mechanism: `_()` in JavaScript and gettext
+catalogues in `po/`. At build time `po//overview-manager.po` is compiled
+into `/usr/lib/lua/luci/i18n/overview-manager..lmo` and ships in the main
+package, and `/etc/uci-defaults/luci-app-overview-manager` registers the
+language in `luci.languages`. The interface language follows the LuCI setting;
+no separate `luci-i18n-*` package is needed.
+
+The package translates only its own strings: a fully Russian LuCI also needs
+`luci-i18n-base-ru`. A new language is added as a
+`po//overview-manager.po` catalogue; `scripts/test-po2lmo.py` checks that
+the catalogues match the sources.
+
+## Limitations
+
+A LuCI status include has no common description of its internals: every widget
+implements arbitrary `load()` and `render()`. Overview Manager therefore
+arranges the order and visibility of cards, but does not edit their contents.
+
+A hidden widget is not displayed, but its own data collection may still run on
+the page poll.
+
+## Development
+
+```sh
+./scripts/ci-check.sh
+```
+
+Building, signing and releasing: [docs/DEVELOPMENT.md](docs/DEVELOPMENT.md).
+
+## Documentation
+
+- [Repository map](docs/MAP.md) - where things live
+- [Architecture](docs/ARCHITECTURE.md) - why the page is built this way
+- [Development](docs/DEVELOPMENT.md) - building, signing and releasing
+
+## Support
+
+Questions and bug reports go to
+[Issues](https://github.com/Nikitid/luci-app-overview-manager/issues/new/choose): pick the form that
+fits. Report a vulnerability privately through
+[a security advisory](https://github.com/Nikitid/luci-app-overview-manager/security/advisories/new).
+English or Russian is fine.
+
+## License
+
+[MIT](LICENSE)
diff --git a/luci-app-overview-manager/README.ru.md b/luci-app-overview-manager/README.ru.md
new file mode 100644
index 000000000..51b42267b
--- /dev/null
+++ b/luci-app-overview-manager/README.ru.md
@@ -0,0 +1,119 @@
+# Overview Manager для OpenWrt
+
+[English](README.md)
+
+[![CI](https://github.com/Nikitid/luci-app-overview-manager/actions/workflows/ci.yml/badge.svg)](https://github.com/Nikitid/luci-app-overview-manager/actions/workflows/ci.yml)
+[![Release](https://img.shields.io/github/v/release/Nikitid/luci-app-overview-manager)](https://github.com/Nikitid/luci-app-overview-manager/releases/latest)
+[![Лицензия: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
+
+Пакет `luci-app-overview-manager` - LuCI-приложение для настройки карточек на
+странице **Status -> Overview**.
+
+![Список виджетов в Overview Manager](docs/images/widgets.png)
+
+## Возможности
+
+- порядок виджетов меняется перетаскиванием или кнопками "выше" и "ниже";
+- ненужные карточки скрываются полностью;
+- работает со сторонними виджетами, установленными как LuCI status include;
+- раскладка хранится в UCI и общая для всех браузеров.
+
+## Требования
+
+- официальный OpenWrt `24.10.x` с `opkg`;
+- официальный OpenWrt `25.12.x` с `apk`;
+- стандартная страница `luci-mod-status` Status Overview;
+- сторонние виджеты, установленные как LuCI status include.
+
+В OpenWrt 25.12 штатная кнопка Hide хранит состояние отдельно в
+`localStorage` конкретного браузера. Она продолжает работать независимо от
+общей раскладки Overview Manager.
+
+## Установка
+
+### OpenWrt 24.10
+
+Скачайте `luci-app-overview-manager_*_all.ipk` из
+[Releases](https://github.com/Nikitid/luci-app-overview-manager/releases) и загрузите его
+через **System -> Software -> Upload Package**.
+
+### OpenWrt 25.12
+
+```sh
+wget -O /tmp/nikitid-feed.sh \
+  https://raw.githubusercontent.com/Nikitid/openwrt-feed/feed/install.sh
+sh /tmp/nikitid-feed.sh luci-app-overview-manager
+```
+
+Установщик проверяет публичный ключ издателя по закреплённой контрольной сумме,
+подключает общий подписанный репозиторий приложений и ставит только указанный
+пакет.
+
+Последующие обновления:
+
+```sh
+apk update
+apk upgrade luci-app-overview-manager
+```
+
+Обновляется только Overview Manager, а не все пакеты роутера.
+
+## Как это работает
+
+Штатный LuCI загружает файлы из
+`/www/luci-static/resources/view/status/include` в алфавитном порядке.
+Overview Manager добавляет ранний служебный include, сопоставляет карточки с
+исходными файлами и применяет сохранённую в UCI раскладку к DOM.
+
+Файлы других пакетов не изменяются, не переименовываются и не удаляются.
+После удаления Overview Manager штатное поведение LuCI восстанавливается
+автоматически.
+
+## Переводы
+
+Интерфейс использует штатный механизм LuCI: `_()` в JavaScript и каталоги
+gettext в `po/`. При сборке `po/<язык>/overview-manager.po` компилируется в
+`/usr/lib/lua/luci/i18n/overview-manager.<язык>.lmo` и попадает в основной
+пакет, а `/etc/uci-defaults/luci-app-overview-manager` регистрирует язык в
+`luci.languages`. Язык интерфейса следует настройке LuCI, отдельный пакет
+`luci-i18n-*` не требуется.
+
+Пакет переводит только свои строки: для полностью русского LuCI нужен ещё
+`luci-i18n-base-ru`. Новый язык добавляется каталогом
+`po/<язык>/overview-manager.po`; соответствие каталогов исходникам проверяет
+`scripts/test-po2lmo.py`.
+
+## Ограничения
+
+У LuCI status include нет общего описания внутренних полей: каждый виджет
+реализует произвольные `load()` и `render()`. Поэтому Overview Manager
+настраивает порядок и видимость карточек, но не редактирует их содержимое.
+
+Скрытый виджет не отображается, однако его штатный сбор данных может
+продолжать выполняться при опросе страницы.
+
+## Разработка
+
+```sh
+./scripts/ci-check.sh
+```
+
+Сборка, подпись и выпуск: [docs/DEVELOPMENT.md](docs/DEVELOPMENT.md).
+
+## Документация
+
+- [Карта репозитория](docs/MAP.md) - где что лежит
+- [Архитектура](docs/ARCHITECTURE.md) - почему страница устроена именно так
+- [Разработка](docs/DEVELOPMENT.md) - сборка, подпись и выпуск
+
+## Поддержка
+
+Вопросы и сообщения об ошибках - в
+[Issues](https://github.com/Nikitid/luci-app-overview-manager/issues/new/choose), выберите
+подходящую форму. Об уязвимости сообщайте приватно через
+[security advisory](https://github.com/Nikitid/luci-app-overview-manager/security/advisories/new).
+Можно писать по-русски или по-английски.
+
+## Лицензия
+
+[MIT](LICENSE)
diff --git a/luci-app-overview-manager/apk-feed.env b/luci-app-overview-manager/apk-feed.env
new file mode 100644
index 000000000..b45476fd2
--- /dev/null
+++ b/luci-app-overview-manager/apk-feed.env
@@ -0,0 +1,23 @@
+# Public OpenWrt 25.12 build and feed identity. This file is sourced as POSIX sh.
+
+# Target this package is built for.
+OPENWRT_APK_VERSION=25.12.5
+OPENWRT_APK_TARGET=mediatek/filogic
+OPENWRT_APK_ARCH=aarch64_cortex-a53
+OPENWRT_APK_SDK_ARCHIVE=openwrt-sdk-25.12.5-mediatek-filogic_gcc-14.3.0_musl.Linux-x86_64.tar.zst
+OPENWRT_APK_SDK_SHA256=ff4a38a397caa2cfe1c39e18f84ddede14878221b3593c3f2c4cfe24e3ec4c25
+
+# Shared publisher key. The same key signs every Nikitid OpenWrt application and
+# the shared index; apk binds a key to neither a package nor a repository, so a
+# per-application key would only add another trust anchor to every router.
+OPENWRT_APK_KEY_FILE=keys/nikitid-openwrt-release.pem
+OPENWRT_APK_TRUST_SHA256=f27474d9261f1084350cf4ba34ecdff29e533769c36483d8dd85566e30a6a703
+
+# This repository builds and signs its own package and publishes it as a GitHub
+# Release asset. It neither assembles an index nor hosts a feed URL:
+# Nikitid/openwrt-feed collects the current release of every member
+# application, verifies the signatures and publishes the signed index. Keeping
+# the feed out of an application repository means renaming or retiring this
+# project no longer moves a URL recorded in /etc/apk/repositories.d on every
+# installed router.
+OPENWRT_FEED_REPOSITORY=Nikitid/openwrt-feed
diff --git a/luci-app-overview-manager/docs/ARCHITECTURE.md b/luci-app-overview-manager/docs/ARCHITECTURE.md
new file mode 100644
index 000000000..39c194e22
--- /dev/null
+++ b/luci-app-overview-manager/docs/ARCHITECTURE.md
@@ -0,0 +1,212 @@
+# Implementation notes
+
+Load-bearing facts about LuCI and OpenWrt that this package depends on, why the
+code is shaped the way it is, and how to re-verify each claim. None of it is
+derivable from this repository alone: the upstream behaviour lives in
+`luci-base`, `luci-mod-status` and the active theme.
+
+Upstream references are paths inside `openwrt/luci`.
+
+## The Overview page rebuilds itself every poll cycle
+
+`luci-mod-status/htdocs/luci-static/resources/view/status/index.js` builds one
+`.cbi-section` per include **once**, in `render()`, and then on every poll cycle
+calls each include's `load()` and `render()` again and replaces the section
+*content* through `dom.content`. The interval is `luci.main.pollinterval`,
+default 5 seconds.
+
+Two consequences drive the design of `luci/overview.js`:
+
+1. **Never move a section unless the order actually changed.** Re-appending a
+   node re-inserts it, and re-insertion restarts its CSS animations. The theme
+   puts `fade-in` on every revealed section — `.fade-in { animation: fade-in
+   .4s ease }` with `opacity` `0 → 1` in
+   `themes/luci-theme-bootstrap/htdocs/luci-static/bootstrap/cascade.css` — so
+   re-appending all sections on each cycle makes the whole page flash every
+   five seconds. `applyLayout()` therefore compares the wanted order against
+   the live DOM order and touches nothing when they match.
+
+2. **Never clear a visibility class and re-add it.** Dropping
+   `overview-manager-hidden` from every section and then re-adding it exposes
+   every hidden widget for a frame. Use `classList.toggle(name, force)`, which
+   only mutates when the state really changes.
+
+`scripts/test-overview-ui.js` pins both: it counts `appendChild` calls and class
+mutations across a second identical render and fails if either is non-zero.
+Reverting either property makes it fail, which is worth re-checking if the test
+is ever refactored.
+
+`dom.content` (in `luci.js`) removes all children and appends the new ones in
+one synchronous task, so replacing our own container each cycle cannot paint an
+intermediate state. Only node *moves* and class churn are visible.
+
+`load()` caches its result for the lifetime of the page. The saved layout cannot
+change while the Overview page stays open, and the alternative is two helper
+process spawns every five seconds forever. A failed read is deliberately not
+cached, so a transient rpcd error retries on the next cycle instead of pinning
+an empty widget list for the session.
+
+## Widget-to-section mapping is positional and order-sensitive
+
+There is no attribute tying a rendered section to the include that produced it,
+so the mapping is by index: the *n*-th `.cbi-section` belongs to the *n*-th
+include. `data-overview-widget` is stamped on first use and reused afterwards.
+
+`index.js` requires its includes as `view.status.include.` and sorts
+**those module names**, so the `.js` suffix takes no part in the ordering. A
+file-name sort is not the same sort: `-` is 0x2D and `.` is 0x2E, so plain file
+names order `20_x-y.js` before `20_x.js`, while module names order `20_x` before
+`20_x-y`. One such pair shifts every later widget onto the wrong section, and
+the visible effect is that the wrong card is hidden or moved.
+
+`common.compareWidgets` exists for exactly this and must stay code-unit based.
+`localeCompare` would reorder per browser locale and reintroduce the bug in a
+locale-dependent way.
+
+Two further constraints follow from the same mechanism:
+
+- The include count must equal the section count, or `applyLayout()` gives up
+  after eight retries and silently does nothing. `index.js` filters
+  `fs.list` entries by `type == 'file'`, so an include installed as a symlink
+  would be skipped there while the shell helper's `[ -f ]` follows it and counts
+  it. Nothing in the tree creates such a symlink today; if the layout ever stops
+  applying on a specific device, check this first.
+- `title` must be non-empty and stable. `index.js` uses the include title as the
+  `localStorage` key for its own per-browser Hide button (`includes[i].id =
+  title`), so an empty title claims the empty key and collides with any other
+  untitled include. It is deliberately not wrapped in `_()`: a translated title
+  would change that key whenever the interface language changes.
+
+## Client-side translation
+
+The chain is not obvious and is easy to get subtly wrong.
+
+- The global `_()` is defined in `luci-base/htdocs/luci-static/resources/cbi.js`,
+  not in `luci.js`. It is `TR[sfh(trimws(s))] || s`.
+- `window.TR` is emitted by `admin/translations/`
+  (`luci-base/ucode/controller/admin/index.uc`), which the theme header loads on
+  every page, including the login page. It is a flat map of eight-hex-digit
+  hashes to strings, merged from **every** `*..lmo` in
+  `/usr/lib/lua/luci/i18n`.
+- The lookup key is the hash of the *whitespace-normalised* msgid: `trimws` in
+  `cbi.js` trims and collapses runs of space, tab and newline. `po2lmo` hashes
+  the **raw** msgid from the catalog. **Therefore msgids must already be
+  normalised** — one line, single spaces, no leading or trailing whitespace — or
+  the runtime lookup misses and the string silently stays English.
+- Because all catalogs share one namespace in an unspecified merge order, a
+  string that `luci-base` also translates must either be left out or given the
+  identical translation. `Show`, `Move up` and `Move down` are in that category
+  and use the exact `luci-base` wording so the collision cannot matter.
+
+`scripts/test-po2lmo.py` enforces the normalisation rule, the catalog-to-source
+correspondence in both directions, and round-trips every translation through the
+real hash and a minimal LMO reader.
+
+### Registering the language is mandatory
+
+Shipping a catalog is not enough. `determine_request_language()` in
+`luci-base/ucode/dispatcher.uc` only accepts a language that exists in
+`luci.languages`; with `luci.main.lang=auto` and no matching entry it falls
+through to `en`. A router with no `luci-i18n-*` package installed has an empty
+`luci.languages`, so the catalog would never be selected.
+
+`openwrt/files/etc/uci-defaults/luci-app-overview-manager` adds the entry, the
+same way `luci.mk` generates it for stock `luci-i18n-*` packages. Because this
+package defines its own `postinst`, the default handler that drains
+`/etc/uci-defaults` does not run, so `postinst` invokes the script itself and
+removes it on success; otherwise the language would only appear after the next
+reboot.
+
+Verify on a device:
+
+```sh
+wget -qO- 'http://127.0.0.1/cgi-bin/luci/admin/translations/ru' | head -c 400
+uci show luci.languages
+```
+
+and that content negotiation resolves as expected:
+
+```sh
+curl -s -H 'Accept-Language: ru' http:///cgi-bin/luci/ | grep -o ' oracle/lib/sfh.c
+cp luci/modules/luci-base/src/lib/lmo.h oracle/lib/
+: > oracle/lib/plural_formula.h
+cc -O1 -Ioracle/lib -o oracle/po2lmo oracle/po2lmo.c oracle/lib/sfh.c
+
+PO2LMO_REFERENCE=$PWD/oracle/po2lmo python3 scripts/test-po2lmo.py
+```
+
+The same binary can be diffed against every catalog in `luci-base/po/*/*.po` as
+a broader check; all of them currently match byte for byte.
+
+## Static resources are cached without a cache-buster
+
+`L.require` builds module URLs as
+`/.js` plus `?v=` **only when that field is
+set**, and the OpenWrt 25.12 page template does not set it — it versions
+`luci.js` alone. uhttpd serves the files with `ETag` and `Last-Modified` but no
+`Cache-Control`, so browsers apply heuristic freshness and can reuse a stale
+copy for a long time.
+
+Practical effect: after changing anything under
+`/www/luci-static/resources/`, a normal reload may keep running the old code. A
+reload that bypasses the cache is required — in Safari that is
+`Cmd+Option+R` ("Reload Page From Origin"); `Cmd+Shift+R` does nothing there.
+Confirm which code is live by reading the section titles, since a stale include
+renders its section heading differently:
+
+```js
+[...document.querySelectorAll('.cbi-section')].map(s => s.querySelector('h3')?.textContent.trim())
+```
+
+## Shell that ships to the router runs under BusyBox
+
+The test suite runs on GNU coreutils, which silently accepts constructs a stock
+OpenWrt image does not have: `sort -o`, `base64`, `grep -P` and `find -printf`
+among them. `scripts/check-busybox-compat.sh` scans the **staged package tree**
+rather than the sources, so the checked set cannot drift from what is installed;
+it also runs `busybox ash -n` on each script when a `busybox` binary is present,
+which no pattern list can replace.
+
+Four files reach the router: `CONTROL/postinst`, `CONTROL/prerm`,
+`etc/uci-defaults/luci-app-overview-manager` and `usr/libexec/overview-manager`.
+
+## Working against a real device
+
+- OpenWrt has no `sftp-server`, so `scp` fails. Stream instead:
+  `ssh  'cat > /path' < localfile`.
+- `apk-tools` on the device has no `mkpkg`, and OpenWrt 25.12 cannot install an
+  `.ipk`. Building a package needs the SDK; for a quick check, deploy the payload
+  files and compare checksums.
+- ACL changes need `/etc/init.d/rpcd reload`, which drops active LuCI sessions.
+- Name the package in every transaction. A blanket upgrade is never appropriate
+  on a live router; `scripts/check-apk-trust.sh` fails the build if one appears
+  in a script or in the documentation.
+- Verify a published package with the device's own `apk` and the tracked public
+  key, and confirm it is rejected without it:
+
+  ```sh
+  apk verify --keys-dir  .apk
+  ```
diff --git a/luci-app-overview-manager/docs/DEVELOPMENT.md b/luci-app-overview-manager/docs/DEVELOPMENT.md
new file mode 100644
index 000000000..4bd426539
--- /dev/null
+++ b/luci-app-overview-manager/docs/DEVELOPMENT.md
@@ -0,0 +1,38 @@
+# Development
+
+## Checks
+
+```sh
+./scripts/ci-check.sh
+```
+
+## Building
+
+The IPK is written to `dist/`. The APK is built with the official OpenWrt 25.12
+SDK:
+
+```sh
+OPENWRT_SDK_DIR=/path/to/openwrt-sdk-25.12.x-target \
+  ./scripts/build-apk.sh
+```
+
+A release APK is signed with the shared publisher key:
+
+```sh
+OPENWRT_SDK_DIR=/path/to/openwrt-sdk-25.12.x-target \
+OPENWRT_APK_SIGNING_KEY=/secure/path/release-private.pem \
+  ./scripts/build-apk-release.sh
+```
+
+The private half of the publisher key is not stored in any repository. This
+repository builds and signs only its own package and publishes it as a release
+asset; the index is assembled by
+[Nikitid/openwrt-feed](https://github.com/Nikitid/openwrt-feed). See
+[Joining the shared feed](https://github.com/Nikitid/openwrt-feed/blob/main/docs/MEMBER_INTEGRATION.md).
+
+## Release
+
+Push a `vX.Y.Z` tag matching the version in `release.env`. The release workflow
+checks the tag, runs `scripts/ci-check.sh`, builds and signs the APK with the
+pinned OpenWrt SDK, and publishes the release with notes made by
+`scripts/release-notes.sh` from the commit subjects since the previous tag.
diff --git a/luci-app-overview-manager/docs/MAP.md b/luci-app-overview-manager/docs/MAP.md
new file mode 100644
index 000000000..b7d86b1b4
--- /dev/null
+++ b/luci-app-overview-manager/docs/MAP.md
@@ -0,0 +1,34 @@
+# Repository map
+
+Where things live, so a task starts at the right file. Nothing here is large
+enough to need a generated function index; the biggest source file is 254
+lines, so reading one whole is cheap.
+
+## The shape of it
+
+One OpenWrt package: a LuCI application that customises the Overview page -
+which sections appear, in what order, and what each one shows.
+
+| area | files |
+| --- | --- |
+| pages | `luci/overview.js`, `luci/settings.js` |
+| shared design system and dictionary | `luci/shared.js` |
+| wiring | `luci/menu.json`, `luci/acl.json` |
+| packaged defaults | `openwrt/files/etc/config/overview-manager` |
+| translations | `po/` plus `scripts/po2lmo.py` |
+| build and release | `Makefile`, `apk-feed.env`, `scripts/` |
+
+## Checks
+
+`scripts/` holds the version-sync, release-tag and translation checks plus
+`test-po2lmo.py`. Run them before completion.
+
+## Documentation
+
+| file | for |
+| --- | --- |
+| `docs/MAP.md` | this file |
+| `docs/DEVELOPMENT.md` | building, signing and releasing |
+| `docs/ARCHITECTURE.md` | why the page is built the way it is |
+| `README.md` | user-facing, English |
+| `README.ru.md` | the Russian version |
diff --git a/luci-app-overview-manager/docs/images/widgets.png b/luci-app-overview-manager/docs/images/widgets.png
new file mode 100644
index 000000000..e748833c2
Binary files /dev/null and b/luci-app-overview-manager/docs/images/widgets.png differ
diff --git a/luci-app-overview-manager/keys/README.md b/luci-app-overview-manager/keys/README.md
new file mode 100644
index 000000000..5ae999105
--- /dev/null
+++ b/luci-app-overview-manager/keys/README.md
@@ -0,0 +1,15 @@
+# OpenWrt APK release key
+
+`nikitid-openwrt-release.pem` is the shared public P-256 key for the author's
+OpenWrt 25.12 application feed. It is byte-for-byte identical to the existing
+IKEv2 Manager release public key.
+
+The matching private key is not stored in this repository. Release builds read
+it from the protected `OPENWRT_APK_SIGNING_KEY` CI secret. Compromise of that
+private key would affect every package in the shared feed.
+
+Public-key SHA-256:
+
+```text
+f27474d9261f1084350cf4ba34ecdff29e533769c36483d8dd85566e30a6a703
+```
diff --git a/luci-app-overview-manager/keys/nikitid-openwrt-release.pem b/luci-app-overview-manager/keys/nikitid-openwrt-release.pem
new file mode 100644
index 000000000..786ed8adb
--- /dev/null
+++ b/luci-app-overview-manager/keys/nikitid-openwrt-release.pem
@@ -0,0 +1,4 @@
+-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE4Kze8kPGZESezGw8NMN4gDMgaevH
++Y9IgZbqWeHpW0gCNXNpctIlS1LSlQraDRwRTJlbg0R+uCGyv0/QnduYkg==
+-----END PUBLIC KEY-----
diff --git a/luci-app-overview-manager/luci/acl.json b/luci-app-overview-manager/luci/acl.json
new file mode 100644
index 000000000..94dc3ad63
--- /dev/null
+++ b/luci-app-overview-manager/luci/acl.json
@@ -0,0 +1,22 @@
+{
+	"luci-app-overview-manager": {
+		"description": "Configure the Status Overview widget layout",
+		"read": {
+			"file": {
+				"/usr/libexec/overview-manager files": [ "exec" ],
+				"/usr/libexec/overview-manager layout": [ "exec" ]
+			},
+			"ubus": {
+				"file": [ "exec" ]
+			}
+		},
+		"write": {
+			"file": {
+				"/usr/libexec/overview-manager save *": [ "exec" ]
+			},
+			"ubus": {
+				"file": [ "exec" ]
+			}
+		}
+	}
+}
diff --git a/luci-app-overview-manager/luci/menu.json b/luci-app-overview-manager/luci/menu.json
new file mode 100644
index 000000000..e0670148c
--- /dev/null
+++ b/luci-app-overview-manager/luci/menu.json
@@ -0,0 +1,13 @@
+{
+	"admin/status/overview-manager": {
+		"title": "Overview Manager",
+		"order": 2,
+		"action": {
+			"type": "view",
+			"path": "overview-manager/settings"
+		},
+		"depends": {
+			"acl": [ "luci-app-overview-manager" ]
+		}
+	}
+}
diff --git a/luci-app-overview-manager/luci/overview.js b/luci-app-overview-manager/luci/overview.js
new file mode 100644
index 000000000..a06b36677
--- /dev/null
+++ b/luci-app-overview-manager/luci/overview.js
@@ -0,0 +1,138 @@
+'use strict';
+'require baseclass';
+'require fs';
+'require overview-manager.shared as common';
+
+var helper = '/usr/libexec/overview-manager';
+var self = '00_overview-manager.js';
+
+/* luci-mod-status builds the widget sections once and only replaces their
+ * content on later poll cycles, and the saved layout cannot change while the
+ * Overview page stays loaded. Reading the layout once per page load keeps the
+ * poll cycle free of two extra helper invocations every five seconds. */
+var cached = null;
+
+function installedFiles(text) {
+	return (text || '').replace(/\r/g, '').split('\n').map(function(name) {
+		return name.trim();
+	}).filter(function(name) {
+		return /\.js$/.test(name);
+	}).sort(common.compareWidgets);
+}
+
+function orderedFiles(files, configured) {
+	var known = {};
+	files.forEach(function(name) { known[name] = true; });
+	var result = [ self ];
+
+	(configured || []).forEach(function(name) {
+		if (name !== self && known[name] && result.indexOf(name) < 0)
+			result.push(name);
+	});
+	files.forEach(function(name) {
+		if (result.indexOf(name) < 0)
+			result.push(name);
+	});
+	return result;
+}
+
+function applyLayout(marker, files, layout, attempts) {
+	var ownSection = marker.closest('.cbi-section');
+	var parent = ownSection && ownSection.parentNode;
+	var sections = parent ? Array.prototype.filter.call(parent.children, function(node) {
+		return node.classList && node.classList.contains('cbi-section');
+	}) : [];
+
+	if (!parent || sections.length !== files.length) {
+		if (attempts < 8)
+			window.setTimeout(function() {
+				applyLayout(marker, files, layout, attempts + 1);
+			}, 25);
+		return;
+	}
+
+	var byName = {};
+	var mapped = sections.every(function(node) {
+		var name = node.getAttribute('data-overview-widget');
+		return name && files.indexOf(name) >= 0 && !byName[name] &&
+			(byName[name] = node);
+	});
+	if (!mapped) {
+		byName = {};
+		files.forEach(function(name, index) {
+			byName[name] = sections[index];
+			sections[index].setAttribute('data-overview-widget', name);
+		});
+	}
+
+	var wanted = orderedFiles(files, layout.order);
+	var moved = wanted.some(function(name, index) {
+		return sections[index] !== byName[name];
+	});
+
+	/* Re-appending every section on each poll is what makes the page flicker,
+	 * so only touch the DOM when the effective order really changed. */
+	if (moved)
+		wanted.forEach(function(name) {
+			if (byName[name])
+				parent.appendChild(byName[name]);
+		});
+
+	var hidden = {};
+	layout.hidden.forEach(function(name) { hidden[name] = true; });
+
+	/* Toggle in place. Dropping the class first and re-adding it would reveal
+	 * every hidden widget for one frame on each poll cycle. */
+	files.forEach(function(name) {
+		if (byName[name])
+			byName[name].classList.toggle('overview-manager-hidden',
+				name === self || hidden[name] === true);
+	});
+}
+
+return baseclass.extend({
+	/* luci-mod-status uses the title as the localStorage key for its own Hide
+	 * button, so an empty one would claim the empty key and collide with any
+	 * other untitled include. This section is hidden by the stylesheet below
+	 * and never displays the title. It stays untranslated on purpose: a
+	 * translated title would change the key whenever the language changes. */
+	title: 'Overview Manager',
+
+	load: function() {
+		if (cached)
+			return Promise.resolve(cached);
+
+		return Promise.all([
+			L.resolveDefault(fs.exec(helper, [ 'files' ]), { stdout: '' }),
+			L.resolveDefault(fs.exec(helper, [ 'layout' ]), { stdout: '' })
+		]).then(function(data) {
+			/* Keep retrying on the next poll when the helper was unreachable
+			 * instead of caching an empty widget list for the whole session. */
+			if (data[0].stdout)
+				cached = data;
+			return data;
+		});
+	},
+
+	render: function(data) {
+		var files = installedFiles(data[0].stdout);
+		var layout = common.parseLayout(data[1].stdout);
+		var marker = E('span', {
+			'data-overview-manager-marker': '1',
+			'style': 'display:none'
+		});
+
+		window.requestAnimationFrame(function() {
+			window.requestAnimationFrame(function() {
+				applyLayout(marker, files, layout, 0);
+			});
+		});
+
+		return E('div', {}, [
+			E('style', {}, [
+				'.overview-manager-hidden{display:none!important}'
+			]),
+			marker
+		]);
+	}
+});
diff --git a/luci-app-overview-manager/luci/settings.js b/luci-app-overview-manager/luci/settings.js
new file mode 100644
index 000000000..f5acf7c3e
--- /dev/null
+++ b/luci-app-overview-manager/luci/settings.js
@@ -0,0 +1,253 @@
+'use strict';
+'require view';
+'require fs';
+'require ui';
+'require overview-manager.shared as common';
+
+var helper = '/usr/libexec/overview-manager';
+var self = '00_overview-manager.js';
+
+function installedFiles(text) {
+	return (text || '').replace(/\r/g, '').split('\n').map(function(name) {
+		return name.trim();
+	}).filter(function(name) {
+		return /\.js$/.test(name) && name !== self;
+	}).sort(common.compareWidgets);
+}
+
+function fallbackTitle(name) {
+	return name.replace(/^\d+_/, '').replace(/\.js$/, '').replace(/[-_]+/g, ' ')
+		.replace(/(^|\s)(.)/g, function(match, space, letter) {
+			return space + letter.toUpperCase();
+		});
+}
+
+function widgetTitle(name) {
+	var moduleName = 'view.status.include.' + name.replace(/\.js$/, '');
+	return L.resolveDefault(L.require(moduleName), null).then(function(widget) {
+		return widget && widget.title != null && widget.title !== '' ?
+			String(widget.title) : fallbackTitle(name);
+	});
+}
+
+function arrange(files, layout) {
+	var known = {};
+	files.forEach(function(name) { known[name] = true; });
+	var order = [];
+	layout.order.forEach(function(name) {
+		if (known[name] && order.indexOf(name) < 0)
+			order.push(name);
+	});
+	files.forEach(function(name) {
+		if (order.indexOf(name) < 0)
+			order.push(name);
+	});
+	return order;
+}
+
+return view.extend({
+	load: function() {
+		return Promise.all([
+			L.resolveDefault(fs.exec(helper, [ 'files' ]), { stdout: '' }),
+			L.resolveDefault(fs.exec(helper, [ 'layout' ]), { stdout: '' })
+		]).then(function(data) {
+			var files = installedFiles(data[0].stdout);
+			var layout = common.parseLayout(data[1].stdout);
+			return Promise.all(files.map(widgetTitle)).then(function(titles) {
+				return arrange(files, layout).map(function(name) {
+					var index = files.indexOf(name);
+					return {
+						name: name,
+						title: titles[index],
+						visible: layout.hidden.indexOf(name) < 0
+					};
+				});
+			});
+		});
+	},
+
+	render: function(items) {
+		var list = E('div', { 'class': 'overview-manager-list' });
+		var result = E('span', { 'class': 'overview-manager-result' });
+		var saveButton;
+		var dragging = null;
+
+		function move(name, offset) {
+			var index = items.findIndex(function(item) { return item.name === name; });
+			var target = index + offset;
+			if (index < 0 || target < 0 || target >= items.length)
+				return;
+			var item = items.splice(index, 1)[0];
+			items.splice(target, 0, item);
+			renderList();
+		}
+
+		function row(item, index) {
+			var visible = E('input', {
+				'type': 'checkbox',
+				'checked': item.visible ? '' : null,
+				'change': function(ev) {
+					item.visible = ev.target.checked;
+					renderList();
+				}
+			});
+			return E('div', {
+				'class': 'overview-manager-row' + (item.visible ? '' : ' hidden-widget'),
+				'draggable': 'true',
+				'data-widget': item.name,
+				'dragstart': function(ev) {
+					dragging = item.name;
+					ev.currentTarget.classList.add('dragging');
+					ev.dataTransfer.effectAllowed = 'move';
+					ev.dataTransfer.setData('text/plain', item.name);
+				},
+				'dragend': function(ev) {
+					dragging = null;
+					ev.currentTarget.classList.remove('dragging');
+					Array.prototype.forEach.call(
+						list.querySelectorAll('.drag-over'),
+						function(node) { node.classList.remove('drag-over'); });
+				},
+				'dragover': function(ev) {
+					ev.preventDefault();
+					ev.currentTarget.classList.add('drag-over');
+					ev.dataTransfer.dropEffect = 'move';
+				},
+				'dragleave': function(ev) {
+					ev.currentTarget.classList.remove('drag-over');
+				},
+				'drop': function(ev) {
+					ev.preventDefault();
+					var sourceName = dragging || ev.dataTransfer.getData('text/plain');
+					var sourceIndex = items.findIndex(function(entry) {
+						return entry.name === sourceName;
+					});
+					if (sourceIndex < 0 || sourceName === item.name)
+						return;
+					var after = ev.clientY > ev.currentTarget.getBoundingClientRect().top +
+						ev.currentTarget.offsetHeight / 2;
+					var moved = items.splice(sourceIndex, 1)[0];
+					var targetIndex = items.findIndex(function(entry) {
+						return entry.name === item.name;
+					});
+					items.splice(targetIndex + (after ? 1 : 0), 0, moved);
+					renderList();
+				}
+			}, [
+				E('span', {
+					'class': 'overview-manager-handle',
+					'title': _('Drag to reorder')
+				}, [ '⠿' ]),
+				E('span', {}, [
+					E('span', { 'class': 'overview-manager-widget-title' }, [ item.title ]),
+					E('span', { 'class': 'overview-manager-widget-file' }, [ item.name ])
+				]),
+				E('label', { 'class': 'overview-manager-switch' }, [
+					visible,
+					E('span', {}, [ _('Show') ])
+				]),
+				E('span', { 'class': 'overview-manager-order-buttons' }, [
+					E('button', {
+						'class': 'cbi-button',
+						'type': 'button',
+						'disabled': index === 0 ? '' : null,
+						'title': _('Move up'),
+						'click': function() { move(item.name, -1); }
+					}, [ '↑' ]),
+					E('button', {
+						'class': 'cbi-button',
+						'type': 'button',
+						'disabled': index === items.length - 1 ? '' : null,
+						'title': _('Move down'),
+						'click': function() { move(item.name, 1); }
+					}, [ '↓' ])
+				])
+			]);
+		}
+
+		function renderList() {
+			list.replaceChildren.apply(list, items.map(row));
+		}
+
+		function save() {
+			var order = items.map(function(item) { return item.name; }).join(',');
+			var hidden = items.filter(function(item) {
+				return !item.visible;
+			}).map(function(item) {
+				return item.name;
+			}).join(',');
+
+			saveButton.disabled = true;
+			result.className = 'overview-manager-result';
+			result.textContent = _('Saving…');
+			return fs.exec(helper, [ 'save', order, hidden ]).then(function() {
+				result.className = 'overview-manager-result good';
+				result.textContent = _('Saved. Reload Overview to see the layout.');
+			}).catch(function(error) {
+				result.className = 'overview-manager-result bad';
+				result.textContent = error.message || _('Unable to save the layout.');
+			}).finally(function() {
+				saveButton.disabled = false;
+			});
+		}
+
+		function resetOrder() {
+			items.sort(function(left, right) {
+				return common.compareWidgets(left.name, right.name);
+			});
+			items.forEach(function(item) { item.visible = true; });
+			result.className = 'overview-manager-result';
+			result.textContent = _('Default order restored locally. Save to apply it.');
+			renderList();
+		}
+
+		saveButton = E('button', {
+			'class': 'cbi-button cbi-button-positive',
+			'type': 'button',
+			'click': save
+		}, [ _('Save layout') ]);
+
+		renderList();
+
+		return E('div', { 'class': 'overview-manager-page' }, [
+			common.styles(),
+			E('div', { 'class': 'overview-manager-header' }, [
+				E('div', {}, [
+					E('h2', {}, [ 'Overview Manager' ]),
+					E('p', { 'class': 'overview-manager-subtitle' }, [
+						_('Change the order of widgets on Status → Overview and hide widgets you do not need.')
+					])
+				])
+			]),
+			E('section', { 'class': 'overview-manager-section' }, [
+				E('div', { 'class': 'overview-manager-section-head' }, [
+					E('div', {}, [
+						E('h3', {}, [ _('Overview widgets') ]),
+						E('p', {}, [
+							_('Drag rows or use the arrow buttons. Newly installed widgets are appended in their normal filename order.')
+						])
+					])
+				]),
+				items.length ? list : E('p', { 'class': 'overview-manager-muted' }, [
+					_('No Overview widgets were found.')
+				]),
+				E('div', { 'class': 'overview-manager-actions' }, [
+					saveButton,
+					E('button', {
+						'class': 'cbi-button',
+						'type': 'button',
+						'click': resetOrder
+					}, [ _('Restore defaults') ]),
+					result
+				]),
+				E('div', { 'class': 'overview-manager-note' }, [
+					_('OpenWrt 25.12 also has a browser-local Hide button. A widget hidden there remains hidden only in that browser, independently of this router-wide layout.')
+				])
+			])
+		]);
+	},
+
+	handleSaveApply: null,
+	handleSave: null,
+	handleReset: null
+});
diff --git a/luci-app-overview-manager/luci/shared.js b/luci-app-overview-manager/luci/shared.js
new file mode 100644
index 000000000..43a191b89
--- /dev/null
+++ b/luci-app-overview-manager/luci/shared.js
@@ -0,0 +1,212 @@
+'use strict';
+'require baseclass';
+
+/* luci-mod-status requires its includes as 'view.status.include.' and
+ * sorts those module names, so the .js suffix takes no part in the ordering.
+ * Sorting the raw file names instead would place '20_x.js' and '20_x-y.js' in
+ * the opposite order and shift the whole widget-to-section mapping. The
+ * comparison stays code-unit based to match the plain Array.sort() upstream
+ * uses; localeCompare would reorder names per browser locale. */
+function compareWidgets(left, right) {
+	left = left.replace(/\.js$/, '');
+	right = right.replace(/\.js$/, '');
+	return left < right ? -1 : (left > right ? 1 : 0);
+}
+
+function parseLayout(text) {
+	var result = { order: [], hidden: [] };
+	(text || '').replace(/\r/g, '').split('\n').forEach(function(line) {
+		var equal = line.indexOf('=');
+		if (equal < 1)
+			return;
+		var key = line.slice(0, equal);
+		if (key !== 'order' && key !== 'hidden')
+			return;
+		result[key] = line.slice(equal + 1).trim().split(/\s+/).filter(Boolean);
+	});
+	return result;
+}
+
+function styles() {
+	return E('style', {}, [ `
+		.overview-manager-page {
+			--ovm-accent: #4f7dff;
+			--ovm-accent-2: #8b5cf6;
+			--ovm-grad: linear-gradient(135deg, #4f7dff, #8b5cf6);
+			--ovm-border: rgba(128, 128, 128, .22);
+			--ovm-border-strong: rgba(128, 128, 128, .34);
+			--ovm-surface: rgba(128, 128, 128, .06);
+			--ovm-surface-2: rgba(128, 128, 128, .11);
+			--ovm-muted: rgba(128, 128, 128, .85);
+			--ovm-good: #16a34a;
+			--ovm-warn: #d97706;
+			--ovm-bad: #e11d48;
+			--ovm-radius: 16px;
+			--ovm-radius-sm: 11px;
+			--ovm-shadow: 0 1px 2px rgba(0, 0, 0, .05),
+				0 10px 30px -18px rgba(0, 0, 0, .45);
+			max-width: 1040px;
+		}
+		.overview-manager-page * { box-sizing: border-box; }
+		.overview-manager-header {
+			display: flex;
+			align-items: flex-start;
+			justify-content: space-between;
+			gap: 1rem;
+			margin: 0 0 1.4rem;
+		}
+		.overview-manager-header h2 {
+			margin: 0 0 .35rem;
+			font-size: clamp(1.45rem, 2.6vw, 1.85rem);
+			font-weight: 750;
+			letter-spacing: -.015em;
+		}
+		.overview-manager-subtitle,
+		.overview-manager-muted {
+			color: var(--ovm-muted);
+			line-height: 1.5;
+		}
+		.overview-manager-subtitle { margin: 0; max-width: 760px; }
+		.overview-manager-section {
+			margin: 1rem 0;
+			padding: 1.2rem 1.3rem;
+			border: 1px solid var(--ovm-border);
+			border-radius: var(--ovm-radius);
+			background: var(--ovm-surface);
+			box-shadow: var(--ovm-shadow);
+		}
+		.overview-manager-section-head {
+			display: flex;
+			align-items: flex-start;
+			justify-content: space-between;
+			gap: 1rem;
+			margin-bottom: 1rem;
+		}
+		.overview-manager-section-head h3 { margin: 0 0 .3rem; }
+		.overview-manager-section-head p {
+			margin: 0;
+			color: var(--ovm-muted);
+			line-height: 1.5;
+		}
+		.overview-manager-list {
+			display: grid;
+			gap: .6rem;
+		}
+		.overview-manager-row {
+			display: grid;
+			grid-template-columns: auto minmax(0, 1fr) auto auto;
+			align-items: center;
+			gap: .75rem;
+			min-width: 0;
+			padding: .75rem .85rem;
+			border: 1px solid var(--ovm-border);
+			border-radius: var(--ovm-radius-sm);
+			background: color-mix(in srgb, currentColor 3%, transparent);
+			transition: border-color .14s ease, background .14s ease,
+				transform .14s ease, opacity .14s ease;
+		}
+		.overview-manager-row[draggable="true"] { cursor: grab; }
+		.overview-manager-row.dragging { opacity: .45; }
+		.overview-manager-row.drag-over {
+			border-color: var(--ovm-accent);
+			background: color-mix(in srgb, var(--ovm-accent) 9%, transparent);
+		}
+		.overview-manager-row.hidden-widget { opacity: .64; }
+		.overview-manager-handle {
+			color: var(--ovm-muted);
+			font-size: 1.25rem;
+			letter-spacing: -.25rem;
+			user-select: none;
+		}
+		.overview-manager-widget-title {
+			display: block;
+			overflow: hidden;
+			font-weight: 680;
+			text-overflow: ellipsis;
+			white-space: nowrap;
+		}
+		.overview-manager-widget-file {
+			display: block;
+			margin-top: .2rem;
+			overflow: hidden;
+			color: var(--ovm-muted);
+			font-family: monospace;
+			font-size: .75rem;
+			text-overflow: ellipsis;
+			white-space: nowrap;
+		}
+		.overview-manager-switch {
+			display: inline-flex;
+			align-items: center;
+			gap: .45rem;
+			white-space: nowrap;
+			cursor: pointer;
+		}
+		.overview-manager-switch input { margin: 0; }
+		.overview-manager-order-buttons {
+			display: inline-flex;
+			gap: .3rem;
+		}
+		.overview-manager-actions {
+			display: flex;
+			align-items: center;
+			flex-wrap: wrap;
+			gap: .6rem;
+			margin-top: 1rem;
+		}
+		.overview-manager-result { color: var(--ovm-muted); }
+		.overview-manager-result.good { color: var(--ovm-good); }
+		.overview-manager-result.bad { color: var(--ovm-bad); }
+		.overview-manager-note {
+			margin-top: 1rem;
+			padding: .85rem 1rem;
+			border: 1px solid color-mix(in srgb, var(--ovm-warn) 30%, var(--ovm-border));
+			border-left: .26rem solid var(--ovm-warn);
+			border-radius: var(--ovm-radius-sm);
+			background: color-mix(in srgb, var(--ovm-warn) 7%, transparent);
+			line-height: 1.5;
+		}
+		.overview-manager-page .cbi-button {
+			padding: .5rem .8rem;
+			border: 1px solid var(--ovm-border);
+			border-radius: var(--ovm-radius-sm);
+			background: var(--ovm-surface-2);
+			font-weight: 620;
+			line-height: 1.2;
+			cursor: pointer;
+			transition: transform .12s ease, border-color .14s ease,
+				filter .14s ease;
+		}
+		.overview-manager-page .cbi-button:hover {
+			border-color: var(--ovm-border-strong);
+			transform: translateY(-1px);
+		}
+		.overview-manager-page .cbi-button-positive {
+			border-color: transparent;
+			background-image: var(--ovm-grad);
+			color: #fff;
+		}
+		.overview-manager-page button[disabled] {
+			opacity: .55;
+			cursor: wait;
+			transform: none;
+		}
+		@media (max-width: 650px) {
+			.overview-manager-header,
+			.overview-manager-section-head { flex-direction: column; }
+			.overview-manager-row {
+				grid-template-columns: auto minmax(0, 1fr) auto;
+			}
+			.overview-manager-order-buttons {
+				grid-column: 2 / -1;
+				justify-self: end;
+			}
+		}
+	` ]);
+}
+
+return baseclass.extend({
+	compareWidgets: compareWidgets,
+	parseLayout: parseLayout,
+	styles: styles
+});
diff --git a/luci-app-overview-manager/openwrt/files/etc/config/overview-manager b/luci-app-overview-manager/openwrt/files/etc/config/overview-manager
new file mode 100644
index 000000000..c540498e0
--- /dev/null
+++ b/luci-app-overview-manager/openwrt/files/etc/config/overview-manager
@@ -0,0 +1,3 @@
+config main 'main'
+	option order ''
+	option hidden ''
diff --git a/luci-app-overview-manager/openwrt/files/etc/uci-defaults/luci-app-overview-manager b/luci-app-overview-manager/openwrt/files/etc/uci-defaults/luci-app-overview-manager
new file mode 100644
index 000000000..f65cb6f43
--- /dev/null
+++ b/luci-app-overview-manager/openwrt/files/etc/uci-defaults/luci-app-overview-manager
@@ -0,0 +1,35 @@
+#!/bin/sh
+
+# Register the bundled catalogs in luci.languages, the same way the stock
+# luci-i18n-* packages do. Without this LuCI never selects the language: both
+# the language dropdown and the "auto" browser detection only consider codes
+# present in this list.
+
+set -e
+
+changed=0
+
+# The section normally exists already, but uci set would fail without it.
+uci -q get luci.languages >/dev/null || uci set luci.languages=internal
+
+for catalog in /usr/lib/lua/luci/i18n/overview-manager.*.lmo; do
+  [ -f "$catalog" ] || continue
+
+  language="${catalog##*/overview-manager.}"
+  language="${language%.lmo}"
+
+  case "$language" in
+    ru) name='Русский' ;;
+    *) name="$language" ;;
+  esac
+
+  # LuCI stores the option name with underscores, as in luci.languages.pt_br.
+  option="$(printf '%s' "$language" | tr '-' '_')"
+
+  uci set "luci.languages.$option=$name"
+  changed=1
+done
+
+[ "$changed" = 0 ] || uci commit luci
+
+exit 0
diff --git a/luci-app-overview-manager/po/ru/overview-manager.po b/luci-app-overview-manager/po/ru/overview-manager.po
new file mode 100644
index 000000000..36bde248e
--- /dev/null
+++ b/luci-app-overview-manager/po/ru/overview-manager.po
@@ -0,0 +1,53 @@
+msgid ""
+msgstr ""
+"Content-Type: text/plain; charset=UTF-8\n"
+"Language: ru\n"
+"Plural-Forms: nplurals=3; plural=(n%10==1 && n%100!=11 ? 0 : n%10>=2 && n%10<=4 && (n%100<10 || n%100>=20) ? 1 : 2);\n"
+
+msgid "Change the order of widgets on Status → Overview and hide widgets you do not need."
+msgstr "Меняйте порядок карточек на странице «Статус → Обзор» и скрывайте ненужные виджеты."
+
+msgid "Default order restored locally. Save to apply it."
+msgstr "Исходный порядок восстановлен. Сохраните, чтобы применить его."
+
+msgid "Drag rows or use the arrow buttons. Newly installed widgets are appended in their normal filename order."
+msgstr "Перетаскивайте строки или используйте стрелки. Новые виджеты добавляются в конец в обычном порядке имён файлов."
+
+msgid "Drag to reorder"
+msgstr "Перетащите для изменения порядка"
+
+# "Move down", "Move up" and "Show" also exist in the luci-base catalog. All
+# catalogs are merged into one lookup table in an unspecified order, so these
+# keep the exact luci-base wording to make the collision a no-op.
+msgid "Move down"
+msgstr "Переместить вниз"
+
+msgid "Move up"
+msgstr "Переместить вверх"
+
+msgid "No Overview widgets were found."
+msgstr "Виджеты страницы «Обзор» не найдены."
+
+msgid "OpenWrt 25.12 also has a browser-local Hide button. A widget hidden there remains hidden only in that browser, independently of this router-wide layout."
+msgstr "В OpenWrt 25.12 также есть локальная для браузера кнопка «Скрыть». Скрытый ею виджет остаётся скрытым только в этом браузере независимо от общей раскладки роутера."
+
+msgid "Overview widgets"
+msgstr "Виджеты страницы «Обзор»"
+
+msgid "Restore defaults"
+msgstr "Вернуть исходный порядок"
+
+msgid "Save layout"
+msgstr "Сохранить раскладку"
+
+msgid "Saved. Reload Overview to see the layout."
+msgstr "Сохранено. Обновите страницу «Обзор», чтобы увидеть раскладку."
+
+msgid "Saving…"
+msgstr "Сохраняю…"
+
+msgid "Show"
+msgstr "Показать"
+
+msgid "Unable to save the layout."
+msgstr "Не удалось сохранить раскладку."
diff --git a/luci-app-overview-manager/po/templates/overview-manager.pot b/luci-app-overview-manager/po/templates/overview-manager.pot
new file mode 100644
index 000000000..504743735
--- /dev/null
+++ b/luci-app-overview-manager/po/templates/overview-manager.pot
@@ -0,0 +1,47 @@
+msgid ""
+msgstr "Content-Type: text/plain; charset=UTF-8\n"
+
+msgid "Change the order of widgets on Status → Overview and hide widgets you do not need."
+msgstr ""
+
+msgid "Default order restored locally. Save to apply it."
+msgstr ""
+
+msgid "Drag rows or use the arrow buttons. Newly installed widgets are appended in their normal filename order."
+msgstr ""
+
+msgid "Drag to reorder"
+msgstr ""
+
+msgid "Move down"
+msgstr ""
+
+msgid "Move up"
+msgstr ""
+
+msgid "No Overview widgets were found."
+msgstr ""
+
+msgid "OpenWrt 25.12 also has a browser-local Hide button. A widget hidden there remains hidden only in that browser, independently of this router-wide layout."
+msgstr ""
+
+msgid "Overview widgets"
+msgstr ""
+
+msgid "Restore defaults"
+msgstr ""
+
+msgid "Save layout"
+msgstr ""
+
+msgid "Saved. Reload Overview to see the layout."
+msgstr ""
+
+msgid "Saving…"
+msgstr ""
+
+msgid "Show"
+msgstr ""
+
+msgid "Unable to save the layout."
+msgstr ""
diff --git a/luci-app-overview-manager/release.env b/luci-app-overview-manager/release.env
new file mode 100644
index 000000000..ba8ee007d
--- /dev/null
+++ b/luci-app-overview-manager/release.env
@@ -0,0 +1,4 @@
+PKG_NAME=luci-app-overview-manager
+PKG_VERSION=0.1.0
+PKG_RELEASE=
+PKG_ARCH=all
diff --git a/luci-app-overview-manager/runtime/overview-manager.sh b/luci-app-overview-manager/runtime/overview-manager.sh
new file mode 100755
index 000000000..6fb777deb
--- /dev/null
+++ b/luci-app-overview-manager/runtime/overview-manager.sh
@@ -0,0 +1,78 @@
+#!/bin/sh
+
+set -eu
+
+INCLUDE_DIR="${OVERVIEW_MANAGER_INCLUDE_DIR:-/www/luci-static/resources/view/status/include}"
+UCI="${OVERVIEW_MANAGER_UCI:-uci}"
+SELF="00_overview-manager.js"
+
+files() {
+  for path in "$INCLUDE_DIR"/*.js; do
+    [ -f "$path" ] || continue
+    basename "$path"
+  done | sort
+}
+
+layout() {
+  order="$("$UCI" -q get overview-manager.main.order 2>/dev/null || true)"
+  hidden="$("$UCI" -q get overview-manager.main.hidden 2>/dev/null || true)"
+  printf 'order=%s\nhidden=%s\n' "$order" "$hidden"
+}
+
+normalize_list() {
+  value="${1:-}"
+  result=""
+  seen=" "
+  old_ifs="$IFS"
+  IFS=', '
+  set -- $value
+  IFS="$old_ifs"
+
+  for name in "$@"; do
+    [ -n "$name" ] || continue
+    case "$name" in
+      "$SELF" | *[!A-Za-z0-9_.-]* | *.js.js)
+        printf 'Invalid widget name: %s\n' "$name" >&2
+        return 1
+        ;;
+      *.js) ;;
+      *)
+        printf 'Invalid widget name: %s\n' "$name" >&2
+        return 1
+        ;;
+    esac
+    [ -f "$INCLUDE_DIR/$name" ] || {
+      printf 'Widget is not installed: %s\n' "$name" >&2
+      return 1
+    }
+    case "$seen" in
+      *" $name "*) continue ;;
+    esac
+    result="${result:+$result }$name"
+    seen="$seen$name "
+  done
+  printf '%s\n' "$result"
+}
+
+save() {
+  order="$(normalize_list "${1:-}")"
+  hidden="$(normalize_list "${2:-}")"
+
+  "$UCI" -q set overview-manager.main=main
+  "$UCI" -q set "overview-manager.main.order=$order"
+  "$UCI" -q set "overview-manager.main.hidden=$hidden"
+  "$UCI" -q commit overview-manager
+  printf 'Layout saved.\n'
+}
+
+usage() {
+  printf 'Usage: %s {files|layout|save ORDER HIDDEN}\n' "$0" >&2
+  exit 2
+}
+
+case "${1:-}" in
+  files) files ;;
+  layout) layout ;;
+  save) save "${2:-}" "${3:-}" ;;
+  *) usage ;;
+esac
diff --git a/luci-app-overview-manager/scripts/build-apk-release.sh b/luci-app-overview-manager/scripts/build-apk-release.sh
new file mode 100755
index 000000000..52f1ab523
--- /dev/null
+++ b/luci-app-overview-manager/scripts/build-apk-release.sh
@@ -0,0 +1,72 @@
+#!/bin/sh
+
+set -eu
+
+fail() {
+  printf 'build-apk-release: %s\n' "$*" >&2
+  exit 1
+}
+
+root="$(CDPATH= cd -- "$(dirname "$0")/.." && pwd)"
+. "$root/release.env"
+. "$root/apk-feed.env"
+
+sdk="${OPENWRT_SDK_DIR:-}"
+signing_key="${OPENWRT_APK_SIGNING_KEY:-}"
+public_key="$root/$OPENWRT_APK_KEY_FILE"
+output="$root/dist/apk"
+
+[ -n "$sdk" ] || fail 'OPENWRT_SDK_DIR is required'
+[ -d "$sdk" ] || fail "SDK directory not found: $sdk"
+[ -n "$signing_key" ] || fail 'OPENWRT_APK_SIGNING_KEY is required'
+[ -r "$signing_key" ] || fail "signing key not readable: $signing_key"
+[ -r "$public_key" ] || fail "public key not found: $public_key"
+
+case "$(basename "$sdk")" in
+  "${OPENWRT_APK_SDK_ARCHIVE%.tar.zst}") ;;
+  *) fail "unexpected SDK directory: $(basename "$sdk")" ;;
+esac
+
+for command in make openssl rsync sha256sum; do
+  command -v "$command" >/dev/null 2>&1 ||
+    fail "required command is missing: $command"
+done
+
+"$root/scripts/check-apk-trust.sh"
+tmp="$(mktemp -d)"
+cleanup() {
+  rm -rf "$tmp"
+}
+trap cleanup EXIT HUP INT TERM
+
+openssl ec -in "$signing_key" -pubout \
+  -out "$tmp/derived-public.pem" >/dev/null 2>&1 ||
+  fail 'invalid EC signing key'
+cmp -s "$tmp/derived-public.pem" "$public_key" ||
+  fail 'signing key does not match the shared public release key'
+
+OPENWRT_APK_PUBLIC_KEY="$public_key" \
+OPENWRT_APK_SIGNING_KEY="$signing_key" \
+  "$root/scripts/build-apk.sh"
+
+apk_tool="$sdk/staging_dir/host/bin/apk"
+[ -x "$apk_tool" ] || fail "SDK apk tool not found: $apk_tool"
+package="$root/dist/${PKG_NAME}-${PKG_VERSION}.apk"
+[ -r "$package" ] || fail "built APK was not found: $package"
+
+"$apk_tool" --allow-untrusted adbsign --sign-key "$signing_key" "$package"
+"$apk_tool" --keys-dir "$root/keys" verify "$package"
+
+# Only this package is published. Nikitid/openwrt-feed collects the released
+# APK and builds the shared signed index, so no public key, bootstrap script or
+# index is shipped from here.
+rm -rf "$output"
+mkdir -p "$output"
+cp "$package" "$output/"
+(
+  cd "$output"
+  sha256sum "${PKG_NAME}-${PKG_VERSION}.apk" >SHA256SUMS.apk
+  sha256sum -c SHA256SUMS.apk
+)
+
+printf 'Signed APK built in %s\n' "$output"
diff --git a/luci-app-overview-manager/scripts/build-apk.sh b/luci-app-overview-manager/scripts/build-apk.sh
new file mode 100755
index 000000000..547fedac0
--- /dev/null
+++ b/luci-app-overview-manager/scripts/build-apk.sh
@@ -0,0 +1,46 @@
+#!/bin/sh
+
+set -eu
+
+fail() {
+  printf 'build-apk: %s\n' "$*" >&2
+  exit 1
+}
+
+root="$(CDPATH= cd -- "$(dirname "$0")/.." && pwd)"
+. "$root/release.env"
+sdk="${OPENWRT_SDK_DIR:-}"
+[ -n "$sdk" ] || fail 'OPENWRT_SDK_DIR is required'
+[ -d "$sdk" ] || fail "SDK directory not found: $sdk"
+command -v rsync >/dev/null 2>&1 || fail 'rsync is required'
