feat(api): add API routes with full state wiring and integration test fixtures

- Add /api routes for agents and proxy resources

- Wire all services into ApiState in service/mod.rs

- Update route tests with all mock services

.gitignore

@@ -161,5 +161,6 @@ target
 **/mutants.out*/
 
 .local/
+.act/
 
 certs/

apps/nxmesh-master/Cargo.toml

@@ -31,6 +31,9 @@ thiserror.workspace = true
 tracing.workspace = true
 tracing-subscriber.workspace = true
 
+#
+anyhow = { version = "1.0.102", features = ["backtrace"] }
+
 # Web
 axum = { workspace = true, features = ["ws"] }
 tower.workspace = true
@@ -87,6 +90,7 @@ zip = { workspace = true }
 rust-embed = { version = "8.11.0", features = [] }
 mime_guess = "2.0.5"
 axum-test = "20.0.0"
+tokio-stream.workspace = true
 
 [dev-dependencies]
 tokio-test.workspace = true

apps/nxmesh-master/src/routes/api/agents/add_agent.rs

@@ -0,0 +1,41 @@
+use std::sync::Arc;
+
+use axum::{Json, extract::State, http::StatusCode, response::IntoResponse};
+use serde::{Deserialize, Serialize};
+use tracing::error;
+
+use crate::{
+    routes::api::{agents::dto::AgentInfo, error::AppError},
+    service::agent::{AgentService, CreateAgentRecord},
+};
+
+#[derive(Debug, Deserialize, Serialize)]
+pub struct CreateAgentRequest {
+    pub name: String,
+    #[serde(default)]
+    pub ip_address: Option<String>,
+}
+
+pub async fn add_agent_handler(
+    State(agent_service): State<Arc<dyn AgentService>>,
+    Json(body): Json<CreateAgentRequest>,
+) -> Result<impl IntoResponse, AppError> {
+    if body.name.trim().is_empty() {
+        return Err(AppError::BadRequest("name is required".to_string()));
+    }
+
+    let rec = CreateAgentRecord {
+        name: body.name,
+        ip_address: body.ip_address,
+    };
+
+    let agent = agent_service.create(&rec).await.map_err(|err| {
+        error!("Failed to create agent: {}", err);
+        AppError::InternalServerError
+    })?;
+
+    Ok((
+        StatusCode::CREATED,
+        Json(serde_json::json!({"agent": AgentInfo::from(agent)})),
+    ))
+}

apps/nxmesh-master/src/routes/api/agents/delete_agent.rs

@@ -0,0 +1,27 @@
+use std::sync::Arc;
+
+use axum::{
+    extract::{Path, State},
+    http::StatusCode,
+    response::IntoResponse,
+};
+use tracing::{error, info};
+
+use crate::{routes::api::error::AppError, service::agent::AgentService};
+
+pub async fn delete_agent_handler(
+    State(agent_service): State<Arc<dyn AgentService>>,
+    Path(id): Path<uuid::Uuid>,
+) -> Result<impl IntoResponse, AppError> {
+    let deleted = agent_service.delete(id).await.map_err(|err| {
+        error!("Failed to delete agent: {}", err);
+        AppError::InternalServerError
+    })?;
+
+    if deleted {
+        info!("Agent {} deleted", id);
+        Ok((StatusCode::NO_CONTENT,))
+    } else {
+        Err(AppError::NotFound)
+    }
+}

apps/nxmesh-master/src/routes/api/agents/dto.rs

@@ -0,0 +1,39 @@
+use serde::{Deserialize, Serialize};
+
+use crate::service::agent::{AgentRecord, State};
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct AgentInfo {
+    pub id: String,
+    pub name: String,
+    pub state: State,
+    //
+    pub deployment_mode: Option<String>,
+    pub ip_address: Option<String>,
+    pub last_seen_at: Option<String>,
+    pub labels: Option<serde_json::Value>,
+    //
+    pub number_of_routes: usize,
+    //
+    pub created_at: String,
+    pub updated_at: String,
+    pub is_disabled: bool,
+}
+
+impl From<AgentRecord> for AgentInfo {
+    fn from(record: AgentRecord) -> Self {
+        AgentInfo {
+            id: record.id.to_string(),
+            name: record.name,
+            ip_address: record.ip_address,
+            state: record.state,
+            deployment_mode: record.deployment_mode,
+            last_seen_at: record.last_seen_at,
+            labels: record.labels,
+            number_of_routes: 0, // This will be populated later
+            created_at: record.created_at,
+            updated_at: record.updated_at,
+            is_disabled: matches!(record.state, State::Disabled),
+        }
+    }
+}

apps/nxmesh-master/src/routes/api/agents/get_agent.rs

@@ -0,0 +1,52 @@
+use std::sync::Arc;
+
+use axum::{
+    Json,
+    extract::{Path, State},
+};
+use serde::Serialize;
+use tracing::error;
+
+use crate::{
+    routes::api::{agents::dto::AgentInfo, error::AppError},
+    service::agent::AgentService,
+};
+
+#[derive(Debug, Clone, Serialize)]
+pub struct GetAgentsResponse {
+    agents: Vec<AgentInfo>,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct GetAgentResponse {
+    agent: AgentInfo,
+}
+
+pub async fn get_agents_handler(
+    State(agent_service): State<Arc<dyn AgentService>>,
+) -> Result<Json<GetAgentsResponse>, AppError> {
+    let agents = agent_service.list().await.map_err(|err| {
+        error!("Failed to get agents: {}", err);
+        AppError::InternalServerError
+    })?;
+
+    Ok(Json(GetAgentsResponse {
+        agents: agents.into_iter().map(AgentInfo::from).collect(),
+    }))
+}
+
+pub async fn get_agent_handler(
+    State(agent_service): State<Arc<dyn AgentService>>,
+    Path(id): Path<uuid::Uuid>,
+) -> Result<Json<GetAgentResponse>, AppError> {
+    let agent = agent_service.get(id).await.map_err(|err| {
+        error!("Failed to get agent: {}", err);
+        AppError::InternalServerError
+    })?;
+    match agent {
+        Some(agent) => Ok(Json(GetAgentResponse {
+            agent: AgentInfo::from(agent),
+        })),
+        None => Err(AppError::NotFound),
+    }
+}

apps/nxmesh-master/src/routes/api/agents/mod.rs

@@ -0,0 +1,223 @@
+use crate::routes::api::{
+    ApiRouter,
+    agents::{
+        add_agent::add_agent_handler,
+        delete_agent::delete_agent_handler,
+        get_agent::{get_agent_handler, get_agents_handler},
+        update_agent::update_agent_handler,
+    },
+};
+
+mod add_agent;
+mod delete_agent;
+mod dto;
+mod get_agent;
+mod update_agent;
+
+pub async fn get_router() -> ApiRouter {
+    ApiRouter::new()
+        .route(
+            "/agents",
+            axum::routing::get(get_agents_handler).post(add_agent_handler),
+        )
+        .route(
+            "/agents/{id}",
+            axum::routing::get(get_agent_handler)
+                .put(update_agent_handler)
+                .delete(delete_agent_handler),
+        )
+}
+
+#[cfg(test)]
+#[allow(clippy::unwrap_used)]
+mod tests {
+    use std::sync::Arc;
+
+    use crate::service::agent::{AgentRecord, MockAgentService, State};
+
+    use super::*;
+    use axum_test::TestServer;
+
+    async fn make_state(mock: MockAgentService) -> axum::Router {
+        use crate::service::proxy::*;
+        let state = crate::routes::api::LocalApiState::from(crate::routes::api::ApiState {
+            agent_service: Arc::new(mock),
+            proxy_service: Arc::new(MockProxyServiceTrait::new()),
+            server_block_service: Arc::new(server_block::MockServerBlockService::new()),
+            upstream_service: Arc::new(upstream::MockUpstreamService::new()),
+            location_block_service: Arc::new(location_block::MockLocationBlockService::new()),
+            access_rule_service: Arc::new(access_rule::MockAccessRuleService::new()),
+            cache_zone_service: Arc::new(cache_zone::MockCacheZoneService::new()),
+            limit_rule_service: Arc::new(limit_rule::MockLimitRuleService::new()),
+            limit_zone_service: Arc::new(limit_zone::MockLimitZoneService::new()),
+            log_setting_service: Arc::new(log_setting::MockLogSettingService::new()),
+            proxy_setting_service: Arc::new(proxy_setting::MockProxySettingService::new()),
+            rewrite_rule_service: Arc::new(rewrite_rule::MockRewriteRuleService::new()),
+            ssl_certificate_service: Arc::new(ssl_certificate::MockSslCertificateService::new()),
+            config_inheritance_service: Arc::new(config_inheritance::MockConfigInheritanceService::new()),
+        });
+        get_router().await.with_state(state)
+    }
+
+    fn make_record(id: uuid::Uuid) -> AgentRecord {
+        AgentRecord {
+            id,
+            name: "agent1".to_string(),
+            ip_address: Some("127.0.0.1".to_string()),
+            state: State::Active,
+            deployment_mode: None,
+            last_seen_at: None,
+            labels: None,
+            created_at: "created".to_string(),
+            updated_at: "updated".to_string(),
+        }
+    }
+
+    #[tokio::test]
+    async fn test_get_agents() {
+        let mut agent_service_mock = MockAgentService::new();
+        agent_service_mock.expect_list().returning(|| Ok(vec![]));
+        let server = TestServer::new(make_state(agent_service_mock).await);
+        let response = server.get("/agents").await;
+        assert_eq!(response.status_code(), 200);
+        assert_eq!(response.text(), r#"{"agents":[]}"#);
+    }
+
+    #[tokio::test]
+    async fn test_get_agent_not_found() {
+        let mut agent_service_mock = MockAgentService::new();
+        agent_service_mock.expect_get().returning(|_| Ok(None));
+        let server = TestServer::new(make_state(agent_service_mock).await);
+        let id = uuid::Uuid::new_v4();
+        let response = server.get(&format!("/agents/{}", id)).await;
+        assert_eq!(response.status_code(), 404);
+    }
+
+    #[tokio::test]
+    async fn test_get_agent_found() {
+        let id = uuid::Uuid::new_v4();
+        let mut agent_service_mock = MockAgentService::new();
+        agent_service_mock
+            .expect_get()
+            .returning(move |_| Ok(Some(make_record(id))));
+        let server = TestServer::new(make_state(agent_service_mock).await);
+        let expected = format!(
+            r#"{{"agent":{{"id":"{}","name":"agent1","state":"Active","deployment_mode":null,"ip_address":"127.0.0.1","last_seen_at":null,"labels":null,"number_of_routes":0,"created_at":"created","updated_at":"updated","is_disabled":false}}}}"#,
+            id
+        );
+        let response = server.get(&format!("/agents/{}", id)).await;
+        assert_eq!(response.status_code(), 200);
+        assert_eq!(response.text(), expected);
+    }
+
+    #[tokio::test]
+    async fn test_create_agent() {
+        let id = uuid::Uuid::new_v4();
+        let mut agent_service_mock = MockAgentService::new();
+        agent_service_mock.expect_create().returning(move |rec| {
+            Ok(AgentRecord {
+                id,
+                name: rec.name.clone(),
+                ip_address: rec.ip_address.clone(),
+                state: State::Active,
+                deployment_mode: None,
+                last_seen_at: None,
+                labels: None,
+                created_at: "created".to_string(),
+                updated_at: "updated".to_string(),
+            })
+        });
+        let server = TestServer::new(make_state(agent_service_mock).await);
+        let response = server
+            .post("/agents")
+            .json(&serde_json::json!({"name": "new-agent", "ip_address": "10.0.0.1"}))
+            .await;
+        assert_eq!(response.status_code(), 201);
+        let body: serde_json::Value = serde_json::from_str(&response.text()).unwrap();
+        assert_eq!(body["agent"]["name"], "new-agent");
+        assert_eq!(body["agent"]["ip_address"], "10.0.0.1");
+        assert_eq!(body["agent"]["id"], id.to_string());
+    }
+
+    #[tokio::test]
+    async fn test_create_agent_empty_name() {
+        let agent_service_mock = MockAgentService::new();
+        let server = TestServer::new(make_state(agent_service_mock).await);
+        let response = server
+            .post("/agents")
+            .json(&serde_json::json!({"name": ""}))
+            .await;
+        assert_eq!(response.status_code(), 400);
+    }
+
+    #[tokio::test]
+    async fn test_create_agent_missing_name() {
+        let agent_service_mock = MockAgentService::new();
+        let server = TestServer::new(make_state(agent_service_mock).await);
+        let response = server.post("/agents").json(&serde_json::json!({})).await;
+        assert_eq!(response.status_code(), 422);
+    }
+
+    #[tokio::test]
+    async fn test_update_agent() {
+        let id = uuid::Uuid::new_v4();
+        let mut agent_service_mock = MockAgentService::new();
+        agent_service_mock.expect_update().returning(move |_, _| {
+            Ok(Some(AgentRecord {
+                id,
+                name: "updated-agent".to_string(),
+                ip_address: Some("10.0.0.2".to_string()),
+                state: State::Inactive,
+                deployment_mode: None,
+                last_seen_at: None,
+                labels: None,
+                created_at: "created".to_string(),
+                updated_at: "updated".to_string(),
+            }))
+        });
+        let server = TestServer::new(make_state(agent_service_mock).await);
+        let response = server
+            .put(&format!("/agents/{}", id))
+            .json(&serde_json::json!({"name": "updated-agent", "state": "Inactive"}))
+            .await;
+        assert_eq!(response.status_code(), 200);
+        let body: serde_json::Value = serde_json::from_str(&response.text()).unwrap();
+        assert_eq!(body["agent"]["name"], "updated-agent");
+        assert_eq!(body["agent"]["state"], "Inactive");
+    }
+
+    #[tokio::test]
+    async fn test_update_agent_not_found() {
+        let mut agent_service_mock = MockAgentService::new();
+        agent_service_mock
+            .expect_update()
+            .returning(|_, _| Ok(None));
+        let server = TestServer::new(make_state(agent_service_mock).await);
+        let id = uuid::Uuid::new_v4();
+        let response = server
+            .put(&format!("/agents/{}", id))
+            .json(&serde_json::json!({"name": "updated-agent"}))
+            .await;
+        assert_eq!(response.status_code(), 404);
+    }
+
+    #[tokio::test]
+    async fn test_delete_agent() {
+        let mut agent_service_mock = MockAgentService::new();
+        agent_service_mock.expect_delete().returning(|_| Ok(true));
+        let server = TestServer::new(make_state(agent_service_mock).await);
+        let id = uuid::Uuid::new_v4();
+        let response = server.delete(&format!("/agents/{}", id)).await;
+        assert_eq!(response.status_code(), 204);
+    }
+
+    #[tokio::test]
+    async fn test_delete_agent_not_found() {
+        let mut agent_service_mock = MockAgentService::new();
+        agent_service_mock.expect_delete().returning(|_| Ok(false));
+        let server = TestServer::new(make_state(agent_service_mock).await);
+        let id = uuid::Uuid::new_v4();
+        let response = server.delete(&format!("/agents/{}", id)).await;
+        assert_eq!(response.status_code(), 404);
+    }
+}

apps/nxmesh-master/src/routes/api/agents/update_agent.rs

@@ -0,0 +1,62 @@
+use std::sync::Arc;
+
+use axum::{
+    Json,
+    extract::{Path, State},
+    http::StatusCode,
+    response::IntoResponse,
+};
+use serde::Deserialize;
+use tracing::error;
+
+use crate::{
+    routes::api::{agents::dto::AgentInfo, error::AppError},
+    service::agent::{AgentService, State as AgentState, UpdateAgentRecord},
+};
+
+#[derive(Debug, Deserialize)]
+pub struct UpdateAgentRequest {
+    #[serde(default)]
+    pub name: Option<String>,
+    #[serde(default)]
+    pub ip_address: Option<String>,
+    #[serde(default)]
+    pub state: Option<AgentState>,
+    #[serde(default)]
+    pub deployment_mode: Option<String>,
+    #[serde(default)]
+    pub labels: Option<serde_json::Value>,
+}
+
+pub async fn update_agent_handler(
+    State(agent_service): State<Arc<dyn AgentService>>,
+    Path(id): Path<uuid::Uuid>,
+    Json(body): Json<UpdateAgentRequest>,
+) -> Result<impl IntoResponse, AppError> {
+    if let Some(ref name) = body.name {
+        if name.trim().is_empty() {
+            return Err(AppError::BadRequest("name must not be empty".to_string()));
+        }
+    }
+
+    let rec = UpdateAgentRecord {
+        name: body.name,
+        ip_address: body.ip_address,
+        state: body.state,
+        deployment_mode: body.deployment_mode,
+        labels: body.labels,
+    };
+
+    let agent = agent_service.update(id, &rec).await.map_err(|err| {
+        error!("Failed to update agent: {}", err);
+        AppError::InternalServerError
+    })?;
+
+    match agent {
+        Some(agent) => Ok((
+            StatusCode::OK,
+            Json(serde_json::json!({"agent": AgentInfo::from(agent)})),
+        )),
+        None => Err(AppError::NotFound),
+    }
+}

apps/nxmesh-master/src/routes/api/error.rs

@@ -0,0 +1,55 @@
+use axum::{
+    http::StatusCode,
+    response::{IntoResponse, Response},
+};
+use serde_json::json;
+use tracing::error;
+
+use crate::service::proxy::types::ProxyServiceError;
+
+impl From<ProxyServiceError> for AppError {
+    fn from(e: ProxyServiceError) -> Self {
+        match e {
+            ProxyServiceError::ConfigNotFound => AppError::NotFound,
+            ProxyServiceError::InvalidConfig(msg) => AppError::BadRequest(msg),
+            ProxyServiceError::RendererNotFound => AppError::InternalServerError,
+            ProxyServiceError::DatabaseError(_) => AppError::InternalServerError,
+        }
+    }
+}
+
+pub enum AppError {
+    NotFound,
+    InternalServerError,
+    BadRequest(String),
+}
+
+fn make_error_response(status: StatusCode, code: &str, msg: &str) -> Response {
+    let body = json!({"code": code, "message": msg});
+    Response::builder()
+        .status(status)
+        .header("Content-Type", "application/json")
+        .body(serde_json::to_string(&body).unwrap_or_default().into())
+        .unwrap_or_else(|err| {
+            error!("Failed to build error response: {}", err);
+            StatusCode::INTERNAL_SERVER_ERROR.into_response()
+        })
+}
+
+impl IntoResponse for AppError {
+    fn into_response(self) -> Response {
+        match self {
+            AppError::BadRequest(msg) => {
+                make_error_response(StatusCode::BAD_REQUEST, "BAD_REQUEST", &msg)
+            }
+            AppError::NotFound => {
+                make_error_response(StatusCode::NOT_FOUND, "NOT_FOUND", "Not Found")
+            }
+            AppError::InternalServerError => make_error_response(
+                StatusCode::INTERNAL_SERVER_ERROR,
+                "INTERNAL_ERROR",
+                "Internal Server Error",
+            ),
+        }
+    }
+}