+
+"$root/scripts/check-version-sync.sh"
+sdk_package="$sdk/package/$PKG_NAME"
+rm -rf "$sdk_package"
+mkdir -p "$sdk_package"
+rsync -a --delete \
+  --exclude .git \
+  --exclude build \
+  --exclude dist \
+  --exclude .DS_Store \
+  "$root/" "$sdk_package/"
+
+make -C "$sdk" defconfig
+make -C "$sdk" "package/$PKG_NAME/clean" V=s
+
+if [ -n "${OPENWRT_APK_SIGNING_KEY:-}" ] && [ -n "${OPENWRT_APK_PUBLIC_KEY:-}" ]; then
+  make -C "$sdk" \
+    BUILD_KEY_APK_SEC="$OPENWRT_APK_SIGNING_KEY" \
+    BUILD_KEY_APK_PUB="$OPENWRT_APK_PUBLIC_KEY" \
+    "package/$PKG_NAME/compile" V=s
+else
+  make -C "$sdk" "package/$PKG_NAME/compile" V=s
+fi
+
+package_path="$(find "$sdk/bin/packages" -type f \
+  -name "${PKG_NAME}-${PKG_VERSION}.apk" -print -quit)"
+[ -n "$package_path" ] || fail 'built APK was not found'
+mkdir -p "$root/dist"
+rm -f "$root/dist"/*.apk
+cp "$package_path" "$root/dist/"
+printf '%s\n' "$root/dist/${package_path##*/}"
diff --git a/luci-app-overview-manager/scripts/build-ipk.sh b/luci-app-overview-manager/scripts/build-ipk.sh
new file mode 100755
index 000000000..06b1ddc2d
--- /dev/null
+++ b/luci-app-overview-manager/scripts/build-ipk.sh
@@ -0,0 +1,16 @@
+#!/bin/sh
+
+set -eu
+
+root="$(CDPATH= cd -- "$(dirname "$0")/.." && pwd)"
+stage="${BUILD_DIR:-$root/build/ipk}/stage"
+
+mkdir -p "$root/dist"
+"$root/scripts/check-version-sync.sh"
+"$root/scripts/stage-package.sh" "$stage"
+rm -f "$root/dist"/*.ipk
+python3 "$root/scripts/pack-ipk.py" "$stage" "$root/dist"
+(
+  cd "$root/dist"
+  sha256sum ./*.ipk >SHA256SUMS
+)
diff --git a/luci-app-overview-manager/scripts/check-apk-trust.sh b/luci-app-overview-manager/scripts/check-apk-trust.sh
new file mode 100755
index 000000000..b3cedfa92
--- /dev/null
+++ b/luci-app-overview-manager/scripts/check-apk-trust.sh
@@ -0,0 +1,81 @@
+#!/bin/sh
+
+set -eu
+
+fail() {
+  printf 'check-apk-trust: %s\n' "$*" >&2
+  exit 1
+}
+
+root="$(CDPATH= cd -- "$(dirname "$0")/.." && pwd)"
+. "$root/apk-feed.env"
+public_key="$root/$OPENWRT_APK_KEY_FILE"
+
+[ -r "$public_key" ] || fail "public key not found: $OPENWRT_APK_KEY_FILE"
+actual="$(sha256sum "$public_key" | awk '{ print $1 }')"
+[ "$actual" = "$OPENWRT_APK_TRUST_SHA256" ] ||
+  fail "public key checksum mismatch: $actual"
+openssl pkey -pubin -in "$public_key" -noout >/dev/null 2>&1 ||
+  fail 'release public key is not a valid PEM public key'
+
+tracked_files() {
+  find "$root" -path "$root/.git" -prune -o \
+    -path "$root/build" -prune -o -path "$root/dist" -prune -o \
+    -type f -print
+}
+
+# Keep this in sync with the secret patterns in .gitignore. The previous
+# anchored form missed names such as release-private.pem.
+if tracked_files |
+    grep -Ei '\.key$|private[^/]*\.(pem|key)$|signing[^/]*\.(pem|key)$|/signing/' \
+    >/dev/null; then
+  fail 'private signing material is present in the source tree'
+fi
+
+# A private key under an unexpected name still has recognisable contents. The
+# scan runs in a subshell, so it only reports and leaves failing to the caller.
+key_material="$(tracked_files |
+  grep -Ei '\.(pem|key|crt)$' |
+  while IFS= read -r candidate; do
+    if grep -q 'PRIVATE KEY' "$candidate"; then
+      printf '%s\n' "${candidate#"$root"/}"
+    fi
+  done)"
+[ -z "$key_material" ] ||
+  fail "private key material found in: $(printf '%s' "$key_material" | tr '\n' ' ')"
+
+# Contract with the shared feed (see openwrt-feed/docs/MEMBER_INTEGRATION.md):
+# this repository signs
+# and publishes only its own package. It must not host a feed URL, ship a trust
+# bootstrap of its own or assemble an index.
+[ "${OPENWRT_FEED_REPOSITORY:-}" = Nikitid/openwrt-feed ] ||
+  fail 'OPENWRT_FEED_REPOSITORY must name the shared feed'
+
+[ ! -e "$root/scripts/install-openwrt25.sh" ] ||
+  fail 'the shared installer replaced scripts/install-openwrt25.sh; remove it'
+
+if grep -rlE 'raw\.githubusercontent\.com/Nikitid/[A-Za-z0-9._-]+/apk-feed' \
+    "$root/scripts" "$root/docs" "$root/.github" "$root"/*.md "$root"/*.env \
+    2>/dev/null | grep -q .; then
+  fail 'a retired per-application feed URL is still referenced'
+fi
+
+# Contract rule: every package transaction names the packages it touches, so a
+# release never upgrades the whole router.
+blanket="$(tracked_files |
+  grep -E '\.(sh|md|yml|env)$' |
+  xargs awk '
+    /(apk|opkg)[ \t]+upgrade/ {
+      rest = $0
+      sub(/.*(apk|opkg)[ \t]+upgrade/, "", rest)
+      gsub(/[ \t]*--[a-zA-Z-]+/, "", rest)
+      gsub(/[ \t]/, "", rest)
+      if (rest == "" || rest ~ /^([;&|#]|\|\||&&)/)
+        printf "%s:%d\n", FILENAME, FNR
+    }
+  ' 2>/dev/null)"
+[ -z "$blanket" ] ||
+  fail "package upgrade without an explicit package name: $(
+    printf '%s' "$blanket" | tr '\n' ' ')"
+
+printf 'APK trust configuration OK\n'
diff --git a/luci-app-overview-manager/scripts/check-busybox-compat.sh b/luci-app-overview-manager/scripts/check-busybox-compat.sh
new file mode 100755
index 000000000..eb8049202
--- /dev/null
+++ b/luci-app-overview-manager/scripts/check-busybox-compat.sh
@@ -0,0 +1,99 @@
+#!/bin/sh
+
+# Check the shell that actually lands on the router for constructs BusyBox does
+# not provide. The test suite runs on GNU coreutils, which masks these: sort -o,
+# base64, grep -P and find -printf all exist there and none exist on a stock
+# OpenWrt image.
+#
+# The scan runs over a staged package tree so it can never drift from what is
+# installed. When a busybox binary is available it also syntax-checks every
+# script with BusyBox ash itself.
+
+set -eu
+
+fail() {
+  printf 'check-busybox-compat: %s\n' "$*" >&2
+  exit 1
+}
+
+stage="${1:?usage: check-busybox-compat.sh STAGE_DIR}"
+[ -d "$stage" ] || fail "stage directory not found: $stage"
+
+# Every regular file in the stage whose first line is a POSIX sh shebang.
+shell_files() {
+  find "$stage" -type f -print | sort | while IFS= read -r file; do
+    case "$(head -n 1 "$file" 2>/dev/null)" in
+      '#!/bin/sh' | '#!/bin/sh '* | '#!/bin/ash' | '#!/usr/bin/env sh') ;;
+      *) continue ;;
+    esac
+    printf '%s\n' "$file"
+  done
+}
+
+files="$(shell_files)"
+[ -n "$files" ] || fail 'no shell scripts found in the stage'
+
+# Each entry is "regexexplanation".
+findings=''
+scan() {
+  pattern="$1"
+  message="$2"
+  hits="$(printf '%s\n' "$files" |
+    xargs grep -nE "$pattern" 2>/dev/null || true)"
+  if [ -n "$hits" ]; then
+    findings="$findings
+$message
+$(printf '%s' "$hits" | sed "s|^$stage/||")"
+  fi
+}
+
+# Absent from BusyBox, or present with different semantics.
+scan '\bsort\b[^|;&]*(-o[[:space:]]|--output)' \
+  'sort -o is not supported by BusyBox sort; redirect to a temporary file'
+scan '\bbase64\b' \
+  'base64 is not present on a stock OpenWrt image'
+scan '\bgrep\b[^|;&]*(-[a-zA-Z]*P|--perl-regexp)' \
+  'grep -P is not supported by BusyBox grep'
+scan '\bfind\b[^|;&]*-printf' \
+  'find -printf is not supported by BusyBox find'
+scan '\bgensub[[:space:]]*\(' \
+  'gensub() is a GNU awk extension'
+scan '\bstat\b[^|;&]*--format' \
+  'stat --format is GNU-only; BusyBox stat accepts -c'
+scan '\breadlink\b[^|;&]*--canonicalize' \
+  'readlink --canonicalize is GNU-only; BusyBox accepts -f'
+
+# Bash-only syntax that ash rejects outright.
+scan '\[\[' \
+  '[[ ]] is a bash keyword; ash only has [ ]'
+scan 'set[[:space:]]+-o[[:space:]]+pipefail' \
+  'set -o pipefail is not supported by ash'
+scan '\$\{[A-Za-z_][A-Za-z0-9_]*//' \
+  '${var//pattern/replacement} is bash-only; use tr or sed'
+scan '\$\{[A-Za-z_][A-Za-z0-9_]*\^\^' \
+  '${var^^} is bash-only'
+scan "\\\$'" \
+  "\$'...' quoting is bash-only"
+scan '\becho[[:space:]]+-e\b' \
+  'echo -e is not portable; use printf'
+scan '=\([[:space:]]*[^)]' \
+  'arrays are bash-only'
+
+if [ -n "$findings" ]; then
+  printf 'BusyBox incompatibilities in the packaged shell:%s\n' "$findings" >&2
+  exit 1
+fi
+
+# A real parser is stricter than any pattern list, so use one when present.
+if command -v busybox >/dev/null 2>&1; then
+  # The loop runs in a subshell, so it reports names and leaves failing to the
+  # caller; parser diagnostics go to stderr on their own.
+  rejected="$(printf '%s\n' "$files" | while IFS= read -r file; do
+    busybox ash -n "$file" || printf '%s\n' "${file#"$stage"/}"
+  done)"
+  [ -z "$rejected" ] ||
+    fail "BusyBox ash rejected: $(printf '%s' "$rejected" | tr '\n' ' ')"
+  printf 'BusyBox compatibility OK (patterns and ash -n)\n'
+else
+  printf 'BusyBox compatibility OK (patterns only; busybox not installed)\n'
+fi
diff --git a/luci-app-overview-manager/scripts/check-readme.sh b/luci-app-overview-manager/scripts/check-readme.sh
new file mode 100755
index 000000000..ef684cc74
--- /dev/null
+++ b/luci-app-overview-manager/scripts/check-readme.sh
@@ -0,0 +1,115 @@
+#!/bin/sh
+#
+# template: check-readme v1 (repo-templates)
+# Formatted to pass both `shfmt -i 2` and `shfmt -i 2 -bn -ci`, the styles
+# the consuming repositories check with; each gets this file verbatim.
+# Do not edit in place: change templates/shared/ in repo-templates
+# and run scripts/sync-templates.sh --update.
+#
+# Hold README.md (English) and README.ru.md (Russian) to the shared layout:
+#
+#   #  for         #  для 
+#   [Русский](README.ru.md)           [English](README.md)
+#   badges: CI, Release, License
+#   ## Features                       ## Возможности
+#   ## Requirements                   ## Требования
+#   ## Installation                   ## Установка
+#   ##              ## 
+#   ## Development                    ## Разработка
+#   ## Documentation                  ## Документация
+#   ## Support                        ## Поддержка
+#   ## License                        ## Лицензия
+#
+# Both files must have the same number of sections, so one language cannot
+# silently drop what the other says. Punctuation is plain ASCII in both: no
+# typographic dashes, arrows, quotes or ellipses. The release badge is required
+# only where .github/workflows/release.yml exists. Every relative link must
+# resolve.
+
+set -eu
+
+root="$(CDPATH='' cd -- "$(dirname "$0")/.." && pwd)"
+cd "$root"
+
+status=0
+fail() {
+  printf 'README: %s\n' "$*" >&2
+  status=1
+}
+
+headings() {
+  sed -n 's/^## //p' "$1"
+}
+
+# check_layout   , each list
+# separated by '|'. Project sections may only sit between the two.
+check_layout() {
+  file="$1"
+  head_want="$2"
+  tail_want="$3"
+  if [ ! -f "$file" ]; then
+    fail "$file is missing"
+    return
+  fi
+  if ! head -n 1 "$file" | grep -q '^# '; then
+    fail "$file does not start with a '# ' title"
+  fi
+  head_have="$(headings "$file" | head -n 3 | paste -sd '|' -)"
+  tail_have="$(headings "$file" | tail -n 4 | paste -sd '|' -)"
+  if [ "$head_have" != "$head_want" ]; then
+    fail "$file: the first sections are '$head_have', expected '$head_want'"
+  fi
+  if [ "$tail_have" != "$tail_want" ]; then
+    fail "$file: the last sections are '$tail_have', expected '$tail_want'"
+  fi
+}
+
+check_layout README.md 'Features|Requirements|Installation' \
+  'Development|Documentation|Support|License'
+check_layout README.ru.md 'Возможности|Требования|Установка' \
+  'Разработка|Документация|Поддержка|Лицензия'
+
+if ! grep -qF '[Русский](README.ru.md)' README.md; then
+  fail 'README.md does not link to README.ru.md'
+fi
+if ! grep -qF '[English](README.md)' README.ru.md; then
+  fail 'README.ru.md does not link to README.md'
+fi
+
+en="$(headings README.md | wc -l | tr -d ' ')"
+ru="$(headings README.ru.md | wc -l | tr -d ' ')"
+if [ "$en" != "$ru" ]; then
+  fail "README.md has $en sections and README.ru.md has $ru"
+fi
+
+for file in README.md README.ru.md; do
+  if ! grep -q 'actions/workflows/.*badge\.svg' "$file"; then
+    fail "$file has no CI badge"
+  fi
+  if ! grep -q 'img\.shields\.io/github/license\|License-\|license-' "$file"; then
+    fail "$file has no license badge"
+  fi
+  if [ -f .github/workflows/release.yml ]; then
+    if ! grep -q 'img\.shields\.io/github/v/release' "$file"; then
+      fail "$file has no release badge"
+    fi
+  fi
+
+  # The curly quotes in the pattern are what it looks for, not a typo.
+  # shellcheck disable=SC1112
+  typographic="$(grep -n '—\|–\|→\|←\|«\|»\|“\|”\|‘\|’\|…' "$file" | head -n 3 || true)"
+  if [ -n "$typographic" ]; then
+    fail "$file has non-ASCII punctuation: $typographic"
+  fi
+
+  # Relative links: [text](path) and [text](path#anchor), not URLs or anchors.
+  links="$(grep -o '](\([^)#:]*\)[)#]' "$file" | sed 's/^](//; s/[)#]$//' | sort -u)"
+  missing=""
+  for target in $links; do
+    [ -e "$target" ] || missing="$missing $target"
+  done
+  [ -z "$missing" ] || fail "$file links to missing files:$missing"
+done
+
+[ "$status" -eq 0 ] && printf 'README layout OK: %s sections each\n' "$en"
+exit "$status"
diff --git a/luci-app-overview-manager/scripts/check-release-tag.sh b/luci-app-overview-manager/scripts/check-release-tag.sh
new file mode 100755
index 000000000..4994e6d7f
--- /dev/null
+++ b/luci-app-overview-manager/scripts/check-release-tag.sh
@@ -0,0 +1,14 @@
+#!/bin/sh
+
+set -eu
+
+root="$(CDPATH= cd -- "$(dirname "$0")/.." && pwd)"
+. "$root/release.env"
+tag="${1:?usage: check-release-tag.sh TAG}"
+expected="v$PKG_VERSION"
+
+[ "$tag" = "$expected" ] || {
+  printf 'release tag mismatch: expected %s, got %s\n' "$expected" "$tag" >&2
+  exit 1
+}
+printf 'release tag OK: %s\n' "$tag"
diff --git a/luci-app-overview-manager/scripts/check-version-sync.sh b/luci-app-overview-manager/scripts/check-version-sync.sh
new file mode 100755
index 000000000..88a4b4c68
--- /dev/null
+++ b/luci-app-overview-manager/scripts/check-version-sync.sh
@@ -0,0 +1,23 @@
+#!/bin/sh
+
+set -eu
+
+root="$(CDPATH= cd -- "$(dirname "$0")/.." && pwd)"
+. "$root/release.env"
+
+make_name="$(sed -n 's/^PKG_NAME:=//p' "$root/Makefile" | head -n 1)"
+make_version="$(sed -n 's/^PKG_VERSION:=//p' "$root/Makefile" | head -n 1)"
+make_arch="$(sed -n 's/^PKGARCH:=//p' "$root/Makefile" | head -n 1)"
+
+[ "$make_name" = "$PKG_NAME" ] || {
+  printf 'package name mismatch: %s != %s\n' "$make_name" "$PKG_NAME" >&2
+  exit 1
+}
+[ "$make_version" = "$PKG_VERSION" ] || {
+  printf 'package version mismatch: %s != %s\n' "$make_version" "$PKG_VERSION" >&2
+  exit 1
+}
+[ "$make_arch" = "$PKG_ARCH" ] || {
+  printf 'package architecture mismatch: %s != %s\n' "$make_arch" "$PKG_ARCH" >&2
+  exit 1
+}
diff --git a/luci-app-overview-manager/scripts/ci-check.sh b/luci-app-overview-manager/scripts/ci-check.sh
new file mode 100755
index 000000000..0a0adc126
--- /dev/null
+++ b/luci-app-overview-manager/scripts/ci-check.sh
@@ -0,0 +1,36 @@
+#!/bin/sh
+
+set -eu
+
+root="$(CDPATH= cd -- "$(dirname "$0")/.." && pwd)"
+cd "$root"
+
+./scripts/check-version-sync.sh
+./scripts/check-readme.sh
+./scripts/check-apk-trust.sh
+find runtime scripts -type f -name '*.sh' -exec sh -n {} +
+find luci -type f -name '*.js' -exec node --check {} +
+node ./scripts/test-overview-ui.js
+PYTHONPYCACHEPREFIX="$root/build/pycache" \
+  python3 -m py_compile scripts/pack-ipk.py scripts/po2lmo.py scripts/test-po2lmo.py
+PYTHONPYCACHEPREFIX="$root/build/pycache" \
+  python3 ./scripts/test-po2lmo.py
+python3 - <<'PY'
+import json
+from pathlib import Path
+
+for path in Path("luci").glob("*.json"):
+    json.loads(path.read_text())
+    print(f"json OK: {path}")
+PY
+./scripts/test-runtime.sh
+./scripts/build-ipk.sh
+# The staged tree is exactly what lands on the router, so check it rather than
+# the sources: the build host has GNU coreutils and the router does not.
+./scripts/check-busybox-compat.sh "${BUILD_DIR:-$root/build/ipk}/stage"
+first="$(sha256sum dist/*.ipk | awk '{print $1}')"
+./scripts/build-ipk.sh
+second="$(sha256sum dist/*.ipk | awk '{print $1}')"
+[ "$first" = "$second" ]
+git diff --check 2>/dev/null || true
+printf 'ci-check OK\n'
diff --git a/luci-app-overview-manager/scripts/pack-ipk.py b/luci-app-overview-manager/scripts/pack-ipk.py
new file mode 100755
index 000000000..ddae1bf7c
--- /dev/null
+++ b/luci-app-overview-manager/scripts/pack-ipk.py
@@ -0,0 +1,96 @@
+#!/usr/bin/env python3
+"""Build a deterministic opkg package without requiring an OpenWrt SDK."""
+
+import gzip
+import io
+import os
+import sys
+import tarfile
+
+EPOCH = 0
+
+
+def normalize(info):
+    info.uid = info.gid = 0
+    info.uname = info.gname = "root"
+    info.mtime = EPOCH
+    return info
+
+
+def archive(members):
+    raw = io.BytesIO()
+    with tarfile.open(fileobj=raw, mode="w", format=tarfile.GNU_FORMAT) as tar:
+        for archive_name, path in members:
+            info = normalize(tar.gettarinfo(path, archive_name))
+            if info.isreg():
+                with open(path, "rb") as source:
+                    tar.addfile(info, source)
+            else:
+                tar.addfile(info)
+    compressed = io.BytesIO()
+    with gzip.GzipFile(fileobj=compressed, mode="wb", mtime=EPOCH) as output:
+        output.write(raw.getvalue())
+    return compressed.getvalue()
+
+
+def walk_payload(stage):
+    result = []
+    for root, directories, files in os.walk(stage):
+        directories.sort()
+        relative = os.path.relpath(root, stage)
+        if relative == "CONTROL" or relative.startswith("CONTROL" + os.sep):
+            continue
+        if relative != ".":
+            result.append(("./" + relative, root))
+        for name in sorted(files):
+            path = os.path.join(root, name)
+            result.append(("./" + os.path.relpath(path, stage), path))
+    return sorted(result)
+
+
+def field(path, name):
+    with open(path, encoding="utf-8") as source:
+        for line in source:
+            if line.startswith(name + ":"):
+                return line.split(":", 1)[1].strip()
+    raise SystemExit(f"missing {name} in {path}")
+
+
+def main():
+    if len(sys.argv) != 3:
+        raise SystemExit("usage: pack-ipk.py STAGE OUTPUT_DIR")
+    stage, output_dir = sys.argv[1:]
+    control_dir = os.path.join(stage, "CONTROL")
+    control_path = os.path.join(control_dir, "control")
+    control_members = [("./", control_dir)]
+    control_members.extend(
+        ("./" + name, os.path.join(control_dir, name))
+        for name in sorted(os.listdir(control_dir))
+    )
+    parts = {
+        "debian-binary": b"2.0\n",
+        "control.tar.gz": archive(control_members),
+        "data.tar.gz": archive(walk_payload(stage)),
+    }
+    package = field(control_path, "Package")
+    version = field(control_path, "Version")
+    architecture = field(control_path, "Architecture")
+    os.makedirs(output_dir, exist_ok=True)
+    output_path = os.path.join(
+        output_dir, f"{package}_{version}_{architecture}.ipk"
+    )
+    raw = io.BytesIO()
+    with tarfile.open(fileobj=raw, mode="w", format=tarfile.GNU_FORMAT) as tar:
+        for name in ("debian-binary", "control.tar.gz", "data.tar.gz"):
+            payload = parts[name]
+            info = normalize(tarfile.TarInfo("./" + name))
+            info.mode = 0o644
+            info.size = len(payload)
+            tar.addfile(info, io.BytesIO(payload))
+    with gzip.GzipFile(output_path, "wb", mtime=EPOCH) as output:
+        output.write(raw.getvalue())
+    print(output_path)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/luci-app-overview-manager/scripts/po2lmo.py b/luci-app-overview-manager/scripts/po2lmo.py
new file mode 100644
index 000000000..3f62ab528
--- /dev/null
+++ b/luci-app-overview-manager/scripts/po2lmo.py
@@ -0,0 +1,254 @@
+#!/usr/bin/env python3
+"""Compile a gettext PO catalog into LuCI's LMO format.
+
+This is a byte-for-byte reimplementation of po2lmo from luci-base. Both package
+build paths use it so the SDK-less IPK and the SDK-built APK ship identical
+catalogs and neither depends on the LuCI feed host tools being available.
+
+The reference implementation is modules/luci-base/src/po2lmo.c; the reader that
+consumes the output is modules/luci-base/src/lib/lmo.c. scripts/test-po2lmo.py
+pins the behaviour with known-answer tests and can diff against the real
+po2lmo binary when one is available.
+"""
+
+import os
+import struct
+import sys
+
+MASK = 0xFFFFFFFF
+
+
+def sfh_hash(data):
+    """Paul Hsieh's SuperFastHash, seeded with the length as lmo.c does."""
+    length = len(data)
+    if length <= 0:
+        return 0
+
+    def u16(offset):
+        return data[offset] | (data[offset + 1] << 8)
+
+    def s8(offset):
+        value = data[offset]
+        return value - 256 if value > 127 else value
+
+    hash_value = length
+    rem = length & 3
+    offset = 0
+
+    for _ in range(length >> 2):
+        hash_value = (hash_value + u16(offset)) & MASK
+        tmp = ((u16(offset + 2) << 11) ^ hash_value) & MASK
+        hash_value = ((hash_value << 16) ^ tmp) & MASK
+        hash_value = (hash_value + (hash_value >> 11)) & MASK
+        offset += 4
+
+    if rem == 3:
+        hash_value = (hash_value + u16(offset)) & MASK
+        hash_value = (hash_value ^ (hash_value << 16)) & MASK
+        hash_value = (hash_value ^ ((s8(offset + 2) << 18) & MASK)) & MASK
+        hash_value = (hash_value + (hash_value >> 11)) & MASK
+    elif rem == 2:
+        hash_value = (hash_value + u16(offset)) & MASK
+        hash_value = (hash_value ^ (hash_value << 11)) & MASK
+        hash_value = (hash_value + (hash_value >> 17)) & MASK
+    elif rem == 1:
+        hash_value = (hash_value + s8(offset)) & MASK
+        hash_value = (hash_value ^ (hash_value << 10)) & MASK
+        hash_value = (hash_value + (hash_value >> 1)) & MASK
+
+    hash_value = (hash_value ^ (hash_value << 3)) & MASK
+    hash_value = (hash_value + (hash_value >> 5)) & MASK
+    hash_value = (hash_value ^ (hash_value << 4)) & MASK
+    hash_value = (hash_value + (hash_value >> 17)) & MASK
+    hash_value = (hash_value ^ (hash_value << 25)) & MASK
+    hash_value = (hash_value + (hash_value >> 6)) & MASK
+    return hash_value
+
+
+def extract_string(line):
+    """Return the quoted payload of a PO line, or None when there is none.
+
+    Like the C original this only unescapes \\" and \\\\. Every other escape,
+    \\n included, is kept verbatim as backslash plus character, which is what
+    makes the PO header parse below work on literal "\\n" separators.
+    """
+    if line.startswith("#"):
+        return None
+
+    out = []
+    escaped = False
+    started = False
+
+    for char in line:
+        if not started:
+            if char == '"':
+                started = True
+            continue
+        if escaped:
+            if char not in ('"', "\\"):
+                out.append("\\")
+            out.append(char)
+            escaped = False
+        elif char == "\\":
+            escaped = True
+        elif char != '"':
+            out.append(char)
+        else:
+            break
+
+    return "".join(out) if started else None
+
+
+class Message:
+    """One PO record, mirroring struct msg in po2lmo.c."""
+
+    def __init__(self):
+        self.reset()
+
+    def reset(self):
+        self.plural_num = -1
+        self.ctxt = None
+        self.msgid = None
+        self.id_plural = None
+        self.values = [None] * 10
+        self.current = None
+
+    def append(self, text):
+        if self.current is None:
+            return
+        field, index = self.current
+        if field == "values":
+            self.values[index] = (self.values[index] or "") + text
+        else:
+            setattr(self, field, (getattr(self, field) or "") + text)
+
+
+class Catalog:
+    """Accumulates the string blob and the index of an LMO archive."""
+
+    def __init__(self):
+        self.blob = bytearray()
+        self.entries = []
+
+    def _write(self, payload):
+        offset = len(self.blob)
+        self.blob += payload
+        # Every blob is padded to a 4-byte boundary, as print() does in C.
+        self.blob += b"\0" * ((4 - (len(payload) % 4)) % 4)
+        return offset
+
+    def add(self, key, value, plural_count):
+        key_id = sfh_hash(key)
+        # Identical hashes mean the string is its own translation; the C tool
+        # drops those entries so the reader falls back to the source string.
+        if key_id == sfh_hash(value):
+            return
+        offset = self._write(value)
+        self.entries.append((key_id, plural_count, offset, len(value)))
+
+    def add_plural_forms(self, formula):
+        offset = self._write(formula)
+        self.entries.append((0, 0, offset, len(formula)))
+
+    def serialize(self):
+        if not self.blob:
+            return None
+        out = bytearray(self.blob)
+        # Stable sort by key_id keeps the output deterministic where the C
+        # qsort would leave the order of equal keys unspecified.
+        for entry in sorted(self.entries, key=lambda item: item[0]):
+            out += struct.pack(">IIII", *entry)
+        out += struct.pack(">I", len(self.blob))
+        return bytes(out)
+
+
+def add_message(catalog, msg):
+    """Emit one PO record, mirroring print_msg() in po2lmo.c."""
+    if msg.msgid is not None and msg.values[0] is not None:
+        for index in range(msg.plural_num + 1):
+            value = msg.values[index]
+            if value is None:
+                continue
+            if msg.ctxt is not None and msg.id_plural is not None:
+                key = f"{msg.ctxt}\1{msg.msgid}\2{index}"
+            elif msg.ctxt is not None:
+                key = f"{msg.ctxt}\1{msg.msgid}"
+            elif msg.id_plural is not None:
+                key = f"{msg.msgid}\2{index}"
+            else:
+                key = msg.msgid
+            catalog.add(
+                key.encode(), value.encode(), msg.plural_num + 1
+            )
+    elif msg.values[0] is not None:
+        # The header record carries the plural formula. Fields are separated by
+        # literal "\n" two-character sequences left in place by extract_string,
+        # and a formula on an unterminated last line is ignored upstream too.
+        header = msg.values[0]
+        for field in header.split("\\n")[:-1]:
+            if field[:14].lower() == "plural-forms: ":
+                catalog.add_plural_forms(field[14:].encode())
+                break
+    msg.reset()
+
+
+def compile_po(text):
+    catalog = Catalog()
+    msg = Message()
+
+    for line in text.splitlines() + [None]:
+        eof = line is None
+
+        if not eof and line.startswith('msgctxt "'):
+            if msg.msgid is not None or msg.values[0] is not None:
+                add_message(catalog, msg)
+            msg.ctxt = None
+            msg.current = ("ctxt", 0)
+        elif eof or line.startswith('msgid "'):
+            if msg.msgid is not None or msg.values[0] is not None:
+                add_message(catalog, msg)
+            msg.msgid = None
+            msg.current = ("msgid", 0)
+        elif line.startswith('msgid_plural "'):
+            msg.id_plural = None
+            msg.current = ("id_plural", 0)
+        elif line.startswith('msgstr "') or line.startswith("msgstr["):
+            if line.startswith("msgstr["):
+                msg.plural_num = int(line[7:].split("]")[0])
+            else:
+                msg.plural_num = 0
+            if msg.plural_num >= 10:
+                raise SystemExit("po2lmo: too many plural forms")
+            msg.values[msg.plural_num] = None
+            msg.current = ("values", msg.plural_num)
+
+        if eof:
+            break
+
+        text_part = extract_string(line)
+        if text_part:
+            msg.append(text_part)
+
+    return catalog.serialize()
+
+
+def main():
+    if len(sys.argv) != 3:
+        raise SystemExit("usage: po2lmo.py input.po output.lmo")
+
+    source, target = sys.argv[1:]
+    with open(source, encoding="utf-8") as handle:
+        payload = compile_po(handle.read())
+
+    # An empty catalog produces no file at all, matching the C tool.
+    if payload is None:
+        if os.path.exists(target):
+            os.unlink(target)
+        return
+
+    with open(target, "wb") as handle:
+        handle.write(payload)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/luci-app-overview-manager/scripts/release-notes.sh b/luci-app-overview-manager/scripts/release-notes.sh
new file mode 100755
index 000000000..749c606ea
--- /dev/null
+++ b/luci-app-overview-manager/scripts/release-notes.sh
@@ -0,0 +1,99 @@
+#!/bin/sh
+#
+# template: release-notes v3 (repo-templates)
+# Formatted to pass both `shfmt -i 2` and `shfmt -i 2 -bn -ci`, the styles
+# the consuming repositories check with; each gets this file verbatim.
+# Do not edit in place: change templates/shared/ in repo-templates
+# and run scripts/sync-templates.sh --update.
+#
+# Print release notes for a tag, built from the subjects of the commits since
+# the previous release tag. There is no changelog file: the commit subject is
+# the release note, so write it as the line a user should read.
+#
+# A commit whose subject is only a version number ("Release 1.2.0",
+# "release: v0.2.0") says nothing a user can read and is left out.
+#
+# A commit that touches only documentation, CI, tests or checks is listed
+# under "Documentation and tooling" rather than "Changes".
+#
+# Usage: scripts/release-notes.sh  [previous-tag]
+#
+# The previous tag defaults to the nearest v* tag before . For a final
+# release, pre-release tags (_rc, _beta, _alpha) are skipped, so its notes
+# cover everything since the last final release rather than since its RC. The repository
+# for the compare link comes from GITHUB_REPOSITORY, or from the origin remote.
+# Needs the full history: check out with fetch-depth 0.
+
+set -eu
+
+[ $# -ge 1 ] || {
+  printf 'usage: %s  [previous-tag]\n' "$0" >&2
+  exit 2
+}
+
+tag="$1"
+if [ $# -ge 2 ]; then
+  previous="$2"
+elif printf '%s\n' "$tag" | grep -Eq '_(rc|beta|alpha)'; then
+  previous="$(git describe --tags --abbrev=0 --match 'v*' "$tag^" 2>/dev/null || true)"
+else
+  previous="$(git describe --tags --abbrev=0 --match 'v*' --exclude '*_rc*' \
+    --exclude '*_beta*' --exclude '*_alpha*' "$tag^" 2>/dev/null || true)"
+fi
+
+repository="${GITHUB_REPOSITORY:-}"
+if [ -z "$repository" ]; then
+  url="$(git remote get-url origin 2>/dev/null || true)"
+  url="${url%.git}"
+  repository="$(printf '%s\n' "$url" | sed -n 's#.*github\.com[:/]\(.*\)$#\1#p')"
+fi
+
+if [ -n "$previous" ]; then
+  range="$previous..$tag"
+else
+  range="$tag"
+fi
+
+# Subjects that carry nothing but a version number.
+bump='^(release|bump|version)[: ]+(to )?v?[0-9]+(\.[0-9]+)*([-_][a-z0-9]+)?$'
+
+# Paths that never change what a user runs.
+tooling='^(docs/|\.github/|tests?/|scripts/(check|test|gen|ci)-|scripts/release-notes\.sh$|LICENSE|NOTICE|THIRD_PARTY|.*\.md$|\.[^/]+$)'
+
+changes=""
+tooling_changes=""
+for commit in $(git rev-list --no-merges --reverse "$range"); do
+  subject="$(git log -1 --format=%s "$commit")"
+  if printf '%s\n' "$subject" | grep -Eiq "$bump"; then
+    continue
+  fi
+  paths="$(git diff-tree --no-commit-id --name-only -r --root "$commit")"
+  if printf '%s\n' "$paths" | grep -Evq "$tooling"; then
+    changes="$changes- $subject
+"
+  else
+    tooling_changes="$tooling_changes- $subject
+"
+  fi
+done
+
+if [ -n "$changes" ]; then
+  printf '## Changes\n\n%s' "$changes"
+fi
+if [ -n "$tooling_changes" ]; then
+  [ -z "$changes" ] || printf '\n'
+  printf '## Documentation and tooling\n\n%s' "$tooling_changes"
+fi
+if [ -z "$changes$tooling_changes" ]; then
+  printf 'Version update only; no other changes since %s.\n' "$previous"
+fi
+
+if [ -n "$repository" ]; then
+  if [ -n "$previous" ]; then
+    printf '\n**Full diff**: https://github.com/%s/compare/%s...%s\n' \
+      "$repository" "$previous" "$tag"
+  else
+    printf '\n**Full history**: https://github.com/%s/commits/%s\n' \
+      "$repository" "$tag"
+  fi
+fi
diff --git a/luci-app-overview-manager/scripts/stage-package.sh b/luci-app-overview-manager/scripts/stage-package.sh
new file mode 100755
index 000000000..17e0aaf24
--- /dev/null
+++ b/luci-app-overview-manager/scripts/stage-package.sh
@@ -0,0 +1,96 @@
+#!/bin/sh
+
+set -eu
+
+root="$(CDPATH= cd -- "$(dirname "$0")/.." && pwd)"
+stage="${1:?usage: stage-package.sh STAGE_DIR}"
+. "$root/release.env"
+
+rm -rf "$stage"
+mkdir -p \
+  "$stage/CONTROL" \
+  "$stage/etc/config" \
+  "$stage/etc/uci-defaults" \
+  "$stage/usr/libexec" \
+  "$stage/usr/share/luci/menu.d" \
+  "$stage/usr/share/rpcd/acl.d" \
+  "$stage/usr/share/licenses/$PKG_NAME" \
+  "$stage/usr/lib/lua/luci/i18n" \
+  "$stage/www/luci-static/resources/overview-manager" \
+  "$stage/www/luci-static/resources/view/overview-manager" \
+  "$stage/www/luci-static/resources/view/status/include"
+
+install -m 600 "$root/openwrt/files/etc/config/overview-manager" \
+  "$stage/etc/config/overview-manager"
+install -m 755 "$root/runtime/overview-manager.sh" \
+  "$stage/usr/libexec/overview-manager"
+install -m 755 "$root/openwrt/files/etc/uci-defaults/luci-app-overview-manager" \
+  "$stage/etc/uci-defaults/luci-app-overview-manager"
+install -m 644 "$root/luci/menu.json" \
+  "$stage/usr/share/luci/menu.d/$PKG_NAME.json"
+install -m 644 "$root/luci/acl.json" \
+  "$stage/usr/share/rpcd/acl.d/$PKG_NAME.json"
+install -m 644 "$root/luci/shared.js" \
+  "$stage/www/luci-static/resources/overview-manager/shared.js"
+install -m 644 "$root/luci/settings.js" \
+  "$stage/www/luci-static/resources/view/overview-manager/settings.js"
+install -m 644 "$root/luci/overview.js" \
+  "$stage/www/luci-static/resources/view/status/include/00_overview-manager.js"
+install -m 644 "$root/LICENSE" \
+  "$stage/usr/share/licenses/$PKG_NAME/LICENSE"
+
+# The APK path compiles the same catalogs from the Makefile, so both packages
+# ship identical translations without needing the LuCI feed host tools.
+for po in "$root"/po/*/*.po; do
+  [ -f "$po" ] || continue
+  language="$(basename "$(dirname "$po")")"
+  [ "$language" != templates ] || continue
+  catalog="$stage/usr/lib/lua/luci/i18n/$(basename "$po" .po).$language.lmo"
+  python3 "$root/scripts/po2lmo.py" "$po" "$catalog"
+  # po2lmo.py honours the caller's umask; fix the mode so the packaged file
+  # stays byte-identical across build hosts.
+  chmod 644 "$catalog"
+done
+
+cat >"$stage/CONTROL/control" <"$stage/CONTROL/conffiles" <<'EOF'
+/etc/config/overview-manager
+EOF
+
+cat >"$stage/CONTROL/postinst" <<'EOF'
+#!/bin/sh
+[ -n "${IPKG_INSTROOT:-}" ] && exit 0
+# This package defines its own postinst, so the default handler that drains
+# /etc/uci-defaults does not run. Apply the language registration here so a
+# runtime install takes effect without waiting for the next boot.
+if [ -x /etc/uci-defaults/luci-app-overview-manager ]; then
+	/etc/uci-defaults/luci-app-overview-manager &&
+		rm -f /etc/uci-defaults/luci-app-overview-manager
+fi
+rm -f /tmp/luci-indexcache
+rm -rf /tmp/luci-modulecache
+echo "Overview Manager installed. Open LuCI -> Status -> Overview Manager."
+exit 0
+EOF
+
+cat >"$stage/CONTROL/prerm" <<'EOF'
+#!/bin/sh
+[ -n "${IPKG_INSTROOT:-}" ] && exit 0
+case "${1:-}" in upgrade) exit 0 ;; esac
+[ "${PKG_UPGRADE:-0}" = 1 ] && exit 0
+rm -f /tmp/luci-indexcache
+rm -rf /tmp/luci-modulecache
+exit 0
+EOF
+
+chmod 755 "$stage/CONTROL/postinst" "$stage/CONTROL/prerm"
diff --git a/luci-app-overview-manager/scripts/test-overview-ui.js b/luci-app-overview-manager/scripts/test-overview-ui.js
new file mode 100644
index 000000000..c8a8be920
--- /dev/null
+++ b/luci-app-overview-manager/scripts/test-overview-ui.js
@@ -0,0 +1,207 @@
+'use strict';
+
+const fs = require('fs');
+const vm = require('vm');
+
+let classMutations = 0;
+
+function classList() {
+	const values = new Set();
+	return {
+		add: value => { classMutations++; values.add(value); },
+		remove: value => { classMutations++; values.delete(value); },
+		contains: value => values.has(value),
+		/* The real DOM only mutates when the state actually changes, which is
+		 * what keeps the toggle in overview.js from repainting on every poll. */
+		toggle: (value, force) => {
+			const wanted = force === undefined ? !values.has(value) : !!force;
+			if (wanted === values.has(value))
+				return wanted;
+			classMutations++;
+			if (wanted)
+				values.add(value);
+			else
+				values.delete(value);
+			return wanted;
+		}
+	};
+}
+
+function section() {
+	const attributes = {};
+	return {
+		classList: classList(),
+		parentNode: null,
+		getAttribute: name => attributes[name] || null,
+		setAttribute: (name, value) => { attributes[name] = value; }
+	};
+}
+
+function load(path, context) {
+	const source = fs.readFileSync(path, 'utf8');
+	return vm.runInNewContext(`(function() {${source}\n})()`, context);
+}
+
+const common = load('luci/shared.js', {
+	baseclass: { extend: value => value },
+	E: (tag, attrs, children) => ({ tag, attrs, children })
+});
+
+/* luci-mod-status requires its includes as module names, so the .js suffix is
+ * not part of the sort. Sorting raw file names would invert this pair and
+ * shift every widget onto the wrong section. */
+const sorted = [ '20_x-y.js', '20_x.js' ].sort(common.compareWidgets);
+if (JSON.stringify(sorted) !== JSON.stringify([ '20_x.js', '20_x-y.js' ]))
+	throw new Error(`unexpected widget sort order: ${sorted.join(',')}`);
+
+const names = [
+	'00_overview-manager.js',
+	'10_system.js',
+	'20_memory.js',
+	'70_custom.js'
+];
+const sections = names.map(() => section());
+sections.forEach(node => node.classList.add('cbi-section'));
+
+let appendCalls = 0;
+const parent = {
+	children: sections,
+	appendChild(node) {
+		appendCalls++;
+		const index = this.children.indexOf(node);
+		if (index >= 0)
+			this.children.splice(index, 1);
+		this.children.push(node);
+		node.parentNode = this;
+	}
+};
+sections.forEach(node => { node.parentNode = parent; });
+
+let execCalls = [];
+const context = {
+	baseclass: { extend: value => value },
+	common: common,
+	fs: {
+		exec: (path, args) => {
+			execCalls.push(args.join(' '));
+			return Promise.resolve({ stdout: stdoutFor(args[0]) });
+		}
+	},
+	L: { resolveDefault: value => value },
+	Promise,
+	window: {
+		requestAnimationFrame: callback => callback(),
+		setTimeout: callback => callback()
+	},
+	E(tag, attrs) {
+		if (attrs && attrs['data-overview-manager-marker']) {
+			return { closest: () => sections[0] };
+		}
+		return { tag, attrs };
+	}
+};
+
+let helperAvailable = true;
+
+function stdoutFor(command) {
+	if (!helperAvailable)
+		return '';
+	if (command === 'files')
+		return `${names.join('\n')}\n`;
+	return 'order=70_custom.js 10_system.js 20_memory.js\nhidden=20_memory.js\n';
+}
+
+const widget = load('luci/overview.js', context);
+const data = [
+	{ stdout: stdoutFor('files') },
+	{ stdout: stdoutFor('layout') }
+];
+
+widget.render(data);
+
+function currentOrder() {
+	return parent.children.map(node => node.getAttribute('data-overview-widget'));
+}
+
+const expected = [
+	'00_overview-manager.js',
+	'70_custom.js',
+	'10_system.js',
+	'20_memory.js'
+];
+if (JSON.stringify(currentOrder()) !== JSON.stringify(expected))
+	throw new Error(`unexpected initial order: ${currentOrder().join(',')}`);
+
+const hidden = parent.children.filter(node =>
+	node.classList.contains('overview-manager-hidden')
+).map(node => node.getAttribute('data-overview-widget'));
+if (JSON.stringify(hidden) !== JSON.stringify([
+	'00_overview-manager.js',
+	'20_memory.js'
+]))
+	throw new Error(`unexpected hidden widgets: ${hidden.join(',')}`);
+
+/* Regression test for the white flicker: a poll cycle that changes nothing
+ * must not move any section or touch any class. */
+appendCalls = 0;
+classMutations = 0;
+widget.render(data);
+
+if (JSON.stringify(currentOrder()) !== JSON.stringify(expected))
+	throw new Error(`polling changed the order: ${currentOrder().join(',')}`);
+if (appendCalls !== 0)
+	throw new Error(`polling re-appended ${appendCalls} sections`);
+if (classMutations !== 0)
+	throw new Error(`polling caused ${classMutations} class mutations`);
+
+/* A changed layout must still be applied. */
+widget.render([
+	{ stdout: `${names.join('\n')}\n` },
+	{ stdout: 'order=10_system.js 20_memory.js 70_custom.js\nhidden=\n' }
+]);
+const reordered = [
+	'00_overview-manager.js',
+	'10_system.js',
+	'20_memory.js',
+	'70_custom.js'
+];
+if (JSON.stringify(currentOrder()) !== JSON.stringify(reordered))
+	throw new Error(`layout change was not applied: ${currentOrder().join(',')}`);
+if (parent.children.filter(node =>
+	node.classList.contains('overview-manager-hidden')
+).length !== 1)
+	throw new Error('unhiding a widget did not take effect');
+
+/* The layout is read once per page load instead of spawning the helper twice
+ * on every five-second poll cycle. */
+function testLoadCaching() {
+	helperAvailable = false;
+	execCalls = [];
+
+	return widget.load().then(() => {
+		if (execCalls.length !== 2)
+			throw new Error(`first load ran ${execCalls.length} helper calls`);
+		return widget.load();
+	}).then(() => {
+		/* An unreachable helper must be retried, not cached as an empty list. */
+		if (execCalls.length !== 4)
+			throw new Error('a failed load was cached');
+		helperAvailable = true;
+		execCalls = [];
+		return widget.load();
+	}).then(() => {
+		if (execCalls.length !== 2)
+			throw new Error(`recovery load ran ${execCalls.length} helper calls`);
+		return widget.load();
+	}).then(() => {
+		if (execCalls.length !== 2)
+			throw new Error(`polling re-ran the helper: ${execCalls.join(', ')}`);
+	});
+}
+
+testLoadCaching().then(() => {
+	console.log('overview UI tests OK');
+}).catch(error => {
+	console.error(error.message);
+	process.exit(1);
+});
diff --git a/luci-app-overview-manager/scripts/test-po2lmo.py b/luci-app-overview-manager/scripts/test-po2lmo.py
new file mode 100644
index 000000000..eecdfd4c8
--- /dev/null
+++ b/luci-app-overview-manager/scripts/test-po2lmo.py
@@ -0,0 +1,270 @@
+#!/usr/bin/env python3
+"""Tests for the LMO compiler and the translation catalogs.
+
+The hash vectors are pinned against the upstream po2lmo binary built from
+luci-base. Set PO2LMO_REFERENCE to a real po2lmo executable to additionally
+diff the compiled output byte for byte.
+"""
+
+import os
+import re
+import struct
+import subprocess
+import sys
+import tempfile
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+from po2lmo import compile_po, sfh_hash  # noqa: E402
+
+ROOT = Path(__file__).resolve().parent.parent
+LANGUAGES = ["ru"]
+
+# Verified against sfh_hash() from luci-base/src/lib/lmo.c. The browser side
+# computes the same values in sfh() from luci-base/htdocs/.../cbi.js.
+HASH_VECTORS = {
+    "": 0x00000000,
+    "a": 0x115EA782,
+    "ab": 0x516B8B44,
+    "abc": 0xD2BE198A,
+    "abcd": 0xDAD8B8DB,
+    "Show": 0x49D1A0A4,
+    "Save layout": 0x18762B08,
+    "Saving…": 0x7A938C83,
+    "Переместить вверх": 0x669DABB0,
+    "ctx\1key": 0x999A0ABE,
+}
+
+
+def fail(message):
+    print(f"test-po2lmo: {message}", file=sys.stderr)
+    sys.exit(1)
+
+
+def check(condition, message):
+    if not condition:
+        fail(message)
+
+
+def read_lmo(payload):
+    """Decode an LMO archive the way lmo.c reads it: {key_id: value}."""
+    (blob_size,) = struct.unpack(">I", payload[-4:])
+    index = payload[blob_size:-4]
+    check(len(index) % 16 == 0, "index size is not a multiple of the entry size")
+
+    catalog = {}
+    previous = None
+    for offset in range(0, len(index), 16):
+        key_id, val_id, value_offset, length = struct.unpack(
+            ">IIII", index[offset:offset + 16]
+        )
+        check(
+            previous is None or key_id >= previous,
+            "index is not sorted by key_id",
+        )
+        previous = key_id
+        check(
+            value_offset + length <= blob_size,
+            f"entry {key_id:08x} points outside the string blob",
+        )
+        catalog[key_id] = payload[value_offset:value_offset + length].decode()
+    return catalog
+
+
+def trimws(value):
+    """The normalisation _() applies before hashing, from cbi.js."""
+    return re.sub(r"[ \t\n]+", " ", value.strip())
+
+
+def parse_po(path):
+    """Return {msgid: msgstr} for the simple single-form records we ship."""
+    entries = {}
+    key = None
+    field = None
+    values = {"msgid": "", "msgstr": ""}
+
+    def flush():
+        if key:
+            entries[key] = values["msgstr"]
+
+    for line in path.read_text(encoding="utf-8").splitlines():
+        line = line.strip()
+        if line.startswith("#") or not line:
+            continue
+        match = re.match(r'^(msgid|msgstr)\s+"(.*)"$', line)
+        if match:
+            if match.group(1) == "msgid":
+                flush()
+                values = {"msgid": match.group(2), "msgstr": ""}
+                field = "msgid"
+            else:
+                field = "msgstr"
+                values["msgstr"] = match.group(2)
+            key = values["msgid"] or None
+            continue
+        match = re.match(r'^"(.*)"$', line)
+        if match and field:
+            values[field] += match.group(1)
+            if field == "msgid":
+                key = values["msgid"] or None
+    flush()
+    return entries
+
+
+def source_strings():
+    """Every literal passed to _() in the shipped JavaScript."""
+    found = set()
+    for path in sorted((ROOT / "luci").glob("*.js")):
+        text = path.read_text(encoding="utf-8")
+        for match in re.finditer(r"\b_\(\s*'((?:[^'\\]|\\.)*)'", text):
+            found.add(match.group(1).replace("\\'", "'").replace("\\\\", "\\"))
+    return found
+
+
+def test_hash_vectors():
+    for value, expected in HASH_VECTORS.items():
+        actual = sfh_hash(value.encode())
+        check(
+            actual == expected,
+            f"sfh_hash({value!r}) = {actual:08x}, expected {expected:08x}",
+        )
+
+
+def test_empty_catalog():
+    header = 'msgid ""\nmsgstr "Content-Type: text/plain; charset=UTF-8\\n"\n'
+    check(
+        compile_po(header) is None,
+        "a catalog without translations must not produce a file",
+    )
+
+
+def test_identical_translation_omitted():
+    payload = compile_po('msgid "same"\nmsgstr "same"\n')
+    check(
+        payload is None,
+        "a translation identical to its source must be omitted",
+    )
+
+
+def test_plural_forms_recorded():
+    payload = compile_po(
+        'msgid ""\nmsgstr ""\n'
+        '"Plural-Forms: nplurals=2; plural=(n != 1);\\n"\n'
+    )
+    check(payload is not None, "the plural formula must be compiled")
+    catalog = read_lmo(payload)
+    check(
+        catalog.get(0) == "nplurals=2; plural=(n != 1);",
+        f"unexpected plural formula entry: {catalog.get(0)!r}",
+    )
+
+
+def test_catalogs_round_trip():
+    """Every translation must be reachable through the hash _() computes."""
+    for language in LANGUAGES:
+        path = ROOT / "po" / language / "overview-manager.po"
+        entries = parse_po(path)
+        check(bool(entries), f"{path} has no translations")
+
+        payload = compile_po(path.read_text(encoding="utf-8"))
+        check(payload is not None, f"{path} compiled to an empty catalog")
+        catalog = read_lmo(payload)
+
+        for msgid, msgstr in entries.items():
+            check(
+                msgid == trimws(msgid),
+                f"{path}: msgid is not whitespace-normalised: {msgid!r}",
+            )
+            if msgid == msgstr:
+                continue
+            key = sfh_hash(trimws(msgid).encode())
+            check(
+                catalog.get(key) == msgstr,
+                f"{path}: {msgid!r} resolves to {catalog.get(key)!r}, "
+                f"expected {msgstr!r}",
+            )
+
+
+def test_catalogs_cover_sources():
+    used = source_strings()
+    check(bool(used), "no _() strings were found in the sources")
+
+    template = parse_po(ROOT / "po" / "templates" / "overview-manager.pot")
+    check(
+        set(template) == used,
+        "po/templates/overview-manager.pot is out of sync with the sources; "
+        f"only in template: {sorted(set(template) - used)}; "
+        f"only in sources: {sorted(used - set(template))}",
+    )
+    check(
+        not any(template.values()),
+        "the template must not carry translations",
+    )
+
+    for language in LANGUAGES:
+        path = ROOT / "po" / language / "overview-manager.po"
+        entries = parse_po(path)
+        check(
+            set(entries) == used,
+            f"{path} is out of sync with the sources; "
+            f"only in catalog: {sorted(set(entries) - used)}; "
+            f"only in sources: {sorted(used - set(entries))}",
+        )
+        for msgid, msgstr in entries.items():
+            check(msgstr != "", f"{path}: {msgid!r} is untranslated")
+
+
+def test_languages_registered():
+    """Every shipped catalog needs a display name in the uci-defaults script.
+
+    LuCI only offers languages listed in luci.languages, so a catalog with no
+    entry there can never be selected.
+    """
+    script = (
+        ROOT / "openwrt" / "files" / "etc" / "uci-defaults"
+        / "luci-app-overview-manager"
+    ).read_text(encoding="utf-8")
+
+    for language in LANGUAGES:
+        check(
+            re.search(rf"^\s*{re.escape(language)}\)\s", script, re.MULTILINE),
+            f"{language} has no display name in the uci-defaults script",
+        )
+
+
+def test_reference_binary():
+    reference = os.environ.get("PO2LMO_REFERENCE")
+    if not reference:
+        print("test-po2lmo: PO2LMO_REFERENCE not set, skipping oracle diff")
+        return
+
+    for language in LANGUAGES:
+        source = ROOT / "po" / language / "overview-manager.po"
+        with tempfile.TemporaryDirectory() as directory:
+            expected = Path(directory) / "reference.lmo"
+            subprocess.run(
+                [reference, str(source), str(expected)], check=True
+            )
+            check(
+                expected.read_bytes()
+                == compile_po(source.read_text(encoding="utf-8")),
+                f"{source}: output differs from {reference}",
+            )
+    print("test-po2lmo: output matches the reference po2lmo binary")
+
+
+def main():
+    test_hash_vectors()
+    test_empty_catalog()
+    test_identical_translation_omitted()
+    test_plural_forms_recorded()
+    test_catalogs_round_trip()
+    test_catalogs_cover_sources()
+    test_languages_registered()
+    test_reference_binary()
+    print("po2lmo tests OK")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/luci-app-overview-manager/scripts/test-runtime.sh b/luci-app-overview-manager/scripts/test-runtime.sh
new file mode 100755
index 000000000..55978e157
--- /dev/null
+++ b/luci-app-overview-manager/scripts/test-runtime.sh
@@ -0,0 +1,75 @@
+#!/bin/sh
+
+set -eu
+
+root="$(CDPATH= cd -- "$(dirname "$0")/.." && pwd)"
+tmp="$(mktemp -d)"
+trap 'rm -rf "$tmp"' EXIT HUP INT TERM
+
+mkdir -p "$tmp/includes"
+touch \
+  "$tmp/includes/00_overview-manager.js" \
+  "$tmp/includes/10_system.js" \
+  "$tmp/includes/20_memory.js" \
+  "$tmp/includes/70_custom.js"
+
+cat >"$tmp/uci" <<'EOF'
+#!/bin/sh
+while [ "${1:-}" = -q ]; do shift; done
+case "${1:-}:${2:-}" in
+  get:overview-manager.main.order)
+    printf '%s\n' "${FAKE_ORDER:-}"
+    ;;
+  get:overview-manager.main.hidden)
+    printf '%s\n' "${FAKE_HIDDEN:-}"
+    ;;
+  set:* | commit:*)
+    printf '%s\n' "$*" >>"${FAKE_UCI_LOG:?}"
+    ;;
+  *)
+    exit 1
+    ;;
+esac
+EOF
+chmod 755 "$tmp/uci"
+
+run() {
+  OVERVIEW_MANAGER_INCLUDE_DIR="$tmp/includes" \
+    OVERVIEW_MANAGER_UCI="$tmp/uci" \
+    FAKE_UCI_LOG="$tmp/uci.log" \
+    FAKE_ORDER="${FAKE_ORDER:-}" \
+    FAKE_HIDDEN="${FAKE_HIDDEN:-}" \
+    "$root/runtime/overview-manager.sh" "$@"
+}
+
+expected_files='00_overview-manager.js
+10_system.js
+20_memory.js
+70_custom.js'
+[ "$(run files)" = "$expected_files" ]
+
+FAKE_ORDER='70_custom.js 10_system.js' \
+FAKE_HIDDEN='20_memory.js' \
+  run layout >"$tmp/layout"
+grep -qx 'order=70_custom.js 10_system.js' "$tmp/layout"
+grep -qx 'hidden=20_memory.js' "$tmp/layout"
+
+: >"$tmp/uci.log"
+run save \
+  '70_custom.js,10_system.js,20_memory.js,70_custom.js' \
+  '20_memory.js'
+grep -qx 'set overview-manager.main.order=70_custom.js 10_system.js 20_memory.js' \
+  "$tmp/uci.log"
+grep -qx 'set overview-manager.main.hidden=20_memory.js' "$tmp/uci.log"
+grep -qx 'commit overview-manager' "$tmp/uci.log"
+
+if run save '00_overview-manager.js' '' >/dev/null 2>&1; then
+  printf 'self widget was accepted unexpectedly\n' >&2
+  exit 1
+fi
+if run save '99_missing.js' '' >/dev/null 2>&1; then
+  printf 'missing widget was accepted unexpectedly\n' >&2
+  exit 1
+fi
+
+printf 'runtime tests OK\n'
diff --git a/luci-app-passwall/Makefile b/luci-app-passwall/Makefile
index 7f466d020..0b95afdca 100644
--- a/luci-app-passwall/Makefile
+++ b/luci-app-passwall/Makefile
@@ -8,7 +8,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=luci-app-passwall
 PKG_VERSION:=26.9.27
-PKG_RELEASE:=296
+PKG_RELEASE:=297
 PKG_PO_VERSION:=$(PKG_VERSION)
 