apps/nxmesh-master/src/routes/api/mod.rs

@@ -0,0 +1,148 @@
+use std::sync::Arc;
+
+use axum::{Router, extract::FromRef};
+
+use crate::service::agent::AgentService;
+use crate::service::proxy::ProxyServiceTrait;
+use crate::service::proxy::access_rule::AccessRuleService;
+use crate::service::proxy::cache_zone::CacheZoneService;
+use crate::service::proxy::config_inheritance::ConfigInheritanceService;
+use crate::service::proxy::limit_rule::LimitRuleService;
+use crate::service::proxy::limit_zone::LimitZoneService;
+use crate::service::proxy::location_block::LocationBlockService;
+use crate::service::proxy::log_setting::LogSettingService;
+use crate::service::proxy::proxy_setting::ProxySettingService;
+use crate::service::proxy::rewrite_rule::RewriteRuleService;
+use crate::service::proxy::server_block::ServerBlockService;
+use crate::service::proxy::ssl_certificate::SslCertificateService;
+use crate::service::proxy::upstream::UpstreamService;
+
+mod agents;
+pub mod error;
+pub use error::AppError;
+pub(crate) mod proxy;
+
+pub struct ApiState {
+    pub agent_service: Arc<dyn AgentService>,
+    pub proxy_service: Arc<dyn ProxyServiceTrait>,
+    pub server_block_service: Arc<dyn ServerBlockService>,
+    pub upstream_service: Arc<dyn UpstreamService>,
+    pub location_block_service: Arc<dyn LocationBlockService>,
+    pub access_rule_service: Arc<dyn AccessRuleService>,
+    pub cache_zone_service: Arc<dyn CacheZoneService>,
+    pub limit_rule_service: Arc<dyn LimitRuleService>,
+    pub limit_zone_service: Arc<dyn LimitZoneService>,
+    pub log_setting_service: Arc<dyn LogSettingService>,
+    pub proxy_setting_service: Arc<dyn ProxySettingService>,
+    pub rewrite_rule_service: Arc<dyn RewriteRuleService>,
+    pub ssl_certificate_service: Arc<dyn SslCertificateService>,
+    pub config_inheritance_service: Arc<dyn ConfigInheritanceService>,
+}
+
+#[derive(Clone)]
+pub struct LocalApiState(pub Arc<ApiState>);
+
+impl From<ApiState> for LocalApiState {
+    fn from(api_state: ApiState) -> Self {
+        LocalApiState(Arc::new(api_state))
+    }
+}
+
+impl From<Arc<ApiState>> for LocalApiState {
+    fn from(api_state: Arc<ApiState>) -> Self {
+        LocalApiState(api_state)
+    }
+}
+
+pub type ApiRouter = Router<LocalApiState>;
+
+impl FromRef<LocalApiState> for Arc<dyn AgentService> {
+    fn from_ref(api_state: &LocalApiState) -> Arc<dyn AgentService> {
+        api_state.0.agent_service.clone()
+    }
+}
+
+impl FromRef<LocalApiState> for Arc<dyn ProxyServiceTrait> {
+    fn from_ref(api_state: &LocalApiState) -> Arc<dyn ProxyServiceTrait> {
+        api_state.0.proxy_service.clone()
+    }
+}
+
+impl FromRef<LocalApiState> for Arc<dyn ServerBlockService> {
+    fn from_ref(api_state: &LocalApiState) -> Arc<dyn ServerBlockService> {
+        api_state.0.server_block_service.clone()
+    }
+}
+
+impl FromRef<LocalApiState> for Arc<dyn UpstreamService> {
+    fn from_ref(api_state: &LocalApiState) -> Arc<dyn UpstreamService> {
+        api_state.0.upstream_service.clone()
+    }
+}
+
+impl FromRef<LocalApiState> for Arc<dyn LocationBlockService> {
+    fn from_ref(api_state: &LocalApiState) -> Arc<dyn LocationBlockService> {
+        api_state.0.location_block_service.clone()
+    }
+}
+
+impl FromRef<LocalApiState> for Arc<dyn AccessRuleService> {
+    fn from_ref(api_state: &LocalApiState) -> Arc<dyn AccessRuleService> {
+        api_state.0.access_rule_service.clone()
+    }
+}
+
+impl FromRef<LocalApiState> for Arc<dyn CacheZoneService> {
+    fn from_ref(api_state: &LocalApiState) -> Arc<dyn CacheZoneService> {
+        api_state.0.cache_zone_service.clone()
+    }
+}
+
+impl FromRef<LocalApiState> for Arc<dyn LimitRuleService> {
+    fn from_ref(api_state: &LocalApiState) -> Arc<dyn LimitRuleService> {
+        api_state.0.limit_rule_service.clone()
+    }
+}
+
+impl FromRef<LocalApiState> for Arc<dyn LimitZoneService> {
+    fn from_ref(api_state: &LocalApiState) -> Arc<dyn LimitZoneService> {
+        api_state.0.limit_zone_service.clone()
+    }
+}
+
+impl FromRef<LocalApiState> for Arc<dyn LogSettingService> {
+    fn from_ref(api_state: &LocalApiState) -> Arc<dyn LogSettingService> {
+        api_state.0.log_setting_service.clone()
+    }
+}
+
+impl FromRef<LocalApiState> for Arc<dyn ProxySettingService> {
+    fn from_ref(api_state: &LocalApiState) -> Arc<dyn ProxySettingService> {
+        api_state.0.proxy_setting_service.clone()
+    }
+}
+
+impl FromRef<LocalApiState> for Arc<dyn RewriteRuleService> {
+    fn from_ref(api_state: &LocalApiState) -> Arc<dyn RewriteRuleService> {
+        api_state.0.rewrite_rule_service.clone()
+    }
+}
+
+impl FromRef<LocalApiState> for Arc<dyn SslCertificateService> {
+    fn from_ref(api_state: &LocalApiState) -> Arc<dyn SslCertificateService> {
+        api_state.0.ssl_certificate_service.clone()
+    }
+}
+
+impl FromRef<LocalApiState> for Arc<dyn ConfigInheritanceService> {
+    fn from_ref(api_state: &LocalApiState) -> Arc<dyn ConfigInheritanceService> {
+        api_state.0.config_inheritance_service.clone()
+    }
+}
+
+pub async fn get_router(state: impl Into<LocalApiState>) -> Router {
+    ApiRouter::new()
+        .nest("/agents", agents::get_router().await)
+        .nest("/proxy", proxy::get_router().await)
+        .with_state(state.into())
+}

apps/nxmesh-master/src/routes/api/proxy/access_rules.rs

@@ -0,0 +1,164 @@
+use std::sync::Arc;
+
+use axum::{
+    Json,
+    extract::{Path, State},
+    http::StatusCode,
+    response::IntoResponse,
+};
+use serde::{Deserialize, Serialize};
+use uuid::Uuid;
+
+use crate::routes::api::{AppError, ApiRouter};
+use crate::service::proxy::access_rule::{
+    AccessRuleService, CreateAccessRuleParams, UpdateAccessRuleParams,
+};
+use crate::service::proxy::types::AccessRuleConfig;
+
+#[derive(Serialize)]
+pub(crate) struct AccessRuleResponse {
+    pub id: Uuid,
+    pub r#type: String,
+    pub ip_cidr: String,
+    pub description: Option<String>,
+    pub priority: i32,
+    pub override_of_id: Option<Uuid>,
+}
+
+impl From<AccessRuleConfig> for AccessRuleResponse {
+    fn from(c: AccessRuleConfig) -> Self {
+        Self {
+            id: c.id,
+            r#type: c.r#type,
+            ip_cidr: c.ip_cidr,
+            description: c.description,
+            priority: c.priority,
+            override_of_id: c.override_of_id,
+        }
+    }
+}
+
+#[derive(Deserialize)]
+pub(crate) struct CreateAccessRuleRequest {
+    pub server_id: Option<Uuid>,
+    pub location_id: Option<Uuid>,
+    pub r#type: String,
+    pub ip_cidr: String,
+    pub description: Option<String>,
+    pub priority: i32,
+    pub override_of_id: Option<Uuid>,
+}
+
+impl From<CreateAccessRuleRequest> for CreateAccessRuleParams {
+    fn from(r: CreateAccessRuleRequest) -> Self {
+        Self {
+            server_id: r.server_id,
+            location_id: r.location_id,
+            r#type: r.r#type,
+            ip_cidr: r.ip_cidr,
+            description: r.description,
+            priority: r.priority,
+            override_of_id: r.override_of_id,
+        }
+    }
+}
+
+#[derive(Deserialize)]
+pub(crate) struct UpdateAccessRuleRequest {
+    pub server_id: Option<Option<Uuid>>,
+    pub location_id: Option<Option<Uuid>>,
+    pub r#type: Option<String>,
+    pub ip_cidr: Option<String>,
+    pub description: Option<Option<String>>,
+    pub priority: Option<i32>,
+    pub override_of_id: Option<Option<Uuid>>,
+}
+
+impl From<UpdateAccessRuleRequest> for UpdateAccessRuleParams {
+    fn from(r: UpdateAccessRuleRequest) -> Self {
+        Self {
+            server_id: r.server_id,
+            location_id: r.location_id,
+            r#type: r.r#type,
+            ip_cidr: r.ip_cidr,
+            description: r.description,
+            priority: r.priority,
+            override_of_id: r.override_of_id,
+        }
+    }
+}
+
+async fn list_access_rules_by_server(
+    State(svc): State<Arc<dyn AccessRuleService>>,
+    Path(server_id): Path<Uuid>,
+) -> Result<Json<Vec<AccessRuleResponse>>, AppError> {
+    let rules = svc.list_by_server(server_id).await?;
+    Ok(Json(rules.into_iter().map(Into::into).collect()))
+}
+
+async fn list_access_rules_by_location(
+    State(svc): State<Arc<dyn AccessRuleService>>,
+    Path(location_id): Path<Uuid>,
+) -> Result<Json<Vec<AccessRuleResponse>>, AppError> {
+    let rules = svc.list_by_location(location_id).await?;
+    Ok(Json(rules.into_iter().map(Into::into).collect()))
+}
+
+async fn create_access_rule(
+    State(svc): State<Arc<dyn AccessRuleService>>,
+    Json(body): Json<CreateAccessRuleRequest>,
+) -> Result<impl IntoResponse, AppError> {
+    let rule = svc.create(body.into()).await?;
+    Ok((StatusCode::CREATED, Json(AccessRuleResponse::from(rule))))
+}
+
+async fn get_access_rule(
+    State(svc): State<Arc<dyn AccessRuleService>>,
+    Path(id): Path<Uuid>,
+) -> Result<Json<AccessRuleResponse>, AppError> {
+    let rule = svc.get(id).await?;
+    Ok(Json(rule.into()))
+}
+
+async fn update_access_rule(
+    State(svc): State<Arc<dyn AccessRuleService>>,
+    Path(id): Path<Uuid>,
+    Json(body): Json<UpdateAccessRuleRequest>,
+) -> Result<Json<AccessRuleResponse>, AppError> {
+    let rule = svc.update(id, body.into()).await?;
+    Ok(Json(rule.into()))
+}
+
+async fn delete_access_rule(
+    State(svc): State<Arc<dyn AccessRuleService>>,
+    Path(id): Path<Uuid>,
+) -> Result<impl IntoResponse, AppError> {
+    let deleted = svc.delete(id).await?;
+    if deleted {
+        Ok((StatusCode::NO_CONTENT,))
+    } else {
+        Err(AppError::NotFound)
+    }
+}
+
+pub(super) fn routes() -> ApiRouter {
+    ApiRouter::new()
+        .route(
+            "/server-blocks/{server_id}/access-rules",
+            axum::routing::get(list_access_rules_by_server),
+        )
+        .route(
+            "/locations/{location_id}/access-rules",
+            axum::routing::get(list_access_rules_by_location),
+        )
+        .route(
+            "/access-rules",
+            axum::routing::post(create_access_rule),
+        )
+        .route(
+            "/access-rules/{id}",
+            axum::routing::get(get_access_rule)
+                .put(update_access_rule)
+                .delete(delete_access_rule),
+        )
+}

apps/nxmesh-master/src/routes/api/proxy/agents.rs

@@ -0,0 +1,82 @@
+use std::sync::Arc;
+
+use axum::{
+    Json,
+    extract::{Path, State},
+    http::StatusCode,
+    response::IntoResponse,
+};
+use serde::{Deserialize, Serialize};
+use uuid::Uuid;
+
+use crate::routes::api::{AppError, ApiRouter};
+use crate::service::proxy::{ProxyServiceTrait, types::AgentConfigBinding};
+
+use super::configs::ProxyConfigResponse;
+
+#[derive(Serialize)]
+pub(crate) struct AgentConfigResponse {
+    pub id: Uuid,
+    pub agent_id: Option<Uuid>,
+    pub group_id: Option<Uuid>,
+    pub config_id: Uuid,
+    pub is_active: bool,
+    pub applied_at: String,
+}
+
+impl From<AgentConfigBinding> for AgentConfigResponse {
+    fn from(b: AgentConfigBinding) -> Self {
+        Self {
+            id: b.id,
+            agent_id: b.agent_id,
+            group_id: b.group_id,
+            config_id: b.config_id,
+            is_active: b.is_active,
+            applied_at: b.applied_at.to_rfc3339(),
+        }
+    }
+}
+
+#[derive(Deserialize)]
+pub(crate) struct BindAgentRequest {
+    pub config_id: Uuid,
+}
+
+async fn get_active_agent_config(
+    State(svc): State<Arc<dyn ProxyServiceTrait>>,
+    Path(agent_id): Path<Uuid>,
+) -> Result<Json<Option<ProxyConfigResponse>>, AppError> {
+    let config = svc.get_active_agent_config(agent_id).await?;
+    Ok(Json(config.map(Into::into)))
+}
+
+async fn bind_agent(
+    State(svc): State<Arc<dyn ProxyServiceTrait>>,
+    Path(agent_id): Path<Uuid>,
+    Json(body): Json<BindAgentRequest>,
+) -> Result<impl IntoResponse, AppError> {
+    let binding = svc.bind_agent(agent_id, body.config_id).await?;
+    Ok((StatusCode::CREATED, Json(AgentConfigResponse::from(binding))))
+}
+
+async fn unbind_agent(
+    State(svc): State<Arc<dyn ProxyServiceTrait>>,
+    Path(agent_id): Path<Uuid>,
+) -> Result<impl IntoResponse, AppError> {
+    let deleted = svc.unbind_agent(agent_id).await?;
+    if deleted {
+        Ok((StatusCode::NO_CONTENT,))
+    } else {
+        Err(AppError::NotFound)
+    }
+}
+
+pub(super) fn routes() -> ApiRouter {
+    ApiRouter::new()
+        .route(
+            "/agents/{agent_id}/config",
+            axum::routing::get(get_active_agent_config)
+                .post(bind_agent)
+                .delete(unbind_agent),
+        )
+}

apps/nxmesh-master/src/routes/api/proxy/cache_zones.rs

@@ -0,0 +1,133 @@
+use std::sync::Arc;
+
+use axum::{
+    Json,
+    extract::{Path, State},
+    http::StatusCode,
+    response::IntoResponse,
+};
+use serde::{Deserialize, Serialize};
+use uuid::Uuid;
+
+use crate::routes::api::{AppError, ApiRouter};
+use crate::service::proxy::cache_zone::{
+    CacheZoneService, CreateCacheZoneParams, UpdateCacheZoneParams,
+};
+use crate::service::proxy::types::CacheZoneConfig;
+
+#[derive(Serialize)]
+pub(crate) struct CacheZoneResponse {
+    pub id: Uuid,
+    pub name: String,
+    pub path: String,
+    pub size: String,
+    pub override_of_id: Option<Uuid>,
+}
+
+impl From<CacheZoneConfig> for CacheZoneResponse {
+    fn from(c: CacheZoneConfig) -> Self {
+        Self {
+            id: c.id,
+            name: c.name,
+            path: c.path,
+            size: c.size,
+            override_of_id: c.override_of_id,
+        }
+    }
+}
+
+#[derive(Deserialize)]
+pub(crate) struct CreateCacheZoneRequest {
+    pub name: String,
+    pub path: String,
+    pub size_limit: String,
+    pub override_of_id: Option<Uuid>,
+}
+
+impl From<CreateCacheZoneRequest> for CreateCacheZoneParams {
+    fn from(r: CreateCacheZoneRequest) -> Self {
+        Self {
+            name: r.name,
+            path: r.path,
+            size_limit: r.size_limit,
+            override_of_id: r.override_of_id,
+        }
+    }
+}
+
+#[derive(Deserialize)]
+pub(crate) struct UpdateCacheZoneRequest {
+    pub name: Option<String>,
+    pub path: Option<String>,
+    pub size_limit: Option<String>,
+    pub override_of_id: Option<Option<Uuid>>,
+}
+
+impl From<UpdateCacheZoneRequest> for UpdateCacheZoneParams {
+    fn from(r: UpdateCacheZoneRequest) -> Self {
+        Self {
+            name: r.name,
+            path: r.path,
+            size_limit: r.size_limit,
+            override_of_id: r.override_of_id,
+        }
+    }
+}
+
+async fn list_cache_zones(
+    State(svc): State<Arc<dyn CacheZoneService>>,
+) -> Result<Json<Vec<CacheZoneResponse>>, AppError> {
+    let zones = svc.list().await?;
+    Ok(Json(zones.into_iter().map(Into::into).collect()))
+}
+
+async fn create_cache_zone(
+    State(svc): State<Arc<dyn CacheZoneService>>,
+    Json(body): Json<CreateCacheZoneRequest>,
+) -> Result<impl IntoResponse, AppError> {
+    let zone = svc.create(body.into()).await?;
+    Ok((StatusCode::CREATED, Json(CacheZoneResponse::from(zone))))
+}
+
+async fn get_cache_zone(
+    State(svc): State<Arc<dyn CacheZoneService>>,
+    Path(id): Path<Uuid>,
+) -> Result<Json<CacheZoneResponse>, AppError> {
+    let zone = svc.get(id).await?;
+    Ok(Json(zone.into()))
+}
+
+async fn update_cache_zone(
+    State(svc): State<Arc<dyn CacheZoneService>>,
+    Path(id): Path<Uuid>,
+    Json(body): Json<UpdateCacheZoneRequest>,
+) -> Result<Json<CacheZoneResponse>, AppError> {
+    let zone = svc.update(id, body.into()).await?;
+    Ok(Json(zone.into()))
+}
+
+async fn delete_cache_zone(
+    State(svc): State<Arc<dyn CacheZoneService>>,
+    Path(id): Path<Uuid>,
+) -> Result<impl IntoResponse, AppError> {
+    let deleted = svc.delete(id).await?;
+    if deleted {
+        Ok((StatusCode::NO_CONTENT,))
+    } else {
+        Err(AppError::NotFound)
+    }
+}
+
+pub(super) fn routes() -> ApiRouter {
+    ApiRouter::new()
+        .route(
+            "/cache-zones",
+            axum::routing::get(list_cache_zones).post(create_cache_zone),
+        )
+        .route(
+            "/cache-zones/{id}",
+            axum::routing::get(get_cache_zone)
+                .put(update_cache_zone)
+                .delete(delete_cache_zone),
+        )
+}

apps/nxmesh-master/src/routes/api/proxy/config_inheritance.rs

@@ -0,0 +1,107 @@
+use std::sync::Arc;
+
+use axum::{
+    Json,
+    extract::{Path, State},
+    http::StatusCode,
+    response::IntoResponse,
+};
+use serde::{Deserialize, Serialize};
+use uuid::Uuid;
+
+use crate::routes::api::{AppError, ApiRouter};
+use crate::service::proxy::config_inheritance::{
+    AddInheritanceParams, ConfigInheritanceRecord, ConfigInheritanceService,
+};
+
+#[derive(Deserialize)]
+pub(crate) struct AddParentRequest {
+    pub parent_config_id: Uuid,
+    #[serde(default)]
+    pub priority: Option<i32>,
+}
+
+#[derive(Serialize)]
+pub(crate) struct InheritanceRecordResponse {
+    pub id: Uuid,
+    pub child_config_id: Uuid,
+    pub parent_config_id: Uuid,
+    pub priority: Option<i32>,
+    pub applied_at: String,
+}
+
+impl From<ConfigInheritanceRecord> for InheritanceRecordResponse {
+    fn from(r: ConfigInheritanceRecord) -> Self {
+        Self {
+            id: r.id,
+            child_config_id: r.child_config_id,
+            parent_config_id: r.parent_config_id,
+            priority: r.priority,
+            applied_at: r.applied_at.and_utc().to_rfc3339(),
+        }
+    }
+}
+
+async fn list_parents(
+    State(svc): State<Arc<dyn ConfigInheritanceService>>,
+    Path(id): Path<Uuid>,
+) -> Result<Json<serde_json::Value>, AppError> {
+    let records = svc.list_parents(id).await?;
+    let response: Vec<InheritanceRecordResponse> = records.into_iter().map(Into::into).collect();
+    Ok(Json(serde_json::json!(response)))
+}
+
+async fn add_parent(
+    State(svc): State<Arc<dyn ConfigInheritanceService>>,
+    Path(id): Path<Uuid>,
+    Json(body): Json<AddParentRequest>,
+) -> Result<impl IntoResponse, AppError> {
+    let record = svc
+        .add(AddInheritanceParams {
+            child_config_id: id,
+            parent_config_id: body.parent_config_id,
+            priority: body.priority,
+        })
+        .await?;
+    Ok((
+        StatusCode::CREATED,
+        Json(InheritanceRecordResponse::from(record)),
+    ))
+}
+
+async fn remove_parent(
+    State(svc): State<Arc<dyn ConfigInheritanceService>>,
+    Path((id, parent_id)): Path<(Uuid, Uuid)>,
+) -> Result<impl IntoResponse, AppError> {
+    let deleted = svc.remove(id, parent_id).await?;
+    if deleted {
+        Ok((StatusCode::NO_CONTENT,))
+    } else {
+        Err(AppError::NotFound)
+    }
+}
+
+async fn list_children(
+    State(svc): State<Arc<dyn ConfigInheritanceService>>,
+    Path(id): Path<Uuid>,
+) -> Result<Json<serde_json::Value>, AppError> {
+    let records = svc.list_children(id).await?;
+    let response: Vec<InheritanceRecordResponse> = records.into_iter().map(Into::into).collect();
+    Ok(Json(serde_json::json!(response)))
+}
+
+pub(super) fn routes() -> ApiRouter {
+    ApiRouter::new()
+        .route(
+            "/configs/{id}/parents",
+            axum::routing::get(list_parents).post(add_parent),
+        )
+        .route(
+            "/configs/{id}/parents/{parent_id}",
+            axum::routing::delete(remove_parent),
+        )
+        .route(
+            "/configs/{id}/children",
+            axum::routing::get(list_children),
+        )
+}

apps/nxmesh-master/src/routes/api/proxy/configs.rs

@@ -0,0 +1,147 @@
+use std::sync::Arc;
+
+use axum::{
+    Json,
+    extract::{Path, State},
+    http::StatusCode,
+    response::IntoResponse,
+};
+use serde::{Deserialize, Serialize};
+use uuid::Uuid;
+
+use crate::routes::api::{AppError, ApiRouter};
+use crate::service::proxy::{
+    ProxyServiceTrait,
+    types::{CreateProxyConfigParams, ProxyConfigSummary, UpdateProxyConfigParams},
+};
+
+#[derive(Serialize)]
+pub(crate) struct ProxyConfigResponse {
+    pub id: Uuid,
+    pub name: String,
+    pub description: Option<String>,
+    pub is_template: bool,
+    pub created_at: String,
+    pub updated_at: String,
+}
+
+impl From<ProxyConfigSummary> for ProxyConfigResponse {
+    fn from(s: ProxyConfigSummary) -> Self {
+        Self {
+            id: s.id,
+            name: s.name,
+            description: s.description,
+            is_template: s.is_template,
+            created_at: s.created_at.to_rfc3339(),
+            updated_at: s.updated_at.to_rfc3339(),
+        }
+    }
+}
+
+#[derive(Deserialize)]
+pub(crate) struct CreateConfigRequest {
+    pub name: String,
+    #[serde(default)]
+    pub description: Option<String>,
+    #[serde(default)]
+    pub is_template: bool,
+}
+
+#[derive(Deserialize)]
+pub(crate) struct UpdateConfigRequest {
+    #[serde(default)]
+    pub name: Option<String>,
+    #[serde(default)]
+    pub description: Option<String>,
+    #[serde(default)]
+    pub is_template: Option<bool>,
+}
+
+#[derive(Serialize)]
+pub(crate) struct ListConfigsResponse {
+    pub configs: Vec<ProxyConfigResponse>,
+}
+
+async fn list_configs(
+    State(svc): State<Arc<dyn ProxyServiceTrait>>,
+) -> Result<Json<ListConfigsResponse>, AppError> {
+    let configs = svc.list_configs().await?;
+    Ok(Json(ListConfigsResponse {
+        configs: configs.into_iter().map(Into::into).collect(),
+    }))
+}
+
+async fn create_config(
+    State(svc): State<Arc<dyn ProxyServiceTrait>>,
+    Json(body): Json<CreateConfigRequest>,
+) -> Result<impl IntoResponse, AppError> {
+    if body.name.trim().is_empty() {
+        return Err(AppError::BadRequest("name is required".to_string()));
+    }
+    let config = svc
+        .create_config(CreateProxyConfigParams {
+            name: body.name,
+            description: body.description,
+            is_template: body.is_template,
+        })
+        .await?;
+    Ok((StatusCode::CREATED, Json(ProxyConfigResponse::from(config))))
+}
+
+async fn get_config(
+    State(svc): State<Arc<dyn ProxyServiceTrait>>,
+    Path(id): Path<Uuid>,
+) -> Result<Json<serde_json::Value>, AppError> {
+    let config = svc.get_proxy_config(id).await?;
+    Ok(Json(serde_json::to_value(&config.id).unwrap_or_default()))
+}
+
+async fn update_config(
+    State(svc): State<Arc<dyn ProxyServiceTrait>>,
+    Path(id): Path<Uuid>,
+    Json(body): Json<UpdateConfigRequest>,
+) -> Result<Json<ProxyConfigResponse>, AppError> {
+    let config = svc
+        .update_config(
+            id,
+            UpdateProxyConfigParams {
+                name: body.name,
+                description: body.description,
+                is_template: body.is_template,
+            },
+        )
+        .await?;
+    Ok(Json(config.into()))
+}
+
+async fn delete_config(
+    State(svc): State<Arc<dyn ProxyServiceTrait>>,
+    Path(id): Path<Uuid>,
+) -> Result<impl IntoResponse, AppError> {
+    let deleted = svc.delete_config(id).await?;
+    if deleted {
+        Ok((StatusCode::NO_CONTENT,))
+    } else {
+        Err(AppError::NotFound)
+    }
+}
+
+async fn render_config(
+    State(svc): State<Arc<dyn ProxyServiceTrait>>,
+    Path(id): Path<Uuid>,
+) -> Result<String, AppError> {
+    let output = svc.render_config(id).await?;
+    Ok(output)
+}
+
+pub(super) fn routes() -> ApiRouter {
+    ApiRouter::new()
+        .route("/configs", axum::routing::get(list_configs).post(create_config))
+        .route(
+            "/configs/{id}",
+            axum::routing::get(get_config)
+                .put(update_config)
+                .delete(delete_config),
+        )
+        .route("/configs/{id}/render", axum::routing::get(render_config))
+}

apps/nxmesh-master/src/routes/api/proxy/limit_rules.rs

@@ -0,0 +1,144 @@
+use std::sync::Arc;
+
+use axum::{
+    Json,
+    extract::{Path, State},
+    http::StatusCode,
+    response::IntoResponse,
+};
+use serde::{Deserialize, Serialize};
+use uuid::Uuid;
+
+use crate::routes::api::{AppError, ApiRouter};
+use crate::service::proxy::limit_rule::{
+    CreateLimitRuleParams, LimitRuleService, UpdateLimitRuleParams,
+};
+use crate::service::proxy::types::LimitRuleConfig;
+
+#[derive(Serialize)]
+pub(crate) struct LimitRuleResponse {
+    pub id: Uuid,
+    pub location_id: Uuid,
+    pub zone_id: Uuid,
+    pub burst: Option<i32>,
+    pub nodelay: Option<bool>,
+    pub override_of_id: Option<Uuid>,
+}
+
+impl From<LimitRuleConfig> for LimitRuleResponse {
+    fn from(c: LimitRuleConfig) -> Self {
+        Self {
+            id: c.id,
+            location_id: c.location_id,
+            zone_id: c.zone_id,
+            burst: c.burst,
+            nodelay: c.nodelay,
+            override_of_id: c.override_of_id,
+        }
+    }
+}
+
+#[derive(Deserialize)]
+pub(crate) struct CreateLimitRuleRequest {
+    pub location_id: Uuid,
+    pub zone_id: Uuid,
+    pub burst: Option<i32>,
+    pub nodelay: Option<bool>,
+    pub override_of_id: Option<Uuid>,
+}
+
+impl From<CreateLimitRuleRequest> for CreateLimitRuleParams {
+    fn from(r: CreateLimitRuleRequest) -> Self {
+        Self {
+            location_id: r.location_id,
+            zone_id: r.zone_id,
+            burst: r.burst,
+            nodelay: r.nodelay,
+            override_of_id: r.override_of_id,
+        }
+    }
+}
+
+#[derive(Deserialize)]
+pub(crate) struct UpdateLimitRuleRequest {
+    pub location_id: Option<Uuid>,
+    pub zone_id: Option<Uuid>,
+    pub burst: Option<Option<i32>>,
+    pub nodelay: Option<Option<bool>>,
+    pub override_of_id: Option<Option<Uuid>>,
+}
+
+impl From<UpdateLimitRuleRequest> for UpdateLimitRuleParams {
+    fn from(r: UpdateLimitRuleRequest) -> Self {
+        Self {
+            location_id: r.location_id,
+            zone_id: r.zone_id,
+            burst: r.burst,
+            nodelay: r.nodelay,
+            override_of_id: r.override_of_id,
+        }
+    }
+}
+
+async fn list_limit_rules_by_location(
+    State(svc): State<Arc<dyn LimitRuleService>>,
+    Path(location_id): Path<Uuid>,
+) -> Result<Json<Vec<LimitRuleResponse>>, AppError> {
+    let rules = svc.list_by_location(location_id).await?;
+    Ok(Json(rules.into_iter().map(Into::into).collect()))
+}
+
+async fn create_limit_rule(
+    State(svc): State<Arc<dyn LimitRuleService>>,
+    Json(body): Json<CreateLimitRuleRequest>,
+) -> Result<impl IntoResponse, AppError> {
+    let rule = svc.create(body.into()).await?;
+    Ok((StatusCode::CREATED, Json(LimitRuleResponse::from(rule))))
+}
+
+async fn get_limit_rule(
+    State(svc): State<Arc<dyn LimitRuleService>>,
+    Path(id): Path<Uuid>,
+) -> Result<Json<LimitRuleResponse>, AppError> {
+    let rule = svc.get(id).await?;
+    Ok(Json(rule.into()))
+}
+
+async fn update_limit_rule(
+    State(svc): State<Arc<dyn LimitRuleService>>,
+    Path(id): Path<Uuid>,
+    Json(body): Json<UpdateLimitRuleRequest>,
+) -> Result<Json<LimitRuleResponse>, AppError> {
+    let rule = svc.update(id, body.into()).await?;
+    Ok(Json(rule.into()))
+}
+
+async fn delete_limit_rule(
+    State(svc): State<Arc<dyn LimitRuleService>>,
+    Path(id): Path<Uuid>,
+) -> Result<impl IntoResponse, AppError> {
+    let deleted = svc.delete(id).await?;
+    if deleted {
+        Ok((StatusCode::NO_CONTENT,))
+    } else {
+        Err(AppError::NotFound)
+    }
+}
+
+pub(super) fn routes() -> ApiRouter {
+    ApiRouter::new()
+        .route(
+            "/locations/{location_id}/limit-rules",
+            axum::routing::get(list_limit_rules_by_location),
+        )
+        .route(
+            "/limit-rules",
+            axum::routing::post(create_limit_rule),
+        )
+        .route(
+            "/limit-rules/{id}",
+            axum::routing::get(get_limit_rule)
+                .put(update_limit_rule)
+                .delete(delete_limit_rule),
+        )
+}

apps/nxmesh-master/src/routes/api/proxy/limit_zones.rs

@@ -0,0 +1,133 @@
+use std::sync::Arc;
+
+use axum::{
+    Json,
+    extract::{Path, State},
+    http::StatusCode,
+    response::IntoResponse,
+};
+use serde::{Deserialize, Serialize};
+use uuid::Uuid;
+
+use crate::routes::api::{AppError, ApiRouter};
+use crate::service::proxy::limit_zone::{
+    CreateLimitZoneParams, LimitZoneService, UpdateLimitZoneParams,
+};
+use crate::service::proxy::types::LimitZoneConfig;
+
+#[derive(Serialize)]
+pub(crate) struct LimitZoneResponse {
+    pub id: Uuid,
+    pub name: String,
+    pub key: String,
+    pub rate: String,
+    pub override_of_id: Option<Uuid>,
+}
+
+impl From<LimitZoneConfig> for LimitZoneResponse {
+    fn from(c: LimitZoneConfig) -> Self {
+        Self {
+            id: c.id,
+            name: c.name,
+            key: c.key,
+            rate: c.rate,
+            override_of_id: c.override_of_id,
+        }
+    }
+}
+
+#[derive(Deserialize)]
+pub(crate) struct CreateLimitZoneRequest {
+    pub name: String,
+    pub key: String,
+    pub rate: String,
+    pub override_of_id: Option<Uuid>,
+}
+
+impl From<CreateLimitZoneRequest> for CreateLimitZoneParams {
+    fn from(r: CreateLimitZoneRequest) -> Self {
+        Self {
+            name: r.name,
+            key: r.key,
+            rate: r.rate,
+            override_of_id: r.override_of_id,
+        }
+    }
+}
+
+#[derive(Deserialize)]
+pub(crate) struct UpdateLimitZoneRequest {
+    pub name: Option<String>,
+    pub key: Option<String>,
+    pub rate: Option<String>,
+    pub override_of_id: Option<Option<Uuid>>,
+}
+
+impl From<UpdateLimitZoneRequest> for UpdateLimitZoneParams {
+    fn from(r: UpdateLimitZoneRequest) -> Self {
+        Self {
+            name: r.name,
+            key: r.key,
+            rate: r.rate,
+            override_of_id: r.override_of_id,
+        }
+    }
+}
+
+async fn list_limit_zones(
+    State(svc): State<Arc<dyn LimitZoneService>>,
+) -> Result<Json<Vec<LimitZoneResponse>>, AppError> {
+    let zones = svc.list().await?;
+    Ok(Json(zones.into_iter().map(Into::into).collect()))
+}
+
+async fn create_limit_zone(
+    State(svc): State<Arc<dyn LimitZoneService>>,
+    Json(body): Json<CreateLimitZoneRequest>,
+) -> Result<impl IntoResponse, AppError> {
+    let zone = svc.create(body.into()).await?;
+    Ok((StatusCode::CREATED, Json(LimitZoneResponse::from(zone))))
+}
+
+async fn get_limit_zone(
+    State(svc): State<Arc<dyn LimitZoneService>>,
+    Path(id): Path<Uuid>,
+) -> Result<Json<LimitZoneResponse>, AppError> {
+    let zone = svc.get(id).await?;
+    Ok(Json(zone.into()))
+}
+
+async fn update_limit_zone(
+    State(svc): State<Arc<dyn LimitZoneService>>,
+    Path(id): Path<Uuid>,
+    Json(body): Json<UpdateLimitZoneRequest>,
+) -> Result<Json<LimitZoneResponse>, AppError> {
+    let zone = svc.update(id, body.into()).await?;
+    Ok(Json(zone.into()))
+}
+
+async fn delete_limit_zone(
+    State(svc): State<Arc<dyn LimitZoneService>>,
+    Path(id): Path<Uuid>,
+) -> Result<impl IntoResponse, AppError> {
+    let deleted = svc.delete(id).await?;
+    if deleted {
+        Ok((StatusCode::NO_CONTENT,))
+    } else {
+        Err(AppError::NotFound)
+    }
+}
+
+pub(super) fn routes() -> ApiRouter {
+    ApiRouter::new()
+        .route(
+            "/limit-zones",
+            axum::routing::get(list_limit_zones).post(create_limit_zone),
+        )
+        .route(
+            "/limit-zones/{id}",
+            axum::routing::get(get_limit_zone)
+                .put(update_limit_zone)
+                .delete(delete_limit_zone),
+        )
+}

apps/nxmesh-master/src/routes/api/proxy/locations.rs

@@ -0,0 +1,142 @@
+use std::sync::Arc;
+
+use axum::{
+    Json,
+    extract::{Path, State},
+    http::StatusCode,
+    response::IntoResponse,
+};
+use serde::{Deserialize, Serialize};
+use uuid::Uuid;
+
+use crate::routes::api::{AppError, ApiRouter};
+use crate::service::proxy::location_block::{
+    CreateLocationBlockParams, LocationBlockService, UpdateLocationBlockParams,
+};
+use crate::service::proxy::types::LocationBlockConfig;
+
+#[derive(Serialize)]
+pub(crate) struct LocationBlockResponse {
+    pub id: Uuid,
+    pub server_id: Uuid,
+    pub path_pattern: String,
+    pub proxy_pass_upstream_id: Option<Uuid>,
+    pub metadata: Option<serde_json::Value>,
+    pub override_of_id: Option<Uuid>,
+}
+
+impl From<LocationBlockConfig> for LocationBlockResponse {
+    fn from(c: LocationBlockConfig) -> Self {
+        Self {
+            id: c.id,
+            server_id: c.server_id,
+            path_pattern: c.path_pattern,
+            proxy_pass_upstream_id: c.proxy_pass_upstream_id,
+            metadata: c.metadata,
+            override_of_id: c.override_of_id,
+        }
+    }
+}
+
+#[derive(Deserialize)]
+pub(crate) struct CreateLocationBlockRequest {
+    pub path_pattern: String,
+    pub proxy_pass_upstream_id: Option<Uuid>,
+    pub metadata: Option<serde_json::Value>,
+    pub override_of_id: Option<Uuid>,
+}
+
+impl From<CreateLocationBlockRequest> for CreateLocationBlockParams {
+    fn from(r: CreateLocationBlockRequest) -> Self {
+        Self {
+            server_id: Uuid::nil(),
+            path_pattern: r.path_pattern,
+            proxy_pass_upstream_id: r.proxy_pass_upstream_id,
+            metadata: r.metadata,
+            override_of_id: r.override_of_id,
+        }
+    }
+}
+
+#[derive(Deserialize)]
+pub(crate) struct UpdateLocationBlockRequest {
+    pub server_id: Option<Uuid>,
+    pub path_pattern: Option<String>,
+    pub proxy_pass_upstream_id: Option<Option<Uuid>>,
+    pub metadata: Option<Option<serde_json::Value>>,
+    pub override_of_id: Option<Option<Uuid>>,
+}
+
+impl From<UpdateLocationBlockRequest> for UpdateLocationBlockParams {
+    fn from(r: UpdateLocationBlockRequest) -> Self {
+        Self {
+            server_id: r.server_id,
+            path_pattern: r.path_pattern,
+            proxy_pass_upstream_id: r.proxy_pass_upstream_id,
+            metadata: r.metadata,
+            override_of_id: r.override_of_id,
+        }
+    }
+}
+
+async fn list_locations(
+    State(svc): State<Arc<dyn LocationBlockService>>,
+    Path(server_id): Path<Uuid>,
+) -> Result<Json<Vec<LocationBlockResponse>>, AppError> {
+    let locations = svc.list_by_server(server_id).await?;
+    Ok(Json(locations.into_iter().map(Into::into).collect()))
+}
+
+async fn create_location(
+    State(svc): State<Arc<dyn LocationBlockService>>,
+    Path(server_id): Path<Uuid>,
+    Json(body): Json<CreateLocationBlockRequest>,
+) -> Result<impl IntoResponse, AppError> {
+    let mut params = CreateLocationBlockParams::from(body);
+    params.server_id = server_id;
+    let location = svc.create(params).await?;
+    Ok((StatusCode::CREATED, Json(LocationBlockResponse::from(location))))
+}
+
+async fn get_location(
+    State(svc): State<Arc<dyn LocationBlockService>>,
+    Path(id): Path<Uuid>,
+) -> Result<Json<LocationBlockResponse>, AppError> {
+    let location = svc.get(id).await?;
+    Ok(Json(location.into()))
+}
+
+async fn update_location(
+    State(svc): State<Arc<dyn LocationBlockService>>,
+    Path(id): Path<Uuid>,
+    Json(body): Json<UpdateLocationBlockRequest>,
+) -> Result<Json<LocationBlockResponse>, AppError> {
+    let location = svc.update(id, body.into()).await?;
+    Ok(Json(location.into()))
+}
+
+async fn delete_location(
+    State(svc): State<Arc<dyn LocationBlockService>>,
+    Path(id): Path<Uuid>,
+) -> Result<impl IntoResponse, AppError> {
+    let deleted = svc.delete(id).await?;
+    if deleted {
+        Ok((StatusCode::NO_CONTENT,))
+    } else {
+        Err(AppError::NotFound)
+    }
+}
+
+pub(super) fn routes() -> ApiRouter {
+    ApiRouter::new()
+        .route(
+            "/server-blocks/{server_id}/locations",
+            axum::routing::get(list_locations).post(create_location),
+        )
+        .route(
+            "/locations/{id}",
+            axum::routing::get(get_location)
+                .put(update_location)
+                .delete(delete_location),
+        )
+}