 PKG_CONFIG_DEPENDS:= \
diff --git a/luci-app-passwall/root/usr/share/passwall/app.sh b/luci-app-passwall/root/usr/share/passwall/app.sh
index 82047e4fe..f97724c32 100755
--- a/luci-app-passwall/root/usr/share/passwall/app.sh
+++ b/luci-app-passwall/root/usr/share/passwall/app.sh
@@ -1710,6 +1710,9 @@ start() {
 		}
 	fi
 
+	[ "$1" = "boot" ] && {
+		rm -f "${LOCK_PATH}/${CONFIG}_cron.lock"
+	}
 	start_crontab
 	echolog "运行完成！\n"
 
@@ -1772,6 +1775,12 @@ stop() {
 	rm -f ${LOCK_PATH}/${CONFIG}_socks_auto_switch*
 	rm -f ${LOCK_PATH}/${CONFIG}_lease2hosts*
 	rm -f ${LOCK_PATH}/${CONFIG}_monitor*
+	if ! busybox pgrep -af "${CONFIG}/" | grep -q '/subscribe\.lua'; then
+		rm -f "${LOCK_PATH}/${CONFIG}_subscribe.lock"
+	fi
+	if ! busybox pgrep -af "${CONFIG}/" | grep -q '/rule_update\.lua'; then
+		rm -f "${LOCK_PATH}/${CONFIG}_rule_update.lock"
+	fi
 	echolog "清空并关闭相关程序和缓存完成。"
 	exit 0
 }
diff --git a/luci-app-substore/CHANGELOG.md b/luci-app-substore/CHANGELOG.md
index 27c1cdde5..b095cfafa 100644
--- a/luci-app-substore/CHANGELOG.md
+++ b/luci-app-substore/CHANGELOG.md
@@ -2,6 +2,15 @@
 
 All notable changes to this project will be documented in this file.
 
+## [2.2.0-r1] - 节点页批量选择与操作
+
+- 「节点」页关键词搜索框缩短为原长度的 3/5（`size` 默认 20 → 12）
+- 节点表格最左新增复选框列：表头复选框全选 / 取消全选，行复选框单独勾选
+- 「筛选」后新增「刷新」按钮（重载页面，筛选参数随 GET URL 自动保留）与「删除」按钮（勾选批量删除，confirm 确认，返回保留筛选参数）
+- action_node_delete 的 idx 参数支持逗号分隔多值，倒序 table.remove 避免下标偏移；行内单删路径不变
+- po/zh-cn 新增 Refresh / Delete selected nodes? / Please select nodes first 三条
+- 版本号 2.1.3-r6 → 2.2.0-r1；README.md / README.en.md / docs/INSTALL.md 版本与功能描述同步
+
 ## [2.1.3-r6] - 节点分组与单节点编辑
 
 - 表单导入节点行新增「分组」输入框（`data-k="group"`，parse_local 透传入模型）
diff --git a/luci-app-substore/Makefile b/luci-app-substore/Makefile
index 4d0728daa..4cff55429 100644
--- a/luci-app-substore/Makefile
+++ b/luci-app-substore/Makefile
@@ -9,8 +9,8 @@ include $(TOPDIR)/rules.mk
 PKG_NAME:=luci-app-substore
 # 版本约定：每次提交 PKG_RELEASE +1（2.1.2-r1 ~ r9）；
 # 达到 r10 时 PKG_VERSION 末位 +1（2.1.2 -> 2.1.3），PKG_RELEASE 重置为 1。
-PKG_VERSION:=2.1.3
-PKG_RELEASE:=1
+PKG_VERSION:=2.2.0
+PKG_RELEASE:=2
 
 LUCI_DEPENDS:=+luci-lua-runtime +luci-compat
 
diff --git a/luci-app-substore/README.en.md b/luci-app-substore/README.en.md
index 9e397e1b3..5fd9599bc 100644
--- a/luci-app-substore/README.en.md
+++ b/luci-app-substore/README.en.md
@@ -21,6 +21,9 @@ group them, then re-emit them in a format your client can consume.
   (optionally with keyword include / exclude and dedup rules) into one combination that
   has its own name, token and subscription link; combinations are recomputed automatically
   when a source updates
+- **Local subscription**: no URL needed — paste node text (mixed YAML / URI / JSON) or
+  enter nodes one by one via a form whose fields adapt to the selected protocol
+  (vmess / vless / ss / ssr / trojan / hysteria2 / tuic / wireguard / socks)
 
 **Input parsing**
 - Subscription formats: URI lists, Base64, JSON, Clash YAML, sing-box JSON,
@@ -30,7 +33,12 @@ group them, then re-emit them in a format your client can consume.
   `tuic` / `socks` (and more)
 
 **Node processing**
-- Browse nodes, filter by protocol, keyword search, sort
+- Browse nodes, filter by group / protocol, keyword search, sort
+- Node grouping: set a node's group inline in the Group column (saved via XHR without
+  reload), filter via the Group dropdown
+- Per-node edit / delete (Actions column); header checkbox selects all, then the Delete
+  button batch-deletes the selection; the Refresh button reloads the list keeping the
+  current filters
 - Per-subscription rules applied on every update:
   - keyword include / exclude (comma-separated, multi-keyword)
   - deduplication
@@ -59,18 +67,18 @@ group them, then re-emit them in a format your client can consume.
 ## Installation
 
 > The version in the package name must match `PKG_VERSION` / `PKG_RELEASE` in the
-> [Makefile](Makefile) (currently `2.1.3-r6`).
+> [Makefile](Makefile) (currently `2.2.0-r1`).
 
 opkg (OpenWrt / ImmortalWrt 24.10 and earlier):
 
 ```bash
-opkg install luci-app-substore-2.1.3-r6.ipk
+opkg install luci-app-substore-2.2.0-r1.ipk
 ```
 
 apk (OpenWrt / ImmortalWrt 25.12+):
 
 ```bash
-apk add --allow-untrusted luci-app-substore-2.1.3-r6.apk
+apk add --allow-untrusted luci-app-substore-2.2.0-r1.apk
 ```
 
 Then open LuCI: **Services → Subscriptions**.
@@ -78,9 +86,12 @@ Then open LuCI: **Services → Subscriptions**.
 ## Usage
 
 1. **Add a subscription** — paste the subscription URL; optionally set up a
-   per-subscription cron schedule, rules, or a download proxy.
+   per-subscription cron schedule, rules, or a download proxy. No remote source?
+   Use **Add local subscription**: paste node text or enter nodes via the form.
 2. **Update** — fetch, parse and filter the nodes.
-3. **Browse nodes** — filter, sort, and probe latency.
+3. **Browse nodes** — filter (group / protocol / keyword), sort, probe latency; tick
+   checkboxes and hit Delete for batch deletion, edit / delete / regroup in-row, and
+   Refresh reloads the list.
 4. **Export** — pick one of the 13 output formats, or copy the subscription link
    to feed a downstream client (Passwall / OpenClash / …).
 
diff --git a/luci-app-substore/README.md b/luci-app-substore/README.md
index 1b68f78d3..59305b4d7 100644
--- a/luci-app-substore/README.md
+++ b/luci-app-substore/README.md
@@ -19,6 +19,8 @@
   用于订阅源直连失败时
 - **组合订阅**：勾选任意子集的现有订阅（可叠加关键词包含 / 排除、去重规则）合并成一个组合，
   拥有独立名称、token 与订阅链接；源订阅更新后组合自动重算
+- **本地订阅**：不填 URL，直接粘贴节点文本（YAML / URI / JSON 混合）导入，或用「表单导入」
+  按协议动态字段逐条录入节点（vmess / vless / ss / ssr / trojan / hysteria2 / tuic / wireguard / socks）
 
 **输入解析**
 - 订阅格式：URI 列表、Base64、JSON、Clash YAML、sing-box JSON、V2Ray / Xray JSON、
@@ -26,7 +28,10 @@
 - 节点协议：`vmess` / `vless` / `trojan` / `shadowsocks` / `ssr` / `hysteria2` / `tuic` / `socks`（及更多）
 
 **节点处理**
-- 浏览节点，按协议筛选、关键词搜索、排序
+- 浏览节点，按分组 / 协议筛选、关键词搜索、排序
+- 节点分组：「分组」列单元格内直接修改单节点分组（XHR 无刷新保存），配合「分组:」下拉筛选
+- 单节点编辑 / 删除（行尾「操作」列）；表头复选框全选、行复选框勾选后点「删除」批量删除；
+  「刷新」按钮重载列表（保留当前筛选条件）
 - 每次更新时生效的按订阅规则：
   - 关键词包含 / 排除（逗号分隔，支持多关键词）
   - 去重
@@ -54,18 +59,18 @@
 ## 安装
 
 > 包名中的版本号必须与 [Makefile](Makefile) 的 `PKG_VERSION` / `PKG_RELEASE` 保持一致
-> （当前 `2.1.3-r6`）。
+> （当前 `2.2.0-r1`）。
 
 opkg（OpenWrt / ImmortalWrt 24.10 及更早）：
 
 ```bash
-opkg install luci-app-substore-2.1.3-r6.ipk
+opkg install luci-app-substore-2.2.0-r1.ipk
 ```
 
 apk（OpenWrt / ImmortalWrt 25.12+）：
 
 ```bash
-apk add --allow-untrusted luci-app-substore-2.1.3-r6.apk
+apk add --allow-untrusted luci-app-substore-2.2.0-r1.apk
 ```
 
 然后在 LuCI 菜单打开：**服务 → 订阅**。
@@ -73,8 +78,10 @@ apk add --allow-untrusted luci-app-substore-2.1.3-r6.apk
 ## 使用方法
 
 1. **添加订阅** —— 粘贴订阅 URL；可选的按订阅 cron 定时、规则或下载代理。
+   无订阅源时可「添加本地订阅」：粘贴节点文本或表单逐条录入。
 2. **更新** —— 下载、解析并过滤节点。
-3. **浏览节点** —— 筛选、排序、探测延迟。
+3. **浏览节点** —— 筛选（分组 / 协议 / 关键词）、排序、探测延迟；勾选复选框后「删除」
+   可批量删除，行内可编辑 / 删除 / 改分组，「刷新」重载列表。
 4. **导出** —— 任选 13 种格式之一，或复制订阅链接供下游客户端（Passwall / OpenClash / …）使用。
 
 ## 目录结构
diff --git a/luci-app-substore/docs/INSTALL.md b/luci-app-substore/docs/INSTALL.md
index 46a670c60..ea809f4f5 100644
--- a/luci-app-substore/docs/INSTALL.md
+++ b/luci-app-substore/docs/INSTALL.md
@@ -3,18 +3,18 @@
 > NOTE: stage-0 skeleton has not yet been installed/verified on a target device.
 > This document will be updated once installation is validated.
 >
-> 包名中的版本号需与 Makefile 的 `PKG_VERSION` / `PKG_RELEASE` 保持同步（当前 2.1.3-r6）。
+> 包名中的版本号需与 Makefile 的 `PKG_VERSION` / `PKG_RELEASE` 保持同步（当前 2.2.0-r1）。
 
 ## Install (opkg — OpenWrt / ImmortalWrt 24.10 及更早)
 
 ```bash
-opkg install luci-app-substore-2.1.3-r6.ipk
+opkg install luci-app-substore-2.2.0-r1.ipk
 ```
 
 ## Install (apk — OpenWrt / ImmortalWrt 25.12+)
 
 ```bash
-apk add --allow-untrusted luci-app-substore-2.1.3-r6.apk
+apk add --allow-untrusted luci-app-substore-2.2.0-r1.apk
 ```
 
 Refresh LuCI:
diff --git a/luci-app-substore/po/zh-cn/substore.po b/luci-app-substore/po/zh-cn/substore.po
index 1485a46b9..6e33b1356 100644
--- a/luci-app-substore/po/zh-cn/substore.po
+++ b/luci-app-substore/po/zh-cn/substore.po
@@ -265,4 +265,14 @@ msgid "Failed to set group"
 msgstr "分组设置失败"
 
 msgid "Note: edits to this node are overwritten the next time the subscription is updated or re-saved."
-msgstr "注意：对该节点的修改会在订阅下次更新或重新保存后被覆盖。"
\ No newline at end of file
+msgstr "注意：对该节点的修改会在订阅下次更新或重新保存后被覆盖。"
+
+# 节点页：刷新 / 勾选批量删除
+msgid "Refresh"
+msgstr "刷新"
+
+msgid "Delete selected nodes?"
+msgstr "确定删除选中的节点？"
+
+msgid "Please select nodes first"
+msgstr "请先勾选节点"
\ No newline at end of file
diff --git a/luci-app-substore/root/usr/lib/lua/luci/controller/admin/substore.lua b/luci-app-substore/root/usr/lib/lua/luci/controller/admin/substore.lua
index 9524e692a..f1cbd9d84 100644
--- a/luci-app-substore/root/usr/lib/lua/luci/controller/admin/substore.lua
+++ b/luci-app-substore/root/usr/lib/lua/luci/controller/admin/substore.lua
@@ -218,21 +218,32 @@ function action_node_save()
 	back_to_nodes(http)
 end
 
--- 单节点删除
+-- 节点删除：idx 支持单个（行内删除按钮）或逗号分隔多个（勾选批量删除）
 function action_node_delete()
 	local http = require("luci.http")
 	local core = require("substore.core")
 	if post_ok() then
 		local id = http.formvalue("id") or ""
-		local idx = tonumber(http.formvalue("idx") or "")
+		local idx_param = http.formvalue("idx") or ""
+		if type(idx_param) == "table" then idx_param = table.concat(idx_param, ",") end
 		local nodes = core.read_nodes(id)
-		if idx and nodes[idx] then
-			table.remove(nodes, idx)
-			if core.write_nodes(id, nodes) then
-				core.save_meta(id, { node_count = #nodes })
-				core.refresh_combos(id)
+		local idxs = {}
+		for s in tostring(idx_param):gmatch("%d+") do
+			idxs[#idxs + 1] = tonumber(s)
+		end
+		-- 倒序删除，避免 table.remove 后下标偏移
+		table.sort(idxs, function(a, b) return a > b end)
+		local removed = false
+		for _, i in ipairs(idxs) do
+			if nodes[i] then
+				table.remove(nodes, i)
+				removed = true
 			end
 		end
+		if removed and core.write_nodes(id, nodes) then
+			core.save_meta(id, { node_count = #nodes })
+			core.refresh_combos(id)
+		end
 	end
 	back_to_nodes(http)
 end
diff --git a/luci-app-substore/root/usr/lib/lua/luci/view/substore/local_form.htm b/luci-app-substore/root/usr/lib/lua/luci/view/substore/local_form.htm
index e849499af..ddff81d85 100644
--- a/luci-app-substore/root/usr/lib/lua/luci/view/substore/local_form.htm
+++ b/luci-app-substore/root/usr/lib/lua/luci/view/substore/local_form.htm
@@ -125,7 +125,7 @@ var NODEFORM_I18N = {
 	"defaultOpt": "<%:Default%>"
 };
 
-
+
 
-
+
 
-
diff --git a/luci-app-wolplus/po/zh_Hans/wolplus.po b/luci-app-wolplus/po/zh_Hans/wolplus.po
index 8e4d4bb16..7d9890d7e 100644
--- a/luci-app-wolplus/po/zh_Hans/wolplus.po
+++ b/luci-app-wolplus/po/zh_Hans/wolplus.po
@@ -1,30 +1,46 @@
 msgid ""
 msgstr ""
+"Project-Id-Version: luci-app-wolplus\n"
+"Report-Msgid-Bugs-To: \n"
+"POT-Creation-Date: 2026-09-19 00:00+0800\n"
+"PO-Revision-Date: 2026-09-19 00:00+0800\n"
+"Last-Translator: sundaqiang\n"
+"Language-Team: Chinese (Simplified)\n"
+"Language: zh_Hans\n"
+"MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
-"Language: zh_Hans\n"
 "Plural-Forms: nplurals=1; plural=0;\n"
 
-msgid "wolplus"
+msgid "Wake on LAN +"
 msgstr "网络唤醒++"
 
-msgid "Wake up your LAN device"
-msgstr "唤醒你的局域网设备"
+msgid "Wake on LAN is a mechanism to remotely boot computers in the local network."
+msgstr "网络唤醒是一种远程启动局域网内计算机的机制。"
 
-msgid "macclient"
+msgid "Host Clients"
 msgstr "设备列表"
 
-msgid "name"
+msgid "Name"
 msgstr "名称"
 
-msgid "macaddr"
+msgid "MAC Address"
 msgstr "客户端MAC"
 
-msgid "maceth"
+msgid "Network Interface"
 msgstr "网络接口"
 
-msgid "awake"
+msgid "Awake"
 msgstr "唤醒"
 
-msgid "Please [Save & Apply] your changes first"
-msgstr "请先保存并应用您的设置"
+msgid "Woke up successfully"
+msgstr "唤醒成功"
+
+msgid "Wake up failed"
+msgstr "唤醒失败"
+
+msgid "Close"
+msgstr "关闭"
+
+msgid "Edit"
+msgstr "编辑"
diff --git a/luci-app-wolplus/root/etc/config/wolplus b/luci-app-wolplus/root/etc/config/wolplus
index e69de29bb..8b1378917 100644
--- a/luci-app-wolplus/root/etc/config/wolplus
+++ b/luci-app-wolplus/root/etc/config/wolplus
@@ -0,0 +1 @@
+
diff --git a/luci-app-wolplus/root/etc/uci-defaults/luci-app-wolplus b/luci-app-wolplus/root/etc/uci-defaults/luci-app-wolplus
index aa8f10456..f944a6ece 100644
--- a/luci-app-wolplus/root/etc/uci-defaults/luci-app-wolplus
+++ b/luci-app-wolplus/root/etc/uci-defaults/luci-app-wolplus
@@ -1,19 +1,11 @@
 #!/bin/sh
-[ ! -f "/usr/share/ucitrack/luci-app-wolplus.json" ] && {
-    cat > /usr/share/ucitrack/luci-app-wolplus.json << EEOF
-{
-    "config": "wolplus",
-    "init": "wolplus"
-}
-EEOF
-}
 