apps/nxmesh-master/src/routes/api/proxy/log_settings.rs

@@ -0,0 +1,140 @@
+use std::sync::Arc;
+
+use axum::{
+    Json,
+    extract::{Path, State},
+    http::StatusCode,
+    response::IntoResponse,
+};
+use serde::{Deserialize, Serialize};
+use uuid::Uuid;
+
+use crate::routes::api::{AppError, ApiRouter};
+use crate::service::proxy::log_setting::{
+    CreateLogSettingParams, LogSettingService, UpdateLogSettingParams,
+};
+use crate::service::proxy::types::LogSettingConfig;
+
+#[derive(Serialize)]
+pub(crate) struct LogSettingResponse {
+    pub id: Uuid,
+    pub access_log_path: Option<String>,
+    pub error_log_path: Option<String>,
+    pub log_level: Option<String>,
+    pub override_of_id: Option<Uuid>,
+}
+
+impl From<LogSettingConfig> for LogSettingResponse {
+    fn from(c: LogSettingConfig) -> Self {
+        Self {
+            id: c.id,
+            access_log_path: c.access_log_path,
+            error_log_path: c.error_log_path,
+            log_level: c.log_level,
+            override_of_id: c.override_of_id,
+        }
+    }
+}
+
+#[derive(Deserialize)]
+pub(crate) struct CreateLogSettingRequest {
+    pub access_log_path: Option<String>,
+    pub error_log_path: Option<String>,
+    pub log_level: Option<String>,
+    pub override_of_id: Option<Uuid>,
+}
+
+impl From<CreateLogSettingRequest> for CreateLogSettingParams {
+    fn from(r: CreateLogSettingRequest) -> Self {
+        Self {
+            server_id: Uuid::nil(),
+            access_log_path: r.access_log_path,
+            error_log_path: r.error_log_path,
+            log_level: r.log_level,
+            override_of_id: r.override_of_id,
+        }
+    }
+}
+
+#[derive(Deserialize)]
+pub(crate) struct UpdateLogSettingRequest {
+    pub server_id: Option<Uuid>,
+    pub access_log_path: Option<Option<String>>,
+    pub error_log_path: Option<Option<String>>,
+    pub log_level: Option<Option<String>>,
+    pub override_of_id: Option<Option<Uuid>>,
+}
+
+impl From<UpdateLogSettingRequest> for UpdateLogSettingParams {
+    fn from(r: UpdateLogSettingRequest) -> Self {
+        Self {
+            server_id: r.server_id,
+            access_log_path: r.access_log_path,
+            error_log_path: r.error_log_path,
+            log_level: r.log_level,
+            override_of_id: r.override_of_id,
+        }
+    }
+}
+
+async fn list_log_settings(
+    State(svc): State<Arc<dyn LogSettingService>>,
+    Path(server_id): Path<Uuid>,
+) -> Result<Json<Vec<LogSettingResponse>>, AppError> {
+    let settings = svc.list_by_server(server_id).await?;
+    Ok(Json(settings.into_iter().map(Into::into).collect()))
+}
+
+async fn create_log_setting(
+    State(svc): State<Arc<dyn LogSettingService>>,
+    Path(server_id): Path<Uuid>,
+    Json(body): Json<CreateLogSettingRequest>,
+) -> Result<impl IntoResponse, AppError> {
+    let mut params = CreateLogSettingParams::from(body);
+    params.server_id = server_id;
+    let setting = svc.create(params).await?;
+    Ok((StatusCode::CREATED, Json(LogSettingResponse::from(setting))))
+}
+
+async fn get_log_setting(
+    State(svc): State<Arc<dyn LogSettingService>>,
+    Path(id): Path<Uuid>,
+) -> Result<Json<LogSettingResponse>, AppError> {
+    let setting = svc.get(id).await?;
+    Ok(Json(setting.into()))
+}
+
+async fn update_log_setting(
+    State(svc): State<Arc<dyn LogSettingService>>,
+    Path(id): Path<Uuid>,
+    Json(body): Json<UpdateLogSettingRequest>,
+) -> Result<Json<LogSettingResponse>, AppError> {
+    let setting = svc.update(id, body.into()).await?;
+    Ok(Json(setting.into()))
+}
+
+async fn delete_log_setting(
+    State(svc): State<Arc<dyn LogSettingService>>,
+    Path(id): Path<Uuid>,
+) -> Result<impl IntoResponse, AppError> {
+    let deleted = svc.delete(id).await?;
+    if deleted {
+        Ok((StatusCode::NO_CONTENT,))
+    } else {
+        Err(AppError::NotFound)
+    }
+}
+
+pub(super) fn routes() -> ApiRouter {
+    ApiRouter::new()
+        .route(
+            "/server-blocks/{server_id}/log-settings",
+            axum::routing::get(list_log_settings).post(create_log_setting),
+        )
+        .route(
+            "/log-settings/{id}",
+            axum::routing::get(get_log_setting)
+                .put(update_log_setting)
+                .delete(delete_log_setting),
+        )
+}

apps/nxmesh-master/src/routes/api/proxy/mod.rs

@@ -0,0 +1,37 @@
+use crate::routes::api::ApiRouter;
+
+pub(crate) mod access_rules;
+pub(crate) mod agents;
+pub(crate) mod cache_zones;
+pub(crate) mod config_inheritance;
+pub(crate) mod configs;
+pub(crate) mod limit_rules;
+pub(crate) mod limit_zones;
+pub(crate) mod locations;
+pub(crate) mod log_settings;
+pub(crate) mod proxy_settings;
+pub(crate) mod rewrite_rules;
+pub(crate) mod server_blocks;
+pub(crate) mod ssl_certificates;
+pub(crate) mod upstreams;
+
+#[cfg(test)]
+pub(crate) mod test_builder;
+
+pub async fn get_router() -> ApiRouter {
+    ApiRouter::new()
+        .merge(configs::routes())
+        .merge(agents::routes())
+        .merge(config_inheritance::routes())
+        .merge(server_blocks::routes())
+        .merge(upstreams::routes())
+        .merge(locations::routes())
+        .merge(access_rules::routes())
+        .merge(cache_zones::routes())
+        .merge(limit_rules::routes())
+        .merge(limit_zones::routes())
+        .merge(log_settings::routes())
+        .merge(proxy_settings::routes())
+        .merge(rewrite_rules::routes())
+        .merge(ssl_certificates::routes())
+}

apps/nxmesh-master/src/routes/api/proxy/proxy_settings.rs

@@ -0,0 +1,154 @@
+use std::sync::Arc;
+
+use axum::{
+    Json,
+    extract::{Path, State},
+    http::StatusCode,
+    response::IntoResponse,
+};
+use serde::{Deserialize, Serialize};
+use uuid::Uuid;
+
+use crate::routes::api::{AppError, ApiRouter};
+use crate::service::proxy::proxy_setting::{
+    CreateProxySettingParams, ProxySettingService, UpdateProxySettingParams,
+};
+use crate::service::proxy::types::ProxySettingConfig;
+
+#[derive(Serialize)]
+pub(crate) struct ProxySettingResponse {
+    pub id: Uuid,
+    pub location_id: Uuid,
+    pub read_timeout: Option<i32>,
+    pub connect_timeout: Option<i32>,
+    pub buffer_size: Option<i32>,
+    pub cache_enabled: Option<bool>,
+    pub cache_zone: Option<Uuid>,
+    pub override_of_id: Option<Uuid>,
+}
+
+impl From<ProxySettingConfig> for ProxySettingResponse {
+    fn from(c: ProxySettingConfig) -> Self {
+        Self {
+            id: c.id,
+            location_id: c.location_id,
+            read_timeout: c.read_timeout,
+            connect_timeout: c.connect_timeout,
+            buffer_size: c.buffer_size,
+            cache_enabled: c.cache_enabled,
+            cache_zone: c.cache_zone,
+            override_of_id: c.override_of_id,
+        }
+    }
+}
+
+#[derive(Deserialize)]
+pub(crate) struct CreateProxySettingRequest {
+    pub read_timeout: Option<i32>,
+    pub connect_timeout: Option<i32>,
+    pub buffer_size: Option<i32>,
+    pub cache_enabled: Option<bool>,
+    pub cache_zone: Option<Uuid>,
+    pub override_of_id: Option<Uuid>,
+}
+
+impl From<CreateProxySettingRequest> for CreateProxySettingParams {
+    fn from(r: CreateProxySettingRequest) -> Self {
+        Self {
+            location_id: Uuid::nil(),
+            read_timeout: r.read_timeout,
+            connect_timeout: r.connect_timeout,
+            buffer_size: r.buffer_size,
+            cache_enabled: r.cache_enabled,
+            cache_zone: r.cache_zone,
+            override_of_id: r.override_of_id,
+        }
+    }
+}
+
+#[derive(Deserialize)]
+pub(crate) struct UpdateProxySettingRequest {
+    pub location_id: Option<Uuid>,
+    pub read_timeout: Option<Option<i32>>,
+    pub connect_timeout: Option<Option<i32>>,
+    pub buffer_size: Option<Option<i32>>,
+    pub cache_enabled: Option<Option<bool>>,
+    pub cache_zone: Option<Option<Uuid>>,
+    pub override_of_id: Option<Option<Uuid>>,
+}
+
+impl From<UpdateProxySettingRequest> for UpdateProxySettingParams {
+    fn from(r: UpdateProxySettingRequest) -> Self {
+        Self {
+            location_id: r.location_id,
+            read_timeout: r.read_timeout,
+            connect_timeout: r.connect_timeout,
+            buffer_size: r.buffer_size,
+            cache_enabled: r.cache_enabled,
+            cache_zone: r.cache_zone,
+            override_of_id: r.override_of_id,
+        }
+    }
+}
+
+async fn list_proxy_settings(
+    State(svc): State<Arc<dyn ProxySettingService>>,
+    Path(location_id): Path<Uuid>,
+) -> Result<Json<Vec<ProxySettingResponse>>, AppError> {
+    let settings = svc.list_by_location(location_id).await?;
+    Ok(Json(settings.into_iter().map(Into::into).collect()))
+}
+
+async fn create_proxy_setting(
+    State(svc): State<Arc<dyn ProxySettingService>>,
+    Path(location_id): Path<Uuid>,
+    Json(body): Json<CreateProxySettingRequest>,
+) -> Result<impl IntoResponse, AppError> {
+    let mut params = CreateProxySettingParams::from(body);
+    params.location_id = location_id;
+    let setting = svc.create(params).await?;
+    Ok((StatusCode::CREATED, Json(ProxySettingResponse::from(setting))))
+}
+
+async fn get_proxy_setting(
+    State(svc): State<Arc<dyn ProxySettingService>>,
+    Path(id): Path<Uuid>,
+) -> Result<Json<ProxySettingResponse>, AppError> {
+    let setting = svc.get(id).await?;
+    Ok(Json(setting.into()))
+}
+
+async fn update_proxy_setting(
+    State(svc): State<Arc<dyn ProxySettingService>>,
+    Path(id): Path<Uuid>,
+    Json(body): Json<UpdateProxySettingRequest>,
+) -> Result<Json<ProxySettingResponse>, AppError> {
+    let setting = svc.update(id, body.into()).await?;
+    Ok(Json(setting.into()))
+}
+
+async fn delete_proxy_setting(
+    State(svc): State<Arc<dyn ProxySettingService>>,
+    Path(id): Path<Uuid>,
+) -> Result<impl IntoResponse, AppError> {
+    let deleted = svc.delete(id).await?;
+    if deleted {
+        Ok((StatusCode::NO_CONTENT,))
+    } else {
+        Err(AppError::NotFound)
+    }
+}
+
+pub(super) fn routes() -> ApiRouter {
+    ApiRouter::new()
+        .route(
+            "/locations/{location_id}/proxy-settings",
+            axum::routing::get(list_proxy_settings).post(create_proxy_setting),
+        )
+        .route(
+            "/proxy-settings/{id}",
+            axum::routing::get(get_proxy_setting)
+                .put(update_proxy_setting)
+                .delete(delete_proxy_setting),
+        )
+}

apps/nxmesh-master/src/routes/api/proxy/rewrite_rules.rs

@@ -0,0 +1,148 @@
+use std::sync::Arc;
+
+use axum::{
+    Json,
+    extract::{Path, State},
+    http::StatusCode,
+    response::IntoResponse,
+};
+use serde::{Deserialize, Serialize};
+use uuid::Uuid;
+
+use crate::routes::api::{AppError, ApiRouter};
+use crate::service::proxy::rewrite_rule::{
+    CreateRewriteRuleParams, RewriteRuleService, UpdateRewriteRuleParams,
+};
+use crate::service::proxy::types::RewriteRuleConfig;
+
+#[derive(Serialize)]
+pub(crate) struct RewriteRuleResponse {
+    pub id: Uuid,
+    pub location_id: Uuid,
+    pub pattern: String,
+    pub replacement: String,
+    pub flag: Option<String>,
+    pub priority: i32,
+    pub override_of_id: Option<Uuid>,
+}
+
+impl From<RewriteRuleConfig> for RewriteRuleResponse {
+    fn from(c: RewriteRuleConfig) -> Self {
+        Self {
+            id: c.id,
+            location_id: c.location_id,
+            pattern: c.pattern,
+            replacement: c.replacement,
+            flag: c.flag,
+            priority: c.priority,
+            override_of_id: c.override_of_id,
+        }
+    }
+}
+
+#[derive(Deserialize)]
+pub(crate) struct CreateRewriteRuleRequest {
+    pub pattern: String,
+    pub replacement: String,
+    pub flag: Option<String>,
+    pub priority: i32,
+    pub override_of_id: Option<Uuid>,
+}
+
+impl From<CreateRewriteRuleRequest> for CreateRewriteRuleParams {
+    fn from(r: CreateRewriteRuleRequest) -> Self {
+        Self {
+            location_id: Uuid::nil(),
+            pattern: r.pattern,
+            replacement: r.replacement,
+            flag: r.flag,
+            priority: r.priority,
+            override_of_id: r.override_of_id,
+        }
+    }
+}
+
+#[derive(Deserialize)]
+pub(crate) struct UpdateRewriteRuleRequest {
+    pub location_id: Option<Uuid>,
+    pub pattern: Option<String>,
+    pub replacement: Option<String>,
+    pub flag: Option<Option<String>>,
+    pub priority: Option<i32>,
+    pub override_of_id: Option<Option<Uuid>>,
+}
+
+impl From<UpdateRewriteRuleRequest> for UpdateRewriteRuleParams {
+    fn from(r: UpdateRewriteRuleRequest) -> Self {
+        Self {
+            location_id: r.location_id,
+            pattern: r.pattern,
+            replacement: r.replacement,
+            flag: r.flag,
+            priority: r.priority,
+            override_of_id: r.override_of_id,
+        }
+    }
+}
+
+async fn list_rewrite_rules(
+    State(svc): State<Arc<dyn RewriteRuleService>>,
+    Path(location_id): Path<Uuid>,
+) -> Result<Json<Vec<RewriteRuleResponse>>, AppError> {
+    let rules = svc.list_by_location(location_id).await?;
+    Ok(Json(rules.into_iter().map(Into::into).collect()))
+}
+
+async fn create_rewrite_rule(
+    State(svc): State<Arc<dyn RewriteRuleService>>,
+    Path(location_id): Path<Uuid>,
+    Json(body): Json<CreateRewriteRuleRequest>,
+) -> Result<impl IntoResponse, AppError> {
+    let mut params = CreateRewriteRuleParams::from(body);
+    params.location_id = location_id;
+    let rule = svc.create(params).await?;
+    Ok((StatusCode::CREATED, Json(RewriteRuleResponse::from(rule))))
+}
+
+async fn get_rewrite_rule(
+    State(svc): State<Arc<dyn RewriteRuleService>>,
+    Path(id): Path<Uuid>,
+) -> Result<Json<RewriteRuleResponse>, AppError> {
+    let rule = svc.get(id).await?;
+    Ok(Json(rule.into()))
+}
+
+async fn update_rewrite_rule(
+    State(svc): State<Arc<dyn RewriteRuleService>>,
+    Path(id): Path<Uuid>,
+    Json(body): Json<UpdateRewriteRuleRequest>,
+) -> Result<Json<RewriteRuleResponse>, AppError> {
+    let rule = svc.update(id, body.into()).await?;
+    Ok(Json(rule.into()))
+}
+
+async fn delete_rewrite_rule(
+    State(svc): State<Arc<dyn RewriteRuleService>>,
+    Path(id): Path<Uuid>,
+) -> Result<impl IntoResponse, AppError> {
+    let deleted = svc.delete(id).await?;
+    if deleted {
+        Ok((StatusCode::NO_CONTENT,))
+    } else {
+        Err(AppError::NotFound)
+    }
+}
+
+pub(super) fn routes() -> ApiRouter {
+    ApiRouter::new()
+        .route(
+            "/locations/{location_id}/rewrite-rules",
+            axum::routing::get(list_rewrite_rules).post(create_rewrite_rule),
+        )
+        .route(
+            "/rewrite-rules/{id}",
+            axum::routing::get(get_rewrite_rule)
+                .put(update_rewrite_rule)
+                .delete(delete_rewrite_rule),
+        )
+}

apps/nxmesh-master/src/routes/api/proxy/server_blocks.rs

@@ -0,0 +1,142 @@
+use std::sync::Arc;
+
+use axum::{
+    Json,
+    extract::{Path, State},
+    http::StatusCode,
+    response::IntoResponse,
+};
+use serde::{Deserialize, Serialize};
+use uuid::Uuid;
+
+use crate::routes::api::{AppError, ApiRouter};
+use crate::service::proxy::server_block::{
+    CreateServerBlockParams, ServerBlockService, UpdateServerBlockParams,
+};
+use crate::service::proxy::types::ServerBlockConfig;
+
+#[derive(Serialize)]
+pub(crate) struct ServerBlockResponse {
+    pub id: Uuid,
+    pub server_name: Option<Vec<String>>,
+    pub listen_port: i32,
+    pub ssl_enabled: Option<bool>,
+    pub override_of_id: Option<Uuid>,
+}
+
+impl From<ServerBlockConfig> for ServerBlockResponse {
+    fn from(c: ServerBlockConfig) -> Self {
+        Self {
+            id: c.id,
+            server_name: c.server_name,
+            listen_port: c.listen_port,
+            ssl_enabled: c.ssl_enabled,
+            override_of_id: c.override_of_id,
+        }
+    }
+}
+
+#[derive(Deserialize)]
+pub(crate) struct CreateServerBlockRequest {
+    pub server_name: Option<Vec<String>>,
+    pub listen_port: i32,
+    pub ssl_enabled: Option<bool>,
+    pub ssl_cert_id: Option<Uuid>,
+    pub override_of_id: Option<Uuid>,
+}
+
+impl From<CreateServerBlockRequest> for CreateServerBlockParams {
+    fn from(r: CreateServerBlockRequest) -> Self {
+        Self {
+            config_id: Uuid::nil(),
+            server_name: r.server_name,
+            listen_port: r.listen_port,
+            ssl_enabled: r.ssl_enabled,
+            ssl_cert_id: r.ssl_cert_id,
+            override_of_id: r.override_of_id,
+        }
+    }
+}
+
+#[derive(Deserialize)]
+pub(crate) struct UpdateServerBlockRequest {
+    pub server_name: Option<Option<Vec<String>>>,
+    pub listen_port: Option<i32>,
+    pub ssl_enabled: Option<Option<bool>>,
+    pub ssl_cert_id: Option<Option<Uuid>>,
+    pub override_of_id: Option<Option<Uuid>>,
+}
+
+impl From<UpdateServerBlockRequest> for UpdateServerBlockParams {
+    fn from(r: UpdateServerBlockRequest) -> Self {
+        Self {
+            server_name: r.server_name,
+            listen_port: r.listen_port,
+            ssl_enabled: r.ssl_enabled,
+            ssl_cert_id: r.ssl_cert_id,
+            override_of_id: r.override_of_id,
+        }
+    }
+}
+
+async fn list_server_blocks(
+    State(svc): State<Arc<dyn ServerBlockService>>,
+    Path(config_id): Path<Uuid>,
+) -> Result<Json<Vec<ServerBlockResponse>>, AppError> {
+    let blocks = svc.list_by_config(config_id).await?;
+    Ok(Json(blocks.into_iter().map(Into::into).collect()))
+}
+
+async fn create_server_block(
+    State(svc): State<Arc<dyn ServerBlockService>>,
+    Path(config_id): Path<Uuid>,
+    Json(body): Json<CreateServerBlockRequest>,
+) -> Result<impl IntoResponse, AppError> {
+    let mut params = CreateServerBlockParams::from(body);
+    params.config_id = config_id;
+    let block = svc.create(params).await?;
+    Ok((StatusCode::CREATED, Json(ServerBlockResponse::from(block))))
+}
+
+async fn get_server_block(
+    State(svc): State<Arc<dyn ServerBlockService>>,
+    Path(id): Path<Uuid>,
+) -> Result<Json<ServerBlockResponse>, AppError> {
+    let block = svc.get(id).await?;
+    Ok(Json(block.into()))
+}
+
+async fn update_server_block(
+    State(svc): State<Arc<dyn ServerBlockService>>,
+    Path(id): Path<Uuid>,
+    Json(body): Json<UpdateServerBlockRequest>,
+) -> Result<Json<ServerBlockResponse>, AppError> {
+    let block = svc.update(id, body.into()).await?;
+    Ok(Json(block.into()))
+}
+
+async fn delete_server_block(
+    State(svc): State<Arc<dyn ServerBlockService>>,
+    Path(id): Path<Uuid>,
+) -> Result<impl IntoResponse, AppError> {
+    let deleted = svc.delete(id).await?;
+    if deleted {
+        Ok((StatusCode::NO_CONTENT,))
+    } else {
+        Err(AppError::NotFound)
+    }
+}
+
+pub(super) fn routes() -> ApiRouter {
+    ApiRouter::new()
+        .route(
+            "/configs/{config_id}/server-blocks",
+            axum::routing::get(list_server_blocks).post(create_server_block),
+        )
+        .route(
+            "/server-blocks/{id}",
+            axum::routing::get(get_server_block)
+                .put(update_server_block)
+                .delete(delete_server_block),
+        )
+}

apps/nxmesh-master/src/routes/api/proxy/ssl_certificates.rs

@@ -0,0 +1,133 @@
+use std::sync::Arc;
+
+use axum::{
+    Json,
+    extract::{Path, State},
+    http::StatusCode,
+    response::IntoResponse,
+};
+use serde::{Deserialize, Serialize};
+use uuid::Uuid;
+
+use crate::routes::api::{AppError, ApiRouter};
+use crate::service::proxy::ssl_certificate::{
+    CreateSslCertificateParams, SslCertificateService, UpdateSslCertificateParams,
+};
+use crate::service::proxy::types::SslCertificateConfig;
+
+#[derive(Serialize)]
+pub(crate) struct SslCertificateResponse {
+    pub id: Uuid,
+    pub name: String,
+    pub cert_path: String,
+    pub key_path: String,
+    pub expiry_date: String,
+}
+
+impl From<SslCertificateConfig> for SslCertificateResponse {
+    fn from(c: SslCertificateConfig) -> Self {
+        Self {
+            id: c.id,
+            name: c.name,
+            cert_path: c.cert_path,
+            key_path: c.key_path,
+            expiry_date: c.expiry_date.to_rfc3339(),
+        }
+    }
+}
+
+#[derive(Deserialize)]
+pub(crate) struct CreateSslCertificateRequest {
+    pub name: String,
+    pub cert_path: String,
+    pub key_path: String,
+    pub expiry_date: chrono::DateTime<chrono::Utc>,
+}
+
+impl From<CreateSslCertificateRequest> for CreateSslCertificateParams {
+    fn from(r: CreateSslCertificateRequest) -> Self {
+        Self {
+            name: r.name,
+            cert_path: r.cert_path,
+            key_path: r.key_path,
+            expiry_date: r.expiry_date,
+        }
+    }
+}
+
+#[derive(Deserialize)]
+pub(crate) struct UpdateSslCertificateRequest {
+    pub name: Option<String>,
+    pub cert_path: Option<String>,
+    pub key_path: Option<String>,
+    pub expiry_date: Option<chrono::DateTime<chrono::Utc>>,
+}
+
+impl From<UpdateSslCertificateRequest> for UpdateSslCertificateParams {
+    fn from(r: UpdateSslCertificateRequest) -> Self {
+        Self {
+            name: r.name,
+            cert_path: r.cert_path,
+            key_path: r.key_path,
+            expiry_date: r.expiry_date,
+        }
+    }
+}
+
+async fn list_ssl_certificates(
+    State(svc): State<Arc<dyn SslCertificateService>>,
+) -> Result<Json<Vec<SslCertificateResponse>>, AppError> {
+    let certs = svc.list().await?;
+    Ok(Json(certs.into_iter().map(Into::into).collect()))
+}
+
+async fn create_ssl_certificate(
+    State(svc): State<Arc<dyn SslCertificateService>>,
+    Json(body): Json<CreateSslCertificateRequest>,
+) -> Result<impl IntoResponse, AppError> {
+    let cert = svc.create(body.into()).await?;
+    Ok((StatusCode::CREATED, Json(SslCertificateResponse::from(cert))))
+}
+
+async fn get_ssl_certificate(
+    State(svc): State<Arc<dyn SslCertificateService>>,
+    Path(id): Path<Uuid>,
+) -> Result<Json<SslCertificateResponse>, AppError> {
+    let cert = svc.get(id).await?;
+    Ok(Json(cert.into()))
+}
+
+async fn update_ssl_certificate(
+    State(svc): State<Arc<dyn SslCertificateService>>,
+    Path(id): Path<Uuid>,
+    Json(body): Json<UpdateSslCertificateRequest>,
+) -> Result<Json<SslCertificateResponse>, AppError> {
+    let cert = svc.update(id, body.into()).await?;
+    Ok(Json(cert.into()))
+}
+
+async fn delete_ssl_certificate(
+    State(svc): State<Arc<dyn SslCertificateService>>,
+    Path(id): Path<Uuid>,
+) -> Result<impl IntoResponse, AppError> {
+    let deleted = svc.delete(id).await?;
+    if deleted {
+        Ok((StatusCode::NO_CONTENT,))
+    } else {
+        Err(AppError::NotFound)
+    }
+}
+
+pub(super) fn routes() -> ApiRouter {
+    ApiRouter::new()
+        .route(
+            "/ssl-certificates",
+            axum::routing::get(list_ssl_certificates).post(create_ssl_certificate),
+        )
+        .route(
+            "/ssl-certificates/{id}",
+            axum::routing::get(get_ssl_certificate)
+                .put(update_ssl_certificate)
+                .delete(delete_ssl_certificate),
+        )
+}

apps/nxmesh-master/src/routes/api/proxy/test_builder.rs

@@ -0,0 +1,174 @@
+use std::sync::Arc;
+
+use axum_test::TestServer;
+
+use crate::routes::api::{ApiState, LocalApiState};
+use crate::service::proxy::*;
+use crate::service::proxy::{
+    access_rule::MockAccessRuleService,
+    cache_zone::MockCacheZoneService,
+    config_inheritance::MockConfigInheritanceService,
+    limit_rule::MockLimitRuleService,
+    limit_zone::MockLimitZoneService,
+    location_block::MockLocationBlockService,
+    log_setting::MockLogSettingService,
+    proxy_setting::MockProxySettingService,
+    rewrite_rule::MockRewriteRuleService,
+    server_block::MockServerBlockService,
+    ssl_certificate::MockSslCertificateService,
+    upstream::MockUpstreamService,
+};
+
+pub(crate) struct TestProxyApiBuilder {
+    proxy_service: Option<MockProxyServiceTrait>,
+    server_block_service: Option<MockServerBlockService>,
+    upstream_service: Option<MockUpstreamService>,
+    location_block_service: Option<MockLocationBlockService>,
+    access_rule_service: Option<MockAccessRuleService>,
+    cache_zone_service: Option<MockCacheZoneService>,
+    limit_rule_service: Option<MockLimitRuleService>,
+    limit_zone_service: Option<MockLimitZoneService>,
+    log_setting_service: Option<MockLogSettingService>,
+    proxy_setting_service: Option<MockProxySettingService>,
+    rewrite_rule_service: Option<MockRewriteRuleService>,
+    ssl_certificate_service: Option<MockSslCertificateService>,
+    config_inheritance_service: Option<MockConfigInheritanceService>,
+}
+
+impl TestProxyApiBuilder {
+    pub fn new() -> Self {
+        Self {
+            proxy_service: None,
+            server_block_service: None,
+            upstream_service: None,
+            location_block_service: None,
+            access_rule_service: None,
+            cache_zone_service: None,
+            limit_rule_service: None,
+            limit_zone_service: None,
+            log_setting_service: None,
+            proxy_setting_service: None,
+            rewrite_rule_service: None,
+            ssl_certificate_service: None,
+            config_inheritance_service: None,
+        }
+    }
+
+    pub fn with_proxy(mut self, mock: MockProxyServiceTrait) -> Self {
+        self.proxy_service = Some(mock);
+        self
+    }
+
+    pub fn with_server_block(mut self, mock: MockServerBlockService) -> Self {
+        self.server_block_service = Some(mock);
+        self
+    }
+
+    pub fn with_upstream(mut self, mock: MockUpstreamService) -> Self {
+        self.upstream_service = Some(mock);
+        self
+    }
+
+    pub fn with_location_block(mut self, mock: MockLocationBlockService) -> Self {
+        self.location_block_service = Some(mock);
+        self
+    }
+
+    pub fn with_access_rule(mut self, mock: MockAccessRuleService) -> Self {
+        self.access_rule_service = Some(mock);
+        self
+    }
+
+    pub fn with_cache_zone(mut self, mock: MockCacheZoneService) -> Self {
+        self.cache_zone_service = Some(mock);
+        self
+    }
+
+    pub fn with_limit_rule(mut self, mock: MockLimitRuleService) -> Self {
+        self.limit_rule_service = Some(mock);
+        self
+    }
+
+    pub fn with_limit_zone(mut self, mock: MockLimitZoneService) -> Self {
+        self.limit_zone_service = Some(mock);
+        self
+    }
+
+    pub fn with_log_setting(mut self, mock: MockLogSettingService) -> Self {
+        self.log_setting_service = Some(mock);
+        self
+    }
+
+    pub fn with_proxy_setting(mut self, mock: MockProxySettingService) -> Self {
+        self.proxy_setting_service = Some(mock);
+        self
+    }
+
+    pub fn with_rewrite_rule(mut self, mock: MockRewriteRuleService) -> Self {
+        self.rewrite_rule_service = Some(mock);
+        self
+    }
+
+    pub fn with_ssl_certificate(mut self, mock: MockSslCertificateService) -> Self {
+        self.ssl_certificate_service = Some(mock);
+        self
+    }
+
+    pub fn with_config_inheritance(mut self, mock: MockConfigInheritanceService) -> Self {
+        self.config_inheritance_service = Some(mock);
+        self
+    }
+
+    pub async fn build(self) -> TestServer {
+        let state = ApiState {
+            proxy_service: Arc::new(self.proxy_service.unwrap_or_else(MockProxyServiceTrait::new)),
+            server_block_service: Arc::new(
+                self.server_block_service.unwrap_or_else(MockServerBlockService::new),
+            ),
+            upstream_service: Arc::new(
+                self.upstream_service.unwrap_or_else(MockUpstreamService::new),
+            ),
+            location_block_service: Arc::new(
+                self.location_block_service
+                    .unwrap_or_else(MockLocationBlockService::new),
+            ),
+            access_rule_service: Arc::new(
+                self.access_rule_service.unwrap_or_else(MockAccessRuleService::new),
+            ),
+            cache_zone_service: Arc::new(
+                self.cache_zone_service.unwrap_or_else(MockCacheZoneService::new),
+            ),
+            limit_rule_service: Arc::new(
+                self.limit_rule_service.unwrap_or_else(MockLimitRuleService::new),
+            ),
+            limit_zone_service: Arc::new(
+                self.limit_zone_service.unwrap_or_else(MockLimitZoneService::new),
+            ),
+            log_setting_service: Arc::new(
+                self.log_setting_service.unwrap_or_else(MockLogSettingService::new),
+            ),
+            proxy_setting_service: Arc::new(
+                self.proxy_setting_service
+                    .unwrap_or_else(MockProxySettingService::new),
+            ),
+            rewrite_rule_service: Arc::new(
+                self.rewrite_rule_service
+                    .unwrap_or_else(MockRewriteRuleService::new),
+            ),
+            ssl_certificate_service: Arc::new(
+                self.ssl_certificate_service
+                    .unwrap_or_else(MockSslCertificateService::new),
+            ),
+            config_inheritance_service: Arc::new(
+                self.config_inheritance_service
+                    .unwrap_or_else(MockConfigInheritanceService::new),
+            ),
+            // Keep agent_service for ApiState completeness; not used by proxy routes
+            agent_service: Arc::new(crate::service::agent::MockAgentService::new()),
+        };
+        let app = super::get_router()
+            .await
+            .with_state(LocalApiState(Arc::new(state)));
+        TestServer::new(app)
+    }
+}

apps/nxmesh-master/src/routes/api/proxy/upstreams.rs

@@ -0,0 +1,144 @@
+use std::sync::Arc;
+
+use axum::{
+    Json,
+    extract::{Path, State},
+    http::StatusCode,
+    response::IntoResponse,
+};
+use serde::{Deserialize, Serialize};
+use uuid::Uuid;
+
+use crate::routes::api::{AppError, ApiRouter};
+use crate::service::proxy::types::UpstreamConfig;
+use crate::service::proxy::upstream::{
+    CreateUpstreamParams, UpstreamService, UpdateUpstreamParams,
+};
+
+#[derive(Serialize)]
+pub(crate) struct UpstreamResponse {
+    pub id: Uuid,
+    pub name: String,
+    pub target_host: String,
+    pub target_port: i32,
+    pub metadata: Option<serde_json::Value>,
+    pub override_of_id: Option<Uuid>,
+}
+
+impl From<UpstreamConfig> for UpstreamResponse {
+    fn from(c: UpstreamConfig) -> Self {
+        Self {
+            id: c.id,
+            name: c.name,
+            target_host: c.target_host,
+            target_port: c.target_port,
+            metadata: c.metadata,
+            override_of_id: c.override_of_id,
+        }
+    }
+}
+
+#[derive(Deserialize)]
+pub(crate) struct CreateUpstreamRequest {
+    pub name: String,
+    pub target_host: String,
+    pub target_port: i32,
+    pub metadata: Option<serde_json::Value>,
+    pub override_of_id: Option<Uuid>,
+}
+
+impl From<CreateUpstreamRequest> for CreateUpstreamParams {
+    fn from(r: CreateUpstreamRequest) -> Self {
+        Self {
+            config_id: Uuid::nil(),
+            name: r.name,
+            target_host: r.target_host,
+            target_port: r.target_port,
+            metadata: r.metadata,
+            override_of_id: r.override_of_id,
+        }
+    }
+}
+
+#[derive(Deserialize)]
+pub(crate) struct UpdateUpstreamRequest {
+    pub name: Option<String>,
+    pub target_host: Option<String>,
+    pub target_port: Option<i32>,
+    pub metadata: Option<Option<serde_json::Value>>,
+    pub override_of_id: Option<Option<Uuid>>,
+}
+
+impl From<UpdateUpstreamRequest> for UpdateUpstreamParams {
+    fn from(r: UpdateUpstreamRequest) -> Self {
+        Self {
+            name: r.name,
+            target_host: r.target_host,
+            target_port: r.target_port,
+            metadata: r.metadata,
+            override_of_id: r.override_of_id,
+        }
+    }
+}
+
+async fn list_upstreams(
+    State(svc): State<Arc<dyn UpstreamService>>,
+    Path(config_id): Path<Uuid>,
+) -> Result<Json<Vec<UpstreamResponse>>, AppError> {
+    let upstreams = svc.list_by_config(config_id).await?;
+    Ok(Json(upstreams.into_iter().map(Into::into).collect()))
+}
+
+async fn create_upstream(
+    State(svc): State<Arc<dyn UpstreamService>>,
+    Path(config_id): Path<Uuid>,
+    Json(body): Json<CreateUpstreamRequest>,
+) -> Result<impl IntoResponse, AppError> {
+    let mut params = CreateUpstreamParams::from(body);
+    params.config_id = config_id;
+    let upstream = svc.create(params).await?;
+    Ok((StatusCode::CREATED, Json(UpstreamResponse::from(upstream))))
+}
+
+async fn get_upstream(
+    State(svc): State<Arc<dyn UpstreamService>>,
+    Path(id): Path<Uuid>,
+) -> Result<Json<UpstreamResponse>, AppError> {
+    let upstream = svc.get(id).await?;
+    Ok(Json(upstream.into()))
+}
+
+async fn update_upstream(
+    State(svc): State<Arc<dyn UpstreamService>>,
+    Path(id): Path<Uuid>,
+    Json(body): Json<UpdateUpstreamRequest>,
+) -> Result<Json<UpstreamResponse>, AppError> {
+    let upstream = svc.update(id, body.into()).await?;
+    Ok(Json(upstream.into()))
+}
+
+async fn delete_upstream(
+    State(svc): State<Arc<dyn UpstreamService>>,
+    Path(id): Path<Uuid>,
+) -> Result<impl IntoResponse, AppError> {
+    let deleted = svc.delete(id).await?;
+    if deleted {
+        Ok((StatusCode::NO_CONTENT,))
+    } else {
+        Err(AppError::NotFound)
+    }
+}
+
+pub(super) fn routes() -> ApiRouter {
+    ApiRouter::new()
+        .route(
+            "/configs/{config_id}/upstreams",
+            axum::routing::get(list_upstreams).post(create_upstream),
+        )
+        .route(
+            "/upstreams/{id}",
+            axum::routing::get(get_upstream)
+                .put(update_upstream)
+                .delete(delete_upstream),
+        )
+}

apps/nxmesh-master/src/routes/mod.rs

@@ -1,21 +1,44 @@
+use std::sync::Arc;
+
 use axum::Router;
 
+pub mod api;
 mod frontend;
 
-pub async fn get_root_router() -> Router {
+pub async fn get_root_router(api_state: impl Into<Arc<api::ApiState>>) -> Router {
     Router::new()
         .merge(frontend::get_router().await)
+        .nest("/api", api::get_router(api_state.into()).await)
         .fallback(frontend::get_fallback_handler().await)
 }
 
 #[cfg(test)]
 mod tests {
+    use crate::service::agent::MockAgentService;
+
     use super::*;
     use axum_test::TestServer;
 
     #[tokio::test]
     async fn test_should_return_index_html_for_root_path() {
-        let router = get_root_router().await;
+        use crate::service::proxy::*;
+        let state = Arc::new(api::ApiState {
+            agent_service: Arc::new(MockAgentService::new()),
+            proxy_service: Arc::new(MockProxyServiceTrait::new()),
+            server_block_service: Arc::new(server_block::MockServerBlockService::new()),
+            upstream_service: Arc::new(upstream::MockUpstreamService::new()),
+            location_block_service: Arc::new(location_block::MockLocationBlockService::new()),
+            access_rule_service: Arc::new(access_rule::MockAccessRuleService::new()),
+            cache_zone_service: Arc::new(cache_zone::MockCacheZoneService::new()),
+            limit_rule_service: Arc::new(limit_rule::MockLimitRuleService::new()),
+            limit_zone_service: Arc::new(limit_zone::MockLimitZoneService::new()),
+            log_setting_service: Arc::new(log_setting::MockLogSettingService::new()),
+            proxy_setting_service: Arc::new(proxy_setting::MockProxySettingService::new()),
+            rewrite_rule_service: Arc::new(rewrite_rule::MockRewriteRuleService::new()),
+            ssl_certificate_service: Arc::new(ssl_certificate::MockSslCertificateService::new()),
+            config_inheritance_service: Arc::new(config_inheritance::MockConfigInheritanceService::new()),
+        });
+        let router = get_root_router(state).await;
         let server = TestServer::new(router);
         let response = server.get("/").await;
         assert_eq!(response.status_code(), 200);
@@ -23,7 +46,24 @@ mod tests {
 
     #[tokio::test]
     async fn test_should_return_index_html_for_nonexistent_path() {
-        let router = get_root_router().await;
+        use crate::service::proxy::*;
+        let state = Arc::new(api::ApiState {
+            agent_service: Arc::new(MockAgentService::new()),
+            proxy_service: Arc::new(MockProxyServiceTrait::new()),
+            server_block_service: Arc::new(server_block::MockServerBlockService::new()),
+            upstream_service: Arc::new(upstream::MockUpstreamService::new()),
+            location_block_service: Arc::new(location_block::MockLocationBlockService::new()),
+            access_rule_service: Arc::new(access_rule::MockAccessRuleService::new()),
+            cache_zone_service: Arc::new(cache_zone::MockCacheZoneService::new()),
+            limit_rule_service: Arc::new(limit_rule::MockLimitRuleService::new()),
+            limit_zone_service: Arc::new(limit_zone::MockLimitZoneService::new()),
+            log_setting_service: Arc::new(log_setting::MockLogSettingService::new()),
+            proxy_setting_service: Arc::new(proxy_setting::MockProxySettingService::new()),
+            rewrite_rule_service: Arc::new(rewrite_rule::MockRewriteRuleService::new()),
+            ssl_certificate_service: Arc::new(ssl_certificate::MockSslCertificateService::new()),
+            config_inheritance_service: Arc::new(config_inheritance::MockConfigInheritanceService::new()),
+        });
+        let router = get_root_router(state).await;
         let server = TestServer::new(router);
         let fallback_response = server.get("/nonexistent").await;
         assert_eq!(fallback_response.status_code(), 200);

apps/nxmesh-master/src/service/agent/mod.rs

@@ -1,26 +1,120 @@
-use nxmesh_proto::{AgentMessage, MasterMessage, agent_service_server::AgentService};
+use chrono::Utc;
+use nxmesh_proto::{
+    AgentMessage, MasterMessage, agent_service_server::AgentService as GrpcAgentService,
+};
+use sea_orm::DatabaseConnection;
+use tokio::sync::mpsc;
+use tokio_stream::wrappers::ReceiverStream;
+use tracing::{error, info};
+use uuid::Uuid;
 
-pub mod repo;
+mod repo;
+pub mod types;
+
+pub use types::{AgentRecord, CreateAgentRecord, State, UpdateAgentRecord};
+
+use crate::service::error::RepoError;
+use repo::{AgentRepo, AgentRepoImpl};
+
+#[cfg_attr(test, mockall::automock)]
+#[async_trait::async_trait]
+pub trait AgentService: Send + Sync + 'static {
+    async fn list(&self) -> Result<Vec<AgentRecord>, RepoError>;
+    async fn get(&self, id: Uuid) -> Result<Option<AgentRecord>, RepoError>;
+    async fn create(&self, rec: &CreateAgentRecord) -> Result<AgentRecord, RepoError>;
+    async fn update(
+        &self,
+        id: Uuid,
+        rec: &UpdateAgentRecord,
+    ) -> Result<Option<AgentRecord>, RepoError>;
+    async fn delete(&self, id: Uuid) -> Result<bool, RepoError>;
+}
+
+pub struct AgentServiceImpl {
+    repo: Box<dyn AgentRepo>,
+}
+
+impl AgentServiceImpl {
+    pub fn new(db: DatabaseConnection) -> Self {
+        Self {
+            repo: Box::new(AgentRepoImpl::new(db)),
+        }
+    }
+}
+
+#[async_trait::async_trait]
+impl AgentService for AgentServiceImpl {
+    async fn list(&self) -> Result<Vec<AgentRecord>, RepoError> {
+        self.repo.list().await
+    }
+
+    async fn get(&self, id: Uuid) -> Result<Option<AgentRecord>, RepoError> {
+        self.repo.get(id).await
+    }
+
+    async fn create(&self, rec: &CreateAgentRecord) -> Result<AgentRecord, RepoError> {
+        self.repo.create(rec).await
+    }
+
+    async fn update(
+        &self,
+        id: Uuid,
+        rec: &UpdateAgentRecord,
+    ) -> Result<Option<AgentRecord>, RepoError> {
+        self.repo.update(id, rec).await
+    }
+
+    async fn delete(&self, id: Uuid) -> Result<bool, RepoError> {
+        self.repo.delete(id).await
+    }
+}
 