-uci -q batch <<-EOF >/dev/null
-	delete ucitrack.@wolplus[-1]
-	add ucitrack wolplus
-	set ucitrack.@wolplus[-1].init=wolplus
-	commit ucitrack
-EOF
+# 修复 rpcd ucode 脚本执行权限（rpcd 仅加载带可执行位的脚本）
+chmod 0755 /usr/share/rpcd/ucode/luci.wolplus 2>/dev/null
+
+# 清理缓存并重载 rpcd
+rm -f /tmp/luci-indexcache.*
+rm -rf /tmp/luci-modulecache/
+/etc/init.d/rpcd reload 2>/dev/null
 
-rm -f /tmp/luci-indexcache
 exit 0
diff --git a/luci-app-wolplus/root/usr/share/luci/menu.d/luci-app-wolplus.json b/luci-app-wolplus/root/usr/share/luci/menu.d/luci-app-wolplus.json
new file mode 100644
index 000000000..fb9e8e229
--- /dev/null
+++ b/luci-app-wolplus/root/usr/share/luci/menu.d/luci-app-wolplus.json
@@ -0,0 +1,14 @@
+{
+	"admin/services/wolplus": {
+		"title": "Wake on LAN +",
+		"order": 95,
+		"action": {
+			"type": "view",
+			"path": "wolplus"
+		},
+		"depends": {
+			"acl": [ "luci-app-wolplus" ],
+			"fs": { "/etc/config/wolplus": "file" }
+		}
+	}
+}
diff --git a/luci-app-wolplus/root/usr/share/rpcd/acl.d/luci-app-wolplus.json b/luci-app-wolplus/root/usr/share/rpcd/acl.d/luci-app-wolplus.json
index 3aed4cad4..93370cfb1 100644
--- a/luci-app-wolplus/root/usr/share/rpcd/acl.d/luci-app-wolplus.json
+++ b/luci-app-wolplus/root/usr/share/rpcd/acl.d/luci-app-wolplus.json
@@ -2,9 +2,16 @@
 	"luci-app-wolplus": {
 		"description": "Grant UCI access for luci-app-wolplus",
 		"read": {
+			"ubus": {
+				"luci.wolplus": [ "awake" ],
+				"luci-rpc": [ "getHostHints", "getNetworkDevices" ]
+			},
 			"uci": [ "wolplus" ]
 		},
 		"write": {
+			"ubus": {
+				"luci.wolplus": [ "awake" ]
+			},
 			"uci": [ "wolplus" ]
 		}
 	}
diff --git a/luci-app-wolplus/root/usr/share/rpcd/ucode/luci.wolplus b/luci-app-wolplus/root/usr/share/rpcd/ucode/luci.wolplus
new file mode 100644
index 000000000..2359917c1
--- /dev/null
+++ b/luci-app-wolplus/root/usr/share/rpcd/ucode/luci.wolplus
@@ -0,0 +1,45 @@
+#!/usr/bin/ucode
+
+'use strict';
+
+import { popen } from 'fs';
+import { cursor } from 'uci';
+
+const etherwake = '/usr/bin/etherwake';
+
+function shellquote(s) {
+	return "'" + replace(s, "'", "'\\''") + "'";
+}
+
+const methods = {
+	awake: {
+		args: { section: 'string' },
+		call: function(request) {
+			const section = request.args.section;
+			if (!section || match(section, /[^A-Za-z0-9_]/))
+				return { data: 'invalid section' };
+
+			let ctx = cursor();
+			let lan = ctx.get('wolplus', section, 'maceth') || '';
+			let mac = ctx.get('wolplus', section, 'macaddr') || '';
+
+			if (!mac)
+				return { data: 'missing MAC address' };
+
+			let cmd = etherwake + ' -D' +
+				(lan ? ' -i ' + shellquote(lan) : '') +
+				' -b ' + shellquote(mac) + ' 2>&1';
+
+			const fd = popen(cmd);
+			let out = fd.read('all') || '';
+			fd.close();
+
+			if (length(out) > 500)
+				out = substr(out, 0, 500) + '...';
+
+			return { data: out };
+		}
+	}
+};
+
+return { 'luci.wolplus': methods };
diff --git a/luci-app-wrqr/.editorconfig b/luci-app-wrqr/.editorconfig
new file mode 100644
index 000000000..2cab0c307
--- /dev/null
+++ b/luci-app-wrqr/.editorconfig
@@ -0,0 +1,12 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+indent_style = tab
+
+# Markdown may use trailing spaces for hard line breaks.
+[*.md]
+trim_trailing_whitespace = false
diff --git a/luci-app-wrqr/.gitattributes b/luci-app-wrqr/.gitattributes
new file mode 100644
index 000000000..e20643316
--- /dev/null
+++ b/luci-app-wrqr/.gitattributes
@@ -0,0 +1,19 @@
+* text=auto eol=lf
+
+*.sh text eol=lf
+*.js text eol=lf
+*.json text eol=lf
+*.md text eol=lf
+Makefile text eol=lf
+
+*.apk binary
+*.ipk binary
+*.bin binary
+*.img binary
+*.gz binary
+*.zst binary
+*.pem text eol=lf
+
+# Shared scripts vendored from repo-templates: kept out of the language stats.
+scripts/check-readme.sh linguist-vendored
+scripts/release-notes.sh linguist-vendored
diff --git a/luci-app-wrqr/.gitignore b/luci-app-wrqr/.gitignore
new file mode 100644
index 000000000..2c301d7e8
--- /dev/null
+++ b/luci-app-wrqr/.gitignore
@@ -0,0 +1,3 @@
+/build/
+/dist/
+.DS_Store
diff --git a/luci-app-wrqr/LICENSE b/luci-app-wrqr/LICENSE
new file mode 100644
index 000000000..d45f1d470
--- /dev/null
+++ b/luci-app-wrqr/LICENSE
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Nikitid
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/luci-app-wrqr/Makefile b/luci-app-wrqr/Makefile
new file mode 100644
index 000000000..12f3e1684
--- /dev/null
+++ b/luci-app-wrqr/Makefile
@@ -0,0 +1,59 @@
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=luci-app-wrqr
+PKG_VERSION:=0.1.0
+PKG_RELEASE:=1
+PKG_LICENSE:=MIT
+PKG_MAINTAINER:=nikitid
+PKGARCH:=all
+
+include $(INCLUDE_DIR)/package.mk
+
+define Package/luci-app-wrqr
+  SECTION:=luci
+  CATEGORY:=LuCI
+  SUBMENU:=3. Applications
+  TITLE:=Wi-Fi QR codes for Status Overview
+  DEPENDS:=+luci-base +luci-lib-uqr
+endef
+
+define Package/luci-app-wrqr/description
+ Display QR codes for active Wi-Fi access points on the LuCI Status Overview.
+endef
+
+define Build/Compile
+endef
+
+define Package/luci-app-wrqr/install
+	$(INSTALL_DIR) $(1)/usr/share/rpcd/acl.d
+	$(INSTALL_DATA) ./luci/acl.json $(1)/usr/share/rpcd/acl.d/luci-app-wrqr.json
+
+	$(INSTALL_DIR) $(1)/www/luci-static/resources/wrqr
+	$(INSTALL_DATA) ./luci/shared.js $(1)/www/luci-static/resources/wrqr/shared.js
+
+	$(INSTALL_DIR) $(1)/www/luci-static/resources/view/status/include
+	$(INSTALL_DATA) ./luci/overview.js $(1)/www/luci-static/resources/view/status/include/15_wifi-qr.js
+
+	$(INSTALL_DIR) $(1)/usr/share/licenses/luci-app-wrqr
+	$(INSTALL_DATA) ./LICENSE $(1)/usr/share/licenses/luci-app-wrqr/LICENSE
+endef
+
+define Package/luci-app-wrqr/postinst
+#!/bin/sh
+[ -n "$${IPKG_INSTROOT:-}" ] && exit 0
+rm -f /tmp/luci-indexcache
+rm -rf /tmp/luci-modulecache
+exit 0
+endef
+
+define Package/luci-app-wrqr/prerm
+#!/bin/sh
+[ -n "$${IPKG_INSTROOT:-}" ] && exit 0
+case "$${1:-}" in upgrade) exit 0 ;; esac
+[ "$${PKG_UPGRADE:-0}" = 1 ] && exit 0
+rm -f /tmp/luci-indexcache
+rm -rf /tmp/luci-modulecache
+exit 0
+endef
+
+$(eval $(call BuildPackage,luci-app-wrqr))
diff --git a/luci-app-wrqr/README.md b/luci-app-wrqr/README.md
new file mode 100644
index 000000000..9cb86b4b3
--- /dev/null
+++ b/luci-app-wrqr/README.md
@@ -0,0 +1,78 @@
+# Wi-Fi QR for OpenWrt
+
+[Русский](README.ru.md)
+
+[![CI](https://github.com/Nikitid/luci-app-wrqr/actions/workflows/ci.yml/badge.svg)](https://github.com/Nikitid/luci-app-wrqr/actions/workflows/ci.yml)
+[![Release](https://img.shields.io/github/v/release/Nikitid/luci-app-wrqr)](https://github.com/Nikitid/luci-app-wrqr/releases/latest)
+[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
+
+The `luci-app-wrqr` package adds a widget with Wi-Fi QR codes to the LuCI
+**Status -> Overview** page.
+
+![Wi-Fi QR widget on Status -> Overview](docs/images/widget.png)
+
+## Features
+
+- one QR code for each distinct active access point;
+- identical networks broadcast by several radios share one code;
+- disabled, unsupported and non-AP interfaces are left out.
+
+## Requirements
+
+- OpenWrt 24.10 (IPK) or OpenWrt 25.12 (APK);
+- LuCI.
+
+## Installation
+
+### OpenWrt 24.10
+
+Download the latest `luci-app-wrqr_*_all.ipk` from
+[Releases](https://github.com/Nikitid/luci-app-wrqr/releases) and upload it
+through **System -> Software -> Upload Package**.
+
+### OpenWrt 25.12
+
+```sh
+wget -O /tmp/nikitid-feed.sh \
+  https://raw.githubusercontent.com/Nikitid/openwrt-feed/feed/install.sh
+sh /tmp/nikitid-feed.sh luci-app-wrqr
+```
+
+The installer verifies the publisher key, adds the shared signed Nikitid
+application repository and installs only the named package. To update:
+
+```sh
+apk update
+apk upgrade luci-app-wrqr
+```
+
+## How it works
+
+The widget reads fresh UCI and wireless runtime state on LuCI's normal status
+poll. It only reads: it restarts nothing and writes nothing - not Wi-Fi, rpcd,
+uhttpd or the router.
+
+## Development
+
+```sh
+./scripts/ci-check.sh
+```
+
+Building, signing and releasing: [docs/DEVELOPMENT.md](docs/DEVELOPMENT.md).
+
+## Documentation
+
+- [Repository map](docs/MAP.md) - where things live
+- [Development](docs/DEVELOPMENT.md) - building, signing and releasing
+
+## Support
+
+Questions and bug reports go to
+[Issues](https://github.com/Nikitid/luci-app-wrqr/issues/new/choose): pick the form that
+fits. Report a vulnerability privately through
+[a security advisory](https://github.com/Nikitid/luci-app-wrqr/security/advisories/new).
+English or Russian is fine.
+
+## License
+
+[MIT](LICENSE)
diff --git a/luci-app-wrqr/README.ru.md b/luci-app-wrqr/README.ru.md
new file mode 100644
index 000000000..19ee08ee0
--- /dev/null
+++ b/luci-app-wrqr/README.ru.md
@@ -0,0 +1,78 @@
+# Wi-Fi QR для OpenWrt
+
+[English](README.md)
+
+[![CI](https://github.com/Nikitid/luci-app-wrqr/actions/workflows/ci.yml/badge.svg)](https://github.com/Nikitid/luci-app-wrqr/actions/workflows/ci.yml)
+[![Release](https://img.shields.io/github/v/release/Nikitid/luci-app-wrqr)](https://github.com/Nikitid/luci-app-wrqr/releases/latest)
+[![Лицензия: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
+
+Пакет `luci-app-wrqr` добавляет на страницу LuCI **Status -> Overview** виджет с
+QR-кодами для подключения к Wi-Fi.
+
+![Виджет Wi-Fi QR на странице Status -> Overview](docs/images/widget.png)
+
+## Возможности
+
+- по одному QR-коду на каждую различающуюся активную точку доступа;
+- одинаковые сети, вещаемые несколькими радиомодулями, объединяются в один код;
+- отключённые, неподдерживаемые и не-AP интерфейсы не показываются.
+
+## Требования
+
+- OpenWrt 24.10 (IPK) или OpenWrt 25.12 (APK);
+- LuCI.
+
+## Установка
+
+### OpenWrt 24.10
+
+Скачайте последний `luci-app-wrqr_*_all.ipk` из
+[Releases](https://github.com/Nikitid/luci-app-wrqr/releases) и загрузите его
+через **System -> Software -> Upload Package**.
+
+### OpenWrt 25.12
+
+```sh
+wget -O /tmp/nikitid-feed.sh \
+  https://raw.githubusercontent.com/Nikitid/openwrt-feed/feed/install.sh
+sh /tmp/nikitid-feed.sh luci-app-wrqr
+```
+
+Установщик проверяет ключ издателя, подключает общий подписанный репозиторий
+приложений Nikitid и ставит только указанный пакет. Обновление:
+
+```sh
+apk update
+apk upgrade luci-app-wrqr
+```
+
+## Как это работает
+
+Виджет читает свежее состояние UCI и беспроводного стека на обычном опросе
+статуса LuCI. Он только читает: ничего не перезапускает и ничего не
+записывает - ни Wi-Fi, ни rpcd, ни uhttpd, ни роутер.
+
+## Разработка
+
+```sh
+./scripts/ci-check.sh
+```
+
+Сборка, подпись и выпуск: [docs/DEVELOPMENT.md](docs/DEVELOPMENT.md).
+
+## Документация
+
+- [Карта репозитория](docs/MAP.md) - где что лежит
+- [Разработка](docs/DEVELOPMENT.md) - сборка, подпись и выпуск
+
+## Поддержка
+
+Вопросы и сообщения об ошибках - в
+[Issues](https://github.com/Nikitid/luci-app-wrqr/issues/new/choose), выберите
+подходящую форму. Об уязвимости сообщайте приватно через
+[security advisory](https://github.com/Nikitid/luci-app-wrqr/security/advisories/new).
+Можно писать по-русски или по-английски.
+
+## Лицензия
+
+[MIT](LICENSE)
diff --git a/luci-app-wrqr/apk-feed.env b/luci-app-wrqr/apk-feed.env
new file mode 100644
index 000000000..b13395b5d
--- /dev/null
+++ b/luci-app-wrqr/apk-feed.env
@@ -0,0 +1,9 @@
+# OpenWrt 25.12 build and shared feed identity.
+OPENWRT_APK_VERSION=25.12.5
+OPENWRT_APK_TARGET=mediatek/filogic
+OPENWRT_APK_ARCH=aarch64_cortex-a53
+OPENWRT_APK_SDK_ARCHIVE=openwrt-sdk-25.12.5-mediatek-filogic_gcc-14.3.0_musl.Linux-x86_64.tar.zst
+OPENWRT_APK_SDK_SHA256=ff4a38a397caa2cfe1c39e18f84ddede14878221b3593c3f2c4cfe24e3ec4c25
+OPENWRT_APK_KEY_FILE=keys/nikitid-openwrt-release.pem
+OPENWRT_APK_TRUST_SHA256=f27474d9261f1084350cf4ba34ecdff29e533769c36483d8dd85566e30a6a703
+OPENWRT_FEED_REPOSITORY=Nikitid/openwrt-feed
diff --git a/luci-app-wrqr/docs/DEVELOPMENT.md b/luci-app-wrqr/docs/DEVELOPMENT.md
new file mode 100644
index 000000000..c7a02d86d
--- /dev/null
+++ b/luci-app-wrqr/docs/DEVELOPMENT.md
@@ -0,0 +1,34 @@
+# Development
+
+## Checks
+
+```sh
+./scripts/ci-check.sh
+```
+
+## Building
+
+The IPK for OpenWrt 24.10 is written to `dist/` by `scripts/build-ipk.sh`. The
+APK for OpenWrt 25.12 needs a compatible SDK:
+
+```sh
+OPENWRT_SDK_DIR=/path/to/openwrt-sdk-25.12.5-mediatek-filogic \
+  ./scripts/build-apk.sh
+```
+
+A release APK is signed with the shared publisher key by
+`scripts/build-apk-release.sh`, which reads the key from
+`OPENWRT_APK_SIGNING_KEY`.
+
+The private half of the publisher key is not stored in any repository. This
+repository builds and signs only its own package and publishes it as a release
+asset; the index is assembled by
+[Nikitid/openwrt-feed](https://github.com/Nikitid/openwrt-feed). See
+[Joining the shared feed](https://github.com/Nikitid/openwrt-feed/blob/main/docs/MEMBER_INTEGRATION.md).
+
+## Release
+
+Push a `vX.Y.Z` tag matching the version in `release.env`. The release workflow
+checks the tag, runs `scripts/ci-check.sh`, builds and signs the APK with the
+pinned OpenWrt SDK, and publishes the release with notes made by
+`scripts/release-notes.sh` from the commit subjects since the previous tag.
diff --git a/luci-app-wrqr/docs/MAP.md b/luci-app-wrqr/docs/MAP.md
new file mode 100644
index 000000000..aed408c19
--- /dev/null
+++ b/luci-app-wrqr/docs/MAP.md
@@ -0,0 +1,39 @@
+# Repository map
+
+Where things live. The whole application is two files under `luci/`.
+
+## The shape of it
+
+One OpenWrt package, `luci-app-wrqr`: a Wi-Fi QR widget on LuCI's Status →
+Overview page. It shows one QR code per distinct active access-point
+configuration and merges identical networks broadcast by several radios.
+
+| file | owns |
+| --- | --- |
+| `luci/overview.js` | the widget: reads UCI and wireless runtime state, renders the codes |
+| `luci/shared.js` | the design system and the dictionary |
+| `luci/acl.json` | the calls the widget is allowed to make |
+| `Makefile`, `release.env`, `apk-feed.env` | packaging and release identity |
+| `scripts/` | build, packaging and the checks |
+
+The widget is read-only by design: it restarts nothing and writes nothing.
+Unsupported, disabled and non-AP interfaces are omitted rather than shown in
+an error state.
+
+## Checks
+
+```sh
+./scripts/ci-check.sh
+```
+
+`scripts/test-overview-ui.js` stubs LuCI and renders the widget - a page that
+merely parses can still die at render.
+
+## Documentation
+
+| file | for |
+| --- | --- |
+| `docs/MAP.md` | this file |
+| `docs/DEVELOPMENT.md` | building, signing and releasing |
+| `README.md` | user-facing, English |
+| `README.ru.md` | the Russian version |
diff --git a/luci-app-wrqr/docs/images/widget.png b/luci-app-wrqr/docs/images/widget.png
new file mode 100644
index 000000000..05823fbfd
Binary files /dev/null and b/luci-app-wrqr/docs/images/widget.png differ
diff --git a/luci-app-wrqr/keys/nikitid-openwrt-release.pem b/luci-app-wrqr/keys/nikitid-openwrt-release.pem
new file mode 100644
index 000000000..786ed8adb
--- /dev/null
+++ b/luci-app-wrqr/keys/nikitid-openwrt-release.pem
@@ -0,0 +1,4 @@
+-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE4Kze8kPGZESezGw8NMN4gDMgaevH
++Y9IgZbqWeHpW0gCNXNpctIlS1LSlQraDRwRTJlbg0R+uCGyv0/QnduYkg==
+-----END PUBLIC KEY-----
diff --git a/luci-app-wrqr/luci/acl.json b/luci-app-wrqr/luci/acl.json
new file mode 100644
index 000000000..5d75155c2
--- /dev/null
+++ b/luci-app-wrqr/luci/acl.json
@@ -0,0 +1,12 @@
+{
+	"luci-app-wrqr": {
+		"description": "Read active Wi-Fi access points for the Status Overview QR widget",
+		"read": {
+			"ubus": {
+				"luci-rpc": [ "getWirelessDevices" ],
+				"uci": [ "get" ]
+			},
+			"uci": [ "wireless" ]
+		}
+	}
+}
diff --git a/luci-app-wrqr/luci/overview.js b/luci-app-wrqr/luci/overview.js
new file mode 100644
index 000000000..99d19aa0d
--- /dev/null
+++ b/luci-app-wrqr/luci/overview.js
@@ -0,0 +1,94 @@
+'use strict';
+'require baseclass';
+'require dom';
+'require rpc';
+'require uqr';
+'require wrqr.shared as common';
+
+var callWirelessConfig = rpc.declare({
+	object: 'uci',
+	method: 'get',
+	params: [ 'config' ],
+	expect: { values: {} }
+});
+
+var callWirelessStatus = rpc.declare({
+	object: 'luci-rpc',
+	method: 'getWirelessDevices',
+	expect: {}
+});
+
+var root = null;
+var grid = null;
+var lastFingerprint = null;
+
+function styles() {
+	return E('style', {}, [
+		'.wrqr-grid{display:flex;flex-wrap:wrap;justify-content:center;align-items:flex-start;gap:2.5rem 1rem;max-width:1164px;margin:0 auto}',
+		'.wrqr-card{display:flex;flex:1 1 190px;flex-direction:column;align-items:center;width:220px;max-width:220px;min-width:0;padding:1rem;box-sizing:border-box;text-align:center}',
+		'.wrqr-ssid{display:block;width:100%;margin:0 0 .25rem;overflow-wrap:anywhere;text-align:center;font-size:1.15rem}',
+		'.wrqr-bands{width:100%;min-height:1.4em;margin:0 0 .8rem;text-align:center;color:var(--text-color-medium,#666);font-size:.85rem}',
+		'.wrqr-code{display:flex;align-items:center;justify-content:center;width:220px;max-width:100%;margin:0 auto;padding:12px;background:#fff;box-sizing:border-box}',
+		'.wrqr-code svg{display:block;width:100%;height:auto;margin:0 auto}',
+		'.wrqr-empty{width:100%;margin:.5rem 0;text-align:center;color:var(--text-color-medium,#666)}',
+		'@media(max-width:700px){.wrqr-grid{gap:2rem 1rem}.wrqr-card{flex-basis:160px;padding:.75rem .25rem}}'
+	]);
+}
+
+function card(network) {
+	var svg = uqr.renderSVG(network.payload, {
+		pixelSize: 4,
+		whiteColor: 'white',
+		blackColor: 'black',
+		ecc: 'M',
+		border: 4
+	});
+	svg = svg.replace(/]*) width="([0-9]+)" height="([0-9]+)"/,
+		'= 0x20 && byte <= 0x3a) ||
+			(byte >= 0x3c && byte <= 0x7e);
+		output += printable ? String.fromCharCode(byte) :
+			'%' + byte.toString(16).toUpperCase().padStart(2, '0');
+	}
+
+	return output;
+}
+
+function security(config) {
+	var encryption = String(config.encryption || 'none').toLowerCase();
+	var key = config.key;
+
+	if (encryption === 'none')
+		return { type: '', key: '', transition: '' };
+
+	if (encryption === 'sae')
+		return key ? { type: 'WPA', key: key, transition: '0' } : null;
+
+	if (encryption === 'sae-mixed' || encryption === 'psk' ||
+	    encryption === 'psk2' || encryption === 'psk-mixed' ||
+	    encryption === 'psk+psk2')
+		return key ? { type: 'WPA', key: key, transition: '' } : null;
+
+	return null;
+}
+
+function payload(config) {
+	var auth = security(config);
+	var ssid = config.ssid;
+
+	if (!auth || ssid == null || String(ssid) === '')
+		return null;
+
+	return [
+		'WIFI:',
+		auth.type ? 'T:' + auth.type + ';' : '',
+		auth.transition !== '' ? 'R:' + auth.transition + ';' : '',
+		'S:' + percentEncode(ssid) + ';',
+		config.hidden === true || config.hidden === 1 || config.hidden === '1' ?
+			'H:true;' : '',
+		auth.key ? 'P:' + percentEncode(auth.key) + ';' : '',
+		';'
+	].join('');
+}
+
+function bandLabel(device) {
+	var band = String((device || {}).band || '').toLowerCase();
+	if (band === '2g') return '2.4 GHz';
+	if (band === '5g') return '5 GHz';
+	if (band === '6g') return '6 GHz';
+	return band ? band.toUpperCase() : '';
+}
+
+function activeSections(runtime) {
+	var active = {};
+	Object.keys(runtime || {}).forEach(function(radioName) {
+		var radio = runtime[radioName] || {};
+		if (radio.up === false || radio.disabled === true)
+			return;
+		(radio.interfaces || []).forEach(function(iface) {
+			var section = iface && iface.section;
+			var config = (iface && iface.config) || {};
+			if (section && config.mode === 'ap' && iface.ifname)
+				active[section] = true;
+		});
+	});
+	return active;
+}
+
+function collect(configResponse, runtime) {
+	/* rpc.declare({ expect: { values: {} } }) unwraps the `values` member.
+	 * Accept the raw ubus shape too so the collector stays easy to test. */
+	var values = (configResponse && configResponse.values) || configResponse || {};
+	var active = activeSections(runtime);
+	var grouped = {};
+
+	Object.keys(values).forEach(function(section) {
+		var config = values[section] || {};
+		var device = values[config.device] || {};
+		var code;
+
+		if (config['.type'] !== 'wifi-iface' || config.mode !== 'ap' ||
+		    !enabled(config.disabled) || !enabled(device.disabled) || !active[section])
+			return;
+
+		code = payload(config);
+		if (!code)
+			return;
+
+		if (!grouped[code])
+			grouped[code] = {
+				ssid: String(config.ssid),
+				payload: code,
+				bands: []
+			};
+
+		var band = bandLabel(device);
+		if (band && grouped[code].bands.indexOf(band) < 0)
+			grouped[code].bands.push(band);
+	});
+
+	return Object.keys(grouped).map(function(code) {
+		grouped[code].bands.sort();
+		return grouped[code];
+	}).sort(function(left, right) {
+		return left.ssid < right.ssid ? -1 : left.ssid > right.ssid ? 1 :
+			left.payload < right.payload ? -1 : left.payload > right.payload ? 1 : 0;
+	});
+}
+
+function fingerprint(networks) {
+	return JSON.stringify(networks.map(function(network) {
+		return [ network.ssid, network.payload, network.bands ];
+	}));
+}
+
+return baseclass.extend({
+	percentEncode: percentEncode,
+	payload: payload,
+	collect: collect,
+	fingerprint: fingerprint
+});
diff --git a/luci-app-wrqr/release.env b/luci-app-wrqr/release.env
new file mode 100644
index 000000000..8d220b632
--- /dev/null
+++ b/luci-app-wrqr/release.env
@@ -0,0 +1,4 @@
+PKG_NAME=luci-app-wrqr
+PKG_VERSION=0.1.0
+PKG_RELEASE=
+PKG_ARCH=all
diff --git a/luci-app-wrqr/scripts/build-apk-release.sh b/luci-app-wrqr/scripts/build-apk-release.sh
new file mode 100755
index 000000000..7dcb16579
--- /dev/null
+++ b/luci-app-wrqr/scripts/build-apk-release.sh
@@ -0,0 +1,29 @@
+#!/bin/sh
+set -eu
+fail() { printf 'build-apk-release: %s\n' "$*" >&2; exit 1; }
+root="$(CDPATH= cd -- "$(dirname "$0")/.." && pwd)"
+. "$root/release.env"
+. "$root/apk-feed.env"
+sdk="${OPENWRT_SDK_DIR:-}"
+secret="${OPENWRT_APK_SIGNING_KEY:-}"
+public="$root/$OPENWRT_APK_KEY_FILE"
+[ -d "$sdk" ] || fail 'OPENWRT_SDK_DIR must name an extracted SDK'
+[ -r "$secret" ] || fail 'OPENWRT_APK_SIGNING_KEY is not readable'
+[ -r "$public" ] || fail 'shared public key is not readable'
+"$root/scripts/check-apk-trust.sh"
+verify_dir="$(mktemp -d)"
+trap 'rm -rf "$verify_dir"' EXIT HUP INT TERM
+openssl ec -in "$secret" -pubout -out "$verify_dir/public.pem" >/dev/null 2>&1 ||
+  fail 'invalid EC signing key'
+cmp -s "$verify_dir/public.pem" "$public" || fail 'signing key does not match shared public key'
+OPENWRT_APK_SIGNING_KEY="$secret" OPENWRT_APK_PUBLIC_KEY="$public" \
+  "$root/scripts/build-apk.sh"
+apk_tool="$sdk/staging_dir/host/bin/apk"
+package="$root/dist/$PKG_NAME-$PKG_VERSION.apk"
+[ -x "$apk_tool" ] || fail 'SDK apk tool is unavailable'
+[ -r "$package" ] || fail 'built APK is unavailable'
+"$apk_tool" --allow-untrusted adbsign --sign-key "$secret" "$package"
+"$apk_tool" --keys-dir "$root/keys" verify "$package"
+mkdir -p "$root/dist/apk"
+cp "$package" "$root/dist/apk/"
+(cd "$root/dist/apk" && sha256sum "$PKG_NAME-$PKG_VERSION.apk" >SHA256SUMS.apk)
diff --git a/luci-app-wrqr/scripts/build-apk.sh b/luci-app-wrqr/scripts/build-apk.sh
new file mode 100755
index 000000000..a5b7455ce
--- /dev/null
+++ b/luci-app-wrqr/scripts/build-apk.sh
@@ -0,0 +1,65 @@
+#!/bin/sh
+set -eu
+fail() { printf 'build-apk: %s\n' "$*" >&2; exit 1; }
+root="$(CDPATH= cd -- "$(dirname "$0")/.." && pwd)"
+. "$root/release.env"
+. "$root/apk-feed.env"
+sdk="${OPENWRT_SDK_DIR:-}"
+[ -d "$sdk" ] || fail 'OPENWRT_SDK_DIR must name an extracted SDK'
+apk_tool="$sdk/staging_dir/host/bin/apk"
+[ -x "$apk_tool" ] || fail 'SDK apk tool is unavailable'
+"$root/scripts/check-version-sync.sh"
+work="$(mktemp -d)"
+cleanup() {
+  if [ -d "$work" ]; then
+    chown -R "$(id -u):$(id -g)" "$work" 2>/dev/null ||
+      sudo -n chown -R "$(id -u):$(id -g)" "$work" 2>/dev/null || true
+    rm -rf "$work"
+  fi
+}
+trap cleanup EXIT HUP INT TERM
+"$root/scripts/stage-package.sh" "$work/full"
+mkdir -p "$work/payload"
+cp -R "$work/full/usr" "$work/full/www" "$work/payload/"
+if ! chown -R 0:0 "$work/payload" 2>/dev/null; then
+  command -v sudo >/dev/null 2>&1 || fail 'root-owned APK staging requires chown or sudo'
+  sudo -n chown -R 0:0 "$work/payload" || fail 'could not normalize APK ownership'
+fi
+mkdir -p "$root/dist"
+artifact="$root/dist/$PKG_NAME-$PKG_VERSION.apk"
+"$apk_tool" mkpkg \
+  --info "name:$PKG_NAME" \
+  --info "version:$PKG_VERSION" \
+  --info 'description:Active Wi-Fi access point QR codes for LuCI Status Overview' \
+  --info "arch:$OPENWRT_APK_ARCH" \
+  --info 'license:MIT' \
+  --info "origin:$PKG_NAME" \
+  --info 'maintainer:nikitid' \
+  --info 'depends:libc luci-base luci-lib-uqr' \
+  --script "post-install:$work/full/CONTROL/postinst" \
+  --script "post-upgrade:$work/full/CONTROL/postinst" \
+  --script "pre-deinstall:$work/full/CONTROL/prerm" \
+  --files "$work/payload" \
+  --output "$artifact"
+"$apk_tool" adbdump --format json "$artifact" >"$work/package.json"
+python3 - "$work/package.json" <<'PY'
+import json
+import sys
+
+with open(sys.argv[1], encoding="utf-8") as source:
+    package = json.load(source)
+if package.get("info", {}).get("depends") != ["libc", "luci-base", "luci-lib-uqr"]:
+    raise SystemExit("unexpected APK dependency set")
+for path in package.get("paths", []):
+    entries = [path] + path.get("files", [])
+    for entry in entries:
+        acl = entry.get("acl", {})
+        if acl.get("user") != "root" or acl.get("group") != "root":
+            raise SystemExit("APK contains a non-root-owned path")
+if any(path.get("name") == "CONTROL" for path in package.get("paths", [])):
+    raise SystemExit("IPK control directory leaked into APK payload")
+scripts = package.get("scripts", {})
+if set(scripts) != {"post-install", "post-upgrade", "pre-deinstall"}:
+    raise SystemExit("unexpected APK lifecycle scripts")
+PY
+printf '%s\n' "$artifact"
diff --git a/luci-app-wrqr/scripts/build-ipk.sh b/luci-app-wrqr/scripts/build-ipk.sh
new file mode 100755
index 000000000..3369e15dd
--- /dev/null
+++ b/luci-app-wrqr/scripts/build-ipk.sh
@@ -0,0 +1,10 @@
+#!/bin/sh
+set -eu
+root="$(CDPATH= cd -- "$(dirname "$0")/.." && pwd)"
+stage="${BUILD_DIR:-$root/build/ipk}/stage"
+mkdir -p "$root/dist"
+"$root/scripts/check-version-sync.sh"
+"$root/scripts/stage-package.sh" "$stage"
+rm -f "$root/dist"/*.ipk "$root/dist/SHA256SUMS"
+python3 "$root/scripts/pack-ipk.py" "$stage" "$root/dist"
+(cd "$root/dist" && sha256sum ./*.ipk >SHA256SUMS)
diff --git a/luci-app-wrqr/scripts/check-apk-trust.sh b/luci-app-wrqr/scripts/check-apk-trust.sh
new file mode 100755
index 000000000..bb1924d3b
--- /dev/null
+++ b/luci-app-wrqr/scripts/check-apk-trust.sh
@@ -0,0 +1,14 @@
+#!/bin/sh
+set -eu
+root="$(CDPATH= cd -- "$(dirname "$0")/.." && pwd)"
+. "$root/apk-feed.env"
+actual="$(sha256sum "$root/$OPENWRT_APK_KEY_FILE" | awk '{print $1}')"
+[ "$actual" = "$OPENWRT_APK_TRUST_SHA256" ] || {
+  printf 'shared APK public key checksum mismatch\n' >&2
+  exit 1
+}
+if grep -R -E '(apk|opkg)[[:space:]]+upgrade([[:space:]]*$|[[:space:]]*(&&|;))' \
+    "$root/scripts" "$root/README.md" >/dev/null 2>&1; then
+  printf 'unscoped package upgrade found\n' >&2
+  exit 1
+fi
diff --git a/luci-app-wrqr/scripts/check-readme.sh b/luci-app-wrqr/scripts/check-readme.sh
new file mode 100755
index 000000000..ef684cc74
--- /dev/null
+++ b/luci-app-wrqr/scripts/check-readme.sh
@@ -0,0 +1,115 @@
+#!/bin/sh
+#
+# template: check-readme v1 (repo-templates)
+# Formatted to pass both `shfmt -i 2` and `shfmt -i 2 -bn -ci`, the styles
+# the consuming repositories check with; each gets this file verbatim.
+# Do not edit in place: change templates/shared/ in repo-templates
+# and run scripts/sync-templates.sh --update.
+#
+# Hold README.md (English) and README.ru.md (Russian) to the shared layout:
+#
+#   #  for         #  для 
+#   [Русский](README.ru.md)           [English](README.md)
+#   badges: CI, Release, License
+#   ## Features                       ## Возможности
+#   ## Requirements                   ## Требования
+#   ## Installation                   ## Установка
+#   ##              ## 
+#   ## Development                    ## Разработка
+#   ## Documentation                  ## Документация
+#   ## Support                        ## Поддержка
+#   ## License                        ## Лицензия
+#
+# Both files must have the same number of sections, so one language cannot
+# silently drop what the other says. Punctuation is plain ASCII in both: no
+# typographic dashes, arrows, quotes or ellipses. The release badge is required
+# only where .github/workflows/release.yml exists. Every relative link must
+# resolve.
+
+set -eu
+
+root="$(CDPATH='' cd -- "$(dirname "$0")/.." && pwd)"
+cd "$root"
+
+status=0
+fail() {
+  printf 'README: %s\n' "$*" >&2
+  status=1
+}
+
+headings() {
+  sed -n 's/^## //p' "$1"
+}
+
+# check_layout   , each list
+# separated by '|'. Project sections may only sit between the two.
+check_layout() {
+  file="$1"
+  head_want="$2"
+  tail_want="$3"
+  if [ ! -f "$file" ]; then
+    fail "$file is missing"
+    return
+  fi
+  if ! head -n 1 "$file" | grep -q '^# '; then
+    fail "$file does not start with a '# ' title"
+  fi
+  head_have="$(headings "$file" | head -n 3 | paste -sd '|' -)"
+  tail_have="$(headings "$file" | tail -n 4 | paste -sd '|' -)"
+  if [ "$head_have" != "$head_want" ]; then
+    fail "$file: the first sections are '$head_have', expected '$head_want'"
+  fi
+  if [ "$tail_have" != "$tail_want" ]; then
+    fail "$file: the last sections are '$tail_have', expected '$tail_want'"
+  fi
+}
+
+check_layout README.md 'Features|Requirements|Installation' \
+  'Development|Documentation|Support|License'
+check_layout README.ru.md 'Возможности|Требования|Установка' \
+  'Разработка|Документация|Поддержка|Лицензия'
+
+if ! grep -qF '[Русский](README.ru.md)' README.md; then
+  fail 'README.md does not link to README.ru.md'
+fi
+if ! grep -qF '[English](README.md)' README.ru.md; then
+  fail 'README.ru.md does not link to README.md'
+fi
+
+en="$(headings README.md | wc -l | tr -d ' ')"
+ru="$(headings README.ru.md | wc -l | tr -d ' ')"
+if [ "$en" != "$ru" ]; then
+  fail "README.md has $en sections and README.ru.md has $ru"
+fi
+
+for file in README.md README.ru.md; do
+  if ! grep -q 'actions/workflows/.*badge\.svg' "$file"; then
+    fail "$file has no CI badge"
+  fi
+  if ! grep -q 'img\.shields\.io/github/license\|License-\|license-' "$file"; then
+    fail "$file has no license badge"
+  fi
+  if [ -f .github/workflows/release.yml ]; then
+    if ! grep -q 'img\.shields\.io/github/v/release' "$file"; then
+      fail "$file has no release badge"
+    fi
+  fi
+
+  # The curly quotes in the pattern are what it looks for, not a typo.
+  # shellcheck disable=SC1112
+  typographic="$(grep -n '—\|–\|→\|←\|«\|»\|“\|”\|‘\|’\|…' "$file" | head -n 3 || true)"
+  if [ -n "$typographic" ]; then
+    fail "$file has non-ASCII punctuation: $typographic"
+  fi
+
+  # Relative links: [text](path) and [text](path#anchor), not URLs or anchors.
+  links="$(grep -o '](\([^)#:]*\)[)#]' "$file" | sed 's/^](//; s/[)#]$//' | sort -u)"
+  missing=""
+  for target in $links; do
+    [ -e "$target" ] || missing="$missing $target"
+  done
+  [ -z "$missing" ] || fail "$file links to missing files:$missing"
+done
+
+[ "$status" -eq 0 ] && printf 'README layout OK: %s sections each\n' "$en"
+exit "$status"
diff --git a/luci-app-wrqr/scripts/check-release-tag.sh b/luci-app-wrqr/scripts/check-release-tag.sh
new file mode 100755
index 000000000..2f176ba6e
--- /dev/null
+++ b/luci-app-wrqr/scripts/check-release-tag.sh
@@ -0,0 +1,8 @@
+#!/bin/sh
+set -eu
+root="$(CDPATH= cd -- "$(dirname "$0")/.." && pwd)"
+. "$root/release.env"
+[ "${1:?usage: check-release-tag.sh TAG}" = "v$PKG_VERSION" ] || {
+  printf 'release tag must be v%s\n' "$PKG_VERSION" >&2
+  exit 1
+}
diff --git a/luci-app-wrqr/scripts/check-version-sync.sh b/luci-app-wrqr/scripts/check-version-sync.sh
new file mode 100755
index 000000000..9676b7f55
--- /dev/null
+++ b/luci-app-wrqr/scripts/check-version-sync.sh
@@ -0,0 +1,10 @@
+#!/bin/sh
+set -eu
+root="$(CDPATH= cd -- "$(dirname "$0")/.." && pwd)"
+. "$root/release.env"
+make_name="$(sed -n 's/^PKG_NAME:=//p' "$root/Makefile" | head -n 1)"
+make_version="$(sed -n 's/^PKG_VERSION:=//p' "$root/Makefile" | head -n 1)"
+make_arch="$(sed -n 's/^PKGARCH:=//p' "$root/Makefile" | head -n 1)"
+[ "$make_name" = "$PKG_NAME" ]
+[ "$make_version" = "$PKG_VERSION" ]
+[ "$make_arch" = "$PKG_ARCH" ]
diff --git a/luci-app-wrqr/scripts/ci-check.sh b/luci-app-wrqr/scripts/ci-check.sh
new file mode 100755
index 000000000..69ea4b52c
--- /dev/null
+++ b/luci-app-wrqr/scripts/ci-check.sh
@@ -0,0 +1,30 @@
+#!/bin/sh
+set -eu
+root="$(CDPATH= cd -- "$(dirname "$0")/.." && pwd)"
+cd "$root"
+./scripts/check-version-sync.sh
+./scripts/check-readme.sh
+./scripts/check-apk-trust.sh
+find scripts -type f -name '*.sh' -exec sh -n {} +
+find luci -type f -name '*.js' -exec node --check {} +
+node ./scripts/test-shared.js
+node ./scripts/test-overview-ui.js
+python3 -m py_compile scripts/pack-ipk.py
+python3 - <<'PY'
+import json
+from pathlib import Path
+for path in Path('luci').glob('*.json'):
+    json.loads(path.read_text())
+    print('json OK:', path)
+PY
+./scripts/build-ipk.sh
+if find "${BUILD_DIR:-$root/build/ipk}/stage" -type f -name '._*' | grep -q .; then
+  printf 'AppleDouble metadata leaked into staged package\n' >&2
+  exit 1
+fi
+first="$(sha256sum dist/*.ipk | awk '{print $1}')"
+./scripts/build-ipk.sh
+second="$(sha256sum dist/*.ipk | awk '{print $1}')"
+[ "$first" = "$second" ]
+git diff --check 2>/dev/null || true
+printf 'ci-check OK\n'
diff --git a/luci-app-wrqr/scripts/pack-ipk.py b/luci-app-wrqr/scripts/pack-ipk.py
new file mode 100755
index 000000000..a4b0bc18d
--- /dev/null
+++ b/luci-app-wrqr/scripts/pack-ipk.py
@@ -0,0 +1,74 @@
+#!/usr/bin/env python3
+"""Build a deterministic opkg package."""
+import gzip
+import io
+import os
+import sys
+import tarfile
+
+
+def normalize(info):
+    info.uid = info.gid = info.mtime = 0
+    info.uname = info.gname = "root"
+    return info
+
+
+def archive(members):
+    raw = io.BytesIO()
+    with tarfile.open(fileobj=raw, mode="w", format=tarfile.GNU_FORMAT) as out:
+        for name, path in members:
+            info = normalize(out.gettarinfo(path, name))
+            if info.isreg():
+                with open(path, "rb") as source:
+                    out.addfile(info, source)
+            else:
+                out.addfile(info)
+    compressed = io.BytesIO()
+    with gzip.GzipFile(fileobj=compressed, mode="wb", mtime=0) as out:
+        out.write(raw.getvalue())
+    return compressed.getvalue()
+
+
+def walk(stage, control=False):
+    result = []
+    base = os.path.join(stage, "CONTROL") if control else stage
+    for root, dirs, files in os.walk(base):
+        dirs[:] = sorted(d for d in dirs if control or d != "CONTROL")
+        rel = os.path.relpath(root, base)
+        if rel != ".":
+            result.append(("./" + rel, root))
+        for name in sorted(files):
+            result.append(("./" + os.path.join(rel, name).replace("./", "", 1),
+                           os.path.join(root, name)))
+    return sorted(result)
+
+
+def control_field(path, field):
+    with open(path, encoding="utf-8") as source:
+        for line in source:
+            if line.startswith(field + ":"):
+                return line.split(":", 1)[1].strip()
+    raise SystemExit("missing control field: " + field)
+
+
+stage, output = sys.argv[1:]
+control = os.path.join(stage, "CONTROL", "control")
+parts = {
+    "debian-binary": b"2.0\n",
+    "control.tar.gz": archive(walk(stage, True)),
+    "data.tar.gz": archive(walk(stage, False)),
+}
+os.makedirs(output, exist_ok=True)
+name = "%s_%s_%s.ipk" % tuple(control_field(control, field) for field in
+                               ("Package", "Version", "Architecture"))
+target = os.path.join(output, name)
+raw = io.BytesIO()
+with tarfile.open(fileobj=raw, mode="w", format=tarfile.GNU_FORMAT) as out:
+    for part in ("debian-binary", "control.tar.gz", "data.tar.gz"):
+        data = parts[part]
+        info = normalize(tarfile.TarInfo("./" + part))
+        info.mode, info.size = 0o644, len(data)
+        out.addfile(info, io.BytesIO(data))
+with gzip.GzipFile(target, "wb", mtime=0) as out:
+    out.write(raw.getvalue())
+print(target)
diff --git a/luci-app-wrqr/scripts/release-notes.sh b/luci-app-wrqr/scripts/release-notes.sh
new file mode 100755
index 000000000..749c606ea
--- /dev/null
+++ b/luci-app-wrqr/scripts/release-notes.sh
@@ -0,0 +1,99 @@
+#!/bin/sh
+#
+# template: release-notes v3 (repo-templates)
+# Formatted to pass both `shfmt -i 2` and `shfmt -i 2 -bn -ci`, the styles
+# the consuming repositories check with; each gets this file verbatim.
+# Do not edit in place: change templates/shared/ in repo-templates
+# and run scripts/sync-templates.sh --update.
+#
+# Print release notes for a tag, built from the subjects of the commits since
+# the previous release tag. There is no changelog file: the commit subject is
+# the release note, so write it as the line a user should read.
+#
+# A commit whose subject is only a version number ("Release 1.2.0",
+# "release: v0.2.0") says nothing a user can read and is left out.
+#
+# A commit that touches only documentation, CI, tests or checks is listed
+# under "Documentation and tooling" rather than "Changes".
+#
+# Usage: scripts/release-notes.sh  [previous-tag]
+#
+# The previous tag defaults to the nearest v* tag before . For a final
+# release, pre-release tags (_rc, _beta, _alpha) are skipped, so its notes
+# cover everything since the last final release rather than since its RC. The repository
+# for the compare link comes from GITHUB_REPOSITORY, or from the origin remote.
+# Needs the full history: check out with fetch-depth 0.
+
+set -eu
+
+[ $# -ge 1 ] || {
+  printf 'usage: %s  [previous-tag]\n' "$0" >&2
+  exit 2
+}
+
+tag="$1"
+if [ $# -ge 2 ]; then
+  previous="$2"
+elif printf '%s\n' "$tag" | grep -Eq '_(rc|beta|alpha)'; then
+  previous="$(git describe --tags --abbrev=0 --match 'v*' "$tag^" 2>/dev/null || true)"
+else
+  previous="$(git describe --tags --abbrev=0 --match 'v*' --exclude '*_rc*' \
+    --exclude '*_beta*' --exclude '*_alpha*' "$tag^" 2>/dev/null || true)"
+fi
+
+repository="${GITHUB_REPOSITORY:-}"
+if [ -z "$repository" ]; then
+  url="$(git remote get-url origin 2>/dev/null || true)"
+  url="${url%.git}"
+  repository="$(printf '%s\n' "$url" | sed -n 's#.*github\.com[:/]\(.*\)$#\1#p')"
+fi
+
+if [ -n "$previous" ]; then
+  range="$previous..$tag"
+else
+  range="$tag"
+fi
+
+# Subjects that carry nothing but a version number.
+bump='^(release|bump|version)[: ]+(to )?v?[0-9]+(\.[0-9]+)*([-_][a-z0-9]+)?$'
+
+# Paths that never change what a user runs.
+tooling='^(docs/|\.github/|tests?/|scripts/(check|test|gen|ci)-|scripts/release-notes\.sh$|LICENSE|NOTICE|THIRD_PARTY|.*\.md$|\.[^/]+$)'
+
+changes=""
+tooling_changes=""
+for commit in $(git rev-list --no-merges --reverse "$range"); do
+  subject="$(git log -1 --format=%s "$commit")"
+  if printf '%s\n' "$subject" | grep -Eiq "$bump"; then
+    continue
+  fi
+  paths="$(git diff-tree --no-commit-id --name-only -r --root "$commit")"
+  if printf '%s\n' "$paths" | grep -Evq "$tooling"; then
+    changes="$changes- $subject
+"
+  else
+    tooling_changes="$tooling_changes- $subject
+"
+  fi
+done
+
+if [ -n "$changes" ]; then
+  printf '## Changes\n\n%s' "$changes"
+fi
+if [ -n "$tooling_changes" ]; then
+  [ -z "$changes" ] || printf '\n'
+  printf '## Documentation and tooling\n\n%s' "$tooling_changes"
+fi
+if [ -z "$changes$tooling_changes" ]; then
+  printf 'Version update only; no other changes since %s.\n' "$previous"
+fi
+
+if [ -n "$repository" ]; then
+  if [ -n "$previous" ]; then
+    printf '\n**Full diff**: https://github.com/%s/compare/%s...%s\n' \
+      "$repository" "$previous" "$tag"
+  else
+    printf '\n**Full history**: https://github.com/%s/commits/%s\n' \
+      "$repository" "$tag"
+  fi
+fi
diff --git a/luci-app-wrqr/scripts/stage-package.sh b/luci-app-wrqr/scripts/stage-package.sh
new file mode 100755
index 000000000..9ad3220bc
--- /dev/null
+++ b/luci-app-wrqr/scripts/stage-package.sh
@@ -0,0 +1,41 @@
+#!/bin/sh
+set -eu
+root="$(CDPATH= cd -- "$(dirname "$0")/.." && pwd)"
+stage="${1:?usage: stage-package.sh STAGE_DIR}"
+. "$root/release.env"
+rm -rf "$stage"
+mkdir -p "$stage/CONTROL" "$stage/usr/share/rpcd/acl.d" \
+  "$stage/usr/share/licenses/$PKG_NAME" \
+  "$stage/www/luci-static/resources/wrqr" \
+  "$stage/www/luci-static/resources/view/status/include"
+install -m 644 "$root/luci/acl.json" "$stage/usr/share/rpcd/acl.d/$PKG_NAME.json"
+install -m 644 "$root/luci/shared.js" "$stage/www/luci-static/resources/wrqr/shared.js"
+install -m 644 "$root/luci/overview.js" "$stage/www/luci-static/resources/view/status/include/15_wifi-qr.js"
+install -m 644 "$root/LICENSE" "$stage/usr/share/licenses/$PKG_NAME/LICENSE"
+cat >"$stage/CONTROL/control" <"$stage/CONTROL/postinst" <<'EOF'
+#!/bin/sh
+[ -n "${IPKG_INSTROOT:-}" ] && exit 0
+rm -f /tmp/luci-indexcache
+rm -rf /tmp/luci-modulecache
+exit 0
+EOF
+cat >"$stage/CONTROL/prerm" <<'EOF'
+#!/bin/sh
+[ -n "${IPKG_INSTROOT:-}" ] && exit 0
+case "${1:-}" in upgrade) exit 0 ;; esac
+[ "${PKG_UPGRADE:-0}" = 1 ] && exit 0
+rm -f /tmp/luci-indexcache
+rm -rf /tmp/luci-modulecache
+exit 0
+EOF
+chmod 755 "$stage/CONTROL/postinst" "$stage/CONTROL/prerm"
diff --git a/luci-app-wrqr/scripts/test-overview-ui.js b/luci-app-wrqr/scripts/test-overview-ui.js
new file mode 100644
index 000000000..5c0ab9f15
--- /dev/null
+++ b/luci-app-wrqr/scripts/test-overview-ui.js
@@ -0,0 +1,74 @@
+'use strict';
+
+const fs = require('fs');
+const vm = require('vm');
+
+let replacements = 0;
+let qrRenders = 0;
+
+function node(tag, attrs, children) {
+	return {
+		tag, attrs: attrs || {}, children: children || []
+	};
+}
+
+function evaluate(path, context) {
+	return vm.runInNewContext(`(function(){${fs.readFileSync(path, 'utf8')}\n})()`, context);
+}
+
+const common = evaluate('luci/shared.js', {
+	baseclass: { extend: value => value }, encodeURIComponent
+});
+const rpcCalls = [];
+const context = {
+	baseclass: { extend: value => value },
+	common,
+	dom: { content: (target, next) => { replacements++; target.children = next; } },
+	uqr: { renderSVG: value => {
+		qrRenders++;
+		return `${value}`;
+	} },
+	rpc: { declare: spec => (...args) => { rpcCalls.push([spec.object, spec.method, args]); return Promise.resolve({}); } },
+	L: { resolveDefault: promise => promise },
+	Promise,
+	E: (tag, attrs, children) => node(tag, attrs, children)
+};
+const widget = evaluate('luci/overview.js', context);
+
+const config = { values: {
+	radio0: { '.type': 'wifi-device', band: '5g' },
+	ap0: { '.type': 'wifi-iface', device: 'radio0', mode: 'ap', ssid: 'Home', encryption: 'sae-mixed', key: 'secret' }
+} };
+const running = { radio0: { up: true, interfaces: [
+	{ section: 'ap0', ifname: 'phy0-ap0', config: { mode: 'ap' } }
+] } };
+
+const firstRoot = widget.render([ config, running ]);
+if (replacements !== 1 || qrRenders !== 1)
+	throw new Error('first render did not create exactly one QR snapshot');
+const qrMarkup = firstRoot.children[1].children[0].children[2].children[0].tag;
+if (!qrMarkup.includes('viewBox="0 0 148 148"') || qrMarkup.includes(' width="148"'))
+	throw new Error('QR SVG was not converted to a scalable viewBox');
+
+replacements = 0;
+qrRenders = 0;
+const secondRoot = widget.render([ config, running ]);
+if (secondRoot !== firstRoot)
+	throw new Error('polling replaced the stable widget root');
+if (replacements !== 0 || qrRenders !== 0)
+	throw new Error('unchanged poll mutated or regenerated the widget');
+
+const stopped = { radio0: { up: false, interfaces: [] } };
+widget.render([ config, stopped ]);
+if (replacements !== 1)
+	throw new Error('runtime change was not rendered');
+
+widget.load().then(() => {
+	if (JSON.stringify(rpcCalls.map(call => call.slice(0, 2))) !==
+	    JSON.stringify([ [ 'uci', 'get' ], [ 'luci-rpc', 'getWirelessDevices' ] ]))
+		throw new Error('load did not refresh configuration and runtime state');
+	console.log('overview UI tests OK');
+}).catch(error => {
+	console.error(error.message);
+	process.exit(1);
+});
diff --git a/luci-app-wrqr/scripts/test-shared.js b/luci-app-wrqr/scripts/test-shared.js
new file mode 100644
index 000000000..283b245dc
--- /dev/null
+++ b/luci-app-wrqr/scripts/test-shared.js
@@ -0,0 +1,56 @@
+'use strict';
+
+const fs = require('fs');
+const vm = require('vm');
+
+function load(path) {
+	return vm.runInNewContext(`(function(){${fs.readFileSync(path, 'utf8')}\n})()`, {
+		baseclass: { extend: value => value },
+		encodeURIComponent
+	});
+}
+
+const common = load('luci/shared.js');
+
+function equal(actual, expected, label) {
+	if (JSON.stringify(actual) !== JSON.stringify(expected))
+		throw new Error(`${label}: ${JSON.stringify(actual)} != ${JSON.stringify(expected)}`);
+}
+
+equal(common.percentEncode('a;b\nя'), 'a%3Bb%0A%D1%8F', 'percent encoding');
+equal(common.payload({ ssid: 'Guest', encryption: 'none' }),
+	'WIFI:S:Guest;;', 'open network');
+equal(common.payload({ ssid: 'Main', encryption: 'sae-mixed', key: 'secret' }),
+	'WIFI:T:WPA;S:Main;P:secret;;', 'transition network');
+equal(common.payload({ ssid: 'Main', encryption: 'sae', key: 'secret', hidden: '1' }),
+	'WIFI:T:WPA;R:0;S:Main;H:true;P:secret;;', 'WPA3 network');
+equal(common.payload({ ssid: 'Corp', encryption: 'wpa2', key: 'secret' }), null,
+	'enterprise network');
+
+const config = { values: {
+	radio0: { '.type': 'wifi-device', band: '2g' },
+	radio1: { '.type': 'wifi-device', band: '5g' },
+	radio2: { '.type': 'wifi-device', band: '6g', disabled: '1' },
+	ap0: { '.type': 'wifi-iface', device: 'radio0', mode: 'ap', ssid: 'Home', encryption: 'psk2', key: 'same' },
+	ap1: { '.type': 'wifi-iface', device: 'radio1', mode: 'ap', ssid: 'Home', encryption: 'sae-mixed', key: 'same' },
+	ap2: { '.type': 'wifi-iface', device: 'radio2', mode: 'ap', ssid: 'Off', encryption: 'sae', key: 'off' },
+	sta0: { '.type': 'wifi-iface', device: 'radio1', mode: 'sta', ssid: 'Upstream', encryption: 'psk2', key: 'skip' },
+	broken: { '.type': 'wifi-iface', device: 'radio1', mode: 'ap', ssid: 'Broken', encryption: 'psk2', key: 'skip' }
+} };
+const runtime = {
+	radio0: { up: true, interfaces: [ { section: 'ap0', ifname: 'phy0-ap0', config: { mode: 'ap' } } ] },
+	radio1: { up: true, interfaces: [
+		{ section: 'ap1', ifname: 'phy1-ap0', config: { mode: 'ap' } },
+		{ section: 'sta0', ifname: 'phy1-sta0', config: { mode: 'sta' } }
+	] },
+	radio2: { up: false, interfaces: [ { section: 'ap2', ifname: 'phy2-ap0', config: { mode: 'ap' } } ] }
+};
+
+equal(common.collect(config, runtime), [ {
+	ssid: 'Home',
+	payload: 'WIFI:T:WPA;S:Home;P:same;;',
+	bands: [ '2.4 GHz', '5 GHz' ]
+} ], 'active AP collection and deduplication');
+equal(common.collect(config.values, runtime).length, 1, 'RPC-unwrapped UCI response');
+
+console.log('shared tests OK');
diff --git a/openwrt-thermal-guard/.gitattributes b/openwrt-thermal-guard/.gitattributes
new file mode 100644
index 000000000..6313b56c5
--- /dev/null
+++ b/openwrt-thermal-guard/.gitattributes
@@ -0,0 +1 @@
+* text=auto eol=lf
diff --git a/openwrt-thermal-guard/.gitignore b/openwrt-thermal-guard/.gitignore
new file mode 100644
index 000000000..8335c478d
--- /dev/null
+++ b/openwrt-thermal-guard/.gitignore
@@ -0,0 +1,5 @@
+# editor and OS noise
+*.sync-conflict-*
+.stversions/
+.stfolder/
+*~
diff --git a/openwrt-thermal-guard/CHANGELOG.md b/openwrt-thermal-guard/CHANGELOG.md
new file mode 100644
index 000000000..f7f9c8335
--- /dev/null
+++ b/openwrt-thermal-guard/CHANGELOG.md
@@ -0,0 +1,591 @@
+# Changelog
+
+All notable changes to `thermal-guard` and `luci-app-thermal-guard`.
+Versions follow `Major.Minor.Patch`; both packages are released
+together and carry the same number.
+
+## 2.0.0
+
+### Breaking changes
+
+- **Breaking: `trip_dt` is no longer a UCI option.** The daemon used to write
+  it into `/etc/config/thermal-guard` from the running process, next to the
+  operator's own edits. The device tree trips that `trip_active` was made for
+  now live in `/etc/thermal-guard/trip_base`, written on the first cycle with
+  `trip_active` set and kept across a sysupgrade. Without `trip_active` the file
+  is neither read nor written. The package moves an existing `trip_dt` there
+  once (`/etc/uci-defaults/90-thermal-guard-trip-base`) and removes the option;
+  a leftover `trip_dt` is ignored. The daemon no longer writes UCI.
+- **Breaking: `fan_cooling_device` and `fan_thermal_zone` are gone.** Both
+  named a numbered path (`cooling_device0`, `thermal_zone0`), and those numbers
+  can change between boots, which is what the detection by type avoids. The
+  fan is found by `fan_cooling_device_type`, its zone by the link to it. A
+  value left in an old configuration is ignored like any unknown option.
+
+### Notes for operators
+
+- **Syslog filters may need adjusting.** Every line now carries a
+  `daemon.*` priority instead of `user.notice`: `crit`, `warning`, `notice`,
+  `info` as listed under Changed. A `logread` filter or remote syslog rule
+  written for `user.notice` no longer matches.
+- **New dependency `jsonfilter`.** `base-files` already ships it on every
+  OpenWrt and ImmortalWrt image, so nothing new gets installed there.
+- **Update both packages together.** The config page's answer to a changed
+  firmware runs `thermal-guard trips-keep`, which needs the daemon and the
+  rpcd ACL of this release; the ACL grants exactly that command line.
+
+### Added
+
+- **`thermal-guard trips-keep`** records the device tree trips of the running
+  boot as the ones `trip_active` was made for. The config page runs it for both
+  answers to the new firmware notice; the ACL grants exactly this command line.
+
+### Changed
+
+- **README: a section on known limitations**: ModemManager and `at_lock`,
+  notifications without `curl`, boards that report no temperature, and
+  `wifi_off` on radios netifd does not manage.
+
+- **Without `curl`, a notification address with a query string or user info
+  is refused.** `uclient-fetch` and `wget` take the address on the command
+  line, where every local process can read it in `/proc`, so a token in
+  `?token=...` or `user:pass@host` would leak. The check runs when the
+  configuration loads and clears `notify_url`, so nothing piles up in the
+  outbox; the notify hook still works. An address without `http://` or
+  `https://`, or with characters `curl` would misread, and a malformed
+  `notify_header` are now rejected at load for the same reason. Each reason is
+  logged once, the address itself never. A secret in the path of the address
+  (Slack, Discord, a private ntfy topic) cannot be detected and stays visible
+  without `curl`; the README says so.
+- **A notification post without `curl` has a time limit.** `uclient-fetch` and
+  `wget` run under `timeout` (`HTTP_TIMEOUT`, 20 s by default) with `-T 15` for
+  the network wait, so a hung DNS lookup or server costs one message instead of
+  blocking the loop. The `curl` path keeps its `-m 15`.
+- **`wifi_off` is read back.** It was the only built in stage action that
+  trusted the exit code of `wifi down`. Now the command is sent up to five times
+  with 5 s in between (`WIFI_SETTLE`), and the action succeeds only when
+  `ubus call network.wireless status` reports no radio up; the way back after a
+  reset waits until every radio that is not disabled is up. Checked against the
+  real netifd answers of a Banana Pi R3 Mini (`mt_wifi`) and a GL-X3000, kept as
+  test fixtures.
+- **Time limits for `wifi`, `ifdown`, `ifup` and every hook.** The commands get
+  15 s (`CMD_TIMEOUT`), the `notify`, `stage1` and `stage2` hooks 15 s
+  (`HOOK_TIMEOUT`), the `modem-temp` hook 5 s. A hook that ignores TERM is killed