 #[derive(Debug, Default)]
 pub struct AgentServerService {}
 
 #[async_trait::async_trait]
-impl AgentService for AgentServerService {
-    #[doc = " Server streaming response type for the Stream method."]
-    type StreamStream = tonic::codec::Streaming<MasterMessage>;
+impl GrpcAgentService for AgentServerService {
+    type StreamStream =
+        tokio_stream::wrappers::ReceiverStream<std::result::Result<MasterMessage, tonic::Status>>;
 
-    #[doc = " Stream establishes a persistent connection for real-time communication"]
-    #[allow(
-        mismatched_lifetime_syntaxes,
-        clippy::type_complexity,
-        clippy::type_repetition_in_bounds
-    )]
     async fn stream(
         &self,
         request: tonic::Request<tonic::Streaming<AgentMessage>>,
     ) -> Result<tonic::Response<Self::StreamStream>, tonic::Status> {
-        todo!()
+        let mut inbound = request.into_inner();
+
+        let (tx, rx) = mpsc::channel::<std::result::Result<MasterMessage, tonic::Status>>(32);
+        let outbound = ReceiverStream::new(rx);
+
+        tokio::spawn(async move {
+            loop {
+                match inbound.message().await {
+                    Ok(Some(msg)) => {
+                        info!("Received AgentMessage: {:?}", msg);
+
+                        let ack = MasterMessage {
+                            timestamp: Utc::now().timestamp_millis(),
+                            message_id: Uuid::new_v4().to_string(),
+                            payload: None,
+                        };
+                        if let Err(e) = tx.send(Ok(ack)).await {
+                            error!("Failed to send MasterMessage ack: {:?}", e);
+                            return;
+                        }
+                    }
+                    Ok(None) => {
+                        info!("Agent closed the outbound stream");
+                        return;
+                    }
+                    Err(e) => {
+                        error!("Error receiving AgentMessage: {:?}", e);
+                        return;
+                    }
+                }
+            }
+        });
+
+        Ok(tonic::Response::new(outbound))
     }
 
     async fn connection_test(

apps/nxmesh-master/src/service/agent/repo.rs

@@ -0,0 +1,146 @@
+use sea_orm::{ActiveModelTrait, ActiveValue::Set, DatabaseConnection, EntityTrait};
+use uuid::Uuid;
+
+use super::types::{AgentRecord, CreateAgentRecord, State, UpdateAgentRecord};
+use crate::{
+    db::entities::agents::{ActiveModel as AgentActiveModel, Entity as Agent},
+    service::error::RepoError,
+};
+
+#[async_trait::async_trait]
+pub(crate) trait AgentRepo: Send + Sync + 'static {
+    async fn list(&self) -> Result<Vec<AgentRecord>, RepoError>;
+    async fn get(&self, id: Uuid) -> Result<Option<AgentRecord>, RepoError>;
+    async fn create(&self, rec: &CreateAgentRecord) -> Result<AgentRecord, RepoError>;
+    async fn update(
+        &self,
+        id: Uuid,
+        rec: &UpdateAgentRecord,
+    ) -> Result<Option<AgentRecord>, RepoError>;
+    async fn delete(&self, id: Uuid) -> Result<bool, RepoError>;
+}
+
+pub(crate) struct AgentRepoImpl {
+    db: DatabaseConnection,
+}
+
+impl AgentRepoImpl {
+    pub fn new(db: DatabaseConnection) -> Self {
+        Self { db }
+    }
+}
+
+#[async_trait::async_trait]
+impl AgentRepo for AgentRepoImpl {
+    async fn list(&self) -> Result<Vec<AgentRecord>, RepoError> {
+        let agents = Agent::find().all(&self.db).await?;
+        Ok(agents
+            .into_iter()
+            .map(|m| AgentRecord {
+                id: m.id,
+                name: m.name,
+                ip_address: m.ip_address,
+                state: m.state.into(),
+                deployment_mode: m.deployment_mode,
+                last_seen_at: m.last_seen_at.map(|dt| dt.to_string()),
+                labels: m.labels,
+                created_at: m.created_at.to_string(),
+                updated_at: m.updated_at.to_string(),
+            })
+            .collect())
+    }
+
+    async fn get(&self, id: Uuid) -> Result<Option<AgentRecord>, RepoError> {
+        let agent = Agent::find_by_id(id).one(&self.db).await?;
+        Ok(agent.map(|m| AgentRecord {
+            id: m.id,
+            name: m.name,
+            ip_address: m.ip_address,
+            state: m.state.into(),
+            deployment_mode: m.deployment_mode,
+            last_seen_at: m.last_seen_at.map(|dt| dt.to_string()),
+            labels: m.labels,
+            created_at: m.created_at.to_string(),
+            updated_at: m.updated_at.to_string(),
+        }))
+    }
+
+    async fn create(&self, rec: &CreateAgentRecord) -> Result<AgentRecord, RepoError> {
+        let new_agent = AgentActiveModel {
+            id: Set(Uuid::new_v4()),
+            name: Set(rec.name.clone()),
+            ip_address: Set(rec.ip_address.clone()),
+            state: Set(State::Active.into()),
+            deployment_mode: Set(None),
+            last_seen_at: Set(None),
+            labels: Set(None),
+            created_at: Set(chrono::Utc::now().into()),
+            updated_at: Set(chrono::Utc::now().into()),
+            ..Default::default()
+        };
+
+        let agent = new_agent.insert(&self.db).await?;
+
+        Ok(AgentRecord {
+            id: agent.id,
+            name: agent.name,
+            ip_address: agent.ip_address,
+            state: agent.state.into(),
+            deployment_mode: agent.deployment_mode,
+            last_seen_at: agent.last_seen_at.map(|dt| dt.to_string()),
+            labels: agent.labels,
+            created_at: agent.created_at.to_string(),
+            updated_at: agent.updated_at.to_string(),
+        })
+    }
+
+    async fn update(
+        &self,
+        id: Uuid,
+        rec: &UpdateAgentRecord,
+    ) -> Result<Option<AgentRecord>, RepoError> {
+        let existing = match Agent::find_by_id(id).one(&self.db).await? {
+            Some(agent) => agent,
+            None => return Ok(None),
+        };
+
+        let mut agent: AgentActiveModel = AgentActiveModel::from(existing);
+
+        if let Some(name) = &rec.name {
+            agent.name = Set(name.clone());
+        }
+        if let Some(ip_address) = &rec.ip_address {
+            agent.ip_address = Set(Some(ip_address.clone()));
+        }
+        if let Some(state) = &rec.state {
+            agent.state = Set(String::from(*state));
+        }
+        if let Some(deployment_mode) = &rec.deployment_mode {
+            agent.deployment_mode = Set(Some(deployment_mode.clone()));
+        }
+        if let Some(labels) = &rec.labels {
+            agent.labels = Set(Some(labels.clone()));
+        }
+
+        agent.updated_at = Set(chrono::Utc::now().into());
+
+        let updated = agent.update(&self.db).await?;
+
+        Ok(Some(AgentRecord {
+            id: updated.id,
+            name: updated.name,
+            ip_address: updated.ip_address,
+            state: updated.state.into(),
+            deployment_mode: updated.deployment_mode,
+            last_seen_at: updated.last_seen_at.map(|dt| dt.to_string()),
+            labels: updated.labels,
+            created_at: updated.created_at.to_string(),
+            updated_at: updated.updated_at.to_string(),
+        }))
+    }
+
+    async fn delete(&self, id: Uuid) -> Result<bool, RepoError> {
+        let result = Agent::delete_by_id(id).exec(&self.db).await?;
+        Ok(result.rows_affected > 0)
+    }
+}

apps/nxmesh-master/src/service/agent/types.rs

@@ -0,0 +1,60 @@
+use serde::{Deserialize, Serialize};
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]
+pub enum State {
+    Active,
+    Inactive,
+    Unreachable,
+    Unknown,
+    Disabled,
+}
+
+impl From<State> for String {
+    fn from(state: State) -> Self {
+        match state {
+            State::Active => "active".to_string(),
+            State::Inactive => "inactive".to_string(),
+            State::Unreachable => "unreachable".to_string(),
+            State::Unknown => "unknown".to_string(),
+            State::Disabled => "disabled".to_string(),
+        }
+    }
+}
+
+impl From<String> for State {
+    fn from(s: String) -> Self {
+        match s.as_str() {
+            "active" => State::Active,
+            "inactive" => State::Inactive,
+            "unreachable" => State::Unreachable,
+            "unknown" => State::Unknown,
+            "disabled" => State::Disabled,
+            _ => State::Inactive,
+        }
+    }
+}
+
+pub struct AgentRecord {
+    pub id: uuid::Uuid,
+    pub name: String,
+    pub ip_address: Option<String>,
+    pub state: State,
+    pub deployment_mode: Option<String>,
+    pub last_seen_at: Option<String>,
+    pub labels: Option<serde_json::Value>,
+    pub created_at: String,
+    pub updated_at: String,
+}
+
+pub struct CreateAgentRecord {
+    pub name: String,
+    pub ip_address: Option<String>,
+}
+
+pub struct UpdateAgentRecord {
+    pub name: Option<String>,
+    pub ip_address: Option<String>,
+    pub state: Option<State>,
+    pub deployment_mode: Option<String>,
+    pub labels: Option<serde_json::Value>,
+}

apps/nxmesh-master/src/service/error.rs

@@ -0,0 +1,13 @@
+#[derive(Debug, Clone, PartialEq, Eq, thiserror::Error)]
+pub enum RepoError {
+    #[error("internal error: {0}")]
+    InternalError(String),
+}
+
+impl From<sea_orm::DbErr> for RepoError {
+    fn from(err: sea_orm::DbErr) -> Self {
+        match err {
+            other => RepoError::InternalError(other.to_string()),
+        }
+    }
+}

apps/nxmesh-master/src/service/mod.rs

@@ -6,6 +6,7 @@ use crate::{connector::agent::AgentConnectorTrait, service::certificate::Certifi
 
 pub mod agent;
 pub mod certificate;
+pub mod error;
 pub mod proxy;
 
 pub async fn start_master_server(
@@ -51,7 +52,68 @@ pub async fn start_master_server(
         }
     });
 
-    let axum_router = crate::routes::get_root_router().await;
+    let api_state = crate::routes::api::ApiState {
+        agent_service: Arc::new(crate::service::agent::AgentServiceImpl::new(
+            db_connection.clone(),
+        )),
+        proxy_service: Arc::new(crate::service::proxy::service::ProxyServiceImpl::new(
+            db_connection.clone(),
+        )),
+        server_block_service: Arc::new(
+            crate::service::proxy::server_block::ServerBlockServiceImpl::new(
+                db_connection.clone(),
+            ),
+        ),
+        upstream_service: Arc::new(
+            crate::service::proxy::upstream::UpstreamServiceImpl::new(db_connection.clone()),
+        ),
+        location_block_service: Arc::new(
+            crate::service::proxy::location_block::LocationBlockServiceImpl::new(
+                db_connection.clone(),
+            ),
+        ),
+        access_rule_service: Arc::new(
+            crate::service::proxy::access_rule::AccessRuleServiceImpl::new(
+                db_connection.clone(),
+            ),
+        ),
+        cache_zone_service: Arc::new(
+            crate::service::proxy::cache_zone::CacheZoneServiceImpl::new(db_connection.clone()),
+        ),
+        limit_rule_service: Arc::new(
+            crate::service::proxy::limit_rule::LimitRuleServiceImpl::new(db_connection.clone()),
+        ),
+        limit_zone_service: Arc::new(
+            crate::service::proxy::limit_zone::LimitZoneServiceImpl::new(db_connection.clone()),
+        ),
+        log_setting_service: Arc::new(
+            crate::service::proxy::log_setting::LogSettingServiceImpl::new(
+                db_connection.clone(),
+            ),
+        ),
+        proxy_setting_service: Arc::new(
+            crate::service::proxy::proxy_setting::ProxySettingServiceImpl::new(
+                db_connection.clone(),
+            ),
+        ),
+        rewrite_rule_service: Arc::new(
+            crate::service::proxy::rewrite_rule::RewriteRuleServiceImpl::new(
+                db_connection.clone(),
+            ),
+        ),
+        ssl_certificate_service: Arc::new(
+            crate::service::proxy::ssl_certificate::SslCertificateServiceImpl::new(
+                db_connection.clone(),
+            ),
+        ),
+        config_inheritance_service: Arc::new(
+            crate::service::proxy::config_inheritance::ConfigInheritanceServiceImpl::new(
+                db_connection.clone(),
+            ),
+        ),
+    };
+
+    let axum_router = crate::routes::get_root_router(Arc::new(api_state)).await;
 
     // Start the HTTP server
     let addr = format!("{}:{}", settings.server.bind_address, settings.server.port)

apps/nxmesh-master/src/service/proxy/access_rule/mod.rs

@@ -0,0 +1,156 @@
+use sea_orm::{ActiveModelTrait, ActiveValue::Set, DatabaseConnection, EntityTrait, prelude::*};
+use uuid::Uuid;
+
+use crate::service::proxy::types::{AccessRuleConfig, ProxyServiceError, ProxyServiceResult};
+
+pub struct CreateAccessRuleParams {
+    pub server_id: Option<Uuid>,
+    pub location_id: Option<Uuid>,
+    pub r#type: String,
+    pub ip_cidr: String,
+    pub description: Option<String>,
+    pub priority: i32,
+    pub override_of_id: Option<Uuid>,
+}
+
+pub struct UpdateAccessRuleParams {
+    pub server_id: Option<Option<Uuid>>,
+    pub location_id: Option<Option<Uuid>>,
+    pub r#type: Option<String>,
+    pub ip_cidr: Option<String>,
+    pub description: Option<Option<String>>,
+    pub priority: Option<i32>,
+    pub override_of_id: Option<Option<Uuid>>,
+}
+
+#[cfg_attr(test, mockall::automock)]
+#[async_trait::async_trait]
+pub trait AccessRuleService: Send + Sync + 'static {
+    async fn get(&self, id: Uuid) -> ProxyServiceResult<AccessRuleConfig>;
+    async fn list_by_server(&self, server_id: Uuid) -> ProxyServiceResult<Vec<AccessRuleConfig>>;
+    async fn list_by_location(
+        &self,
+        location_id: Uuid,
+    ) -> ProxyServiceResult<Vec<AccessRuleConfig>>;
+    async fn create(&self, params: CreateAccessRuleParams) -> ProxyServiceResult<AccessRuleConfig>;
+    async fn update(
+        &self,
+        id: Uuid,
+        params: UpdateAccessRuleParams,
+    ) -> ProxyServiceResult<AccessRuleConfig>;
+    async fn delete(&self, id: Uuid) -> ProxyServiceResult<bool>;
+}
+
+pub(crate) struct AccessRuleServiceImpl {
+    db: DatabaseConnection,
+}
+
+impl AccessRuleServiceImpl {
+    pub fn new(db: DatabaseConnection) -> Self {
+        Self { db }
+    }
+}
+
+#[async_trait::async_trait]
+impl AccessRuleService for AccessRuleServiceImpl {
+    async fn get(&self, id: Uuid) -> ProxyServiceResult<AccessRuleConfig> {
+        use crate::db::entities::access_rule;
+
+        let model = access_rule::Entity::find_by_id(id)
+            .one(&self.db)
+            .await?
+            .ok_or(ProxyServiceError::ConfigNotFound)?;
+
+        Ok(model.into())
+    }
+
+    async fn list_by_server(&self, server_id: Uuid) -> ProxyServiceResult<Vec<AccessRuleConfig>> {
+        use crate::db::entities::access_rule;
+
+        let models = access_rule::Entity::find()
+            .filter(access_rule::Column::ServerId.eq(server_id))
+            .all(&self.db)
+            .await?;
+
+        Ok(models.into_iter().map(Into::into).collect())
+    }
+
+    async fn list_by_location(
+        &self,
+        location_id: Uuid,
+    ) -> ProxyServiceResult<Vec<AccessRuleConfig>> {
+        use crate::db::entities::access_rule;
+
+        let models = access_rule::Entity::find()
+            .filter(access_rule::Column::LocationId.eq(location_id))
+            .all(&self.db)
+            .await?;
+
+        Ok(models.into_iter().map(Into::into).collect())
+    }
+
+    async fn create(&self, params: CreateAccessRuleParams) -> ProxyServiceResult<AccessRuleConfig> {
+        use crate::db::entities::access_rule::ActiveModel;
+
+        let model = ActiveModel {
+            id: Set(Uuid::new_v4()),
+            server_id: Set(params.server_id),
+            location_id: Set(params.location_id),
+            r#type: Set(params.r#type),
+            ip_cidr: Set(params.ip_cidr),
+            description: Set(params.description),
+            priority: Set(params.priority),
+            is_deleted: Set(false),
+            override_of_id: Set(params.override_of_id),
+        };
+
+        let result = model.insert(&self.db).await?;
+        Ok(result.into())
+    }
+
+    async fn update(
+        &self,
+        id: Uuid,
+        params: UpdateAccessRuleParams,
+    ) -> ProxyServiceResult<AccessRuleConfig> {
+        use crate::db::entities::access_rule::{ActiveModel, Entity as AccessRuleEntity};
+
+        let existing = AccessRuleEntity::find_by_id(id)
+            .one(&self.db)
+            .await?
+            .ok_or(ProxyServiceError::ConfigNotFound)?;
+
+        let mut model: ActiveModel = existing.into();
+        if let Some(server_id) = params.server_id {
+            model.server_id = Set(server_id);
+        }
+        if let Some(location_id) = params.location_id {
+            model.location_id = Set(location_id);
+        }
+        if let Some(r#type) = params.r#type {
+            model.r#type = Set(r#type);
+        }
+        if let Some(ip_cidr) = params.ip_cidr {
+            model.ip_cidr = Set(ip_cidr);
+        }
+        if let Some(description) = params.description {
+            model.description = Set(description);
+        }
+        if let Some(priority) = params.priority {
+            model.priority = Set(priority);
+        }
+        if let Some(override_of_id) = params.override_of_id {
+            model.override_of_id = Set(override_of_id);
+        }
+
+        let result = model.update(&self.db).await?;
+        Ok(result.into())
+    }
+
+    async fn delete(&self, id: Uuid) -> ProxyServiceResult<bool> {
+        let result = crate::db::entities::access_rule::Entity::delete_by_id(id)
+            .exec(&self.db)
+            .await?;
+        Ok(result.rows_affected > 0)
+    }
+}