+  5 s later. Before, a hung command or hook held the whole loop.
+- **The config page checks what the daemon will use.** The order of the
+  thresholds is checked against the values in the form, not the saved ones,
+  and an empty field counts as the daemon's default; before, `cpu_warn` 85 with
+  `cpu_crit` left empty passed and made the daemon fall back to all defaults.
+  A threshold like `85abc` is refused. `interval` takes whole numbers of 5 and
+  more only. `fan_governor` is a list of the four governors the daemon accepts.
+- **`fan_governor` only takes a kernel governor that regulates:**
+  `step_wise`, `fair_share`, `bang_bang` or `power_allocator`. Before, any
+  string went to the zone's `policy` on reset, `user_space` included, which
+  leaves nothing regulating the fan. Anything else now means `step_wise` and is
+  logged once.
+- **Syslog lines carry a priority** instead of the default `user.notice`:
+  `daemon.crit` for stages, restored stages, a stage that cannot be persisted
+  and failed stage actions (also a modem or interface that does not come back
+  after a reset), `daemon.warning` for rejected options, missing tools, a
+  sensor that does not read and trips that could not be written,
+  `daemon.notice` for cooled down, reset, `trips-keep` and new firmware trips
+  that need a decision, `daemon.info` for the rest. The `blind:` message for a
+  CPU sensor that stops reading ran through the stage 0 path and would have
+  been `crit`; it is a `warning` and is still notified. The event log format
+  is unchanged.
+- **netifd's answers are read with `jsonfilter`** instead of `sed` and `awk` on
+  the text of `ubus` output, which depended on its indentation. Every `ubus
+  call` has a time limit of 5 s (`UBUS_TIMEOUT`): netifd answers late while
+  `wifi down` runs, and the readback must not hang on exactly what it checks.
+  A radio counts as enabled unless netifd reports it `disabled`; the Wi-Fi log
+  line counts only those. `jsonfilter` is now in `DEPENDS`; `base-files`
+  already pulls it into every image.
+- **The configuration is read with one `config_load` per cycle** instead of
+  one `uci -q get` per option, about 40 processes every 20 s. The checks on
+  the values are unchanged.
+- **The detected fan pwm output is logged once as `fan pwm output detected at
+  '...'`.** Before it read `fan pwm path '' unusable`, although nothing was
+  configured. A configured `pwm_path` that stopped working is still reported
+  as unusable, once per replacement.
+
+### Fixed
+
+- **Four help texts on the config page say what the service does** (English
+  and German): `fan_governor` applies only when no earlier control mode was
+  recorded; `hold_minutes` starts stage 2 of 3 when the temperature has not
+  dropped and stage 3 of 3 only while it still rises; the `zone_path` reason
+  names the fan's zone, which is no longer configured; `uplink_interface`
+  decides whether a message goes out or is queued, not whether the modem is
+  switched off, and is the default for the interface action.
+
+- **README, hooks README and the comments in `/etc/config/thermal-guard`
+  describe what the code does**: which stage actions can keep a connection
+  off after a reboot, what a pwm reset writes back, when `test` shows the
+  escalation over time, what a missing hook means per hook, what
+  `fan_cooling_device_type` is used for, and that `fan_governor` applies only
+  when no earlier governor was recorded.
+
+- **`thermal-guard test` reports the fan mode the daemon would use.** It took
+  `fan_mode` as configured, so `auto` without a cooling device or `pwm`
+  without `pwm_full` and `pwm_idle` claimed "forcing fan to full speed", while
+  the daemon leaves the fan alone in both cases. It now runs the same fan
+  detection, which only reads sysfs.
+
+- **A `cpu_temp_path` set in its `/sys/devices` form no longer shows the
+  processor among the other sensors.** Paths were compared as written, and
+  the sensor loops walk the `/sys/class` links. Such a path is now resolved
+  and compared resolved; the default and detected paths are in class form and
+  cost nothing extra.
+
+- **`... cannot send a header` is logged once per fetcher.** Without `curl` it
+  came with every message and with every retry of the outbox, two minutes
+  apart. It is said again when the header was empty in between or another
+  fetcher takes over, and forgotten once `curl` is there.
+
+- **Trip messages are said once each.** They shared one memory, which every
+  successful trip write cleared, so `device tree trips are now ...` came back
+  after each change of the trips. Each message now has its own, cleared when
+  its cause is gone: the zone found, `trip_active` valid again, the firmware
+  trips recorded, a write that worked.
+
+- **The 1.2.0 entry on notifications overstated the config file.** Only `curl`
+  reads `notify_url` and `notify_header` from a file; `uclient-fetch` and
+  `wget` take the address on their command line. Since this release such an
+  address is refused when it carries a query string or user info (see
+  Changed).
+
+- **`at_lock` is checked where it is used, not only when the configuration
+  loads.** 1.2.0 said every UCI path is checked again at its use site; for
+  `at_lock` that was not so, `tg_at` handed it to `flock` as it was. Now a path
+  the guard refuses falls back to `/var/lock/modem-at.lock` there as well.
+
+- **The processor no longer shows up among the other sensors under another
+  name.** It was left out only when its sensor was called `cpu_thermal`. A
+  processor zone with another type, or a hwmon input such as `coretemp`, was
+  listed a second time. Now its own sensor is skipped by path, and where it is
+  a thermal zone, the hwmon node the kernel mirrors it as is skipped by the
+  zone's type. The other inputs of the same chip stay listed.
+
+- **A `modem-temp` hook stopped at its time limit gives no reading.** Its
+  output was used whatever the exit status, so a hook that printed a value
+  and then hung still counted. Now the output is dropped when `timeout`
+  reports the limit (124) or the hook died of a signal (above 128: the KILL
+  for a hook that ignored TERM, or a BusyBox `timeout`, which reports 143),
+  as the hooks README already said.
+
+- **A reading missing at stage entry no longer counts as 0.** The reference
+  for "no drop" and "still climbing" was stored as 0 when that reading was
+  missing, and a state file from before the references existed loaded them as
+  0. Any later reading then counted as a rise, and stage 3 of 3 could start
+  without one. A missing reference now stays empty, the comparison counts only
+  channels with a reading and a reference, and the first reading after the gap
+  becomes the reference, so the channel compares again as "risen since it came
+  back".
+
+- **`thermal-guard test` shows what the readings would trigger, and only on
+  stdout.** It ran one cycle, while every stage needs two readings in a row, so
+  it never showed a stage. What it could do was write a `cooled down` line
+  (notice) into syslog and the event log when a stage was active. Now it runs
+  two cycles at the same moment and prints each message it would send as
+  `would notify (): ...`; syslog, the event log and the outbox stay
+  untouched.
+
+- **Without `ip`, messages were never delivered from stage 2 of 3 on.** The
+  uplink check found no route, so every message went to the outbox, and the
+  outbox waited for a route it could never see. Nothing was logged. Now a
+  missing `ip` means the uplink is unknown and the message goes out at once,
+  with `no ip command, cannot tell whether another uplink exists, sending at
+  once` logged once as a warning. A missing `flock` is logged once as well
+  (`no flock command, AT queries run without the shared lock`); the queries
+  still run.
+
+- **A stage restored after a reboot reports an action that fails.** The
+  restore reapplied the stage actions without looking at the result, so a
+  modem that stayed on or Wi-Fi that stayed up went unreported. Now each
+  failure is logged as crit (`stage N action '...' failed after the reboot`),
+  and the one restore message, sent after the actions, names what failed. The
+  event log gets `restoring stage N after a reboot` before the actions start,
+  so a daemon that dies halfway leaves a trace.
+- **Handing a pwm fan back is read back.** Reset wrote the saved mode and duty
+  cycle without checking them. Both are read back now and a mismatch is logged
+  as crit. In automatic mode the duty cycle is no longer written at all: the
+  chip sets it itself, the value from before the takeover means nothing there,
+  and some drivers refuse it.
+
+- **The status page no longer says a board without a sensor takes no action.**
+  The note read "The service stays idle and takes no action", while the modem
+  thresholds keep working as long as the modem reports a temperature. It now
+  says that the processor is not watched and the modem thresholds still apply
+  (English and German).
+
+- **`wifi_off` no longer counts as done when netifd manages no radio.** An
+  empty `network.wireless` status used to confirm the action: nothing was up,
+  because nothing was there, and the stage reported Wi-Fi off on a device whose
+  radios netifd does not see. Now the action fails (`netifd manages no Wi-Fi
+  radio, wifi_off switched nothing off`, crit) and is notified like any failed
+  action. Bringing Wi-Fi back after a reset still passes, there is nothing to
+  bring back. The daemon also warns once when it loads a configuration that
+  uses `wifi_off` on such a device, so the mistake shows before the box runs
+  hot; a ubus error there is left to the action.
+
+- **`thermal-guard selftest` says why it stops** when it cannot create its
+  scratch directory, instead of ending with 1 and no word. The
+  `cooling-levels` case skips on a host without `hexdump` rather than failing.
+
+- **Handing the zone back on reset is checked.** `tg_fan_release` wrote the
+  governor to the zone's `policy` without reading it back. A governor the
+  kernel was built without, such as `power_allocator` on the Filogic kernel,
+  was refused by the kernel, and the zone stayed on `user_space` with the fan
+  at full speed and nobody told. Now a governor missing from
+  `available_policies` becomes `step_wise` (logged as warning), and a zone that
+  still reports another policy afterwards is logged as crit.
+
+- **A deleted option kept its last value until the daemon restarted.**
+  Removing `notify_url` went on sending notifications, removing a threshold
+  kept the old threshold. Every option now returns to its default within one
+  cycle.
+
+- **A persisted stage could be lost to a power cut, and a failed persist went
+  unnoticed.** Writing `/etc/thermal-guard/state` on a stage change and removing
+  it on reset now end with `sync`. A persist that cannot be written, for example
+  on a full or read only overlay, is logged once (`could not persist stage N to
+  ..., it will not survive a reboot`) instead of being treated as done. The
+  per cycle path writes only to `/var/run` and does not sync.
+
+## 1.5.0
+
+### Added
+
+- **Wi-Fi temperatures with the proprietary MediaTek driver.** `mt_wifi`, used
+  by the MTK vendor images of the Banana Pi R3 Mini, registers no hwmon sensor,
+  so the status page showed no Wi-Fi readings although the LuCI overview did.
+  The extra sensors now also read `CurrentTemperature` from
+  `iwpriv  stat` for `ra0`, `rax0` and the other `mt_wifi`
+  interfaces, only while they are up and bounded by `timeout`, the same way
+  ImmortalWrt's `autocore` does it. Shown as Wi-Fi 1, Wi-Fi 2, for display only.
+
+## 1.4.0
+
+Where the kernel drives the fan, thermal-guard can now lower its trip points
+for a hot modem instead of competing with it. Package release `1.4.0-r2`,
+deployed and checked on the GL-X3000 and both Banana Pi R3 Mini.
+
+### Added
+
+- **Trip management (`trip_boost`, `trip_active`, `trip_boost_offset`,
+  `trip_dt`).** With `trip_boost 'modem'` the daemon lowers the active trips of
+  the thermal zone that drives the fan by `(modem - offset) - cpu`, rounded up
+  to 5 K and capped at 40 K, so the kernel regulator spins the fan up for a hot
+  modem it cannot see. Trips only ever go below the baseline, `hot` and
+  `critical` are never written, a missing reading holds the trips and raising
+  them needs three cool readings in a row. Stopping the daemon leaves them where
+  they are. Nothing is written unless `trip_boost` or `trip_active` is set, so
+  boards with a kernel-driven fan such as the GL-X3000 keep their trips. New
+  module `/usr/share/thermal-guard/trips.sh`, selftest cases against a planted
+  sysfs tree.
+- **`THERMAL_ROOT`** environment variable, default `/sys/class/thermal`, for
+  tests only. UCI cannot change it.
+- **`/var/run/thermal-guard/modem-temp`**: one line ` 
+  `, written atomically after every good modem reading. Other programs
+  read the value here instead of querying the modem over AT themselves. A
+  missing reading leaves the file alone, so its age shows the outage.
+- Deployment findings for 1.2.0 on real hardware, one section per device,
+  taken into the development repository unchanged.
+
+### Changed
+
+- **AT queries have a time limit.** `timeout 10 flock  timeout 5
+  sms_tool …`: the outer limit covers the wait for the lock, which BusyBox
+  `flock` cannot bound itself, the inner one the query. Before, a hung modem or
+  a program sitting on the lock stopped the whole loop, stages and trip
+  management included. A timeout counts as a missing reading. New dependency
+  `coreutils-timeout`; the selftest fails where `timeout` is missing.
+- **Web interface.** System → Thermal Guard, tab Fan: `trip_boost`, the
+  modem allowance and the switching temperatures (`trip_active`, checked with
+  the same rules as the service), the state of the trip management, the
+  `cooling-levels` from the device tree with their duty cycle, and after an
+  image with other device tree trips a notice with "use the firmware values" and
+  "keep my values". The status page shows the current trips and by how much
+  they are lowered. 31 new strings, German catalogue complete.
+- Status file: `trip_state`, `trip_reason` (a fixed code the page translates),
+  `trip_zone`, `trip_base`, `trip_now`, `trip_dt`, `trip_delta`,
+  `trip_dt_changed`, `trip_limit`, `fan_levels`.
+- Docs: README covers trip management, `modem-temp` and the dependency.
+  The internal deployment documents follow the new layout of the build
+  repositories.
+- `luci-app-thermal-guard` 1.4.0, same number as the daemon.
+- **`/lib/upgrade/keep.d/thermal-guard`** keeps `/etc/thermal-guard/` across a
+  `sysupgrade`. Before, only `/etc/config/thermal-guard` survived: the hooks
+  an operator placed over ssh, `matrix.env` for `matrix-notify`, and the
+  persisted stages were lost with every flash. Stages persisted at the time of
+  a flash now come back after it, the same as after a reboot; clear them before
+  flashing if the cause is fixed.
+- The shipped configuration leaves `trip_boost` unset, which means off. An
+  image can then switch it on for its board at first boot with a uci-defaults
+  script that only sets missing options, without overriding an own setting.
+- Integration tests for trip management, the hung modem and the held lock run
+  the daemon against a planted sysfs tree. The suite now takes about two
+  minutes.
+- README: why this package exists, and screenshots of the status page, the
+  overview block and the configuration tabs on a Banana Pi R3 Mini and a
+  GL-X3000, in `screenshots/`.
+- CI installs shellcheck 0.11.0 from its release, checked against a pinned
+  SHA256, instead of the Ubuntu package. Ubuntu 24.04 ships 0.9.0, which does
+  not know the busybox dialect, so the lint job failed on its first run on
+  GitHub without looking at a single line.
+
+### Fixed
+
+- **A package upgrade left the old daemon running.** procd keeps an instance
+  whose command line did not change, and `thermal-guard daemon` never does, so
+  after `apk add` the previous version went on running while `thermal-guard -V`
+  already showed the new one. Found on the GL-X3000 with 1.4.0-r1. The package
+  now restarts the service after an upgrade on a running system, only if it was
+  running. Package release `1.4.0-r2`.
+
+## 1.3.2
+
+### Fixed
+
+- **`thermal-guard selftest` failed on boards with a fan chip.** The case
+  "nothing to read, nothing shown" assumed no hwmon fan exists; on the GL-X3000
+  the real `pwm-fan` is found by name and read, which is correct. The case now
+  runs only where no fan chip is present.
+
+## 1.3.1
+
+### Fixed
+
+- **`thermal-guard selftest` worked in the live state directory.** It saved
+  test stages into `/var/run/thermal-guard/state` under a running daemon, which
+  then saw a changed `GEN` and dropped its decision ("reset during this
+  cycle"), placed test hooks there, and wrote its test messages to syslog. The
+  1.3.0 cases also emptied the event log, the incident history the status page
+  shows. The deployment runbook runs the selftest on every board. It now works
+  in a temporary directory and logs nothing. Found on the GL-MT300N-V2 right
+  after installing 1.3.0.
+
+## 1.3.0
+
+The daemon no longer touches a fan it has not been told about. Found in the
+first buildroot build: a package install starts the service at once, and on a
+board without a configuration the shipped `auto` could resolve to `pwm` with an
+assumed polarity of `255`/`0`, which on an inverted board stops the fan in the
+stage meant to force it.
+
+### Changed
+
+- **`fan_mode` defaults to `none`**, in the shipped configuration and in the
+  daemon when the option is missing. Most boards with a fan already regulate it,
+  and this package is a protection layer, not a regulator.
+- **`pwm_full` and `pwm_idle` have no default.** `fan_mode=pwm` needs both; with
+  either missing the daemon logs it once and leaves the fan alone. The
+  configuration page requires both when `pwm` is selected.
+- **`auto` never resolves to `pwm`**, only to `cooling_device` or `none`. The
+  cooling device carries its polarity in the device tree; a raw pwm output
+  needs it from the operator.
+- An upgrade keeps the existing configuration. Affected is only a board that set
+  `auto` without a cooling device, or `pwm` without both values; the deployment
+  runbook lists the cases.
+
+### Added
+
+- **Stage actions are read back instead of assumed.** `modem_radio_off` asks the
+  modem `AT+CFUN?` afterwards and resends up to three times, because a
+  collision on the AT port swallows a command without an error. A modem that
+  does not confirm fails the stage, which is notified. Switching it back on at
+  a reset is checked the same way.
+- **`modem_radio_off_at`**: `AT+CFUN=4` (flight mode, default) or `AT+CFUN=0`
+  (minimum function) for a modem that does not take 4. Nothing else is
+  accepted, because the configuration page can write every option and a free
+  AT command would let it reset or disable the modem.
+- **`interface_down` as a stage action.** Takes `action_interface` down, or
+  `uplink_interface` when that is unset, and waits for netifd to report it
+  down. A reset brings it back up. Interface names are checked as UCI section
+  names, in the daemon and on the page, since they reach `ifdown` and a ubus
+  path; `uplink_interface` is now checked the same way.
+- **The fan is shown even where another program drives it.** `fan_mode` says
+  what the daemon may write, the new `fan_view` in the status file what it
+  reads. Under `none` it reads the raw pwm output where `pwm_full` and
+  `pwm_idle` are set, otherwise the cooling device, otherwise the raw output
+  without a percentage. The raw output comes first because the kernel derives
+  a cooling device's `cur_state` assuming ascending `cooling-levels`; the Banana
+  Pi R3 Mini's descend (`<255 96 0>`), so full speed reads as state 0. The status
+  page and the overview show the fan whenever `fan_view` names something.
+
+### Fixed
+
+- **A reset only undid `modem_radio_off` at stage 2 of 3 and `wifi_off` at
+  stage 3**, so either action configured for the other stage stayed applied
+  after a clear. Each stage's configured action is now reversed.
+- **The overview block showed a pwm fan as "fan step 140 of 1"** on an inverted
+  board, because it used the raw value against `pwm_full` as the maximum. It
+  now shows the percentage the daemon computes, and `fan_max` is only reported
+  for pwm when both polarity values are set.
+- **Stage 1 of 3 promised a fan at full speed under `fan_mode=none`**, in the
+  notification, on the status page and in two descriptions on the configuration
+  page, and logged "could not force the fan" as if the stage had failed. It now
+  says the fan is left to its own controller and logs nothing about it.
+
+### Translations
+
+- German: new `Leave the fan alone` (replaces `No fan`) and `Stage 1 of 3 active:
+  warning, fan left to its own controller`; reworded the descriptions of the fan
+  mode, `pwm_full`, `pwm_idle`, `cpu_warn` and the Actions tab.
+- German: `Switch the modem radio off` (replaces `Switch the modem off
+  (AT+CFUN=4)`, since the level is now configurable), and new `Take a network
+  interface down`, `network interface down`, `How the modem is switched off`
+  with its description, `Flight mode (AT+CFUN=4)`, `Minimum function
+  (AT+CFUN=0)`, `Interface to take down` with its description.
+
+## 1.2.0
+
+Hardening pass over the whole package, plus the corrections that came out of
+testing on a Banana Pi R3 Mini, a GL-X3000 and a GL-MT300N-V2.
+
+### Fixed
+
+- **One-shot commands narrated the configuration into the event log.** Every
+  entry point runs the same validation, so `status`, `reset` and `test` each
+  repeated whatever it found: three `thermal-guard status` calls on a board
+  without a sensor produced three identical lines. The event log keeps the last
+  50 entries, so a monitoring check calling `status` in a loop flushed the
+  record of an actual incident out of it within the hour. Only the daemon
+  reports these now. Found during deployment on a GL-MT300N-V2.
+- **A reset could be undone by the cycle it interrupted.** Reading the modem
+  over AT takes seconds, and a reset landing in that window was overwritten
+  when the cycle saved. In the worst shape the fan was forced again right after
+  being handed back, leaving it at full speed while the state said idle, with
+  no way to clear it: the release was guarded by `stage >= 0`. Resets are now
+  counted in `GEN` and the count is checked before acting and before saving,
+  and `thermal-guard reset` releases the fan unconditionally.
+- **Turning `enabled` off removed the guard instead of pausing it.**
+  `start_service` registered no instance, so stages stayed applied, the fan
+  stayed forced and the status file froze with its last values while the page
+  kept showing an active stage. The instance now always runs and the daemon
+  pauses itself.
+- **The fan was addressed by hwmon number.** `hwmon2` today is `hwmon1` after
+  an NVMe moves or a kernel changes, and the daemon would then write a duty
+  cycle to a different chip and report success. The fan chip is looked up by
+  its hwmon name.
+- **`tg_fan_release` did nothing in pwm mode** unless `fan_release_command` was
+  set, so the fan stayed on manual full speed after a reset.
+- **A failing stage action reported success.** `tg_run_action` ended in an
+  unconditional `return 0`, so a modem that could not be reached still counted
+  as switched off. It now returns what the action returned, an unknown action
+  name is logged, and a failed stage is notified.
+- **`tg_cfg` skipped path validation and sensor detection** entirely when `uci`
+  was absent.
+- CI checked `70_thermal-guard.js`, which was renamed to `11_` some releases
+  ago, so the `luci-syntax` job had been failing on a missing file.
+- The rpcd ACL named the status file and the reset command but not the ubus
+  `file` object they are reached through, nor the `/tmp/run` path that `/var`
+  resolves to. Both reads and the clear button were denied for every session
+  that was not root.
+- **Installing `luci-app-thermal-guard` as a package did not load its ACL**
+  (`1.2.0-r2`). The package's own `postinst` replaced the one `luci.mk`
+  provides, which is the one that reloads rpcd, so the pages were refused until
+  rpcd restarted. The own `postinst` is gone; the default drops the menu caches
+  as well. Found in the first buildroot build of either package.
+
+### Added
+
+- **Protection stages survive a reboot.** A stage change is mirrored to
+  `/etc/thermal-guard/state` and reapplied at startup. The state used to live
+  only in `/var/run`, which is tmpfs, so any reboot silently cleared the
+  stages and the box came back with the modem enabled and the same broken fan.
+- **`pwm_idle`**, the raw value meaning slowest, as the counterpart to
+  `pwm_full`. The pair carries the polarity, which several boards run inverted
+  (`1` full speed, `255` stopped). The fan percentage on the status page is
+  computed from it instead of assuming a rising scale.
+- **A SoC sensor is looked for** when `cpu_temp_path` does not read, covering
+  ramips and x86 boards that report through hwmon rather than a thermal zone.
+- **"This device reports no temperature at all"** as a state of its own, told
+  apart from a wrong path and shown on the status page. Some boards, the
+  GL-MT300N-V2 among them, expose no sensor whatsoever.
+- **A second fan controller is detected.** When a value the daemon wrote has
+  been replaced, it logs which `fan_mode` avoids the fight, reasserts and
+  reports it to the page.
+- The status file carries `now`, `interval`, `enabled`, `no_sensor`,
+  `fan_percent`, `fan_foreign` and `cpu_src`, which lets the page tell running,
+  paused and stopped apart instead of showing a stale snapshot as current.
+- `tests/run-integration.sh`, exercising reset, the reboot restore, a garbled
+  state file and the collectd filter through the real scripts.
+
+### Changed
+
+- **Notifications go out over HTTP.** `notify_url` is posted to with `curl`
+  where present and `uclient-fetch` otherwise; `notify_header` carries an
+  authorisation token where `curl` is installed. Both go through a config file
+  rather than the command line, because `/proc/*/cmdline` is readable by every
+  local process, and both are rejected if they contain anything that could
+  turn that config file into further directives.
+- **Custom code lives in `/etc/thermal-guard/hooks/`** as executables, not in
+  UCI as strings. The rpcd ACL grants write access to every option in this
+  configuration, so a shell command stored there was a way for anyone who
+  could reach the configuration page to run code as root. `sh -c` no longer
+  appears in the package at all.
+- Paths taken from UCI are checked against the subtree they belong to, in
+  `tg_cfg` and again at each use site, and the config view validates the same
+  prefixes.
+- `thermal-guard-collectd` passes status values through an integer filter
+  before building a `PUTVAL` line.
+- A cooling device that no thermal zone binds is usable; the zone is only
+  needed to take the device away from a governor. `cooling_device` is preferred
+  where available because `max_state` means maximum cooling whichever way the
+  device tree runs its `cooling-levels`, so that mode cannot get the polarity
+  wrong.
+- Reload is a no-op. `tg_cfg` runs every cycle, so a changed option is live
+  within one interval, and restarting would drop a stage action in flight.
+- The stage banner names the configured action instead of the default, so a
+  box with `stage1_action=wifi_off` no longer claims the modem was switched
+  off.
+- German catalogue regenerated: 124 entries, 34 of them new, 11 stale ones
+  removed.
+
+### Documented
+
+- **What this package is for.** It is a protection layer, not a fan controller,
+  and where a board already has one `fan_mode=none` is the normal setting
+  rather than a workaround. The built-in fan handling is for boards with
+  nothing else.
+- **Sharing the modem's AT port.** Overlapping AT queries return nothing
+  useful and neither side reports a fault. Deploying next to a fan controller
+  that queried the modem without a lock garbled that controller's reading,
+  collapsed its control temperature and left the fan at its minimum on a board
+  at 68 °C. The symptom was at the fan, the cause at the serial port.
+- **`fan_mode=pwm` is not a regulator**, now a warning in the deployment
+  runbook. Below the thresholds it writes nothing to the fan. Pausing the Banana
+  Pi's `fan-control` in favour of it left `pwm1` at a stale minimum while the
+  SoC climbed from 58 to 68 °C.
+- **Deployment runbook, gaps found on hardware.** Check for an installed
+  package (`apk info -e` / `opkg status`) and remove it through the package
+  manager before deleting files by hand; the Banana Pi carried 1.1.0 as apk
+  packages. The migration now lists the options this repository removed in
+  1.2.0 (`notify_command` and the other `*_command` options) with their
+  replacements, not only the BananaWRT variant's. `pwm_idle='255'` is set on
+  the Banana Pi, and the runbook separates what a missing value does:
+  `fan_percent` pinned at 100 % under `fan_mode=pwm`, empty under
+  `fan_mode=none`.
+- **Whether there is a kernel backstop at all.** Preferring `cooling_device`
+  used to be justified by the kernel continuing to regulate while the guard is
+  idle. That only holds where a thermal zone actually binds the cooling device,
+  which several boards do not do, and the README now says how to check.
+
+### Removed
+
+- `notify_command`, `stage1_command`, `stage2_command`, `modem_temp_command`
+  and `fan_release_command`. The first is replaced by `notify_url`, the next
+  three by hooks of the same name, and the last by recording what the pwm chip
+  was set to before the takeover and writing it back on release.
+
+## 1.1.0
+
+- Configuration page under System, clear button on the status page
+- Other board temperature sensors reported alongside SoC and modem
+- Fan mode no longer reset to `auto` on every cycle
+
+## 1.0.0
+
+- Staged overheating protection: force the fan, modem radio off, Wi-Fi off
+- Status page, overview block and collectd feed
diff --git a/openwrt-thermal-guard/LICENSE b/openwrt-thermal-guard/LICENSE
new file mode 100644
index 000000000..9efa6fbc9
--- /dev/null
+++ b/openwrt-thermal-guard/LICENSE
@@ -0,0 +1,338 @@
+                    GNU GENERAL PUBLIC LICENSE
+                       Version 2, June 1991
+
+ Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
+ 
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The licenses for most software are designed to take away your
+freedom to share and change it.  By contrast, the GNU General Public
+License is intended to guarantee your freedom to share and change free
+software--to make sure the software is free for all its users.  This
+General Public License applies to most of the Free Software
+Foundation's software and to any other program whose authors commit to
+using it.  (Some other Free Software Foundation software is covered by
+the GNU Lesser General Public License instead.)  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+this service if you wish), that you receive source code or can get it
+if you want it, that you can change the software or use pieces of it
+in new free programs; and that you know you can do these things.
+
+  To protect your rights, we need to make restrictions that forbid
+anyone to deny you these rights or to ask you to surrender the rights.
+These restrictions translate to certain responsibilities for you if you
+distribute copies of the software, or if you modify it.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must give the recipients all the rights that
+you have.  You must make sure that they, too, receive or can get the
+source code.  And you must show them these terms so they know their
+rights.
+
+  We protect your rights with two steps: (1) copyright the software, and
+(2) offer you this license which gives you legal permission to copy,
+distribute and/or modify the software.
+
+  Also, for each author's protection and ours, we want to make certain
+that everyone understands that there is no warranty for this free
+software.  If the software is modified by someone else and passed on, we
+want its recipients to know that what they have is not the original, so
+that any problems introduced by others will not reflect on the original
+authors' reputations.
+
+  Finally, any free program is threatened constantly by software
+patents.  We wish to avoid the danger that redistributors of a free
+program will individually obtain patent licenses, in effect making the
+program proprietary.  To prevent this, we have made it clear that any
+patent must be licensed for everyone's free use or not licensed at all.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                    GNU GENERAL PUBLIC LICENSE
+   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+  0. This License applies to any program or other work which contains
+a notice placed by the copyright holder saying it may be distributed
+under the terms of this General Public License.  The "Program", below,
+refers to any such program or work, and a "work based on the Program"
+means either the Program or any derivative work under copyright law:
+that is to say, a work containing the Program or a portion of it,
+either verbatim or with modifications and/or translated into another
+language.  (Hereinafter, translation is included without limitation in
+the term "modification".)  Each licensee is addressed as "you".
+
+Activities other than copying, distribution and modification are not
+covered by this License; they are outside its scope.  The act of
+running the Program is not restricted, and the output from the Program
+is covered only if its contents constitute a work based on the
+Program (independent of having been made by running the Program).
+Whether that is true depends on what the Program does.
+
+  1. You may copy and distribute verbatim copies of the Program's
+source code as you receive it, in any medium, provided that you
+conspicuously and appropriately publish on each copy an appropriate
+copyright notice and disclaimer of warranty; keep intact all the
+notices that refer to this License and to the absence of any warranty;
+and give any other recipients of the Program a copy of this License
+along with the Program.
+
+You may charge a fee for the physical act of transferring a copy, and
+you may at your option offer warranty protection in exchange for a fee.
+
+  2. You may modify your copy or copies of the Program or any portion
+of it, thus forming a work based on the Program, and copy and
+distribute such modifications or work under the terms of Section 1
+above, provided that you also meet all of these conditions:
+
+    a) You must cause the modified files to carry prominent notices
+    stating that you changed the files and the date of any change.
+
+    b) You must cause any work that you distribute or publish, that in
+    whole or in part contains or is derived from the Program or any
+    part thereof, to be licensed as a whole at no charge to all third
+    parties under the terms of this License.
+
+    c) If the modified program normally reads commands interactively
+    when run, you must cause it, when started running for such
+    interactive use in the most ordinary way, to print or display an
+    announcement including an appropriate copyright notice and a
+    notice that there is no warranty (or else, saying that you provide
+    a warranty) and that users may redistribute the program under
+    these conditions, and telling the user how to view a copy of this
+    License.  (Exception: if the Program itself is interactive but
+    does not normally print such an announcement, your work based on
+    the Program is not required to print an announcement.)
+
+These requirements apply to the modified work as a whole.  If
+identifiable sections of that work are not derived from the Program,
+and can be reasonably considered independent and separate works in
+themselves, then this License, and its terms, do not apply to those
+sections when you distribute them as separate works.  But when you
+distribute the same sections as part of a whole which is a work based
+on the Program, the distribution of the whole must be on the terms of
+this License, whose permissions for other licensees extend to the
+entire whole, and thus to each and every part regardless of who wrote it.
+
+Thus, it is not the intent of this section to claim rights or contest
+your rights to work written entirely by you; rather, the intent is to
+exercise the right to control the distribution of derivative or
+collective works based on the Program.
+
+In addition, mere aggregation of another work not based on the Program
+with the Program (or with a work based on the Program) on a volume of
+a storage or distribution medium does not bring the other work under
+the scope of this License.
+
+  3. You may copy and distribute the Program (or a work based on it,
+under Section 2) in object code or executable form under the terms of
+Sections 1 and 2 above provided that you also do one of the following:
+
+    a) Accompany it with the complete corresponding machine-readable
+    source code, which must be distributed under the terms of Sections
+    1 and 2 above on a medium customarily used for software interchange; or,
+
+    b) Accompany it with a written offer, valid for at least three
+    years, to give any third party, for a charge no more than your
+    cost of physically performing source distribution, a complete
+    machine-readable copy of the corresponding source code, to be
+    distributed under the terms of Sections 1 and 2 above on a medium
+    customarily used for software interchange; or,
+
+    c) Accompany it with the information you received as to the offer
+    to distribute corresponding source code.  (This alternative is
+    allowed only for noncommercial distribution and only if you
+    received the program in object code or executable form with such
+    an offer, in accord with Subsection b above.)
+
+The source code for a work means the preferred form of the work for
+making modifications to it.  For an executable work, complete source
+code means all the source code for all modules it contains, plus any
+associated interface definition files, plus the scripts used to
+control compilation and installation of the executable.  However, as a
+special exception, the source code distributed need not include
+anything that is normally distributed (in either source or binary
+form) with the major components (compiler, kernel, and so on) of the
+operating system on which the executable runs, unless that component
+itself accompanies the executable.
+
+If distribution of executable or object code is made by offering
+access to copy from a designated place, then offering equivalent
+access to copy the source code from the same place counts as
+distribution of the source code, even though third parties are not
+compelled to copy the source along with the object code.
+
+  4. You may not copy, modify, sublicense, or distribute the Program
+except as expressly provided under this License.  Any attempt
+otherwise to copy, modify, sublicense or distribute the Program is
+void, and will automatically terminate your rights under this License.
+However, parties who have received copies, or rights, from you under
+this License will not have their licenses terminated so long as such
+parties remain in full compliance.
+
+  5. You are not required to accept this License, since you have not
+signed it.  However, nothing else grants you permission to modify or
+distribute the Program or its derivative works.  These actions are
+prohibited by law if you do not accept this License.  Therefore, by
+modifying or distributing the Program (or any work based on the
+Program), you indicate your acceptance of this License to do so, and
+all its terms and conditions for copying, distributing or modifying
+the Program or works based on it.
+
+  6. Each time you redistribute the Program (or any work based on the
+Program), the recipient automatically receives a license from the
+original licensor to copy, distribute or modify the Program subject to
+these terms and conditions.  You may not impose any further
+restrictions on the recipients' exercise of the rights granted herein.
+You are not responsible for enforcing compliance by third parties to
+this License.
+
+  7. If, as a consequence of a court judgment or allegation of patent
+infringement or for any other reason (not limited to patent issues),
+conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot
+distribute so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you
+may not distribute the Program at all.  For example, if a patent
+license would not permit royalty-free redistribution of the Program by
+all those who receive copies directly or indirectly through you, then
+the only way you could satisfy both it and this License would be to
+refrain entirely from distribution of the Program.
+
+If any portion of this section is held invalid or unenforceable under
+any particular circumstance, the balance of the section is intended to
+apply and the section as a whole is intended to apply in other
+circumstances.
+
+It is not the purpose of this section to induce you to infringe any
+patents or other property right claims or to contest validity of any
+such claims; this section has the sole purpose of protecting the
+integrity of the free software distribution system, which is
+implemented by public license practices.  Many people have made
+generous contributions to the wide range of software distributed
+through that system in reliance on consistent application of that
+system; it is up to the author/donor to decide if he or she is willing
+to distribute software through any other system and a licensee cannot
+impose that choice.
+
+This section is intended to make thoroughly clear what is believed to
+be a consequence of the rest of this License.
+
+  8. If the distribution and/or use of the Program is restricted in
+certain countries either by patents or by copyrighted interfaces, the
+original copyright holder who places the Program under this License
+may add an explicit geographical distribution limitation excluding
+those countries, so that distribution is permitted only in or among
+countries not thus excluded.  In such case, this License incorporates
+the limitation as if written in the body of this License.
+
+  9. The Free Software Foundation may publish revised and/or new versions
+of the General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+Each version is given a distinguishing version number.  If the Program
+specifies a version number of this License which applies to it and "any
+later version", you have the option of following the terms and conditions
+either of that version or of any later version published by the Free
+Software Foundation.  If the Program does not specify a version number of
+this License, you may choose any version ever published by the Free Software
+Foundation.
+
+  10. If you wish to incorporate parts of the Program into other free
+programs whose distribution conditions are different, write to the author
+to ask for permission.  For software which is copyrighted by the Free
+Software Foundation, write to the Free Software Foundation; we sometimes
+make exceptions for this.  Our decision will be guided by the two goals
+of preserving the free status of all derivatives of our free software and
+of promoting the sharing and reuse of software generally.
+
+                            NO WARRANTY
+
+  11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
+FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
+OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
+PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
+OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
+TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
+PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
+REPAIR OR CORRECTION.
+
+  12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
+REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
+INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
+OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
+TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
+YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
+PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGES.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+convey the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    
+    Copyright (C)   
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License along
+    with this program; if not, see .
+
+Also add information on how to contact you by electronic and paper mail.
+
+If the program is interactive, make it output a short notice like this
+when it starts in an interactive mode:
+
+    Gnomovision version 69, Copyright (C) year name of author
+    Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, the commands you use may
+be called something other than `show w' and `show c'; they could even be
+mouse-clicks or menu items--whatever suits your program.
+
+You should also get your employer (if you work as a programmer) or your
+school, if any, to sign a "copyright disclaimer" for the program, if
+necessary.  Here is a sample; alter the names:
+
+  Yoyodyne, Inc., hereby disclaims all copyright interest in the program
+  `Gnomovision' (which makes passes at compilers) written by James Hacker.
+
+  , 1 April 1989
+  Moe Ghoul, President of Vice
+
+This General Public License does not permit incorporating your program into
+proprietary programs.  If your program is a subroutine library, you may
+consider it more useful to permit linking proprietary applications with the
+library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.
diff --git a/openwrt-thermal-guard/README.md b/openwrt-thermal-guard/README.md
new file mode 100644
index 000000000..fbcb2a81c
--- /dev/null
+++ b/openwrt-thermal-guard/README.md
@@ -0,0 +1,458 @@
+# thermal-guard
+
+Overheating protection for OpenWrt routers with staged mitigation.
+
+![Status page on a Banana Pi R3 Mini](screenshots/status-bpi-r3-mini.png)
+
+## Why this exists
+
+The idea for this project came after a fan malfunction on my Banana Pi R3 Mini
+damaged its Fibocom FM350-GL 5G module beyond repair. An inexpensive part
+failed and took a much pricier one with it. Since one of my BPI R3 Minis runs
+in a motorhome, I did not want to go through that again and set out to build
+something that prevents it. This package is the result.
+
+A better fan controller would not have helped: the one on the board was
+convinced it had the fan at full speed. What was missing was something that
+ignores what the fan is supposed to be doing and only looks at the temperature.
+
+**This is not a fan controller.** OpenWrt has several of those and they do the
+job better: they map temperature onto a curve and keep the box in its normal
+band. This one does nothing at all until a threshold is crossed, and then does
+something drastic that does not undo itself. Thermostat and thermal fuse, two
+layers rather than two opinions.
+
+So where a fan controller is already installed, leave it in charge: `fan_mode`
+is `none` by default, and that is the regular configuration for such a board,
+not a workaround. The built-in fan handling exists for boards that have nothing else,
+and "force it to maximum" is a poor substitute for a curve. What this package
+adds is the layer above: the one that assumes the controller can fail, or can
+be wrong, and acts on the temperature rather than on what the fan reports.
+
+A fan that stops is rarely noticed until something dies. `thermal-guard` watches
+SoC and modem temperature and, when the box runs hot, escalates in three stages:
+
+| Stage | Default action | Triggered by |
+|---|---|---|
+| 1 of 3 | Warning; fan forced to full speed where `fan_mode` lets the daemon drive it | `cpu_warn` or `modem_warn` reached |
+| 2 of 3 | Modem radio off (`AT+CFUN=4`) | `cpu_crit`/`modem_crit`, or stage 1 held for `hold_minutes` without any drop |
+| 3 of 3 | Wi-Fi off | `cpu_emergency`, or stage 2 held for `hold_minutes` while still climbing |
+
+The web interface counts stages from one, the daemon and the status file count
+them from zero, so stage 1 of 3 is `stage=0` in `thermal-guard status`. What
+stages 2 and 3 do is configurable; the table shows the defaults. Each built in
+action is read back rather than assumed: the modem is asked for its state
+(`AT+CFUN?`), `interface_down` waits for netifd to report the interface down,
+`wifi_off` waits for netifd to report no enabled radio up. An action that does not
+confirm counts as failed, and the failure is notified. A `command` hook counts
+by its exit code.
+
+Three design decisions worth knowing before you deploy it:
+
+* **Stages never roll back on their own.** Cooling down is reported once, the
+  stage stays. A fan that failed once will fail again, and a silent recovery
+  hides the fault. Clearing is an operator decision: `thermal-guard reset`.
+* **A reboot does not clear them either.** A stage change is mirrored to
+  `/etc/thermal-guard/state`, and the daemon reapplies it at startup. The box
+  did not get a new fan while it was down, so coming back up with the modem
+  enabled would just repeat the incident. The restore is logged and notified.
+* **A crash leaves the fan running.** The daemon only hands the fan back on an
+  explicit reset, so dying mid-incident is the safe direction.
+
+If a restored stage ever locks you out, reach the box over a wired port or
+serial and run `thermal-guard reset`. Only a device that reached a stage whose
+action is `wifi_off` or `interface_down` (stage 3 of 3 with the defaults) comes
+back from a reboot with that connection still off, and such a device has a fan
+and a modem, so it has wired ports too.
+
+Every transition needs two consecutive readings above the threshold, which keeps
+sensor glitches from triggering anything. A missing reading never blocks an
+escalation: at a threshold it simply does not count, on the hold path it counts
+as no drop, so it never delays stage 2 of 3, and a reference missing at stage
+entry is taken from the first reading after the gap.
+
+Escalating from stage 1 of 3 on time alone, when the temperature has not dropped, is
+the part that earns its keep. The guard never asks whether the fan turned; it
+asks whether the box got cooler. That covers a fan that failed, a fan cable
+that came off, and the case that prompted this package: a fan controller whose
+pwm polarity was configured the wrong way round, which stopped the fan while
+reporting that it had gone to full speed. No software can tell those apart on
+a board without a tachometer, and none of them have to be told apart, because
+the answer is the same. Set `hold_minutes` with that in mind: it is how long a
+stage is given to prove it worked before the next one starts.
+
+## Screenshots
+
+The status page on two boards: a Banana Pi R3 Mini with a Fibocom modem, an NVMe
+drive and the MediaTek vendor Wi-Fi driver, where another program drives the fan,
+and a GL-iNet GL-X3000 with a Quectel modem, where the kernel does. Wi-Fi 1 and 2
+come from `iwpriv` on the one and from hwmon on the other.
+
+
+  
+    
+    
+  
+
Status page, Banana Pi R3 MiniStatus page, GL-X3000

+
+The same readings in a block on the LuCI overview page:
+
+
+  
+    
+    
+  
+
Overview block, Banana Pi R3 MiniOverview block, GL-X3000

+
+

+Configuration page, System → Thermal Guard
+
+General
+
+![General tab](screenshots/settings-general.png)
+
+Thresholds for the three stages
+
+![Thresholds tab](screenshots/settings-thresholds.png)
+
+Fan, including the switching temperatures of a kernel-driven fan
+
+![Fan tab](screenshots/settings-fan.png)
+
+Modem, Fibocom on the Banana Pi and Quectel on the GL-X3000
+
+![Modem tab, Fibocom](screenshots/settings-modem-fibocom.png)
+![Modem tab, Quectel](screenshots/settings-modem-quectel.png)
+
+Actions and notifications
+
+![Actions tab](screenshots/settings-actions.png)
+
+

+
+## Install
+
+```sh
+opkg install thermal-guard luci-app-thermal-guard   # or: apk add ...
+/etc/init.d/thermal-guard enable
+/etc/init.d/thermal-guard start
+```
+
+Two LuCI pages: **Status → Thermal Guard** shows the temperatures, the fan and
+the current stage, and clears the stages; **System → Thermal Guard** edits the
+configuration. A changed option is picked up within one interval, and a
+deleted one is back at its default by then, so Apply needs no restart.
+
+The package depends on `coreutils-timeout`: every AT query runs under a time
+limit, so a hung modem costs one reading instead of the whole loop. It also
+depends on `jsonfilter` to read netifd's answers; `base-files` ships it on every
+image anyway. Optional runtime helpers, none of them a hard dependency:
+`sms_tool` for the modem AT commands, `flock` for the AT lock, `ip` for the
+uplink check, and `curl` for notification headers. Without `flock` the AT
+queries run without the lock; without `ip` the daemon cannot tell whether a
+route exists and sends every message at once instead of queueing it. Each is
+logged once as a warning.
+
+## Configuration
+
+`/etc/config/thermal-guard`, section `main`. Defaults leave the fan alone and
+read a Quectel or Fibocom modem; driving the fan is an explicit choice.
+
+| Option | Default | Meaning |
+|---|---|---|
+| `enabled` | `1` | Pauses the checks when `0`; stages and the fan stay until a reset |
+| `interval` | `20` | Seconds between readings, minimum 5 |
+| `cpu_warn` / `cpu_crit` / `cpu_emergency` | `70` / `80` / `90` | SoC thresholds in °C, must be ordered |
+| `modem_warn` / `modem_crit` | `80` / `88` | Modem thresholds in °C |
+| `hold_minutes` | `3` | How long a stage must persist before time alone escalates |
+| `hysteresis` | `10` | Degrees below the warn thresholds that count as cooled down |
+| `extra_sensors` | `1` | `0` hides the board's other sensors (Wi-Fi, ethernet phys, NVMe) from the status page |
+| `cpu_temp_path` | `/sys/class/thermal/thermal_zone0/temp` | Sysfs source under `/sys/class/thermal/` or `/sys/class/hwmon/`, degrees or millidegrees. A sensor is looked for when this does not read |
+| `fan_mode` | `none` | `cooling_device`, `pwm`, `auto`. `auto` takes the cooling device if there is one, otherwise it stays `none`; it never picks `pwm` |
+| `fan_cooling_device_type` | `pwm-fan` | Type string used to find the cooling device |
+| `fan_governor` | `step_wise` | Governor the zone is handed back to on reset when no earlier one was saved: `step_wise`, `fair_share`, `bang_bang` or `power_allocator`. Anything else, `user_space` included, means `step_wise`, and so does a governor the kernel was built without |
+| `pwm_path`, `pwm_enable_path` | unset | `pwm` mode only; found by hwmon name when left empty |
+| `pwm_full`, `pwm_idle` | unset | Raw values for fastest and slowest, both required for `pwm`. Without both the fan is left alone |
+| `modem_source` | `auto` | `quectel`, `fibocom`, `file`, `command`, `none` |
+| `modem_at_port` | `auto` | Serial port for AT commands |
+| `modem_temp_file` | unset | Source for `file` mode; `command` mode reads the `modem-temp` hook |
+| `at_lock` | `/var/lock/modem-at.lock` | Shared lock. Every other AT user on this port has to take the same one, see below |
+| `trip_boost` | `off` | `modem` lowers the fan's trip points while the modem runs hotter than the CPU, see below |
+| `trip_boost_offset` | `15` | Degrees the modem may run above the CPU before the trips go down, 0 to 40 |
+| `trip_active` | unset | List, baseline of the fan's active trips in °C, ascending, one per trip. Unset means the device tree values |
+| `stage1_action` / `stage2_action` | `modem_radio_off` / `wifi_off` | Also `interface_down`, `command`, which runs a hook, or `none` |
+| `modem_radio_off_at` | `AT+CFUN=4` | Or `AT+CFUN=0` for a modem without flight mode. Nothing else is accepted |
+| `action_interface` | unset | Interface `interface_down` takes down; `uplink_interface` when unset |
+| `notify_url` | unset | The warning text is posted here |
+| `notify_header` | unset | Extra header for the post, needs `curl` |
+| `uplink_interface` | unset | Modem interface name, lets the daemon tell whether another uplink exists |
+
+### Fan modes
+
+`cooling_device` sets the cooling device to its maximum step, taking the thermal
+zone off its governor first if one drives it. Prefer this mode wherever the
+board offers it: `max_state` means maximum cooling whichever way the device tree
+runs its `cooling-levels`, so this mode cannot get the polarity wrong.
+
+On reset the zone gets back the governor it had before, or `fan_governor` when
+none was recorded. A governor the running kernel does not list in the zone's
+`available_policies` is replaced by `step_wise`. The policy is read back
+afterwards: a zone that still reports another one is logged as `crit`, since
+then nothing regulates the fan.
+
+A cooling device that no thermal zone binds still works, there is simply nothing
+to take over and nothing to hand back. Whether one is bound is worth knowing,
+because it decides whether there is a kernel backstop underneath at all:
+
+```sh
+ls /sys/class/thermal/thermal_zone*/cdev* 2>/dev/null || echo "no zone drives any cooling device"
+```
+
+Where nothing is printed, the device tree defines no `cooling-maps`, the zone's
+trip points fire into nothing, and the only regulation on the board is whatever
+runs in userspace. That is worth fixing in the device tree, because it is the
+difference between a fan controller that can fail safely and one whose failure
+nobody catches until this package escalates.
+
+`pwm` writes the duty cycle to sysfs directly. Use it on boards where the fan is
+not wired into a thermal zone. Before taking the chip over, the daemon records
+its mode and duty cycle. Reset writes the mode back, and the duty cycle where
+the chip was in manual mode; in automatic mode the chip sets it itself. Nothing
+has to be configured for the way out. Leaving `pwm_path` empty is fine: the fan chip is
+looked up by its hwmon name, which survives the renumbering that happens when
+another sensor appears.
+
+Polarity is not something the daemon can work out, and getting it wrong stops
+the fan in an emergency instead of speeding it up. Several boards, the Banana Pi
+R3 Mini among them, run the signal inverted: `1` is full speed and `255` stops
+the fan. So there is no default: `pwm` needs both `pwm_full` and `pwm_idle`, and
+with either missing the daemon logs it once and leaves the fan alone. For the
+same reason `auto` never resolves to `pwm`. Confirm the values by ear rather
+than by reading the number.
+
+If another service already controls the fan, keep `fan_mode` at `none`. Stage
+1 of 3 is then a warning only. Setting a fan mode anyway works: the daemon notices when a value it wrote has been replaced, says so in the log and
+reasserts, but two controllers writing one file is worth avoiding, and the
+other one almost certainly has the better curve. Nothing is lost: the stage
+that forces the fan is the one a working controller has already covered, and
+the stages that matter come after it.
+
+### Trip management
+
+Where the kernel drives the fan through a thermal zone, it only compares the
+CPU against the zone's trip points; a modem running hotter than the CPU does not
+reach it. With `trip_boost 'modem'` the daemon lowers the zone's active trips by
+
+```
+delta = (modem - trip_boost_offset) - cpu, 0 if negative,
+        rounded up to 5 K, at most 40 K
+```
+
+which is the same as regulating on `max(cpu, modem - offset)`, but leaves the
+regulator in the kernel. The zone is the one whose `cdevN` points at the fan's
+cooling device, the trips are the `active` ones bound to it, whatever their
+numbers are. `hot` and `critical` are never written.
+
+The trips only ever go below the baseline, never above it. A wrong modem reading
+can therefore only make the fan louder, not slower. A missing reading keeps the
+trips where they are, raising them again takes three cool readings in a row, and
+not at all while a stage is in force. Stopping the daemon leaves them as they
+are; setting `trip_boost 'off'` with `trip_active` unset hands the zone its
+device tree values back once and leaves it alone from then on.
+
+Nothing is written unless `trip_boost` or `trip_active` is set, so a board whose
+fan the kernel already drives keeps its trips as they are.
+
+A new firmware image can bring other trips in its device tree. The first cycle
+with `trip_active` set records the device tree values of that boot in
+`/etc/thermal-guard/trip_base`, which survives a sysupgrade. When a later boot
+finds other values, the log says so, the status file carries
+`trip_dt_changed=1`, and **System → Thermal Guard** offers to use the new values
+or to keep your own. `trip_active` stays in force until you decide. Both
+choices run `thermal-guard trips-keep`, which records the values of the running
+boot. Without `trip_active` the file is neither read nor written.
+
+### Sharing the modem with another program
+
+A modem answers two overlapping AT conversations with nothing useful, and the
+program that gets the nothing rarely says so. This daemon takes `at_lock` around
+every query. **Anything else on the box that talks to the same port has to take
+the same lock**, or both readings become unreliable. ModemManager cannot, see
+the known limitations below.
+
+That is not a theoretical concern. On a Banana Pi R3 Mini this package was
+installed next to a fan controller that queried the modem without a lock. The
+collisions garbled the controller's modem reading, its control temperature
+collapsed, and it set the fan to its minimum while the board sat at 68 °C.
+Nothing in either program reported a fault: the fan controller believed it was
+regulating correctly, and this daemon believed the fan was somebody else's
+business. The symptom appeared at the fan, the cause was at the serial port.
+
+If the other program cannot be changed, give it the modem and set
+`modem_source` to `none` here, but understand the cost. A modem die runs
+appreciably hotter than the SoC, commonly by 10 to 20 K, so protecting it
+through the processor thresholds alone means acting late for the part that is
+actually at risk. Prefer fixing the lock.
+
+Programs that only need the temperature do not have to ask the modem at all.
+After every good reading the daemon writes one line to
+`/var/run/thermal-guard/modem-temp`:
+
+```
+47 1790150400 at
+```
+
+degrees, Unix time of the reading, source (`at`, `file` or `command`). The file
+is replaced atomically and not touched when a reading fails, so a reader that
+finds it older than three intervals should treat the value as unknown.
+
+### Notifications
+
+Set `notify_url` and the message is posted there as the request body. That
+covers ntfy, Gotify, Matrix, Slack and most other things you would want to be
+woken by, and it needs no shell command in the configuration to do it.
+
+```
+option notify_url 'https://ntfy.sh/my-topic'
+```
+
+`curl` is used when it is installed, otherwise `uclient-fetch` from the OpenWrt
+base, or `wget`. Only `curl` can send `notify_header`, and only `curl` reads the
+address and the header from a file (mode 600) instead of the command line, where
+`/proc` shows them to every local process.
+
+Without `curl` the daemon therefore refuses an address that carries a query
+string or user info (`?token=...`, `user:pass@host`). It logs the reason once
+and sends nothing over HTTP; the notify hook below still works. A secret in the
+path of the address, as in Slack or Discord webhooks or a private ntfy topic,
+cannot be told apart from an ordinary path and is sent as it is. Without `curl`
+it is visible in the process list while the message goes out. Install `curl`
+for such services.
+
+For a delivery HTTP cannot express, put an executable at
+`/etc/thermal-guard/hooks/notify`; it gets the text on stdin. With both set,
+the URL is tried first and the hook is the fallback.
+
+From stage 2 of 3 on the daemon checks whether a route exists that does not run
+through the modem; if not, the message is queued and retried, because that
+stage is about to switch the modem off.
+
+### Hooks
+
+`/etc/thermal-guard/hooks/` holds executables the daemon runs for `notify`,
+for `stage1` and `stage2` when the action is `command`, and for `modem-temp`
+when `modem_source` is `command`. See the `README` installed in that directory.
+The whole of `/etc/thermal-guard/` is listed in `/lib/upgrade/keep.d/`, so
+hooks and any files they need, persisted stages and `trip_base` survive a
+`sysupgrade`.
+
+Every hook runs under a time limit: 15 s for `notify`, `stage1` and `stage2`,
+5 s for `modem-temp`, which runs every cycle. A hook still running then gets
+TERM, and KILL 5 s later, and counts as failed.
+
+They are files rather than options because the rpcd ACL that lets the web
+interface edit this configuration does not grant write or execute access to
+that directory. Custom code therefore has to be put there by someone with
+shell access, and editing the configuration cannot introduce any.
+
+## Commands
+
+```sh
+thermal-guard status            # current stage, readings, fan state
+thermal-guard reset             # clear all stages, hand the fan back, radio on
+thermal-guard trips-keep        # record this boot's device tree trips in trip_base
+thermal-guard test 85 70        # two cycles with these readings, print what they would trigger, change nothing
+thermal-guard selftest          # run the decision logic against its test cases
+```
+
+`test` runs its two cycles at the same moment, because every stage needs two
+readings in a row. The hold time does not pass in between: from an idle state,
+stage 3 of 3 shows only through `cpu_emergency`, and the escalation over time
+cannot be tried this way. `test 75 66` staying at stage 1 of 3 says nothing
+about it. On a box already in a stage, its hold timers apply.
+
+`/var/run/thermal-guard.status` holds a machine readable snapshot. Everything
+else reads that file, so only the daemon talks to the modem, and `thermal-guard
+reset`, which switches the radio back on under `at_lock`.
+
+## Where the readings show up
+
+* **Status -> Thermal Guard** is the monitor page: temperatures, fan state, stage.
+* **Status -> Overview** gets a short temperature block, installed with the LuCI app.
+* **Syslog**, tag `thermal-guard`, facility `daemon`: `crit` for a stage, a
+  restored stage, a stage that cannot be persisted and every stage action that
+  failed, the way back after a reset included; `warning` for a rejected option,
+  a missing tool, a sensor that does not read and trips that could not be
+  written; `notice` for cooled down, reset, `trips-keep` and new firmware trips
+  that need a decision; `info` for the rest. `logread -e thermal-guard` shows
+  them all, a remote syslog can filter on the priority. The event log in
+  `/var/run/thermal-guard/log` keeps the same lines without it.
+* **Other sensors** of the board (`extra_sensors`, on by default): every hwmon and
+  thermal zone temperature besides the processor, such as Wi-Fi chips, ethernet
+  phys and NVMe drives. The proprietary MediaTek Wi-Fi driver `mt_wifi` exposes
+  none of those; its radios are read with `iwpriv  stat` instead, the
+  way ImmortalWrt's own overview does it, and only while the interface is up.
+  These readings are shown only, they never trigger a stage.
+* **RRD graphs** through collectd. The package ships an exec plugin feed, enable it
+  in `/etc/collectd.conf`:
+
+  ```
+  LoadPlugin exec
+  
+      Exec "nobody:nogroup" "/usr/libexec/thermal-guard-collectd"
+  
+  ```
+
+  Needs `collectd-mod-exec` and `collectd-mod-rrdtool`. It emits
+  `temperature-soc`, `temperature-modem`, `gauge-fan_step` and `gauge-stage`
+  under the plugin name `thermal_guard`.
+
+## Hardware
+
+Developed against two boards, which is where the two fan modes come from:
+
+| Board | Fan | Modem |
+|---|---|---|
+| GL.iNet GL-X3000 (MT7981) | kernel thermal zone, `cooling_device` | Quectel RM520N-GL |
+| Banana Pi R3 Mini (MT7986) | sysfs PWM, `pwm` | Fibocom FM350-GL |
+
+Nothing in the package is board specific, any OpenWrt device with a readable
+thermal zone should work.
+
+## Known limitations
+
+**ModemManager does not know `at_lock`.** It keeps the modem's AT ports open
+and sends its own commands without taking the lock this daemon uses. The daemon
+cannot detect that. Where ModemManager manages the modem, read the temperature
+another way (`modem_source` `file` or `command`) or set it to `none`; the
+section on sharing the modem says what `none` costs.
+
+**Without `curl`, notifications are limited.** `uclient-fetch` and `wget` cannot
+send `notify_header`. The message goes out without it, a webhook that needs it
+refuses the message, and it stays in the outbox, retried every two minutes.
+Both tools also take the address on their command line, where `/proc` shows it
+to every local process while the message goes out. An address with a query
+string or user info is refused for that reason and logged once; a secret in the
+path of the address cannot be told apart and is sent as it is.
+
+**A board that reports no temperature gets no processor protection.** When
+neither a thermal zone nor a hwmon sensor can be read, the daemon logs `this
+device reports no temperature at all, nothing to watch here` once and the
+status page says so. No stage can start from the processor side. The modem
+thresholds still apply as long as the modem gives a reading.
+
+**`wifi_off` sees only what netifd manages.** The action runs `wifi down` and
+confirms it through `ubus call network.wireless status`. Radios that netifd
+does not manage are neither switched by `wifi` nor seen by the check. When
+netifd lists no radio, the action fails and is notified, and the daemon warns
+once when it loads a configuration that uses `wifi_off`. When netifd does not
+answer, the action fails as well.
+
+**Two cooling devices of the same type cannot be told apart.** The daemon
+takes the first one of `fan_cooling_device_type` whose `max_state` is above 0.
+If your board has such a setup, please report it.
+
+## License
+
+GPL-2.0-only. The escalation logic started out as a device specific script for
+the two boards above and was generalised for this package.
diff --git a/openwrt-thermal-guard/luci-app-thermal-guard/Makefile b/openwrt-thermal-guard/luci-app-thermal-guard/Makefile
new file mode 100644
index 000000000..1d304247a
--- /dev/null
+++ b/openwrt-thermal-guard/luci-app-thermal-guard/Makefile
@@ -0,0 +1,26 @@
+#
+# Copyright (C) 2026 SyntaxError NullPointer
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_VERSION:=2.0.0
+PKG_RELEASE:=1
+
+PKG_LICENSE:=GPL-2.0-only
+PKG_MAINTAINER:=SyntaxError NullPointer <287466119+SyntaxError-NullPointer@users.noreply.github.com>
+
+LUCI_TITLE:=LuCI support for thermal-guard
+LUCI_DESCRIPTION:=Monitor and configuration pages for thermal-guard: temperatures, fan, protection stages and thresholds.
+LUCI_DEPENDS:=+luci-base +thermal-guard
+LUCI_PKGARCH:=all
+
+include $(TOPDIR)/feeds/luci/luci.mk
+
+# No own postinst: luci.mk's default drops the menu caches and reloads rpcd,
+# without which the new ACL is not loaded and the pages are refused.
+
+# call BuildPackage - OpenWrt buildroot signature
diff --git a/openwrt-thermal-guard/luci-app-thermal-guard/htdocs/luci-static/resources/view/status/include/11_thermal-guard.js b/openwrt-thermal-guard/luci-app-thermal-guard/htdocs/luci-static/resources/view/status/include/11_thermal-guard.js
new file mode 100644
index 000000000..a5818f86b
--- /dev/null
+++ b/openwrt-thermal-guard/luci-app-thermal-guard/htdocs/luci-static/resources/view/status/include/11_thermal-guard.js
@@ -0,0 +1,113 @@
+// SPDX-License-Identifier: GPL-2.0-only
+// Adds a temperature row to Status -> Overview. Reads the status file the daemon
+// writes, so the overview never talks to the modem itself.
+'use strict';
+'require baseclass';
+'require fs';
+
+var STATUS_FILE = '/var/run/thermal-guard.status';
+
+function parseStatus(text) {
+	var st = {};
+	(text || '').split('\n').forEach(function(line) {
+		var i = line.indexOf('=');
+		if (i > 0)
+			st[line.substring(0, i)] = line.substring(i + 1).trim();
+	});
+	return st;
+}
+
+function num(v) {
+	var n = parseInt(v, 10);
+	return isNaN(n) ? null : n;
+}
+
+// Sensor names come straight from the kernel. Translate the ones people actually
+// recognise, leave the rest as reported rather than guessing.
+function sensorLabel(name) {
+	var m = name.match(/^(?:mt79\d\d|mtwifi)_phy(\d)/);
+	if (m)
+		return _('Wi-Fi %d').format(parseInt(m[1], 10) + 1);
+	if (name.indexOf('mdio_bus') === 0 || name.indexOf('phy') === 0)
+		return _('Ethernet');
+	if (name === 'nvme')
+		return _('SSD');
+	return name;
+}
+
+function extraSensors(st) {
+	var out = [];
+	for (var k in st) {
+		if (k.indexOf('sensor.') === 0 && st[k] !== '')
+			out.push([ sensorLabel(k.substring(7)), parseInt(st[k], 10) ]);
+	}
+	return out.sort(function(a, b) { return a[0] > b[0] ? 1 : -1; });
+}
+
+function temp(value, warn, crit) {
+	if (value === null)
+		return E('em', {}, _('no reading'));
+
+	var colour = '';
+	if (crit !== null && value >= crit)
+		colour = 'color:#f44336;font-weight:bold';
+	else if (warn !== null && value >= warn)
+		colour = 'color:#ff9800;font-weight:bold';
+
+	return E('span', { 'style': colour }, '%d °C'.format(value));
+}
+
+return baseclass.extend({
+	title: _('Temperatures'),
+
+	load: function() {
+		return fs.read(STATUS_FILE).catch(function() { return null; });
+	},
+
+	render: function(text) {
+		if (text === null)
+			return null;
+
+		var st = parseStatus(text);
+		var stage = num(st.stage);
+		var rows = [
+			[ _('Processor'), temp(num(st.cpu_c), num(st.cpu_warn), num(st.cpu_crit)) ]
+		];
+
+		if (st.modem_src || st.modem_c)
+			rows.push([ _('Modem'), temp(num(st.modem_c), num(st.modem_warn), num(st.modem_crit)) ]);
+
+		extraSensors(st).forEach(function(s) {
+			rows.push([ s[0], temp(s[1], null, null) ]);
+		});
+
+		// fan_view is what can be read, even where fan_mode leaves the fan to
+		// another controller. Older status files only carry fan_mode.
+		var fanView = st.fan_view || st.fan_mode;
+		if (fanView && fanView !== 'none') {
+			var state = num(st.fan_state), max = num(st.fan_max), rpm = num(st.fan_rpm),
+			    percent = num(st.fan_percent);
+			var label = (percent !== null)
+				? '%d %%'.format(percent)
+				: (state === null ? '-'
+					: (max ? _('fan step %d of %d').format(state, max) : String(state)));
+			if (rpm !== null && rpm > 0)
+				label += ' (%d rpm)'.format(rpm);
+			rows.push([ _('Fan'), label ]);
+		}
+
+		if (stage !== null && stage >= 0)
+			rows.push([
+				_('Thermal Guard'),
+				E('span', { 'style': 'color:#f44336;font-weight:bold' },
+					_('protection stage %d active').format(stage + 1))
+			]);
+
+		return E('table', { 'class': 'table' }, rows.map(function(row) {
+			return E('tr', { 'class': 'tr' }, [
+				E('td', { 'class': 'td left', 'width': '33%' }, row[0]),
+				E('td', { 'class': 'td left' }, row[1])
+			]);
+		}));
+	}
+});
diff --git a/openwrt-thermal-guard/luci-app-thermal-guard/htdocs/luci-static/resources/view/thermal-guard/config.js b/openwrt-thermal-guard/luci-app-thermal-guard/htdocs/luci-static/resources/view/thermal-guard/config.js
new file mode 100644
index 000000000..3fcf4b600
--- /dev/null
+++ b/openwrt-thermal-guard/luci-app-thermal-guard/htdocs/luci-static/resources/view/thermal-guard/config.js
@@ -0,0 +1,431 @@
+// SPDX-License-Identifier: GPL-2.0-only
+'use strict';
+'require view';
+'require form';
+'require uci';
+'require fs';
+'require ui';
+
+var STATUS_FILE = '/var/run/thermal-guard.status';
+
+function parseStatus(text) {
+	var st = {};
+	(text || '').split('\n').forEach(function(line) {
+		var i = line.indexOf('=');
+		if (i > 0)
+			st[line.substring(0, i)] = line.substring(i + 1).trim();
+	});
+	return st;
+}
+
+// The daemon reports why it cannot manage the trips as a fixed code.
+function tripReasonText(code) {
+	switch (code) {
+		case 'no_cdev':        return _('the kernel knows no fan on this device');
+		case 'no_zone':        return _('no thermal zone drives the fan');
+		case 'zone_path':      return _('the fan\'s thermal zone is not under /sys/class/thermal');
+		case 'no_active_trip': return _('the fan is not bound to any switching temperature');
+		case 'not_writable':   return _('the switching temperatures cannot be changed');
+		default:               return code || _('unknown reason');
+	}
+}
+
+function tripList(v) {
+	return (v || '').split('/').filter(function(x) { return x !== ''; });
+}
+
+// The daemon's defaults, from tg_cfg_default_thresholds. An empty field means
+// the daemon uses these, so the order is checked against them as well.
+var THRESHOLD_DEFAULTS = {
+	cpu_warn: 70, cpu_crit: 80, cpu_emergency: 90, modem_warn: 80, modem_crit: 88
+};
+
+// The value the daemon will use: the default when empty, NaN when it is not
+// a whole number.
+function thresholdValue(option, value) {
+	if (value == null || value === '')
+		return THRESHOLD_DEFAULTS[option];
+	return /^[0-9]+$/.test(value) ? parseInt(value, 10) : NaN;
+}
+
+// Thresholds have to stay ordered, otherwise the service falls back to its
+// defaults and the protection silently stops doing what the form says. The
+// neighbours are read from the form, not from the saved configuration, so a
+// change made next to this one counts.
+function checkOrder(section, section_id, option, value, below, above, belowLabel, aboveLabel) {
+	var v = thresholdValue(option, value);
+	if (isNaN(v))
+		return _('Enter a whole number');
+
+	if (below) {
+		var b = thresholdValue(below, section.formvalue(section_id, below));
+		if (!isNaN(b) && v <= b)
+			return _('Must be above %s (%d)').format(belowLabel, b);
+	}
+	if (above) {
+		var a = thresholdValue(above, section.formvalue(section_id, above));
+		if (!isNaN(a) && v >= a)
+			return _('Must be below %s (%d)').format(aboveLabel, a);
+	}
+	return true;
+}
+
+// Mirrors the guards in backends.sh. The service rejects anything outside these
+// subtrees anyway, so catching it here saves a silent fallback after Apply.
+function checkPathPrefix(value, prefixes) {
+	if (!value)
+		return true;
+	if (value.charAt(0) !== '/' || value.indexOf('..') >= 0)
+		return _('Must be an absolute path without ".."');
+	for (var i = 0; i < prefixes.length; i++)
+		if (value.indexOf(prefixes[i]) === 0)
+			return true;
+	return _('Path must start with %s').format(prefixes.join(', '));
+}
+
+return view.extend({
+	load: function() {
+		return fs.read(STATUS_FILE).catch(function() { return null; });
+	},
+
+	render: function(statusText) {
+		var m, s, o,
+		    st = parseStatus(statusText),
+		    tripDt = tripList(st.trip_dt),
+		    tripLimit = parseInt(st.trip_limit, 10);
+
+		m = new form.Map('thermal-guard', _('Thermal Guard'),
+			_('Monitors the temperature of the main processor and the modem. If the device gets too hot, it intervenes in up to three protection stages. Stages stay active until you clear them on the status page.'));
+
+		s = m.section(form.NamedSection, 'main', 'thermal-guard');
+		s.addremove = false;
+		s.tab('general', _('General'));
+		s.tab('thresholds', _('Thresholds'),
+			_('Temperatures at which each protection stage starts. What actually happens at stage 2 and 3 is set on the Actions tab.'));
+		s.tab('fan', _('Fan'));
+		s.tab('modem', _('Modem'));
+		s.tab('actions', _('Actions'),
+			_('What happens when a stage starts. Stage 1 of 3 warns and, if this service drives the fan (Fan tab), sets it to full speed. That cannot be changed.'));
+
+		// ---- general ----
+		o = s.taboption('general', form.Flag, 'enabled', _('Enabled'),
+			_('Switching this off pauses the temperature checks. Protection stages that are already active stay applied and the fan is not handed back, so a broken fan cannot be hidden by a checkbox. Use Clear on the status page for that.'));
+		o.default = '1';
+		o.rmempty = false;
+
+		o = s.taboption('general', form.Value, 'interval', _('Interval'),
+			_('Seconds between two temperature readings. Values below five seconds are treated as five.'));
+		o.datatype = 'and(uinteger,min(5))';
+		o.placeholder = '20';
+
+		o = s.taboption('general', form.Value, 'cpu_temp_path', _('Processor temperature source'),
+			_('System file the processor temperature is read from. The default fits most devices; change it only if your device reports its temperature elsewhere.'));
+		o.placeholder = '/sys/class/thermal/thermal_zone0/temp';
+		o.validate = function(id, v) {
+			return checkPathPrefix(v, ['/sys/class/thermal/', '/sys/class/hwmon/', '/sys/devices/']);
+		};
+
+		// ---- thresholds ----
+		o = s.taboption('thresholds', form.Value, 'cpu_warn', _('Processor warning (stage 1 of 3)'),
+			_('Stage 1 of 3 starts when either temperature reaches its warning level: a warning, and full fan speed if this service drives the fan.'));
+		o.placeholder = '70';
+		o.validate = function(id, v) {
+			return checkOrder(this.section, id, 'cpu_warn', v, null, 'cpu_crit', null, _('Processor critical'));
+		};
+
+		o = s.taboption('thresholds', form.Value, 'cpu_crit', _('Processor critical (stage 2 of 3)'));
+		o.placeholder = '80';
+		o.validate = function(id, v) {
+			return checkOrder(this.section, id, 'cpu_crit', v, 'cpu_warn', 'cpu_emergency', _('Processor warning'), _('Processor emergency'));
+		};
+
+		o = s.taboption('thresholds', form.Value, 'cpu_emergency', _('Processor emergency (stage 3 of 3)'));
+		o.placeholder = '90';
+		o.validate = function(id, v) {
+			return checkOrder(this.section, id, 'cpu_emergency', v, 'cpu_crit', null, _('Processor critical'), null);
+		};
+
+		o = s.taboption('thresholds', form.Value, 'modem_warn', _('Modem warning (stage 1 of 3)'));
+		o.placeholder = '80';
+		o.validate = function(id, v) {
+			return checkOrder(this.section, id, 'modem_warn', v, null, 'modem_crit', null, _('Modem critical'));
+		};
+
+		o = s.taboption('thresholds', form.Value, 'modem_crit', _('Modem critical (stage 2 of 3)'));
+		o.placeholder = '88';
+		o.validate = function(id, v) {
+			return checkOrder(this.section, id, 'modem_crit', v, 'modem_warn', null, _('Modem warning'), null);
+		};
+
+		o = s.taboption('thresholds', form.Value, 'hold_minutes', _('Hold time'),
+			_('Minutes a stage has to last before the next one starts on time alone: stage 2 of 3 if the temperature has not dropped, stage 3 of 3 if it is still rising.'));
+		o.datatype = 'uinteger';
+		o.placeholder = '3';
+
+		o = s.taboption('thresholds', form.Value, 'hysteresis', _('Hysteresis'),
+			_('How many degrees the temperature has to fall below the warning level before the device counts as cooled down.'));
+		o.datatype = 'uinteger';
+		o.placeholder = '10';
+
+		// ---- fan ----
+		o = s.taboption('fan', form.ListValue, 'fan_mode', _('Fan control method'),
+			_('Leave the fan to the regulator the device already has, unless it has none. Automatic uses the kernel fan control when the device offers it and otherwise leaves the fan alone. It never picks direct control, which needs the fan\'s polarity.'));
+		o.value('none', _('Leave the fan alone'));
+		o.value('auto', _('Automatic'));
+		o.value('cooling_device', _('Kernel fan control'));
+		o.value('pwm', _('Direct fan control (PWM)'));
+		o.default = 'none';
+
+		o = s.taboption('fan', form.Value, 'fan_cooling_device_type', _('Fan identifier'),
+			_('Name the kernel uses for the fan. Change it only if the fan is not found automatically.'));
+		o.placeholder = 'pwm-fan';
+		o.depends('fan_mode', 'auto');
+		o.depends('fan_mode', 'cooling_device');
+
+		o = s.taboption('fan', form.ListValue, 'fan_governor', _('Control mode to restore'),
+			_('Control mode handed back to the kernel when the stages are cleared and no earlier control mode was recorded. The default fits almost every device.'));
+		// The daemon's list, kernel names and not translated. Not user_space:
+		// nothing would regulate the fan after a reset.
+		[ 'step_wise', 'fair_share', 'bang_bang', 'power_allocator' ].forEach(function(g) {
+			o.value(g);
+		});
+		o.default = 'step_wise';
+		o.depends('fan_mode', 'auto');
+		o.depends('fan_mode', 'cooling_device');
+
+		o = s.taboption('fan', form.Value, 'pwm_path', _('Fan speed file'),
+			_('Only needed for direct fan control.'));
+		o.placeholder = '/sys/class/hwmon/hwmon0/pwm1';
+		o.depends('fan_mode', 'pwm');
+		o.validate = function(id, v) { return checkPathPrefix(v, ['/sys/class/hwmon/', '/sys/devices/']); };
+
+		o = s.taboption('fan', form.Value, 'pwm_enable_path', _('Fan control file'),
+			_('Only needed for direct fan control. Switches the fan chip to manual control.'));
+		o.placeholder = '/sys/class/hwmon/hwmon0/pwm1_enable';
+		o.depends('fan_mode', 'pwm');
+		o.validate = function(id, v) { return checkPathPrefix(v, ['/sys/class/hwmon/', '/sys/devices/']); };
+
+		o = s.taboption('fan', form.Value, 'pwm_full', _('Value for full speed'),
+			_('Required for direct fan control. The raw value that makes this fan spin fastest. Some boards wire the signal inverted, where 1 is full speed and 255 stops the fan. Without this value and the slowest one, the fan is left alone.'));
+		o.datatype = 'uinteger';
+		o.depends('fan_mode', 'pwm');
+		o.rmempty = false;
+
+		o = s.taboption('fan', form.Value, 'pwm_idle', _('Value for the slowest setting'),
+			_('Required for direct fan control. The opposite end of the same scale. Together with full speed it states the polarity, and it shows the fan speed as a percentage. Never written to the hardware.'));
+		o.datatype = 'uinteger';
+		o.depends('fan_mode', 'pwm');
+		o.rmempty = false;
+
+		// ---- switching temperatures of the kernel fan control ----
+		o = s.taboption('fan', form.DummyValue, '_trip_state', _('Kernel fan control'));
+		o.cfgvalue = function() {
+			switch (st.trip_state) {
+				case 'active':
+					return _('Managed by this service, switching temperatures now %s °C').format(tripList(st.trip_now).join(', '));
+				case 'inactive':
+					return _('Not possible on this device: %s').format(tripReasonText(st.trip_reason));
+				default:
+					return _('Not managed by this service');
+			}
+		};
+
+		o = s.taboption('fan', form.ListValue, 'trip_boost', _('Speed the fan up for the modem'),
+			_('Where the kernel drives the fan, its switching temperatures are lowered while the modem runs hotter than the processor, so the fan speeds up for the modem as well. They only ever go down, never above the base values. A missing modem reading keeps them where they are.'));
+		o.value('off', _('Off'));
+		o.value('modem', _('Follow the modem temperature'));
+		o.default = 'off';
+
+		o = s.taboption('fan', form.Value, 'trip_boost_offset', _('Modem allowance'),
+			_('Degrees the modem may run above the processor before the switching temperatures are lowered.'));
+		o.datatype = 'range(0,40)';
+		o.placeholder = '15';
+		o.depends('trip_boost', 'modem');
+
+		o = s.taboption('fan', form.DynamicList, 'trip_active', _('Fan switching temperatures'),
+			tripDt.length
+				? _('Base values in degrees at which the kernel moves the fan one step up, lowest first, one value per step. Empty uses the values of the installed firmware: %s °C.').format(tripDt.join(', '))
+				: _('Base values in degrees at which the kernel moves the fan one step up, lowest first, one value per step. Empty uses the values of the installed firmware.'));