apps/nxmesh-master/src/service/proxy/cache_zone/mod.rs

@@ -0,0 +1,116 @@
+use sea_orm::{ActiveModelTrait, ActiveValue::Set, DatabaseConnection, EntityTrait, prelude::*};
+use uuid::Uuid;
+
+use crate::service::proxy::types::{CacheZoneConfig, ProxyServiceError, ProxyServiceResult};
+
+pub struct CreateCacheZoneParams {
+    pub name: String,
+    pub path: String,
+    pub size_limit: String,
+    pub override_of_id: Option<Uuid>,
+}
+
+pub struct UpdateCacheZoneParams {
+    pub name: Option<String>,
+    pub path: Option<String>,
+    pub size_limit: Option<String>,
+    pub override_of_id: Option<Option<Uuid>>,
+}
+
+#[cfg_attr(test, mockall::automock)]
+#[async_trait::async_trait]
+pub trait CacheZoneService: Send + Sync + 'static {
+    async fn get(&self, id: Uuid) -> ProxyServiceResult<CacheZoneConfig>;
+    async fn list(&self) -> ProxyServiceResult<Vec<CacheZoneConfig>>;
+    async fn create(&self, params: CreateCacheZoneParams) -> ProxyServiceResult<CacheZoneConfig>;
+    async fn update(
+        &self,
+        id: Uuid,
+        params: UpdateCacheZoneParams,
+    ) -> ProxyServiceResult<CacheZoneConfig>;
+    async fn delete(&self, id: Uuid) -> ProxyServiceResult<bool>;
+}
+
+pub(crate) struct CacheZoneServiceImpl {
+    db: DatabaseConnection,
+}
+
+impl CacheZoneServiceImpl {
+    pub fn new(db: DatabaseConnection) -> Self {
+        Self { db }
+    }
+}
+
+#[async_trait::async_trait]
+impl CacheZoneService for CacheZoneServiceImpl {
+    async fn get(&self, id: Uuid) -> ProxyServiceResult<CacheZoneConfig> {
+        use crate::db::entities::cache_zone;
+
+        let model = cache_zone::Entity::find_by_id(id)
+            .one(&self.db)
+            .await?
+            .ok_or(ProxyServiceError::ConfigNotFound)?;
+
+        Ok(model.into())
+    }
+
+    async fn list(&self) -> ProxyServiceResult<Vec<CacheZoneConfig>> {
+        use crate::db::entities::cache_zone;
+
+        let models = cache_zone::Entity::find().all(&self.db).await?;
+
+        Ok(models.into_iter().map(Into::into).collect())
+    }
+
+    async fn create(&self, params: CreateCacheZoneParams) -> ProxyServiceResult<CacheZoneConfig> {
+        use crate::db::entities::cache_zone::ActiveModel;
+
+        let model = ActiveModel {
+            id: Set(Uuid::new_v4()),
+            name: Set(params.name),
+            path: Set(params.path),
+            size_limit: Set(params.size_limit),
+            override_of_id: Set(params.override_of_id),
+        };
+
+        let result = model.insert(&self.db).await?;
+        Ok(result.into())
+    }
+
+    async fn update(
+        &self,
+        id: Uuid,
+        params: UpdateCacheZoneParams,
+    ) -> ProxyServiceResult<CacheZoneConfig> {
+        use crate::db::entities::cache_zone::{ActiveModel, Entity as CacheZoneEntity};
+
+        let existing = CacheZoneEntity::find_by_id(id)
+            .one(&self.db)
+            .await?
+            .ok_or(ProxyServiceError::ConfigNotFound)?;
+
+        let mut model: ActiveModel = existing.into();
+        if let Some(name) = params.name {
+            model.name = Set(name);
+        }
+        if let Some(path) = params.path {
+            model.path = Set(path);
+        }
+        if let Some(size_limit) = params.size_limit {
+            model.size_limit = Set(size_limit);
+        }
+        if let Some(override_of_id) = params.override_of_id {
+            model.override_of_id = Set(override_of_id);
+        }
+
+        let result = model.update(&self.db).await?;
+        Ok(result.into())
+    }
+
+    async fn delete(&self, id: Uuid) -> ProxyServiceResult<bool> {
+        let result = crate::db::entities::cache_zone::Entity::delete_by_id(id)
+            .exec(&self.db)
+            .await?;
+        Ok(result.rows_affected > 0)
+    }
+}

apps/nxmesh-master/src/service/proxy/config_inheritance/mod.rs

@@ -0,0 +1,144 @@
+use sea_orm::{ActiveModelTrait, ActiveValue::Set, DatabaseConnection, EntityTrait, prelude::*};
+use uuid::Uuid;
+
+use crate::service::proxy::types::ProxyServiceResult;
+
+pub struct AddInheritanceParams {
+    pub child_config_id: Uuid,
+    pub parent_config_id: Uuid,
+    pub priority: Option<i32>,
+}
+
+pub struct ConfigInheritanceRecord {
+    pub id: Uuid,
+    pub child_config_id: Uuid,
+    pub parent_config_id: Uuid,
+    pub priority: Option<i32>,
+    pub applied_at: chrono::NaiveDateTime,
+}
+
+#[cfg_attr(test, mockall::automock)]
+#[async_trait::async_trait]
+pub trait ConfigInheritanceService: Send + Sync + 'static {
+    async fn add(
+        &self,
+        params: AddInheritanceParams,
+    ) -> ProxyServiceResult<ConfigInheritanceRecord>;
+    async fn remove(
+        &self,
+        child_config_id: Uuid,
+        parent_config_id: Uuid,
+    ) -> ProxyServiceResult<bool>;
+    async fn list_parents(
+        &self,
+        child_config_id: Uuid,
+    ) -> ProxyServiceResult<Vec<ConfigInheritanceRecord>>;
+    async fn list_children(
+        &self,
+        parent_config_id: Uuid,
+    ) -> ProxyServiceResult<Vec<ConfigInheritanceRecord>>;
+}
+
+pub(crate) struct ConfigInheritanceServiceImpl {
+    db: DatabaseConnection,
+}
+
+impl ConfigInheritanceServiceImpl {
+    pub fn new(db: DatabaseConnection) -> Self {
+        Self { db }
+    }
+}
+
+#[async_trait::async_trait]
+impl ConfigInheritanceService for ConfigInheritanceServiceImpl {
+    async fn add(
+        &self,
+        params: AddInheritanceParams,
+    ) -> ProxyServiceResult<ConfigInheritanceRecord> {
+        use crate::db::entities::config_inheritance::ActiveModel;
+
+        let now = chrono::Utc::now().naive_utc();
+        let model = ActiveModel {
+            id: Set(Uuid::new_v4()),
+            child_config_id: Set(params.child_config_id),
+            parent_config_id: Set(params.parent_config_id),
+            priority: Set(params.priority),
+            applied_at: Set(now),
+        };
+
+        let result = model.insert(&self.db).await?;
+        Ok(ConfigInheritanceRecord {
+            id: result.id,
+            child_config_id: result.child_config_id,
+            parent_config_id: result.parent_config_id,
+            priority: result.priority,
+            applied_at: result.applied_at,
+        })
+    }
+
+    async fn remove(
+        &self,
+        child_config_id: Uuid,
+        parent_config_id: Uuid,
+    ) -> ProxyServiceResult<bool> {
+        use crate::db::entities::config_inheritance::{Column, Entity as ConfigInheritanceEntity};
+        use sea_orm::Condition;
+
+        let result = ConfigInheritanceEntity::delete_many()
+            .filter(
+                Condition::all()
+                    .add(Column::ChildConfigId.eq(child_config_id))
+                    .add(Column::ParentConfigId.eq(parent_config_id)),
+            )
+            .exec(&self.db)
+            .await?;
+
+        Ok(result.rows_affected > 0)
+    }
+
+    async fn list_parents(
+        &self,
+        child_config_id: Uuid,
+    ) -> ProxyServiceResult<Vec<ConfigInheritanceRecord>> {
+        use crate::db::entities::config_inheritance;
+
+        let results = config_inheritance::Entity::find()
+            .filter(config_inheritance::Column::ChildConfigId.eq(child_config_id))
+            .all(&self.db)
+            .await?;
+
+        Ok(results
+            .into_iter()
+            .map(|m| ConfigInheritanceRecord {
+                id: m.id,
+                child_config_id: m.child_config_id,
+                parent_config_id: m.parent_config_id,
+                priority: m.priority,
+                applied_at: m.applied_at,
+            })
+            .collect())
+    }
+
+    async fn list_children(
+        &self,
+        parent_config_id: Uuid,
+    ) -> ProxyServiceResult<Vec<ConfigInheritanceRecord>> {
+        use crate::db::entities::config_inheritance;
+
+        let results = config_inheritance::Entity::find()
+            .filter(config_inheritance::Column::ParentConfigId.eq(parent_config_id))
+            .all(&self.db)
+            .await?;
+
+        Ok(results
+            .into_iter()
+            .map(|m| ConfigInheritanceRecord {
+                id: m.id,
+                child_config_id: m.child_config_id,
+                parent_config_id: m.parent_config_id,
+                priority: m.priority,
+                applied_at: m.applied_at,
+            })
+            .collect())
+    }
+}

apps/nxmesh-master/src/service/proxy/limit_rule/mod.rs

@@ -0,0 +1,130 @@
+use sea_orm::{ActiveModelTrait, ActiveValue::Set, DatabaseConnection, EntityTrait, prelude::*};
+use uuid::Uuid;
+
+use crate::service::proxy::types::{LimitRuleConfig, ProxyServiceError, ProxyServiceResult};
+
+pub struct CreateLimitRuleParams {
+    pub location_id: Uuid,
+    pub zone_id: Uuid,
+    pub burst: Option<i32>,
+    pub nodelay: Option<bool>,
+    pub override_of_id: Option<Uuid>,
+}
+
+pub struct UpdateLimitRuleParams {
+    pub location_id: Option<Uuid>,
+    pub zone_id: Option<Uuid>,
+    pub burst: Option<Option<i32>>,
+    pub nodelay: Option<Option<bool>>,
+    pub override_of_id: Option<Option<Uuid>>,
+}
+
+#[cfg_attr(test, mockall::automock)]
+#[async_trait::async_trait]
+pub trait LimitRuleService: Send + Sync + 'static {
+    async fn get(&self, id: Uuid) -> ProxyServiceResult<LimitRuleConfig>;
+    async fn list_by_location(&self, location_id: Uuid)
+    -> ProxyServiceResult<Vec<LimitRuleConfig>>;
+    async fn create(&self, params: CreateLimitRuleParams) -> ProxyServiceResult<LimitRuleConfig>;
+    async fn update(
+        &self,
+        id: Uuid,
+        params: UpdateLimitRuleParams,
+    ) -> ProxyServiceResult<LimitRuleConfig>;
+    async fn delete(&self, id: Uuid) -> ProxyServiceResult<bool>;
+}
+
+pub(crate) struct LimitRuleServiceImpl {
+    db: DatabaseConnection,
+}
+
+impl LimitRuleServiceImpl {
+    pub fn new(db: DatabaseConnection) -> Self {
+        Self { db }
+    }
+}
+
+#[async_trait::async_trait]
+impl LimitRuleService for LimitRuleServiceImpl {
+    async fn get(&self, id: Uuid) -> ProxyServiceResult<LimitRuleConfig> {
+        use crate::db::entities::limit_rule;
+
+        let model = limit_rule::Entity::find_by_id(id)
+            .one(&self.db)
+            .await?
+            .ok_or(ProxyServiceError::ConfigNotFound)?;
+
+        Ok(model.into())
+    }
+
+    async fn list_by_location(
+        &self,
+        location_id: Uuid,
+    ) -> ProxyServiceResult<Vec<LimitRuleConfig>> {
+        use crate::db::entities::limit_rule;
+
+        let models = limit_rule::Entity::find()
+            .filter(limit_rule::Column::LocationId.eq(location_id))
+            .all(&self.db)
+            .await?;
+
+        Ok(models.into_iter().map(Into::into).collect())
+    }
+
+    async fn create(&self, params: CreateLimitRuleParams) -> ProxyServiceResult<LimitRuleConfig> {
+        use crate::db::entities::limit_rule::ActiveModel;
+
+        let model = ActiveModel {
+            id: Set(Uuid::new_v4()),
+            location_id: Set(params.location_id),
+            zone_id: Set(params.zone_id),
+            burst: Set(params.burst),
+            nodelay: Set(params.nodelay),
+            is_deleted: Set(false),
+            override_of_id: Set(params.override_of_id),
+        };
+
+        let result = model.insert(&self.db).await?;
+        Ok(result.into())
+    }
+
+    async fn update(
+        &self,
+        id: Uuid,
+        params: UpdateLimitRuleParams,
+    ) -> ProxyServiceResult<LimitRuleConfig> {
+        use crate::db::entities::limit_rule::{ActiveModel, Entity as LimitRuleEntity};
+
+        let existing = LimitRuleEntity::find_by_id(id)
+            .one(&self.db)
+            .await?
+            .ok_or(ProxyServiceError::ConfigNotFound)?;
+
+        let mut model: ActiveModel = existing.into();
+        if let Some(location_id) = params.location_id {
+            model.location_id = Set(location_id);
+        }
+        if let Some(zone_id) = params.zone_id {
+            model.zone_id = Set(zone_id);
+        }
+        if let Some(burst) = params.burst {
+            model.burst = Set(burst);
+        }
+        if let Some(nodelay) = params.nodelay {
+            model.nodelay = Set(nodelay);
+        }
+        if let Some(override_of_id) = params.override_of_id {
+            model.override_of_id = Set(override_of_id);
+        }
+
+        let result = model.update(&self.db).await?;
+        Ok(result.into())
+    }
+
+    async fn delete(&self, id: Uuid) -> ProxyServiceResult<bool> {
+        let result = crate::db::entities::limit_rule::Entity::delete_by_id(id)
+            .exec(&self.db)
+            .await?;
+        Ok(result.rows_affected > 0)
+    }
+}

apps/nxmesh-master/src/service/proxy/limit_zone/mod.rs

@@ -0,0 +1,116 @@
+use sea_orm::{ActiveModelTrait, ActiveValue::Set, DatabaseConnection, EntityTrait, prelude::*};
+use uuid::Uuid;
+
+use crate::service::proxy::types::{LimitZoneConfig, ProxyServiceError, ProxyServiceResult};
+
+pub struct CreateLimitZoneParams {
+    pub name: String,
+    pub key: String,
+    pub rate: String,
+    pub override_of_id: Option<Uuid>,
+}
+
+pub struct UpdateLimitZoneParams {
+    pub name: Option<String>,
+    pub key: Option<String>,
+    pub rate: Option<String>,
+    pub override_of_id: Option<Option<Uuid>>,
+}
+
+#[cfg_attr(test, mockall::automock)]
+#[async_trait::async_trait]
+pub trait LimitZoneService: Send + Sync + 'static {
+    async fn get(&self, id: Uuid) -> ProxyServiceResult<LimitZoneConfig>;
+    async fn list(&self) -> ProxyServiceResult<Vec<LimitZoneConfig>>;
+    async fn create(&self, params: CreateLimitZoneParams) -> ProxyServiceResult<LimitZoneConfig>;
+    async fn update(
+        &self,
+        id: Uuid,
+        params: UpdateLimitZoneParams,
+    ) -> ProxyServiceResult<LimitZoneConfig>;
+    async fn delete(&self, id: Uuid) -> ProxyServiceResult<bool>;
+}
+
+pub(crate) struct LimitZoneServiceImpl {
+    db: DatabaseConnection,
+}
+
+impl LimitZoneServiceImpl {
+    pub fn new(db: DatabaseConnection) -> Self {
+        Self { db }
+    }
+}
+
+#[async_trait::async_trait]
+impl LimitZoneService for LimitZoneServiceImpl {
+    async fn get(&self, id: Uuid) -> ProxyServiceResult<LimitZoneConfig> {
+        use crate::db::entities::limit_zone;
+
+        let model = limit_zone::Entity::find_by_id(id)
+            .one(&self.db)
+            .await?
+            .ok_or(ProxyServiceError::ConfigNotFound)?;
+
+        Ok(model.into())
+    }
+
+    async fn list(&self) -> ProxyServiceResult<Vec<LimitZoneConfig>> {
+        use crate::db::entities::limit_zone;
+
+        let models = limit_zone::Entity::find().all(&self.db).await?;
+
+        Ok(models.into_iter().map(Into::into).collect())
+    }
+
+    async fn create(&self, params: CreateLimitZoneParams) -> ProxyServiceResult<LimitZoneConfig> {
+        use crate::db::entities::limit_zone::ActiveModel;
+
+        let model = ActiveModel {
+            id: Set(Uuid::new_v4()),
+            name: Set(params.name),
+            key: Set(params.key),
+            rate: Set(params.rate),
+            override_of_id: Set(params.override_of_id),
+        };
+
+        let result = model.insert(&self.db).await?;
+        Ok(result.into())
+    }
+
+    async fn update(
+        &self,
+        id: Uuid,
+        params: UpdateLimitZoneParams,
+    ) -> ProxyServiceResult<LimitZoneConfig> {
+        use crate::db::entities::limit_zone::{ActiveModel, Entity as LimitZoneEntity};
+
+        let existing = LimitZoneEntity::find_by_id(id)
+            .one(&self.db)
+            .await?
+            .ok_or(ProxyServiceError::ConfigNotFound)?;
+
+        let mut model: ActiveModel = existing.into();
+        if let Some(name) = params.name {
+            model.name = Set(name);
+        }
+        if let Some(key) = params.key {
+            model.key = Set(key);
+        }
+        if let Some(rate) = params.rate {
+            model.rate = Set(rate);
+        }
+        if let Some(override_of_id) = params.override_of_id {
+            model.override_of_id = Set(override_of_id);
+        }
+
+        let result = model.update(&self.db).await?;
+        Ok(result.into())
+    }
+
+    async fn delete(&self, id: Uuid) -> ProxyServiceResult<bool> {
+        let result = crate::db::entities::limit_zone::Entity::delete_by_id(id)
+            .exec(&self.db)
+            .await?;
+        Ok(result.rows_affected > 0)
+    }
+}

apps/nxmesh-master/src/service/proxy/location_block/mod.rs

@@ -0,0 +1,206 @@
+use sea_orm::{ActiveModelTrait, ActiveValue::Set, DatabaseConnection, EntityTrait, prelude::*};
+use uuid::Uuid;
+
+use crate::service::proxy::types::{
+    LocationBlockConfig, OverrideRef, ProxyServiceError, ProxyServiceResult,
+};
+
+pub struct CreateLocationBlockParams {
+    pub server_id: Uuid,
+    pub path_pattern: String,
+    pub proxy_pass_upstream_id: Option<Uuid>,
+    pub metadata: Option<serde_json::Value>,
+    pub override_of_id: Option<Uuid>,
+}
+
+pub struct UpdateLocationBlockParams {
+    pub server_id: Option<Uuid>,
+    pub path_pattern: Option<String>,
+    pub proxy_pass_upstream_id: Option<Option<Uuid>>,
+    pub metadata: Option<Option<serde_json::Value>>,
+    pub override_of_id: Option<Option<Uuid>>,
+}
+
+#[cfg_attr(test, mockall::automock)]
+#[async_trait::async_trait]
+pub trait LocationBlockService: Send + Sync + 'static {
+    async fn get(&self, id: Uuid) -> ProxyServiceResult<LocationBlockConfig>;
+    async fn list_by_server(&self, server_id: Uuid)
+    -> ProxyServiceResult<Vec<LocationBlockConfig>>;
+    async fn create(
+        &self,
+        params: CreateLocationBlockParams,
+    ) -> ProxyServiceResult<LocationBlockConfig>;
+    async fn update(
+        &self,
+        id: Uuid,
+        params: UpdateLocationBlockParams,
+    ) -> ProxyServiceResult<LocationBlockConfig>;
+    async fn delete(&self, id: Uuid) -> ProxyServiceResult<bool>;
+}
+
+pub(crate) struct LocationBlockServiceImpl {
+    db: DatabaseConnection,
+}
+
+impl LocationBlockServiceImpl {
+    pub fn new(db: DatabaseConnection) -> Self {
+        Self { db }
+    }
+
+    async fn build_with_children(
+        &self,
+        model: crate::db::entities::location_block::Model,
+    ) -> ProxyServiceResult<LocationBlockConfig> {
+        use crate::db::entities::{access_rule, limit_rule, proxy_setting, rewrite_rule};
+
+        let access_rules = access_rule::Entity::find()
+            .filter(access_rule::Column::LocationId.eq(model.id))
+            .all(&self.db)
+            .await?
+            .into_iter()
+            .map(|a| OverrideRef {
+                id: a.id,
+                override_of_id: a.override_of_id,
+            })
+            .collect();
+
+        let limit_rules = limit_rule::Entity::find()
+            .filter(limit_rule::Column::LocationId.eq(model.id))
+            .all(&self.db)
+            .await?
+            .into_iter()
+            .map(|l| OverrideRef {
+                id: l.id,
+                override_of_id: l.override_of_id,
+            })
+            .collect();
+
+        let proxy_settings = proxy_setting::Entity::find()
+            .filter(proxy_setting::Column::LocationId.eq(model.id))
+            .all(&self.db)
+            .await?
+            .into_iter()
+            .map(|p| OverrideRef {
+                id: p.id,
+                override_of_id: p.override_of_id,
+            })
+            .collect();
+
+        let rewrite_rules = rewrite_rule::Entity::find()
+            .filter(rewrite_rule::Column::LocationId.eq(model.id))
+            .all(&self.db)
+            .await?
+            .into_iter()
+            .map(|r| OverrideRef {
+                id: r.id,
+                override_of_id: r.override_of_id,
+            })
+            .collect();
+
+        Ok(LocationBlockConfig {
+            id: model.id,
+            server_id: model.server_id,
+            path_pattern: model.path_pattern,
+            proxy_pass_upstream_id: model.proxy_pass_upstream_id,
+            metadata: model.metadata,
+            override_of_id: model.override_of_id,
+            access_rules,
+            limit_rules,
+            proxy_settings,
+            rewrite_rules,
+        })
+    }
+}
+
+#[async_trait::async_trait]
+impl LocationBlockService for LocationBlockServiceImpl {
+    async fn get(&self, id: Uuid) -> ProxyServiceResult<LocationBlockConfig> {
+        use crate::db::entities::location_block;
+
+        let model = location_block::Entity::find_by_id(id)
+            .one(&self.db)
+            .await?
+            .ok_or(ProxyServiceError::ConfigNotFound)?;
+
+        self.build_with_children(model).await
+    }
+
+    async fn list_by_server(
+        &self,
+        server_id: Uuid,
+    ) -> ProxyServiceResult<Vec<LocationBlockConfig>> {
+        use crate::db::entities::location_block;
+
+        let models = location_block::Entity::find()
+            .filter(location_block::Column::ServerId.eq(server_id))
+            .all(&self.db)
+            .await?;
+
+        let mut results = Vec::with_capacity(models.len());
+        for m in models {
+            results.push(self.build_with_children(m).await?);
+        }
+        Ok(results)
+    }
+
+    async fn create(
+        &self,
+        params: CreateLocationBlockParams,
+    ) -> ProxyServiceResult<LocationBlockConfig> {
+        use crate::db::entities::location_block::ActiveModel;
+
+        let id = Uuid::new_v4();
+        let model = ActiveModel {
+            id: Set(id),
+            server_id: Set(params.server_id),
+            path_pattern: Set(params.path_pattern),
+            proxy_pass_upstream_id: Set(params.proxy_pass_upstream_id),
+            metadata: Set(params.metadata),
+            override_of_id: Set(params.override_of_id),
+        };
+
+        let result = model.insert(&self.db).await?;
+        self.build_with_children(result).await
+    }
+
+    async fn update(
+        &self,
+        id: Uuid,
+        params: UpdateLocationBlockParams,
+    ) -> ProxyServiceResult<LocationBlockConfig> {
+        use crate::db::entities::location_block::{ActiveModel, Entity as LocationBlockEntity};
+
+        let existing = LocationBlockEntity::find_by_id(id)
+            .one(&self.db)
+            .await?
+            .ok_or(ProxyServiceError::ConfigNotFound)?;
+
+        let mut model: ActiveModel = existing.into();
+        if let Some(server_id) = params.server_id {
+            model.server_id = Set(server_id);
+        }
+        if let Some(path_pattern) = params.path_pattern {
+            model.path_pattern = Set(path_pattern);
+        }
+        if let Some(proxy_pass_upstream_id) = params.proxy_pass_upstream_id {
+            model.proxy_pass_upstream_id = Set(proxy_pass_upstream_id);
+        }
+        if let Some(metadata) = params.metadata {
+            model.metadata = Set(metadata);
+        }
+        if let Some(override_of_id) = params.override_of_id {
+            model.override_of_id = Set(override_of_id);
+        }
+
+        let result = model.update(&self.db).await?;
+        self.build_with_children(result).await
+    }
+
+    async fn delete(&self, id: Uuid) -> ProxyServiceResult<bool> {
+        let result = crate::db::entities::location_block::Entity::delete_by_id(id)
+            .exec(&self.db)
+            .await?;
+        Ok(result.rows_affected > 0)
+    }
+}