+		// Same rules as the service, which falls back to the firmware values
+		// on anything it rejects.
+		o.validate = function(section_id, value) {
+			var list = L.toArray(this.formvalue(section_id)), prev = null;
+			for (var i = 0; i < list.length; i++) {
+				var raw = String(list[i]).trim(), v = parseInt(raw, 10);
+				if (isNaN(v) || String(v) !== raw)
+					return _('Enter a whole number');
+				if (v < 20 || v > 95)
+					return _('Must be between 20 and 95');
+				if (prev !== null && v <= prev)
+					return _('Each value must be higher than the one before');
+				if (!isNaN(tripLimit) && v >= tripLimit)
+					return _('Must be below %d, the temperature at which the kernel itself intervenes').format(tripLimit);
+				prev = v;
+			}
+			if (list.length && tripDt.length && list.length !== tripDt.length)
+				return _('Needs exactly %d values, one per fan step').format(tripDt.length);
+			return true;
+		};
+
+		if (st.trip_dt_changed === '1' && tripDt.length) {
+			o = s.taboption('fan', form.DummyValue, '_trip_dt_hint', _('New firmware values'));
+			o.cfgvalue = function() {
+				return _('The installed firmware now uses %s °C. Your own base values were set for an earlier firmware and still apply.').format(tripDt.join(', '));
+			};
+
+			// The daemon keeps the firmware values trip_active was made for in
+			// a file of its own; trips-keep records the ones of this boot.
+			// Resolves to true when that worked.
+			var keepTrips = function() {
+				var failed = function(why) {
+					ui.addNotification(null, E('p', {}, _('Recording the firmware values failed: %s').format(why)), 'error');
+					return false;
+				};
+				return fs.exec('/usr/sbin/thermal-guard', [ 'trips-keep' ]).then(function(res) {
+					if (res.code !== 0)
+						return failed(res.stderr || res.stdout || res.code);
+					ui.addNotification(null, E('p', {}, _('Firmware values recorded. The notice goes away with the next check.')), 'info');
+					return true;
+				}).catch(failed);
+			};
+
+			o = s.taboption('fan', form.Button, '_trip_dt_adopt', ' ');
+			o.inputtitle = _('Use the firmware values');
+			// Parse the form first, then set the values, otherwise the form
+			// writes the old list back over them. Apply reloads the page, so
+			// it comes last.
+			o.onclick = function() {
+				return m.save(function() {
+					uci.set('thermal-guard', 'main', 'trip_active', tripDt);
+				}).then(keepTrips).then(function(ok) {
+					if (ok)
+						return ui.changes.apply(true);
+				});
+			};
+
+			o = s.taboption('fan', form.Button, '_trip_dt_keep', ' ');
+			o.inputtitle = _('Keep my values');
+			o.onclick = keepTrips;
+		}
+
+		if (st.fan_levels) {
+			o = s.taboption('fan', form.DummyValue, '_fan_levels', _('Fan steps of the firmware'),
+				_('Raw value per fan step from the device tree, with the duty cycle of the signal. They belong to the fan that is fitted and change only with a new firmware image.'));
+			o.cfgvalue = function() {
+				return st.fan_levels.split(' ').map(function(v, i) {
+					return _('step %d: %d (%d %%)').format(i, parseInt(v, 10), Math.round(parseInt(v, 10) * 100 / 255));
+				}).join(', ');
+			};
+		}
+
+		// ---- modem ----
+		o = s.taboption('modem', form.ListValue, 'modem_source', _('Modem temperature source'),
+			_('Automatic tries the known modem commands in turn. Select your manufacturer if detection fails.'));
+		o.value('auto', _('Automatic'));
+		o.value('quectel', _('Quectel (AT+QTEMP)'));
+		o.value('fibocom', _('Fibocom (AT+GTSENRDTEMP)'));
+		o.value('file', _('File'));
+		o.value('command', _('Command'));
+		o.value('none', _('No modem'));
+		o.default = 'auto';
+
+		o = s.taboption('modem', form.Value, 'modem_at_port', _('Modem control port'),
+			_('Serial port the commands are sent to. Automatic checks the usual ports.'));
+		o.placeholder = 'auto';
+		o.depends('modem_source', 'auto');
+		o.depends('modem_source', 'quectel');
+		o.depends('modem_source', 'fibocom');
+		o.validate = function(id, v) {
+			if (v === 'auto')
+				return true;
+			return checkPathPrefix(v, ['/dev/']);
+		};
+
+		o = s.taboption('modem', form.Value, 'at_lock', _('Lock file for modem access'),
+			_('Prevents this service and other programs from sending commands to the modem at the same time. Point those programs at the same file.'));
+		o.placeholder = '/var/lock/modem-at.lock';
+		o.depends('modem_source', 'auto');
+		o.depends('modem_source', 'quectel');
+		o.depends('modem_source', 'fibocom');
+		o.validate = function(id, v) { return checkPathPrefix(v, ['/var/lock/', '/var/run/', '/tmp/']); };
+
+		o = s.taboption('modem', form.Value, 'modem_temp_file', _('Temperature file'));
+		o.depends('modem_source', 'file');
+		o.validate = function(id, v) { return checkPathPrefix(v, ['/var/run/', '/tmp/', '/sys/']); };
+
+		o = s.taboption('modem', form.DummyValue, '_modem_temp_hook', _('Own temperature source'),
+			_('Reads /etc/thermal-guard/hooks/modem-temp, which has to print the temperature in degrees as a whole number. Place the file over SSH; it runs as root and is deliberately not editable from here.'));
+		o.depends('modem_source', 'command');
+
+		// ---- actions ----
+		o = s.taboption('actions', form.ListValue, 'stage1_action', _('Action at stage 2 of 3'));
+		o.value('modem_radio_off', _('Switch the modem radio off'));
+		o.value('wifi_off', _('Switch Wi-Fi off'));
+		o.value('interface_down', _('Take a network interface down'));
+		o.value('command', _('Run own script'));
+		o.value('none', _('Nothing'));
+		o.default = 'modem_radio_off';
+
+		o = s.taboption('actions', form.DummyValue, '_stage1_hook', _('Script at stage 2 of 3'),
+			_('Runs /etc/thermal-guard/hooks/stage1. Place the file over SSH and make it executable.'));
+		o.depends('stage1_action', 'command');
+
+		o = s.taboption('actions', form.ListValue, 'stage2_action', _('Action at stage 3 of 3'));
+		o.value('wifi_off', _('Switch Wi-Fi off'));
+		o.value('modem_radio_off', _('Switch the modem radio off'));
+		o.value('interface_down', _('Take a network interface down'));
+		o.value('command', _('Run own script'));
+		o.value('none', _('Nothing'));
+		o.default = 'wifi_off';
+
+		o = s.taboption('actions', form.DummyValue, '_stage2_hook', _('Script at stage 3 of 3'),
+			_('Runs /etc/thermal-guard/hooks/stage2. Place the file over SSH and make it executable.'));
+		o.depends('stage2_action', 'command');
+
+		o = s.taboption('actions', form.ListValue, 'modem_radio_off_at', _('How the modem is switched off'),
+			_('Flight mode suits most modems. Use minimum function for a modem that does not accept flight mode. Either way the modem is asked afterwards (AT+CFUN?), and a modem that does not confirm counts as a failed stage.'));
+		o.value('AT+CFUN=4', _('Flight mode (AT+CFUN=4)'));
+		o.value('AT+CFUN=0', _('Minimum function (AT+CFUN=0)'));
+		o.default = 'AT+CFUN=4';
+		o.depends('stage1_action', 'modem_radio_off');
+		o.depends('stage2_action', 'modem_radio_off');
+
+		o = s.taboption('actions', form.Value, 'action_interface', _('Interface to take down'),
+			_('Network interface taken down by the interface action and brought back up when the stages are cleared. Empty uses the modem network interface.'));
+		o.datatype = 'uciname';
+		o.depends('stage1_action', 'interface_down');
+		o.depends('stage2_action', 'interface_down');
+
+		o = s.taboption('actions', form.Value, 'notify_url', _('Notification address'),
+			_('The warning text is posted here. Works with ntfy, Gotify, Matrix, Slack and anything else that accepts a plain POST body.'));
+		o.placeholder = 'https://ntfy.sh/my-topic';
+		// Anchored at both ends, and quotes, backslashes and control characters
+		// are refused: the service writes this into a curl config file, where
+		// any of them would turn the rest of the value into directives.
+		o.validate = function(id, v) {
+			if (!v)
+				return true;
+			if (!/^https?:\/\/[\x21-\x7e]+$/.test(v) || /["\\]/.test(v))
+				return _('Must be an http:// or https:// address without quotes or spaces');
+			return true;
+		};
+
+		o = s.taboption('actions', form.Value, 'notify_header', _('Additional header'),
+			_('Sent with the notification, for example an authorisation token. Needs curl installed; the smaller uclient-fetch cannot send headers.'));
+		o.placeholder = 'Authorization: Bearer ...';
+		o.password = true;
+		o.validate = function(id, v) {
+			if (!v)
+				return true;
+			if (!/^[\x20-\x7e]+$/.test(v) || /["\\]/.test(v))
+				return _('Must be printable text without quotes or backslashes');
+			return true;
+		};
+
+		o = s.taboption('actions', form.Value, 'uplink_interface', _('Modem network interface'),
+			_('Lets the service tell whether another internet connection exists, so a message from stage 2 of 3 on goes out or waits in the queue. Also the interface the interface action takes when none is set.'));
+		o.datatype = 'uciname';
+
+		return m.render();
+	}
+});
diff --git a/openwrt-thermal-guard/luci-app-thermal-guard/htdocs/luci-static/resources/view/thermal-guard/monitor.js b/openwrt-thermal-guard/luci-app-thermal-guard/htdocs/luci-static/resources/view/thermal-guard/monitor.js
new file mode 100644
index 000000000..be98eb476
--- /dev/null
+++ b/openwrt-thermal-guard/luci-app-thermal-guard/htdocs/luci-static/resources/view/thermal-guard/monitor.js
@@ -0,0 +1,298 @@
+// SPDX-License-Identifier: GPL-2.0-only
+'use strict';
+'require view';
+'require poll';
+'require dom';
+'require fs';
+'require ui';
+
+var STATUS_FILE = '/var/run/thermal-guard.status';
+
+function parseStatus(text) {
+	var st = {};
+	(text || '').split('\n').forEach(function(line) {
+		var i = line.indexOf('=');
+		if (i > 0)
+			st[line.substring(0, i)] = line.substring(i + 1).trim();
+	});
+	return st;
+}
+
+function num(v) {
+	var n = parseInt(v, 10);
+	return isNaN(n) ? null : n;
+}
+
+// Colour follows the configured thresholds, not a fixed scale, so the bar means
+// the same thing on a passively cooled box and on one with a fan.
+function tempClass(value, warn, crit) {
+	if (value === null)
+		return '';
+	if (crit !== null && value >= crit)
+		return 'tg-crit';
+	if (warn !== null && value >= warn)
+		return 'tg-warn';
+	return 'tg-ok';
+}
+
+function gauge(value, warn, crit, max) {
+	var pct = (value === null) ? 0 : Math.max(0, Math.min(100, Math.round(value * 100 / max)));
+	return E('div', { 'class': 'tg-gauge' }, [
+		E('div', {
+			'class': 'tg-fill ' + tempClass(value, warn, crit),
+			'style': 'width:%d%%'.format(pct)
+		})
+	]);
+}
+
+// Sensor names come straight from the kernel. Translate the ones people actually
+// recognise, leave the rest as reported rather than guessing.
+function sensorLabel(name) {
+	var m = name.match(/^(?:mt79\d\d|mtwifi)_phy(\d)/);
+	if (m)
+		return _('Wi-Fi %d').format(parseInt(m[1], 10) + 1);
+	if (name.indexOf('mdio_bus') === 0 || name.indexOf('phy') === 0)
+		return _('Ethernet');
+	if (name === 'nvme')
+		return _('SSD');
+	return name;
+}
+
+function extraSensors(st) {
+	var out = [];
+	for (var k in st) {
+		if (k.indexOf('sensor.') === 0 && st[k] !== '')
+			out.push([ sensorLabel(k.substring(7)), parseInt(st[k], 10) ]);
+	}
+	return out.sort(function(a, b) { return a[0] > b[0] ? 1 : -1; });
+}
+
+function row(label, valueNode, gaugeNode) {
+	return E('div', { 'class': 'tg-row' }, [
+		E('div', { 'class': 'tg-label' }, label),
+		gaugeNode || E('div', { 'class': 'tg-gauge tg-empty' }, []),
+		E('div', { 'class': 'tg-value' }, valueNode)
+	]);
+}
+
+// Stage 2 and 3 do whatever the Actions tab says, so the banner has to read the
+// configured action instead of naming the default.
+function actionLabel(action) {
+	switch (action) {
+		case 'modem_radio_off': return _('modem radio off');
+		case 'wifi_off':        return _('Wi-Fi off');
+		case 'interface_down':  return _('network interface down');
+		case 'command':         return _('custom command');
+		case 'none':            return _('no action');
+		default:                return action || _('unknown action');
+	}
+}
+
+function stageText(stage, st) {
+	switch (stage) {
+		case 0: return st.fan_mode === 'none'
+			? _('Stage 1 of 3 active: warning, fan left to its own controller')
+			: _('Stage 1 of 3 active: fan at full speed');
+		case 1: return _('Stage 2 of 3 active: %s').format(actionLabel(st.stage1_action));
+		case 2: return _('Stage 3 of 3 active: %s').format(actionLabel(st.stage2_action));
+		default: return _('No intervention, temperatures within range');
+	}
+}
+
+// Why the page might be showing something other than a live reading. The daemon
+// stamps every write with "now": a file that stopped being written means the
+// service is gone, while a fresh file holding an old reading means it is
+// running but not measuring.
+function serviceState(st) {
+	var written = parseInt(st.now, 10),
+	    interval = parseInt(st.interval, 10) || 30,
+	    age = written ? Math.floor(Date.now() / 1000) - written : null;
+
+	// Three missed writes, with a floor so a short interval is not jumpy.
+	if (age !== null && age > Math.max(90, interval * 3))
+		return 'stopped';
+	if (st.enabled === '0')
+		return 'paused';
+	return 'running';
+}
+
+function fmtAge(ts) {
+	var n = parseInt(ts, 10);
+	if (!n)
+		return '-';
+	var age = Math.max(0, Math.floor(Date.now() / 1000) - n);
+	if (age < 90)
+		return _('%d s ago').format(age);
+	return _('%d min ago').format(Math.round(age / 60));
+}
+
+return view.extend({
+	load: function() {
+		return fs.read(STATUS_FILE).catch(function() { return null; });
+	},
+
+	render: function(text) {
+		var style = E('style', {}, [
+			'.tg-row{display:flex;align-items:center;gap:.6em;margin:.35em 0}',
+			'.tg-label{flex:0 0 12em}',
+			'.tg-value{flex:0 0 7em;text-align:right;font-weight:bold}',
+			'.tg-gauge{flex:1 1 auto;height:1.1em;background:rgba(128,128,128,.25);border-radius:.55em;overflow:hidden;min-width:6em}',
+			'.tg-gauge.tg-empty{background:transparent}',
+			'.tg-fill{height:100%;border-radius:.55em;transition:width .4s}',
+			'.tg-ok{background:#4caf50}.tg-warn{background:#ff9800}.tg-crit{background:#f44336}',
+			'.tg-banner{padding:.6em .8em;border-radius:.3em;margin-bottom:1em}',
+			'.tg-banner.tg-active{background:rgba(244,67,54,.15);border-left:4px solid #f44336}',
+			'.tg-banner.tg-idle{background:rgba(76,175,80,.12);border-left:4px solid #4caf50}',
+			'.tg-banner.tg-warn-banner{background:rgba(255,152,0,.15);border-left:4px solid #ff9800}',
+			'.tg-meta{opacity:.7;font-size:90%;margin-top:.8em}'
+		].join('\n'));
+
+		var body = E('div', { 'id': 'tg-body' }, []);
+		var container = E('div', { 'class': 'cbi-map' }, [
+			style,
+			E('h2', {}, _('Thermal Guard')),
+			E('div', { 'class': 'cbi-map-descr' },
+				_('Current temperatures and protection state. Thresholds and actions are configured under System, Thermal Guard.')),
+			body
+		]);
+
+		this.update(body, text);
+
+		poll.add(L.bind(function() {
+			return fs.read(STATUS_FILE)
+				.catch(function() { return null; })
+				.then(L.bind(function(t) { this.update(body, t); }, this));
+		}, this), 5);
+
+		return container;
+	},
+
+	update: function(body, text) {
+		if (text === null) {
+			dom.content(body, E('div', { 'class': 'alert-message warning' },
+				_('No data yet. Check whether the Thermal Guard service is running.')));
+			return;
+		}
+
+		var st = parseStatus(text);
+		var cpu = num(st.cpu_c), modem = num(st.modem_c), stage = num(st.stage);
+		var cpuWarn = num(st.cpu_warn), cpuCrit = num(st.cpu_crit);
+		var modemWarn = num(st.modem_warn), modemCrit = num(st.modem_crit);
+		var fanState = num(st.fan_state), fanMax = num(st.fan_max), rpm = num(st.fan_rpm);
+
+		var rows = [
+			row(_('Processor temperature'),
+				cpu === null ? '-' : '%d °C'.format(cpu),
+				gauge(cpu, cpuWarn, cpuCrit, num(st.cpu_emergency) || 100))
+		];
+
+		if (st.modem_src !== '' || modem !== null)
+			rows.push(row(_('Modem temperature'),
+				modem === null ? _('no reading') : '%d °C'.format(modem),
+				gauge(modem, modemWarn, modemCrit, (num(st.modem_crit) || 90) + 10)));
+
+		extraSensors(st).forEach(function(s) {
+			rows.push(row(s[0], '%d °C'.format(s[1]), gauge(s[1], null, null, 100)));
+		});
+
+		// fan_view is what can be read, even where fan_mode leaves the fan to
+		// another controller. Older status files only carry fan_mode.
+		var fanView = st.fan_view || st.fan_mode;
+		if (fanView && fanView !== 'none') {
+			// The daemon computes the percentage because only it knows which way
+			// the raw scale runs; an inverted board reports full speed as 0.
+			var fanPercent = num(st.fan_percent);
+			var fanLabel = (fanPercent !== null)
+				? '%d %%'.format(fanPercent)
+				: (fanState === null ? '-'
+					: (fanMax ? _('fan step %d of %d').format(fanState, fanMax) : String(fanState)));
+			if (rpm !== null && rpm > 0)
+				fanLabel += ' (%d rpm)'.format(rpm);
+			rows.push(row(_('Fan'), fanLabel,
+				(fanPercent !== null) ? gauge(fanPercent, null, null, 100)
+					: ((fanState !== null && fanMax) ? gauge(fanState, null, null, fanMax) : null)));
+
+			if (st.fan_foreign === '1')
+				rows.push(row(_('Fan control'),
+					_('Another service is controlling this fan'), null));
+		}
+
+		// Only shown where this service manages the kernel's switching
+		// temperatures; elsewhere they are none of its business.
+		if (st.trip_state === 'active') {
+			var tripDelta = num(st.trip_delta);
+			rows.push(row(_('Fan switching temperatures'),
+				(st.trip_now || '-').replace(/\//g, ' / ') + ' °C', null));
+			if (tripDelta)
+				rows.push(row('', _('lowered by %d K for the modem').format(tripDelta), null));
+		}
+
+		var active = (stage !== null && stage >= 0),
+		    state = serviceState(st),
+		    noSensor = (st.no_sensor === '1'),
+		    banner = [ E('strong', {}, noSensor
+				? _('This device does not report any temperature')
+				: stageText(stage, st)) ];
+
+		// Not a fault to chase: some boards expose no thermal zone and no hwmon
+		// temperature input at all. Saying so beats a page full of dashes.
+		if (noSensor)
+			banner.push(E('div', {},
+				_('No thermal sensor was found, so the processor is not watched on this hardware. The modem thresholds still apply while the modem reports a temperature.')));
+
+		// A stage that is still applied while nothing is watching is the one
+		// thing an operator has to be told about, so it comes before the rest.
+		if (state !== 'running' && !noSensor)
+			banner.push(E('div', {}, state === 'stopped'
+				? (active
+					? _('The service is not running. Protection stages stay applied and the fan is not handed back.')
+					: _('The service is not running. Temperatures are not being watched.'))
+				: (active
+					? _('The service is paused. Protection stages stay applied and the fan is not handed back.')
+					: _('The service is paused. Temperatures are not being watched.'))));
+
+		if (st.trip_dt_changed === '1')
+			banner.push(E('div', {},
+				_('The firmware brings new fan switching temperatures (%s °C). Your own values still apply; review them under System, Thermal Guard, Fan.').format((st.trip_dt || '').replace(/\//g, ', '))));
+
+		if (active)
+			banner.push(E('div', {}, [
+				E('div', {}, _('Protection stages stay active until you clear them. Clear them once the cause is fixed, for example a replaced fan.')),
+				E('button', {
+					'class': 'btn cbi-button cbi-button-reset',
+					'style': 'margin-top:.5em',
+					'click': ui.createHandlerFn(this, 'handleClear')
+				}, _('Clear protection stages'))
+			]));
+
+		dom.content(body, [
+			E('div', {
+				'class': 'tg-banner ' + ((state !== 'running' || noSensor) ? 'tg-warn-banner'
+					: (active ? 'tg-active' : 'tg-idle'))
+			}, banner),
+			E('div', {}, rows),
+			E('div', { 'class': 'tg-meta' }, [
+				_('Last reading: %s').format(fmtAge(st.ts)),
+				st.modem_src ? ' · ' + _('modem source: %s').format(st.modem_src) : '',
+				st.fan_mode ? ' · ' + _('fan mode: %s').format(st.fan_mode) : '',
+				st.version ? ' · ' + _('version %s').format(st.version) : ''
+			].join(''))
+		]);
+	},
+
+	// Runs "thermal-guard reset": hands the fan back, radio on, stage cleared.
+	handleClear: function() {
+		return fs.exec('/usr/sbin/thermal-guard', [ 'reset' ]).then(function(res) {
+			if (res.code !== 0)
+				ui.addNotification(null, E('p', {}, _('Clearing failed: %s').format(res.stderr || res.stdout || res.code)), 'error');
+			else
+				ui.addNotification(null, E('p', {}, _('Protection stages cleared.')), 'info');
+		}).catch(function(err) {
+			ui.addNotification(null, E('p', {}, _('Clearing failed: %s').format(err)), 'error');
+		});
+	},
+
+	handleSave: null,
+	handleSaveApply: null,
+	handleReset: null
+});
diff --git a/openwrt-thermal-guard/luci-app-thermal-guard/po/de/thermal-guard.po b/openwrt-thermal-guard/luci-app-thermal-guard/po/de/thermal-guard.po
new file mode 100644
index 000000000..6f7da04dc
--- /dev/null
+++ b/openwrt-thermal-guard/luci-app-thermal-guard/po/de/thermal-guard.po
@@ -0,0 +1,509 @@
+msgid ""
+msgstr ""
+"Project-Id-Version: luci-app-thermal-guard\n"
+"PO-Revision-Date: 2026-09-22\n"
+"Last-Translator: SyntaxError NullPointer <287466119+SyntaxError-NullPointer@users.noreply.github.com>\n"
+"Language-Team: German\n"
+"Language: de\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"Plural-Forms: nplurals=2; plural=(n != 1);\n"
+
+msgid "Enter a whole number"
+msgstr "Ganze Zahl eingeben"
+
+msgid "Must be above %s (%d)"
+msgstr "Muss über %s (%d) liegen"
+
+msgid "Must be below %s (%d)"
+msgstr "Muss unter %s (%d) liegen"
+
+msgid "Must be an absolute path without \"..\""
+msgstr "Muss ein vollständiger Pfad ohne „..\" sein"
+
+msgid "Path must start with %s"
+msgstr "Pfad muss mit %s beginnen"
+
+msgid "Thermal Guard"
+msgstr "Thermal Guard"
+
+msgid "Monitors the temperature of the main processor and the modem. If the device gets too hot, it intervenes in up to three protection stages. Stages stay active until you clear them on the status page."
+msgstr "Überwacht die Temperatur des Hauptprozessors und des Modems. Wird das Gerät zu heiß, greift der Dienst in bis zu drei Schutzstufen ein. Die Stufen bleiben aktiv, bis Sie sie auf der Statusseite zurücksetzen."
+
+msgid "General"
+msgstr "Allgemein"
+
+msgid "Thresholds"
+msgstr "Schwellen"
+
+msgid "Temperatures at which each protection stage starts. What actually happens at stage 2 and 3 is set on the Actions tab."
+msgstr "Temperaturen, ab denen die jeweilige Schutzstufe einsetzt. Was bei Stufe 2 und 3 geschieht, legen Sie im Reiter „Aktionen\" fest."
+
+msgid "Fan"
+msgstr "Lüfter"
+
+msgid "Modem"
+msgstr "Modem"
+
+msgid "Actions"
+msgstr "Aktionen"
+
+msgid "What happens when a stage starts. Stage 1 of 3 warns and, if this service drives the fan (Fan tab), sets it to full speed. That cannot be changed."
+msgstr "Was beim Einsetzen einer Stufe geschieht. Stufe 1 von 3 warnt und setzt den Lüfter auf volle Drehzahl, sofern dieser Dienst ihn ansteuert (Reiter „Lüfter\"). Das ist nicht änderbar."
+
+msgid "Enabled"
+msgstr "Aktiv"
+
+msgid "Switching this off pauses the temperature checks. Protection stages that are already active stay applied and the fan is not handed back, so a broken fan cannot be hidden by a checkbox. Use Clear on the status page for that."
+msgstr "Durch Deaktivieren werden die Temperaturmessungen angehalten. Bereits aktive Schutzstufen bleiben bestehen und der Lüfter wird nicht freigegeben. Ein defekter Lüfter lässt sich dadurch nicht verbergen. Nutzen Sie dafür die Funktion „Schutzstufen zurücksetzen\" auf der Statusseite."
+
+msgid "Interval"
+msgstr "Intervall"
+
+msgid "Seconds between two temperature readings. Values below five seconds are treated as five."
+msgstr "Sekunden zwischen zwei Temperaturmessungen. Werte unter fünf Sekunden werden als fünf behandelt."
+
+msgid "Processor temperature source"
+msgstr "Quelle der Prozessortemperatur"
+
+msgid "System file the processor temperature is read from. The default fits most devices; change it only if your device reports its temperature elsewhere."
+msgstr "Systemdatei, aus der die Prozessortemperatur gelesen wird. Die Vorgabe passt für die meisten Geräte und muss nur geändert werden, wenn Ihr Gerät die Temperatur an anderer Stelle meldet."
+
+msgid "Processor warning (stage 1 of 3)"
+msgstr "Prozessor Warnung (Stufe 1 von 3)"
+
+msgid "Stage 1 of 3 starts when either temperature reaches its warning level: a warning, and full fan speed if this service drives the fan."
+msgstr "Stufe 1 von 3 setzt ein, sobald eine der beiden Temperaturen ihre Warnschwelle erreicht: eine Warnung und, sofern dieser Dienst den Lüfter ansteuert, volle Drehzahl."
+
+msgid "Processor critical"
+msgstr "Prozessor kritisch"
+
+msgid "Processor critical (stage 2 of 3)"
+msgstr "Prozessor kritisch (Stufe 2 von 3)"
+
+msgid "Processor warning"
+msgstr "Prozessor Warnung"
+
+msgid "Processor emergency"
+msgstr "Prozessor Notfall"
+
+msgid "Processor emergency (stage 3 of 3)"
+msgstr "Prozessor Notfall (Stufe 3 von 3)"
+
+msgid "Modem warning (stage 1 of 3)"
+msgstr "Modem Warnung (Stufe 1 von 3)"
+
+msgid "Modem critical"
+msgstr "Modem kritisch"
+
+msgid "Modem critical (stage 2 of 3)"
+msgstr "Modem kritisch (Stufe 2 von 3)"
+
+msgid "Modem warning"
+msgstr "Modem Warnung"
+
+msgid "Hold time"
+msgstr "Haltezeit"
+
+msgid "Minutes a stage has to last before the next one starts on time alone: stage 2 of 3 if the temperature has not dropped, stage 3 of 3 if it is still rising."
+msgstr "Minuten, die eine Stufe andauern muss, bevor allein nach Zeit die nächste einsetzt: Stufe 2 von 3, wenn die Temperatur nicht gesunken ist, Stufe 3 von 3, wenn sie weiter steigt."
+
+msgid "Hysteresis"
+msgstr "Hysterese"
+
+msgid "How many degrees the temperature has to fall below the warning level before the device counts as cooled down."
+msgstr "Um wie viel Grad die Temperatur unter die Warnschwelle fallen muss, damit das Gerät als abgekühlt gilt."
+
+msgid "Fan control method"
+msgstr "Art der Lüftersteuerung"
+
+msgid "Leave the fan to the regulator the device already has, unless it has none. Automatic uses the kernel fan control when the device offers it and otherwise leaves the fan alone. It never picks direct control, which needs the fan's polarity."
+msgstr "Überlassen Sie den Lüfter der Regelung, die das Gerät bereits hat, sofern es eine gibt. „Automatisch\" nutzt die Kernel-Lüfterregelung, wenn das Gerät sie anbietet, und lässt den Lüfter sonst unangetastet. Die direkte Steuerung wählt es nie, denn dafür muss die Polarität des Lüfters bekannt sein."
+
+msgid "Automatic"
+msgstr "Automatisch"
+
+msgid "Kernel fan control"
+msgstr "Kernel-Lüfterregelung"
+
+msgid "Direct fan control (PWM)"
+msgstr "Direkte Lüftersteuerung (PWM)"
+
+msgid "Leave the fan alone"
+msgstr "Lüfter nicht ansteuern"
+
+msgid "Fan identifier"
+msgstr "Kennung des Lüfters"
+
+msgid "Name the kernel uses for the fan. Change it only if the fan is not found automatically."
+msgstr "Name, unter dem der Kernel den Lüfter führt. Nur ändern, wenn der Lüfter nicht automatisch gefunden wird."
+
+msgid "Control mode to restore"
+msgstr "Wiederherzustellendes Regelverfahren"
+
+msgid "Control mode handed back to the kernel when the stages are cleared and no earlier control mode was recorded. The default fits almost every device."
+msgstr "Regelverfahren, das beim Zurücksetzen der Schutzstufen an den Kernel übergeben wird, wenn kein früheres festgehalten wurde. Die Vorgabe passt für nahezu alle Geräte."
+
+msgid "Fan speed file"
+msgstr "Datei für die Lüfterdrehzahl"
+
+msgid "Only needed for direct fan control."
+msgstr "Nur bei direkter Lüftersteuerung nötig."
+
+msgid "Fan control file"
+msgstr "Datei zum Aktivieren der Steuerung"
+
+msgid "Only needed for direct fan control. Switches the fan chip to manual control."
+msgstr "Nur bei direkter Lüftersteuerung nötig. Schaltet den Lüfterbaustein auf manuelle Steuerung um."
+
+msgid "Value for full speed"
+msgstr "Wert für volle Drehzahl"
+
+msgid "Required for direct fan control. The raw value that makes this fan spin fastest. Some boards wire the signal inverted, where 1 is full speed and 255 stops the fan. Without this value and the slowest one, the fan is left alone."
+msgstr "Erforderlich für die direkte Lüftersteuerung. Der Rohwert, bei dem der Lüfter am schnellsten dreht. Auf manchen Platinen ist das Signal invertiert: 1 bedeutet dann volle Drehzahl und 255 Stillstand. Fehlt dieser Wert oder der für die langsamste Stufe, bleibt der Lüfter unangetastet."
+
+msgid "Value for the slowest setting"
+msgstr "Wert für die niedrigste Drehzahl"
+
+msgid "Required for direct fan control. The opposite end of the same scale. Together with full speed it states the polarity, and it shows the fan speed as a percentage. Never written to the hardware."
+msgstr "Erforderlich für die direkte Lüftersteuerung. Der Gegenwert am anderen Ende derselben Skala. Zusammen mit dem Wert für volle Drehzahl legt er die Polarität fest und dient zur Anzeige der Drehzahl in Prozent. Wird nie an die Hardware geschrieben."
+
+msgid "Modem temperature source"
+msgstr "Quelle der Modemtemperatur"
+
+msgid "Automatic tries the known modem commands in turn. Select your manufacturer if detection fails."
+msgstr "„Automatisch\" probiert die bekannten Modem-Kommandos nacheinander. Wählen Sie Ihren Hersteller, falls die Erkennung fehlschlägt."
+
+msgid "Quectel (AT+QTEMP)"
+msgstr "Quectel (AT+QTEMP)"
+
+msgid "Fibocom (AT+GTSENRDTEMP)"
+msgstr "Fibocom (AT+GTSENRDTEMP)"
+
+msgid "File"
+msgstr "Datei"
+
+msgid "Command"
+msgstr "Kommando"
+
+msgid "No modem"
+msgstr "Kein Modem"
+
+msgid "Modem control port"
+msgstr "Steuerport des Modems"
+
+msgid "Serial port the commands are sent to. Automatic checks the usual ports."
+msgstr "Serieller Anschluss, über den die Kommandos an das Modem gehen. „Automatisch\" sucht die üblichen Anschlüsse ab."
+
+msgid "Lock file for modem access"
+msgstr "Sperrdatei für Modemzugriffe"
+
+msgid "Prevents this service and other programs from sending commands to the modem at the same time. Point those programs at the same file."
+msgstr "Verhindert, dass dieser Dienst und andere Programme gleichzeitig Kommandos an das Modem senden. Richten Sie diese Programme auf dieselbe Datei aus."
+
+msgid "Temperature file"
+msgstr "Temperaturdatei"
+
+msgid "Own temperature source"
+msgstr "Eigene Temperaturquelle"
+
+msgid "Reads /etc/thermal-guard/hooks/modem-temp, which has to print the temperature in degrees as a whole number. Place the file over SSH; it runs as root and is deliberately not editable from here."
+msgstr "Liest /etc/thermal-guard/hooks/modem-temp aus. Das Skript muss die Temperatur in Grad als ganze Zahl ausgeben. Legen Sie die Datei per SSH an. Sie wird als root ausgeführt und ist bewusst nicht über diese Oberfläche bearbeitbar."
+
+msgid "Action at stage 2 of 3"
+msgstr "Aktion bei Stufe 2 von 3"
+
+msgid "Switch the modem radio off"
+msgstr "Mobilfunk abschalten"
+
+msgid "Switch Wi-Fi off"
+msgstr "WLAN abschalten"
+
+msgid "Take a network interface down"
+msgstr "Netzwerkschnittstelle herunterfahren"
+
+msgid "Run own script"
+msgstr "Eigenes Skript ausführen"
+
+msgid "Nothing"
+msgstr "Nichts"
+
+msgid "Script at stage 2 of 3"
+msgstr "Skript bei Stufe 2 von 3"
+
+msgid "Runs /etc/thermal-guard/hooks/stage1. Place the file over SSH and make it executable."
+msgstr "Führt /etc/thermal-guard/hooks/stage1 aus. Legen Sie die Datei per SSH an und machen Sie sie ausführbar."
+
+msgid "Action at stage 3 of 3"
+msgstr "Aktion bei Stufe 3 von 3"
+
+msgid "Script at stage 3 of 3"
+msgstr "Skript bei Stufe 3 von 3"
+
+msgid "How the modem is switched off"
+msgstr "Art der Modem-Abschaltung"
+
+msgid "Flight mode suits most modems. Use minimum function for a modem that does not accept flight mode. Either way the modem is asked afterwards (AT+CFUN?), and a modem that does not confirm counts as a failed stage."
+msgstr "Der Flugmodus passt für die meisten Modems. Minimalbetrieb ist für Modems gedacht, die den Flugmodus nicht annehmen. In beiden Fällen wird das Modem anschließend abgefragt (AT+CFUN?); bestätigt es den Zustand nicht, gilt die Stufe als fehlgeschlagen."
+
+msgid "Flight mode (AT+CFUN=4)"
+msgstr "Flugmodus (AT+CFUN=4)"
+
+msgid "Minimum function (AT+CFUN=0)"
+msgstr "Minimalbetrieb (AT+CFUN=0)"
+
+msgid "Interface to take down"
+msgstr "Herunterzufahrende Schnittstelle"
+
+msgid "Network interface taken down by the interface action and brought back up when the stages are cleared. Empty uses the modem network interface."
+msgstr "Netzwerkschnittstelle, die die Schnittstellen-Aktion herunterfährt und beim Zurücksetzen der Stufen wieder startet. Leer bedeutet: die Netzwerkschnittstelle des Modems."
+
+msgid "Runs /etc/thermal-guard/hooks/stage2. Place the file over SSH and make it executable."
+msgstr "Führt /etc/thermal-guard/hooks/stage2 aus. Legen Sie die Datei per SSH an und machen Sie sie ausführbar."
+
+msgid "Notification address"
+msgstr "Benachrichtigungsadresse"
+
+msgid "The warning text is posted here. Works with ntfy, Gotify, Matrix, Slack and anything else that accepts a plain POST body."
+msgstr "An diese Adresse wird der Warntext gesendet. Funktioniert mit ntfy, Gotify, Matrix, Slack und jedem anderen Dienst, der einen einfachen POST-Inhalt entgegennimmt."
+
+msgid "Must be an http:// or https:// address without quotes or spaces"
+msgstr "Muss eine http:// oder https://-Adresse ohne Anführungszeichen und Leerzeichen sein"
+
+msgid "Additional header"
+msgstr "Zusätzlicher Header"
+
+msgid "Sent with the notification, for example an authorisation token. Needs curl installed; the smaller uclient-fetch cannot send headers."
+msgstr "Wird mit der Benachrichtigung mitgesendet, zum Beispiel ein Autorisierungstoken. Erfordert ein installiertes curl; das kleinere uclient-fetch kann keine Header senden."
+
+msgid "Must be printable text without quotes or backslashes"
+msgstr "Muss druckbarer Text ohne Anführungszeichen und Backslashes sein"
+
+msgid "Modem network interface"
+msgstr "Netzwerkschnittstelle des Modems"
+
+msgid "Lets the service tell whether another internet connection exists, so a message from stage 2 of 3 on goes out or waits in the queue. Also the interface the interface action takes when none is set."
+msgstr "Damit erkennt der Dienst, ob eine andere Internetverbindung besteht, und entscheidet ab Stufe 2 von 3, ob eine Nachricht sofort hinausgeht oder in der Warteschlange wartet. Außerdem die Netzwerkschnittstelle, die die Schnittstellen-Aktion verwendet, wenn keine eingestellt ist."
+
+msgid "Wi-Fi %d"
+msgstr "WLAN %d"
+
+msgid "Ethernet"
+msgstr "Ethernet"
+
+msgid "SSD"
+msgstr "SSD"
+
+msgid "modem radio off"
+msgstr "Mobilfunk abgeschaltet"
+
+msgid "Wi-Fi off"
+msgstr "WLAN abgeschaltet"
+
+msgid "network interface down"
+msgstr "Netzwerkschnittstelle heruntergefahren"
+
+msgid "custom command"
+msgstr "eigenes Skript"
+
+msgid "no action"
+msgstr "keine Aktion"
+
+msgid "unknown action"
+msgstr "unbekannte Aktion"
+
+msgid "Stage 1 of 3 active: fan at full speed"
+msgstr "Stufe 1 von 3 aktiv: Lüfter auf voller Drehzahl"
+
+msgid "Stage 1 of 3 active: warning, fan left to its own controller"
+msgstr "Stufe 1 von 3 aktiv: Warnung, Lüfter bleibt bei seiner eigenen Regelung"
+
+msgid "Stage 2 of 3 active: %s"
+msgstr "Stufe 2 von 3 aktiv: %s"
+
+msgid "Stage 3 of 3 active: %s"
+msgstr "Stufe 3 von 3 aktiv: %s"
+
+msgid "No intervention, temperatures within range"
+msgstr "Kein Eingriff, Temperaturen im normalen Bereich"
+
+msgid "%d s ago"
+msgstr "vor %d s"
+
+msgid "%d min ago"
+msgstr "vor %d min"
+
+msgid "Current temperatures and protection state. Thresholds and actions are configured under System, Thermal Guard."
+msgstr "Aktuelle Temperaturen und Schutzzustand. Schwellen und Aktionen werden unter System, Thermal Guard eingestellt."
+
+msgid "No data yet. Check whether the Thermal Guard service is running."
+msgstr "Noch keine Daten. Prüfen Sie, ob der Dienst Thermal Guard läuft."
+
+msgid "Processor temperature"
+msgstr "Prozessortemperatur"
+
+msgid "Modem temperature"
+msgstr "Modemtemperatur"
+
+msgid "no reading"
+msgstr "kein Messwert"
+
+msgid "fan step %d of %d"
+msgstr "Lüfterstufe %d von %d"
+
+msgid "Fan control"
+msgstr "Lüftersteuerung"
+
+msgid "Another service is controlling this fan"
+msgstr "Der Lüfter wird von einem anderen Dienst gesteuert"
+
+msgid "This device does not report any temperature"
+msgstr "Dieses Gerät meldet keine Temperatur"
+
+msgid "No thermal sensor was found, so the processor is not watched on this hardware. The modem thresholds still apply while the modem reports a temperature."
+msgstr "Es wurde kein Temperatursensor gefunden, der Prozessor wird auf dieser Hardware daher nicht überwacht. Die Modemschwellen gelten weiter, solange das Modem eine Temperatur meldet."
+
+msgid "The service is not running. Protection stages stay applied and the fan is not handed back."
+msgstr "Der Dienst läuft nicht. Aktive Schutzstufen bleiben bestehen und der Lüfter wird nicht freigegeben."
+
+msgid "The service is not running. Temperatures are not being watched."
+msgstr "Der Dienst läuft nicht. Die Temperaturen werden nicht überwacht."
+
+msgid "The service is paused. Protection stages stay applied and the fan is not handed back."
+msgstr "Der Dienst ist angehalten. Aktive Schutzstufen bleiben bestehen und der Lüfter wird nicht freigegeben."
+
+msgid "The service is paused. Temperatures are not being watched."
+msgstr "Der Dienst ist angehalten. Die Temperaturen werden nicht überwacht."
+
+msgid "Protection stages stay active until you clear them. Clear them once the cause is fixed, for example a replaced fan."
+msgstr "Schutzstufen bleiben aktiv, bis Sie sie zurücksetzen. Setzen Sie sie zurück, sobald die Ursache behoben ist, etwa nach dem Austausch des Lüfters."
+
+msgid "Clear protection stages"
+msgstr "Schutzstufen zurücksetzen"
+
+msgid "Last reading: %s"
+msgstr "Letzte Messung: %s"
+
+msgid "modem source: %s"
+msgstr "Modemquelle: %s"
+
+msgid "fan mode: %s"
+msgstr "Lüftersteuerung: %s"
+
+msgid "version %s"
+msgstr "Version %s"
+
+msgid "Clearing failed: %s"
+msgstr "Zurücksetzen fehlgeschlagen: %s"
+
+msgid "Protection stages cleared."
+msgstr "Schutzstufen zurückgesetzt."
+
+msgid "Temperatures"
+msgstr "Temperaturen"
+
+msgid "Processor"
+msgstr "Prozessor"
+
+msgid "protection stage %d active"
+msgstr "Schutzstufe %d aktiv"
+
+msgid "Fan switching temperatures"
+msgstr "Schalttemperaturen des Lüfters"
+
+msgid "lowered by %d K for the modem"
+msgstr "für das Modem um %d K abgesenkt"
+
+msgid "The firmware brings new fan switching temperatures (%s °C). Your own values still apply; review them under System, Thermal Guard, Fan."
+msgstr "Die Firmware bringt neue Schalttemperaturen für den Lüfter mit (%s °C). Ihre eigenen Werte gelten weiter; prüfen Sie sie unter System, Thermal Guard, Lüfter."
+
+msgid "the kernel knows no fan on this device"
+msgstr "der Kernel kennt auf diesem Gerät keinen Lüfter"
+
+msgid "no thermal zone drives the fan"
+msgstr "keine Thermalzone steuert den Lüfter"
+
+msgid "the fan's thermal zone is not under /sys/class/thermal"
+msgstr "die Thermalzone des Lüfters liegt nicht unter /sys/class/thermal"
+
+msgid "the fan is not bound to any switching temperature"
+msgstr "der Lüfter ist an keine Schalttemperatur gebunden"
+
+msgid "the switching temperatures cannot be changed"
+msgstr "die Schalttemperaturen lassen sich nicht ändern"
+
+msgid "unknown reason"
+msgstr "unbekannter Grund"
+
+msgid "Managed by this service, switching temperatures now %s °C"
+msgstr "Von diesem Dienst verwaltet, Schalttemperaturen derzeit %s °C"
+
+msgid "Not possible on this device: %s"
+msgstr "Auf diesem Gerät nicht möglich: %s"
+
+msgid "Not managed by this service"
+msgstr "Nicht von diesem Dienst verwaltet"
+
+msgid "Speed the fan up for the modem"
+msgstr "Lüfter für das Modem hochregeln"
+
+msgid "Where the kernel drives the fan, its switching temperatures are lowered while the modem runs hotter than the processor, so the fan speeds up for the modem as well. They only ever go down, never above the base values. A missing modem reading keeps them where they are."
+msgstr "Wo der Kernel den Lüfter steuert, werden seine Schalttemperaturen abgesenkt, solange das Modem wärmer ist als der Prozessor. So dreht der Lüfter auch für das Modem hoch. Die Werte werden nur abgesenkt, nie über die Grundwerte angehoben. Fehlt ein Messwert des Modems, bleiben sie, wo sie sind."
+
+msgid "Off"
+msgstr "Aus"
+
+msgid "Follow the modem temperature"
+msgstr "Der Modemtemperatur folgen"
+
+msgid "Modem allowance"
+msgstr "Spielraum für das Modem"
+
+msgid "Degrees the modem may run above the processor before the switching temperatures are lowered."
+msgstr "Grad, um die das Modem wärmer sein darf als der Prozessor, bevor die Schalttemperaturen abgesenkt werden."
+
+msgid "Base values in degrees at which the kernel moves the fan one step up, lowest first, one value per step. Empty uses the values of the installed firmware: %s °C."
+msgstr "Grundwerte in Grad, bei denen der Kernel den Lüfter eine Stufe höher schaltet, der niedrigste zuerst, ein Wert je Stufe. Leer gelten die Werte der installierten Firmware: %s °C."
+
+msgid "Base values in degrees at which the kernel moves the fan one step up, lowest first, one value per step. Empty uses the values of the installed firmware."
+msgstr "Grundwerte in Grad, bei denen der Kernel den Lüfter eine Stufe höher schaltet, der niedrigste zuerst, ein Wert je Stufe. Leer gelten die Werte der installierten Firmware."
+
+msgid "Must be between 20 and 95"
+msgstr "Muss zwischen 20 und 95 liegen"
+
+msgid "Each value must be higher than the one before"
+msgstr "Jeder Wert muss höher sein als der vorige"
+
+msgid "Must be below %d, the temperature at which the kernel itself intervenes"
+msgstr "Muss unter %d liegen, der Temperatur, bei der der Kernel selbst eingreift"
+
+msgid "Needs exactly %d values, one per fan step"
+msgstr "Genau %d Werte nötig, einer je Lüfterstufe"
+
+msgid "New firmware values"
+msgstr "Neue Werte der Firmware"
+
+msgid "The installed firmware now uses %s °C. Your own base values were set for an earlier firmware and still apply."
+msgstr "Die installierte Firmware verwendet jetzt %s °C. Ihre eigenen Grundwerte wurden für eine frühere Firmware eingestellt und gelten weiter."
+
+msgid "Use the firmware values"
+msgstr "Werte der Firmware übernehmen"
+
+msgid "Keep my values"
+msgstr "Eigene Werte behalten"
+
+msgid "Recording the firmware values failed: %s"
+msgstr "Die Firmware-Werte konnten nicht festgehalten werden: %s"
+
+msgid "Firmware values recorded. The notice goes away with the next check."
+msgstr "Firmware-Werte festgehalten. Der Hinweis verschwindet mit der nächsten Prüfung."
+
+msgid "Fan steps of the firmware"
+msgstr "Lüfterstufen der Firmware"
+
+msgid "Raw value per fan step from the device tree, with the duty cycle of the signal. They belong to the fan that is fitted and change only with a new firmware image."
+msgstr "Rohwert je Lüfterstufe aus dem Device Tree, mit dem Tastverhältnis des Signals. Sie gehören zum eingebauten Lüfter und ändern sich nur mit einer neuen Firmware."
+
+msgid "step %d: %d (%d %%)"
+msgstr "Stufe %d: %d (%d %%)"
diff --git a/openwrt-thermal-guard/luci-app-thermal-guard/po/templates/thermal-guard.pot b/openwrt-thermal-guard/luci-app-thermal-guard/po/templates/thermal-guard.pot
new file mode 100644
index 000000000..3edd45ede
--- /dev/null
+++ b/openwrt-thermal-guard/luci-app-thermal-guard/po/templates/thermal-guard.pot
@@ -0,0 +1,504 @@
+msgid ""
+msgstr ""
+"Project-Id-Version: luci-app-thermal-guard\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+msgid "Enter a whole number"
+msgstr ""
+
+msgid "Must be above %s (%d)"
+msgstr ""
+
+msgid "Must be below %s (%d)"
+msgstr ""
+
+msgid "Must be an absolute path without \"..\""
+msgstr ""
+
+msgid "Path must start with %s"
+msgstr ""
+
+msgid "Thermal Guard"
+msgstr ""
+
+msgid "Monitors the temperature of the main processor and the modem. If the device gets too hot, it intervenes in up to three protection stages. Stages stay active until you clear them on the status page."
+msgstr ""
+
+msgid "General"
+msgstr ""
+
+msgid "Thresholds"
+msgstr ""
+
+msgid "Temperatures at which each protection stage starts. What actually happens at stage 2 and 3 is set on the Actions tab."
+msgstr ""
+
+msgid "Fan"
+msgstr ""
+
+msgid "Modem"
+msgstr ""
+
+msgid "Actions"
+msgstr ""
+
+msgid "What happens when a stage starts. Stage 1 of 3 warns and, if this service drives the fan (Fan tab), sets it to full speed. That cannot be changed."
+msgstr ""
+
+msgid "Enabled"
+msgstr ""
+
+msgid "Switching this off pauses the temperature checks. Protection stages that are already active stay applied and the fan is not handed back, so a broken fan cannot be hidden by a checkbox. Use Clear on the status page for that."
+msgstr ""
+
+msgid "Interval"
+msgstr ""
+
+msgid "Seconds between two temperature readings. Values below five seconds are treated as five."
+msgstr ""
+
+msgid "Processor temperature source"
+msgstr ""
+
+msgid "System file the processor temperature is read from. The default fits most devices; change it only if your device reports its temperature elsewhere."
+msgstr ""
+
+msgid "Processor warning (stage 1 of 3)"
+msgstr ""
+
+msgid "Stage 1 of 3 starts when either temperature reaches its warning level: a warning, and full fan speed if this service drives the fan."
+msgstr ""
+
+msgid "Processor critical"
+msgstr ""
+
+msgid "Processor critical (stage 2 of 3)"
+msgstr ""
+
+msgid "Processor warning"
+msgstr ""
+
+msgid "Processor emergency"
+msgstr ""
+
+msgid "Processor emergency (stage 3 of 3)"
+msgstr ""
+
+msgid "Modem warning (stage 1 of 3)"
+msgstr ""
+
+msgid "Modem critical"
+msgstr ""
+
+msgid "Modem critical (stage 2 of 3)"
+msgstr ""
+
+msgid "Modem warning"
+msgstr ""
+
+msgid "Hold time"
+msgstr ""
+
+msgid "Minutes a stage has to last before the next one starts on time alone: stage 2 of 3 if the temperature has not dropped, stage 3 of 3 if it is still rising."
+msgstr ""
+
+msgid "Hysteresis"
+msgstr ""
+
+msgid "How many degrees the temperature has to fall below the warning level before the device counts as cooled down."
+msgstr ""
+
+msgid "Fan control method"
+msgstr ""
+
+msgid "Leave the fan to the regulator the device already has, unless it has none. Automatic uses the kernel fan control when the device offers it and otherwise leaves the fan alone. It never picks direct control, which needs the fan's polarity."
+msgstr ""
+
+msgid "Automatic"
+msgstr ""
+
+msgid "Kernel fan control"
+msgstr ""
+
+msgid "Direct fan control (PWM)"
+msgstr ""
+
+msgid "Leave the fan alone"
+msgstr ""
+
+msgid "Fan identifier"
+msgstr ""
+
+msgid "Name the kernel uses for the fan. Change it only if the fan is not found automatically."
+msgstr ""
+
+msgid "Control mode to restore"
+msgstr ""
+
+msgid "Control mode handed back to the kernel when the stages are cleared and no earlier control mode was recorded. The default fits almost every device."
+msgstr ""
+
+msgid "Fan speed file"
+msgstr ""
+
+msgid "Only needed for direct fan control."
+msgstr ""
+
+msgid "Fan control file"
+msgstr ""
+
+msgid "Only needed for direct fan control. Switches the fan chip to manual control."
+msgstr ""
+
+msgid "Value for full speed"
+msgstr ""
+
+msgid "Required for direct fan control. The raw value that makes this fan spin fastest. Some boards wire the signal inverted, where 1 is full speed and 255 stops the fan. Without this value and the slowest one, the fan is left alone."
+msgstr ""
+
+msgid "Value for the slowest setting"
+msgstr ""
+
+msgid "Required for direct fan control. The opposite end of the same scale. Together with full speed it states the polarity, and it shows the fan speed as a percentage. Never written to the hardware."
+msgstr ""
+
+msgid "Modem temperature source"
+msgstr ""
+
+msgid "Automatic tries the known modem commands in turn. Select your manufacturer if detection fails."
+msgstr ""
+
+msgid "Quectel (AT+QTEMP)"
+msgstr ""
+
+msgid "Fibocom (AT+GTSENRDTEMP)"
+msgstr ""
+
+msgid "File"
+msgstr ""
+
+msgid "Command"
+msgstr ""
+
+msgid "No modem"
+msgstr ""
+
+msgid "Modem control port"
+msgstr ""
+
+msgid "Serial port the commands are sent to. Automatic checks the usual ports."
+msgstr ""
+
+msgid "Lock file for modem access"
+msgstr ""
+
+msgid "Prevents this service and other programs from sending commands to the modem at the same time. Point those programs at the same file."
+msgstr ""
+
+msgid "Temperature file"
+msgstr ""
+
+msgid "Own temperature source"
+msgstr ""
+
+msgid "Reads /etc/thermal-guard/hooks/modem-temp, which has to print the temperature in degrees as a whole number. Place the file over SSH; it runs as root and is deliberately not editable from here."
+msgstr ""
+
+msgid "Action at stage 2 of 3"
+msgstr ""
+
+msgid "Switch the modem radio off"
+msgstr ""
+
+msgid "Switch Wi-Fi off"
+msgstr ""
+
+msgid "Take a network interface down"
+msgstr ""
+
+msgid "Run own script"
+msgstr ""
+
+msgid "Nothing"
+msgstr ""
+
+msgid "Script at stage 2 of 3"
+msgstr ""
+
+msgid "Runs /etc/thermal-guard/hooks/stage1. Place the file over SSH and make it executable."
+msgstr ""
+
+msgid "Action at stage 3 of 3"
+msgstr ""
+
+msgid "Script at stage 3 of 3"
+msgstr ""
+
+msgid "How the modem is switched off"
+msgstr ""
+
+msgid "Flight mode suits most modems. Use minimum function for a modem that does not accept flight mode. Either way the modem is asked afterwards (AT+CFUN?), and a modem that does not confirm counts as a failed stage."
+msgstr ""
+
+msgid "Flight mode (AT+CFUN=4)"
+msgstr ""
+
+msgid "Minimum function (AT+CFUN=0)"
+msgstr ""
+
+msgid "Interface to take down"
+msgstr ""
+
+msgid "Network interface taken down by the interface action and brought back up when the stages are cleared. Empty uses the modem network interface."
+msgstr ""
+
+msgid "Runs /etc/thermal-guard/hooks/stage2. Place the file over SSH and make it executable."
+msgstr ""
+
+msgid "Notification address"
+msgstr ""
+
+msgid "The warning text is posted here. Works with ntfy, Gotify, Matrix, Slack and anything else that accepts a plain POST body."
+msgstr ""
+
+msgid "Must be an http:// or https:// address without quotes or spaces"
+msgstr ""
+
+msgid "Additional header"
+msgstr ""
+
+msgid "Sent with the notification, for example an authorisation token. Needs curl installed; the smaller uclient-fetch cannot send headers."
+msgstr ""
+
+msgid "Must be printable text without quotes or backslashes"
+msgstr ""
+
+msgid "Modem network interface"
+msgstr ""
+
+msgid "Lets the service tell whether another internet connection exists, so a message from stage 2 of 3 on goes out or waits in the queue. Also the interface the interface action takes when none is set."
+msgstr ""
+
+msgid "Wi-Fi %d"
+msgstr ""
+
+msgid "Ethernet"
+msgstr ""
+
+msgid "SSD"
+msgstr ""
+
+msgid "modem radio off"
+msgstr ""
+
+msgid "Wi-Fi off"
+msgstr ""
+
+msgid "network interface down"
+msgstr ""
+
+msgid "custom command"
+msgstr ""
+
+msgid "no action"
+msgstr ""
+
+msgid "unknown action"
+msgstr ""
+
+msgid "Stage 1 of 3 active: fan at full speed"
+msgstr ""
+
+msgid "Stage 1 of 3 active: warning, fan left to its own controller"
+msgstr ""
+
+msgid "Stage 2 of 3 active: %s"
+msgstr ""
+
+msgid "Stage 3 of 3 active: %s"
+msgstr ""
+
+msgid "No intervention, temperatures within range"
+msgstr ""
+
+msgid "%d s ago"
+msgstr ""
+
+msgid "%d min ago"
+msgstr ""
+
+msgid "Current temperatures and protection state. Thresholds and actions are configured under System, Thermal Guard."
+msgstr ""
+
+msgid "No data yet. Check whether the Thermal Guard service is running."
+msgstr ""
+
+msgid "Processor temperature"
+msgstr ""
+
+msgid "Modem temperature"
+msgstr ""
+
+msgid "no reading"
+msgstr ""
+
+msgid "fan step %d of %d"
+msgstr ""
+
+msgid "Fan control"
+msgstr ""
+
+msgid "Another service is controlling this fan"
+msgstr ""
+
+msgid "This device does not report any temperature"
+msgstr ""
+
+msgid "No thermal sensor was found, so the processor is not watched on this hardware. The modem thresholds still apply while the modem reports a temperature."
+msgstr ""
+
+msgid "The service is not running. Protection stages stay applied and the fan is not handed back."
+msgstr ""
+
+msgid "The service is not running. Temperatures are not being watched."
+msgstr ""
+
+msgid "The service is paused. Protection stages stay applied and the fan is not handed back."
+msgstr ""
+
+msgid "The service is paused. Temperatures are not being watched."
+msgstr ""
+
+msgid "Protection stages stay active until you clear them. Clear them once the cause is fixed, for example a replaced fan."
+msgstr ""
+
+msgid "Clear protection stages"
+msgstr ""
+
+msgid "Last reading: %s"
+msgstr ""
+
+msgid "modem source: %s"
+msgstr ""
+
+msgid "fan mode: %s"
+msgstr ""
+
+msgid "version %s"
+msgstr ""
+
+msgid "Clearing failed: %s"
+msgstr ""
+
+msgid "Protection stages cleared."
+msgstr ""
+
+msgid "Temperatures"
+msgstr ""
+
+msgid "Processor"
+msgstr ""
+
+msgid "protection stage %d active"
+msgstr ""
+
+msgid "Fan switching temperatures"
+msgstr ""
+
+msgid "lowered by %d K for the modem"
+msgstr ""
+
+msgid "The firmware brings new fan switching temperatures (%s °C). Your own values still apply; review them under System, Thermal Guard, Fan."
+msgstr ""
+
+msgid "the kernel knows no fan on this device"
+msgstr ""
+
+msgid "no thermal zone drives the fan"
+msgstr ""
+
+msgid "the fan's thermal zone is not under /sys/class/thermal"
+msgstr ""
+
+msgid "the fan is not bound to any switching temperature"
+msgstr ""
+
+msgid "the switching temperatures cannot be changed"
+msgstr ""
+
+msgid "unknown reason"
+msgstr ""
+
+msgid "Managed by this service, switching temperatures now %s °C"
+msgstr ""
+
+msgid "Not possible on this device: %s"
+msgstr ""
+
+msgid "Not managed by this service"
+msgstr ""
+
+msgid "Speed the fan up for the modem"
+msgstr ""
+
+msgid "Where the kernel drives the fan, its switching temperatures are lowered while the modem runs hotter than the processor, so the fan speeds up for the modem as well. They only ever go down, never above the base values. A missing modem reading keeps them where they are."
+msgstr ""
+
+msgid "Off"
+msgstr ""
+
+msgid "Follow the modem temperature"
+msgstr ""
+
+msgid "Modem allowance"
+msgstr ""
+
+msgid "Degrees the modem may run above the processor before the switching temperatures are lowered."
+msgstr ""
+
+msgid "Base values in degrees at which the kernel moves the fan one step up, lowest first, one value per step. Empty uses the values of the installed firmware: %s °C."
+msgstr ""
+
+msgid "Base values in degrees at which the kernel moves the fan one step up, lowest first, one value per step. Empty uses the values of the installed firmware."
+msgstr ""
+
+msgid "Must be between 20 and 95"
+msgstr ""
+
+msgid "Each value must be higher than the one before"
+msgstr ""
+
+msgid "Must be below %d, the temperature at which the kernel itself intervenes"
+msgstr ""
+
+msgid "Needs exactly %d values, one per fan step"
+msgstr ""
+
+msgid "New firmware values"
+msgstr ""
+
+msgid "The installed firmware now uses %s °C. Your own base values were set for an earlier firmware and still apply."
+msgstr ""
+
+msgid "Use the firmware values"
+msgstr ""
+
+msgid "Keep my values"
+msgstr ""
+
+msgid "Recording the firmware values failed: %s"
+msgstr ""
+
+msgid "Firmware values recorded. The notice goes away with the next check."
+msgstr ""
+
+msgid "Fan steps of the firmware"
+msgstr ""
+
+msgid "Raw value per fan step from the device tree, with the duty cycle of the signal. They belong to the fan that is fitted and change only with a new firmware image."
+msgstr ""
+
+msgid "step %d: %d (%d %%)"
+msgstr ""
diff --git a/openwrt-thermal-guard/luci-app-thermal-guard/root/usr/share/luci/menu.d/luci-app-thermal-guard.json b/openwrt-thermal-guard/luci-app-thermal-guard/root/usr/share/luci/menu.d/luci-app-thermal-guard.json
new file mode 100644
index 000000000..bf331aa56
--- /dev/null
+++ b/openwrt-thermal-guard/luci-app-thermal-guard/root/usr/share/luci/menu.d/luci-app-thermal-guard.json
@@ -0,0 +1,26 @@
+{
+	"admin/status/thermal-guard": {
+		"title": "Thermal Guard",
+		"order": 60,
+		"action": {
+			"type": "view",
+			"path": "thermal-guard/monitor"
+		},
+		"depends": {
+			"acl": [ "luci-app-thermal-guard" ]
+		}
+	},
+
+	"admin/system/thermal-guard": {
+		"title": "Thermal Guard",
+		"order": 62,
+		"action": {
+			"type": "view",
+			"path": "thermal-guard/config"
+		},
+		"depends": {
+			"acl": [ "luci-app-thermal-guard" ],
+			"uci": { "thermal-guard": true }
+		}
+	}
+}
diff --git a/openwrt-thermal-guard/luci-app-thermal-guard/root/usr/share/rpcd/acl.d/luci-app-thermal-guard.json b/openwrt-thermal-guard/luci-app-thermal-guard/root/usr/share/rpcd/acl.d/luci-app-thermal-guard.json
new file mode 100644
index 000000000..6e3af4b7e
--- /dev/null
+++ b/openwrt-thermal-guard/luci-app-thermal-guard/root/usr/share/rpcd/acl.d/luci-app-thermal-guard.json
@@ -0,0 +1,25 @@
+{
+	"luci-app-thermal-guard": {
+		"description": "Read the thermal-guard status, edit its configuration, clear stages and record firmware trips",
+		"read": {
+			"file": {
+				"/var/run/thermal-guard.status": [ "read" ],
+				"/tmp/run/thermal-guard.status": [ "read" ]
+			},
+			"ubus": {
+				"file": [ "read" ]
+			},
+			"uci": [ "thermal-guard" ]
+		},
+		"write": {
+			"file": {
+				"/usr/sbin/thermal-guard reset": [ "exec" ],
+				"/usr/sbin/thermal-guard trips-keep": [ "exec" ]
+			},
+			"ubus": {
+				"file": [ "exec" ]
+			},
+			"uci": [ "thermal-guard" ]
+		}
+	}
+}
diff --git a/openwrt-thermal-guard/screenshots/overview-bpi-r3-mini.png b/openwrt-thermal-guard/screenshots/overview-bpi-r3-mini.png
new file mode 100644
index 000000000..5fe3e3969
Binary files /dev/null and b/openwrt-thermal-guard/screenshots/overview-bpi-r3-mini.png differ
diff --git a/openwrt-thermal-guard/screenshots/overview-gl-x3000.png b/openwrt-thermal-guard/screenshots/overview-gl-x3000.png
new file mode 100644
index 000000000..7f6607101
Binary files /dev/null and b/openwrt-thermal-guard/screenshots/overview-gl-x3000.png differ
diff --git a/openwrt-thermal-guard/screenshots/settings-actions.png b/openwrt-thermal-guard/screenshots/settings-actions.png
new file mode 100644
index 000000000..9e28da4b3
Binary files /dev/null and b/openwrt-thermal-guard/screenshots/settings-actions.png differ
diff --git a/openwrt-thermal-guard/screenshots/settings-fan.png b/openwrt-thermal-guard/screenshots/settings-fan.png
new file mode 100644
index 000000000..bc0976c46
Binary files /dev/null and b/openwrt-thermal-guard/screenshots/settings-fan.png differ
diff --git a/openwrt-thermal-guard/screenshots/settings-general.png b/openwrt-thermal-guard/screenshots/settings-general.png
new file mode 100644
index 000000000..33bccebe1
Binary files /dev/null and b/openwrt-thermal-guard/screenshots/settings-general.png differ
diff --git a/openwrt-thermal-guard/screenshots/settings-modem-fibocom.png b/openwrt-thermal-guard/screenshots/settings-modem-fibocom.png
new file mode 100644
index 000000000..b63b88379
Binary files /dev/null and b/openwrt-thermal-guard/screenshots/settings-modem-fibocom.png differ
diff --git a/openwrt-thermal-guard/screenshots/settings-modem-quectel.png b/openwrt-thermal-guard/screenshots/settings-modem-quectel.png
new file mode 100644
index 000000000..80f5f2eee
Binary files /dev/null and b/openwrt-thermal-guard/screenshots/settings-modem-quectel.png differ
diff --git a/openwrt-thermal-guard/screenshots/settings-thresholds.png b/openwrt-thermal-guard/screenshots/settings-thresholds.png
new file mode 100644
index 000000000..5d790ae72
Binary files /dev/null and b/openwrt-thermal-guard/screenshots/settings-thresholds.png differ
diff --git a/openwrt-thermal-guard/screenshots/status-bpi-r3-mini.png b/openwrt-thermal-guard/screenshots/status-bpi-r3-mini.png
new file mode 100644
index 000000000..2f5d7f212
Binary files /dev/null and b/openwrt-thermal-guard/screenshots/status-bpi-r3-mini.png differ
diff --git a/openwrt-thermal-guard/screenshots/status-gl-x3000.png b/openwrt-thermal-guard/screenshots/status-gl-x3000.png
new file mode 100644
index 000000000..71fb1a02c
Binary files /dev/null and b/openwrt-thermal-guard/screenshots/status-gl-x3000.png differ
diff --git a/openwrt-thermal-guard/tests/build-jsonfilter.sh b/openwrt-thermal-guard/tests/build-jsonfilter.sh
new file mode 100755
index 000000000..a666a73d3
--- /dev/null
+++ b/openwrt-thermal-guard/tests/build-jsonfilter.sh
@@ -0,0 +1,39 @@
+#!/bin/sh
+# shellcheck shell=busybox
+# SPDX-License-Identifier: GPL-2.0-only
+# Builds jsonfilter for the test suites on a development host or CI runner.
+# It comes from jsonpath, linked against a static libubox, both at the
+# commits the ImmortalWrt image uses. Needs git, cmake, a C compiler and the
+# json-c headers (Ubuntu: cmake libjson-c-dev). The binary lands in
+# /bin/jsonfilter.
+
+set -eu
+
+LIBUBOX_REF=7dd127841e82eb1cfb61185da37dde7b9bd9ba6d
+JSONPATH_REF=b9034210bd331749673416c6bf389cccd4e23610
+
+[ $# -eq 1 ] || { echo "usage: build-jsonfilter.sh " >&2; exit 2; }
+mkdir -p "$1"
+out=$(cd "$1" && pwd)
+src="$out/src"
+
+fetch() { # $1 project, $2 commit
+	[ -d "$src/$1" ] || git clone -q "https://git.openwrt.org/project/$1.git" "$src/$1"
+	git -C "$src/$1" checkout -q "$2"
+}
+fetch libubox "$LIBUBOX_REF"
+fetch jsonpath "$JSONPATH_REF"
+
+cmake -S "$src/libubox" -B "$src/libubox/build" -DBUILD_LUA=OFF -DBUILD_EXAMPLES=OFF \
+	> /dev/null
+cmake --build "$src/libubox/build" --target ubox-static > /dev/null
+mkdir -p "$out/include/libubox" "$out/lib" "$out/bin"
+cp "$src"/libubox/*.h "$out/include/libubox/"
+cp "$src/libubox/build/libubox.a" "$out/lib/"
+
+# jsonpath builds in its source tree, its parser generator uses relative paths.
+cmake -S "$src/jsonpath" -B "$src/jsonpath" -DCMAKE_INCLUDE_PATH="$out/include" \
+	-DCMAKE_EXE_LINKER_FLAGS="-L$out/lib" > /dev/null
+cmake --build "$src/jsonpath" > /dev/null
+cp "$src/jsonpath/jsonpath" "$out/bin/jsonfilter"
+echo "$out/bin/jsonfilter"
diff --git a/openwrt-thermal-guard/tests/check-quoted-newlines.py b/openwrt-thermal-guard/tests/check-quoted-newlines.py
new file mode 100755
index 000000000..7292d0f2f
--- /dev/null
+++ b/openwrt-thermal-guard/tests/check-quoted-newlines.py
@@ -0,0 +1,130 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: GPL-2.0-only
+"""Report quoted strings in shell files that contain a real line break.
+
+A line end has to come from an escape (printf '%s\n'), not from the source
+text: an editor or a CRLF checkout changes the latter without a trace, and
+shellcheck does not look. Heredocs are skipped, and so are awk and sed
+programs, whose text spans lines on purpose. In double quotes a break inside
+$( ) does not count, that is a command spanning lines.
+
+Usage: check-quoted-newlines.py FILE...   exit 1 when anything is found
+       check-quoted-newlines.py --selftest
+"""
+
+import os
+import re
+import sys
+import tempfile
+
+HEREDOC = re.compile(r"<<-?\s*['\"]?([A-Za-z_][A-Za-z0-9_]*)['\"]?")
+PROGRAM = re.compile(r"\b(awk|sed)\b")
+SUBST = re.compile(r"\$\((?:[^()]|\([^()]*\))*\)")
+
+
+def closing_double(text, start):
+    """Index of the double quote that ends the string opened before start."""
+    i, depth = start, 0
+    while i < len(text):
+        c = text[i]
+        if c == "\\":
+            i += 2
+            continue
+        if text.startswith("$(", i):
+            depth += 1
+            i += 2
+            continue
+        if c == ")" and depth:
+            depth -= 1
+        elif c == '"' and not depth:
+            return i
+        i += 1
+    return len(text)
+
+
+def scan(path):
+    """Yields (line, first characters) for every string with a line break."""
+    text = open(path, encoding="utf-8").read()
+    i, line, heredoc = 0, 1, None
+    while i < len(text):
+        c = text[i]
+        if heredoc:
+            end = text.find("\n", i)
+            if end < 0:
+                return
+            if text[i:end].strip() == heredoc:
+                heredoc = None
+            i, line = end + 1, line + 1
+            continue
+        if c == "\n":
+            i, line = i + 1, line + 1
+            continue
+        if c == "#" and (i == 0 or text[i - 1] in " \t\n;"):
+            end = text.find("\n", i)
+            i = len(text) if end < 0 else end
+            continue
+        match = HEREDOC.match(text, i)
+        if match:
+            heredoc = match.group(1)
+            end = text.find("\n", i)
+            i = len(text) if end < 0 else end
+            continue
+        if c == "\\":
+            i += 2
+            continue
+        if c in "'\"":
+            end = text.find("'", i + 1) if c == "'" else closing_double(text, i + 1)
+            if end < 0:
+                end = len(text)
+            body = text[i + 1:end]
+            before = text[text.rfind("\n", 0, i) + 1:i]
+            flat = body if c == "'" else SUBST.sub("", body)
+            if "\n" in flat and not (c == "'" and PROGRAM.search(before)):
+                yield line, body[:40]
+            i, line = end + 1, line + body.count("\n")
+            continue
+        i += 1
+
+
+def check(paths):
+    found = 0
+    for path in paths:
+        for line, head in scan(path):
+            print(f"{path}:{line}: line break inside a quoted string: {head!r}")
+            found += 1
+    return found
+
+
+def selftest():
+    cases = {
+        # These are Python strings: \\n puts the shell escape \n into the
+        # planted file, a bare \n a real line break. Mixing them up tests the
+        # opposite of what the name says.
+        "printf with an escape": ("printf '%s=%s\\n' a b\n", 0),
+        "printf with a real break": ("printf '%s=%s\n' a b\n", 1),
+        "assignment": ('list="$list$t\n"\n', 1),
+        "awk program": ("awk '\n{ print }\n' f\n", 0),
+        "command spanning lines": ('x="$(grep -c \\\n\tfoo f)"\n', 0),
+        "heredoc": ("cat <<'END'\nit's\nEND\n", 0),
+        "comment": ("# don't\necho ok\n", 0),
+    }
+    fail = 0
+    with tempfile.TemporaryDirectory() as tmp:
+        for name, (text, want) in cases.items():
+            path = os.path.join(tmp, "case.sh")
+            with open(path, "w", encoding="utf-8") as f:
+                f.write(text)
+            got = len(list(scan(path)))
+            ok = got == want
+            fail |= not ok
+            print(f"{'ok  ' if ok else 'FAIL'} {name}: {got} found, {want} expected")
+    return fail
+
+
+if __name__ == "__main__":
+    if sys.argv[1:] == ["--selftest"]:
+        sys.exit(1 if selftest() else 0)
+    if not sys.argv[1:]:
+        print(__doc__.strip().splitlines()[-2], file=sys.stderr)
+        sys.exit(2)
+    sys.exit(1 if check(sys.argv[1:]) else 0)
diff --git a/openwrt-thermal-guard/tests/fixtures/wireless-status-bpi-r3-mini.json b/openwrt-thermal-guard/tests/fixtures/wireless-status-bpi-r3-mini.json
new file mode 100644
index 000000000..8f14c0513
--- /dev/null
+++ b/openwrt-thermal-guard/tests/fixtures/wireless-status-bpi-r3-mini.json
@@ -0,0 +1,192 @@
+{
+	"MT7986_1_1": {
+		"up": true,
+		"pending": false,
+		"autostart": true,
+		"disabled": false,
+		"retry_setup_failed": false,
+		"config": {
+			"type": "mtwifi",
+			"band": "2g",
+			"channel": "auto",
+			"htmode": "HE20",
+			"noscan": true,
+			"txpower": 100,
+			"mu_beamformer": true,
+			"dbdc_main": true,
+			"country": "DE"
+		},
+		"interfaces": [
+			{
+				"section": "mgmt_2g",
+				"config": {
+					"network": [
+						"mgmt"
+					],
+					"isolate": true,
+					"device": "MT7986_1_1",
+					"mode": "ap",
+					"encryption": "sae-mixed",
+					"key": "REDACTED",
+					"ssid": "example-ssid",
+					"hidden": false,
+					"ieee80211k": false,
+					"radios": [
+						
+					]
+				},
+				"ifname": "ra0",
+				"vlans": [
+					
+				],
+				"stations": [
+					
+				]
+			},
+			{
+				"section": "gast_2g",
+				"config": {
+					"network": [
+						"gast"
+					],
+					"isolate": true,
+					"device": "MT7986_1_1",
+					"mode": "ap",
+					"encryption": "sae-mixed",
+					"key": "REDACTED",
+					"ssid": "example-ssid",
+					"hidden": false,
+					"ieee80211k": true,
+					"radios": [
+						
+					]
+				},
+				"ifname": "ra1",
+				"vlans": [
+					
+				],
+				"stations": [
+					
+				]
+			},
+			{
+				"section": "iot_2g",
+				"config": {
+					"network": [
+						"iot"
+					],
+					"isolate": true,
+					"device": "MT7986_1_1",
+					"mode": "ap",
+					"encryption": "psk2",
+					"key": "REDACTED",
+					"ssid": "example-ssid",
+					"hidden": false,
+					"ieee80211k": false,
+					"radios": [
+						
+					]
+				},
+				"ifname": "ra2",
+				"vlans": [
+					
+				],
+				"stations": [
+					
+				]
+			},
+			{
+				"section": "yoda_2g",
+				"config": {
+					"network": [
+						"lan"
+					],
+					"device": "MT7986_1_1",
+					"mode": "ap",
+					"encryption": "sae-mixed",
+					"key": "REDACTED",
+					"ssid": "example-ssid",
+					"radios": [
+						
+					]
+				},
+				"ifname": "ra3",
+				"vlans": [
+					
+				],
+				"stations": [
+					
+				]
+			}
+		]
+	},
+	"MT7986_1_2": {
+		"up": true,
+		"pending": false,
+		"autostart": true,
+		"disabled": false,
+		"retry_setup_failed": false,
+		"config": {
+			"type": "mtwifi",
+			"band": "5g",
+			"channel": "auto",
+			"htmode": "HE80",
+			"noscan": false,
+			"txpower": 100,
+			"mu_beamformer": true,
+			"dbdc_main": false,
+			"country": "DE"
+		},
+		"interfaces": [
+			{
+				"section": "yoda_5g",
+				"config": {
+					"network": [
+						"lan"
+					],
+					"device": "MT7986_1_2",
+					"mode": "ap",
+					"encryption": "sae-mixed",
+					"key": "REDACTED",
+					"ssid": "example-ssid",
+					"radios": [
+						
+					]
+				},
+				"ifname": "rax0",
+				"vlans": [
+					
+				],
+				"stations": [
+					
+				]
+			},
+			{
+				"section": "gast_5g",
+				"config": {
+					"network": [
+						"gast"
+					],
+					"isolate": true,
+					"device": "MT7986_1_2",
+					"mode": "ap",
+					"encryption": "sae-mixed",
+					"key": "REDACTED",
+					"ssid": "example-ssid",
+					"hidden": false,
+					"ieee80211k": true,
+					"radios": [
+						
+					]
+				},
+				"ifname": "rax1",
+				"vlans": [
+					
+				],
+				"stations": [
+					
+				]
+			}
+		]
+	}
+}
diff --git a/openwrt-thermal-guard/tests/fixtures/wireless-status-gl-x3000.json b/openwrt-thermal-guard/tests/fixtures/wireless-status-gl-x3000.json
new file mode 100644
index 000000000..c9a5cf414
--- /dev/null
+++ b/openwrt-thermal-guard/tests/fixtures/wireless-status-gl-x3000.json
@@ -0,0 +1,88 @@
+{
+	"radio0": {
+		"up": true,
+		"pending": false,
+		"autostart": true,
+		"disabled": false,
+		"retry_setup_failed": false,
+		"config": {
+			"type": "mac80211",
+			"band": "2g",
+			"cell_density": 0,
+			"channel": "1",
+			"htmode": "HE20",
+			"path": "platform/soc/18000000.wifi"
+		},
+		"interfaces": [
+			{
+				"section": "default_radio0",
+				"config": {
+					"network": [
+						"lan"
+					],
+					"device": [
+						"radio0"
+					],
+					"mode": "ap",
+					"encryption": "sae-mixed",
+					"key": "REDACTED",
+					"ocv": 0,
+					"ssid": "example-ssid",
+					"radios": [
+						
+					]
+				},
+				"ifname": "phy0-ap0",
+				"vlans": [
+					
+				],
+				"stations": [
+					
+				]
+			}
+		]
+	},
+	"radio1": {
+		"up": true,
+		"pending": false,
+		"autostart": true,
+		"disabled": false,
+		"retry_setup_failed": false,
+		"config": {
+			"type": "mac80211",
+			"band": "5g",
+			"cell_density": 0,
+			"channel": "36",
+			"htmode": "HE80",
+			"path": "platform/soc/18000000.wifi+1"
+		},
+		"interfaces": [
+			{
+				"section": "default_radio1",
+				"config": {
+					"network": [
+						"lan"
+					],
+					"device": [
+						"radio1"
+					],
+					"mode": "ap",
+					"encryption": "sae-mixed",
+					"key": "REDACTED",
+					"ocv": 0,
+					"ssid": "example-ssid",
+					"radios": [
+						
+					]
+				},
+				"ifname": "phy1-ap0",
+				"vlans": [
+					
+				],
+				"stations": [
+					
+				]
+			}
+		]
+	}
+}
diff --git a/openwrt-thermal-guard/tests/functions.sh b/openwrt-thermal-guard/tests/functions.sh
new file mode 100644
index 000000000..0f983e4ff
--- /dev/null
+++ b/openwrt-thermal-guard/tests/functions.sh
@@ -0,0 +1,48 @@
+# shellcheck shell=busybox
+# SPDX-License-Identifier: GPL-2.0-only
+# Stand-in for /lib/functions.sh with the two calls thermal-guard makes. Reads
+# the UCI file "$UCI_CONFIG_DIR/" and fills CONFIG_
_