apps/nxmesh-master/src/service/proxy/log_setting/mod.rs

@@ -0,0 +1,125 @@
+use sea_orm::{ActiveModelTrait, ActiveValue::Set, DatabaseConnection, EntityTrait, prelude::*};
+use uuid::Uuid;
+
+use crate::service::proxy::types::{LogSettingConfig, ProxyServiceError, ProxyServiceResult};
+
+pub struct CreateLogSettingParams {
+    pub server_id: Uuid,
+    pub access_log_path: Option<String>,
+    pub error_log_path: Option<String>,
+    pub log_level: Option<String>,
+    pub override_of_id: Option<Uuid>,
+}
+
+pub struct UpdateLogSettingParams {
+    pub server_id: Option<Uuid>,
+    pub access_log_path: Option<Option<String>>,
+    pub error_log_path: Option<Option<String>>,
+    pub log_level: Option<Option<String>>,
+    pub override_of_id: Option<Option<Uuid>>,
+}
+
+#[cfg_attr(test, mockall::automock)]
+#[async_trait::async_trait]
+pub trait LogSettingService: Send + Sync + 'static {
+    async fn get(&self, id: Uuid) -> ProxyServiceResult<LogSettingConfig>;
+    async fn list_by_server(&self, server_id: Uuid) -> ProxyServiceResult<Vec<LogSettingConfig>>;
+    async fn create(&self, params: CreateLogSettingParams) -> ProxyServiceResult<LogSettingConfig>;
+    async fn update(
+        &self,
+        id: Uuid,
+        params: UpdateLogSettingParams,
+    ) -> ProxyServiceResult<LogSettingConfig>;
+    async fn delete(&self, id: Uuid) -> ProxyServiceResult<bool>;
+}
+
+pub(crate) struct LogSettingServiceImpl {
+    db: DatabaseConnection,
+}
+
+impl LogSettingServiceImpl {
+    pub fn new(db: DatabaseConnection) -> Self {
+        Self { db }
+    }
+}
+
+#[async_trait::async_trait]
+impl LogSettingService for LogSettingServiceImpl {
+    async fn get(&self, id: Uuid) -> ProxyServiceResult<LogSettingConfig> {
+        use crate::db::entities::log_setting;
+
+        let model = log_setting::Entity::find_by_id(id)
+            .one(&self.db)
+            .await?
+            .ok_or(ProxyServiceError::ConfigNotFound)?;
+
+        Ok(model.into())
+    }
+
+    async fn list_by_server(&self, server_id: Uuid) -> ProxyServiceResult<Vec<LogSettingConfig>> {
+        use crate::db::entities::log_setting;
+
+        let models = log_setting::Entity::find()
+            .filter(log_setting::Column::ServerId.eq(server_id))
+            .all(&self.db)
+            .await?;
+
+        Ok(models.into_iter().map(Into::into).collect())
+    }
+
+    async fn create(&self, params: CreateLogSettingParams) -> ProxyServiceResult<LogSettingConfig> {
+        use crate::db::entities::log_setting::ActiveModel;
+
+        let model = ActiveModel {
+            id: Set(Uuid::new_v4()),
+            server_id: Set(params.server_id),
+            access_log_path: Set(params.access_log_path),
+            error_log_path: Set(params.error_log_path),
+            log_level: Set(params.log_level),
+            override_of_id: Set(params.override_of_id),
+        };
+
+        let result = model.insert(&self.db).await?;
+        Ok(result.into())
+    }
+
+    async fn update(
+        &self,
+        id: Uuid,
+        params: UpdateLogSettingParams,
+    ) -> ProxyServiceResult<LogSettingConfig> {
+        use crate::db::entities::log_setting::{ActiveModel, Entity as LogSettingEntity};
+
+        let existing = LogSettingEntity::find_by_id(id)
+            .one(&self.db)
+            .await?
+            .ok_or(ProxyServiceError::ConfigNotFound)?;
+
+        let mut model: ActiveModel = existing.into();
+        if let Some(server_id) = params.server_id {
+            model.server_id = Set(server_id);
+        }
+        if let Some(access_log_path) = params.access_log_path {
+            model.access_log_path = Set(access_log_path);
+        }
+        if let Some(error_log_path) = params.error_log_path {
+            model.error_log_path = Set(error_log_path);
+        }
+        if let Some(log_level) = params.log_level {
+            model.log_level = Set(log_level);
+        }
+        if let Some(override_of_id) = params.override_of_id {
+            model.override_of_id = Set(override_of_id);
+        }
+
+        let result = model.update(&self.db).await?;
+        Ok(result.into())
+    }
+
+    async fn delete(&self, id: Uuid) -> ProxyServiceResult<bool> {
+        let result = crate::db::entities::log_setting::Entity::delete_by_id(id)
+            .exec(&self.db)
+            .await?;
+        Ok(result.rows_affected > 0)
+    }
+}

apps/nxmesh-master/src/service/proxy/mod.rs

@@ -1,12 +1,60 @@
-use crate::service::proxy::types::{ProxyConfig, ProxyServiceResult};
+use crate::service::proxy::types::{
+    AgentConfigBinding, CreateProxyConfigParams, ProxyConfig, ProxyConfigSummary,
+    ProxyServiceResult, UpdateProxyConfigParams,
+};
 
+pub(crate) mod access_rule;
+pub(crate) mod cache_zone;
+pub(crate) mod config_inheritance;
+pub(crate) mod limit_rule;
+pub(crate) mod limit_zone;
+pub(crate) mod location_block;
+pub(crate) mod log_setting;
 pub(crate) mod nginx;
+pub(crate) mod proxy_setting;
 pub(crate) mod repo;
+pub(crate) mod rewrite_rule;
+pub(crate) mod server_block;
+pub(crate) mod ssl_certificate;
+pub(crate) mod upstream;
 
 pub mod service;
 pub mod types;
 
+#[cfg_attr(test, mockall::automock)]
 #[async_trait::async_trait]
 pub trait ProxyServiceTrait: Send + Sync + 'static {
     async fn get_proxy_config(&self, proxy_id: uuid::Uuid) -> ProxyServiceResult<ProxyConfig>;
+
+    // CRUD
+    async fn list_configs(&self) -> ProxyServiceResult<Vec<ProxyConfigSummary>>;
+    async fn create_config(
+        &self,
+        params: CreateProxyConfigParams,
+    ) -> ProxyServiceResult<ProxyConfigSummary>;
+    async fn update_config(
+        &self,
+        id: uuid::Uuid,
+        params: UpdateProxyConfigParams,
+    ) -> ProxyServiceResult<ProxyConfigSummary>;
+    async fn delete_config(&self, id: uuid::Uuid) -> ProxyServiceResult<bool>;
+
+    // Render
+    async fn render_config(&self, proxy_id: uuid::Uuid) -> ProxyServiceResult<String>;
+
+    // Binding
+    async fn get_active_agent_config(
+        &self,
+        agent_id: uuid::Uuid,
+    ) -> ProxyServiceResult<Option<ProxyConfigSummary>>;
+    async fn bind_agent(
+        &self,
+        agent_id: uuid::Uuid,
+        config_id: uuid::Uuid,
+    ) -> ProxyServiceResult<AgentConfigBinding>;
+    async fn unbind_agent(&self, agent_id: uuid::Uuid) -> ProxyServiceResult<bool>;
+}
+
+pub trait ProxyConfigRenderer: Send + Sync + 'static {
+    fn render(&self, config: &ProxyConfig) -> String;
 }

apps/nxmesh-master/src/service/proxy/nginx/config/access_rule.rs

@@ -1,7 +1,7 @@
-use crate::db::entities::access_rule::Model as AccessRule;
+use crate::service::proxy::types::AccessRuleConfig;
 
-impl std::fmt::Display for AccessRule {
+impl std::fmt::Display for AccessRuleConfig {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        write!(f, "{} {};", self.r#type.clone(), self.ip_cidr.clone())
+        write!(f, "{} {};", self.r#type, self.ip_cidr)
     }
 }

apps/nxmesh-master/src/service/proxy/nginx/config/cache_zone.rs

@@ -1,11 +1,11 @@
-use crate::db::entities::cache_zone::Model as CacheZone;
+use crate::service::proxy::types::CacheZoneConfig;
 
-impl std::fmt::Display for CacheZone {
+impl std::fmt::Display for CacheZoneConfig {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
         write!(
             f,
             "proxy_cache_path {} levels=1:2 keys_zone={}:{};",
-            self.path, self.name, self.size_limit
+            self.path, self.name, self.size
         )
     }
 }

apps/nxmesh-master/src/service/proxy/nginx/config/limit_rule.rs

@@ -1,11 +1,11 @@
-use crate::db::entities::limit_rule::Model as LimitRule;
+use crate::service::proxy::types::LimitRuleConfig;
 
-pub struct LimitRuleRender {
-    pub rule: LimitRule,
-    pub zone_name: String,
+pub struct LimitRuleRender<'a> {
+    pub rule: &'a LimitRuleConfig,
+    pub zone_name: &'a str,
 }
 
-impl std::fmt::Display for LimitRuleRender {
+impl std::fmt::Display for LimitRuleRender<'_> {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
         write!(f, "limit_req zone={}", self.zone_name)?;
         if let Some(burst) = self.rule.burst {

apps/nxmesh-master/src/service/proxy/nginx/config/limit_zone.rs

@@ -1,6 +1,6 @@
-use crate::db::entities::limit_zone::Model as LimitZone;
+use crate::service::proxy::types::LimitZoneConfig;
 
-impl std::fmt::Display for LimitZone {
+impl std::fmt::Display for LimitZoneConfig {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
         write!(
             f,

apps/nxmesh-master/src/service/proxy/nginx/config/location_block.rs

@@ -1,25 +1,25 @@
-use crate::db::entities::location_block::Model as LocationBlock;
+use crate::service::proxy::types::LocationBlockConfig;
 
-pub struct LocationBlockRender {
-    pub block: LocationBlock,
-    pub upstream_name: Option<String>,
-    pub access_rules: Vec<String>,
-    pub rewrite_rules: Vec<String>,
-    pub proxy_setting: Option<String>,
-    pub limit_rules: Vec<String>,
+pub struct LocationBlockRender<'a> {
+    pub block: &'a LocationBlockConfig,
+    pub upstream_name: Option<&'a str>,
+    pub access_rules: &'a [String],
+    pub rewrite_rules: &'a [String],
+    pub proxy_setting: Option<&'a str>,
+    pub limit_rules: &'a [String],
 }
 
-impl std::fmt::Display for LocationBlockRender {
+impl std::fmt::Display for LocationBlockRender<'_> {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
         writeln!(f, "    location {} {{", self.block.path_pattern)?;
 
-        if let Some(ref upstream) = self.upstream_name {
+        if let Some(upstream) = self.upstream_name {
             writeln!(f, "        proxy_pass http://{};", upstream)?;
             writeln!(f, "        proxy_set_header Host $host;")?;
             writeln!(f, "        proxy_set_header X-Real-IP $remote_addr;")?;
         }
 
-        if let Some(ref settings) = self.proxy_setting {
+        if let Some(settings) = self.proxy_setting {
             for line in settings.lines() {
                 if !line.is_empty() {
                     writeln!(f, "{}", line)?;
@@ -27,15 +27,15 @@ impl std::fmt::Display for LocationBlockRender {
             }
         }
 
-        for rule in &self.access_rules {
+        for rule in self.access_rules {
             writeln!(f, "        {}", rule)?;
         }
 
-        for rule in &self.rewrite_rules {
+        for rule in self.rewrite_rules {
             writeln!(f, "        {}", rule)?;
         }
 
-        for rule in &self.limit_rules {
+        for rule in self.limit_rules {
             writeln!(f, "        {}", rule)?;
         }
 

apps/nxmesh-master/src/service/proxy/nginx/config/log_setting.rs

@@ -1,6 +1,6 @@
-use crate::db::entities::log_setting::Model as LogSetting;
+use crate::service::proxy::types::LogSettingConfig;
 
-impl std::fmt::Display for LogSetting {
+impl std::fmt::Display for LogSettingConfig {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
         if let Some(ref path) = self.access_log_path {
             if let Some(ref level) = self.log_level {

apps/nxmesh-master/src/service/proxy/nginx/config/mod.rs

@@ -1,11 +1,11 @@
-mod access_rule;
-mod cache_zone;
-mod limit_rule;
-mod limit_zone;
-mod location_block;
-mod log_setting;
-mod proxy_setting;
-mod rewrite_rule;
-mod server_block;
-mod ssl_certificate;
-mod upstream;
+pub(crate) mod access_rule;
+pub(crate) mod cache_zone;
+pub(crate) mod limit_rule;
+pub(crate) mod limit_zone;
+pub(crate) mod location_block;
+pub(crate) mod log_setting;
+pub(crate) mod proxy_setting;
+pub(crate) mod rewrite_rule;
+pub(crate) mod server_block;
+pub(crate) mod ssl_certificate;
+pub(crate) mod upstream;

apps/nxmesh-master/src/service/proxy/nginx/config/proxy_setting.rs

@@ -1,32 +1,23 @@
-use crate::db::entities::proxy_setting::Model as ProxySetting;
+use crate::service::proxy::types::ProxySettingConfig;
 
-pub struct ProxySettingRender {
-    pub setting: ProxySetting,
-    pub cache_zone_name: Option<String>,
+pub struct ProxySettingRender<'a> {
+    pub setting: &'a ProxySettingConfig,
+    pub cache_zone_name: Option<&'a str>,
 }
 
-impl ProxySettingRender {
-    fn render_timeout(value: Option<i32>, directive: &str) -> Option<String> {
-        value.map(|v| format!("    {} {}s;", directive, v))
-    }
-}
-
-impl std::fmt::Display for ProxySettingRender {
+impl std::fmt::Display for ProxySettingRender<'_> {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        if let Some(line) = Self::render_timeout(self.setting.read_timeout, "proxy_read_timeout")
-        {
-            writeln!(f, "{}", line)?;
+        if let Some(timeout) = self.setting.read_timeout {
+            writeln!(f, "    proxy_read_timeout {}s;", timeout)?;
         }
-        if let Some(line) =
-            Self::render_timeout(self.setting.connect_timeout, "proxy_connect_timeout")
-        {
-            writeln!(f, "{}", line)?;
+        if let Some(timeout) = self.setting.connect_timeout {
+            writeln!(f, "    proxy_connect_timeout {}s;", timeout)?;
         }
         if let Some(buffer) = self.setting.buffer_size {
             writeln!(f, "    proxy_buffer_size {};", buffer)?;
         }
         if self.setting.cache_enabled.unwrap_or(false) {
-            if let Some(ref zone_name) = self.cache_zone_name {
+            if let Some(zone_name) = self.cache_zone_name {
                 writeln!(f, "    proxy_cache {};", zone_name)?;
             }
         }

apps/nxmesh-master/src/service/proxy/nginx/config/rewrite_rule.rs

@@ -1,6 +1,6 @@
-use crate::db::entities::rewrite_rule::Model as RewriteRule;
+use crate::service::proxy::types::RewriteRuleConfig;
 
-impl std::fmt::Display for RewriteRule {
+impl std::fmt::Display for RewriteRuleConfig {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
         write!(f, "rewrite {} {}", self.pattern, self.replacement)?;
         if let Some(ref flag) = self.flag {

apps/nxmesh-master/src/service/proxy/nginx/config/server_block.rs

@@ -1,14 +1,14 @@
-use crate::db::entities::server_block::Model as ServerBlock;
+use crate::service::proxy::types::ServerBlockConfig;
 
-pub struct ServerBlockRender {
-    pub block: ServerBlock,
-    pub ssl_cert: Option<String>,
-    pub locations: Vec<String>,
-    pub access_rules: Vec<String>,
-    pub log_setting: Option<String>,
+pub struct ServerBlockRender<'a> {
+    pub block: &'a ServerBlockConfig,
+    pub ssl_cert: Option<&'a str>,
+    pub locations: &'a [String],
+    pub access_rules: &'a [String],
+    pub log_setting: Option<&'a str>,
 }
 
-impl std::fmt::Display for ServerBlockRender {
+impl std::fmt::Display for ServerBlockRender<'_> {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
         writeln!(f, "server {{")?;
 
@@ -24,11 +24,11 @@ impl std::fmt::Display for ServerBlockRender {
             }
         }
 
-        if let Some(ref cert) = self.ssl_cert {
+        if let Some(cert) = self.ssl_cert {
             writeln!(f, "{}", cert)?;
         }
 
-        if let Some(ref log) = self.log_setting {
+        if let Some(log) = self.log_setting {
             for line in log.lines() {
                 if !line.is_empty() {
                     writeln!(f, "{}", line)?;
@@ -36,11 +36,11 @@ impl std::fmt::Display for ServerBlockRender {
             }
         }
 
-        for rule in &self.access_rules {
+        for rule in self.access_rules {
             writeln!(f, "    {}", rule)?;
         }
 
-        for loc in &self.locations {
+        for loc in self.locations {
             writeln!(f, "{}", loc)?;
         }
 

apps/nxmesh-master/src/service/proxy/nginx/config/ssl_certificate.rs

@@ -1,6 +1,6 @@
-use crate::db::entities::ssl_certificate::Model as SslCertificate;
+use crate::service::proxy::types::SslCertificateConfig;
 
-impl std::fmt::Display for SslCertificate {
+impl std::fmt::Display for SslCertificateConfig {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
         writeln!(f, "    ssl_certificate {};", self.cert_path)?;
         writeln!(f, "    ssl_certificate_key {};", self.key_path)

apps/nxmesh-master/src/service/proxy/nginx/config/upstream.rs

@@ -1,6 +1,6 @@
-use crate::db::entities::upstream::Model as Upstream;
+use crate::service::proxy::types::UpstreamConfig;
 
-impl std::fmt::Display for Upstream {
+impl std::fmt::Display for UpstreamConfig {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
         write!(f, "    server {}:{};", self.target_host, self.target_port)
     }

apps/nxmesh-master/src/service/proxy/nginx/mod.rs

@@ -1 +1,451 @@
-pub mod config;
+pub(crate) mod config;
+
+use std::collections::HashMap;
+use std::fmt::Write;
+
+use uuid::Uuid;
+
+use crate::service::proxy::ProxyConfigRenderer;
+use crate::service::proxy::types::{
+    AccessRuleConfig, CacheZoneConfig, LimitRuleConfig, LimitZoneConfig, LogSettingConfig,
+    OverrideRef, ProxyConfig, ProxySettingConfig, RewriteRuleConfig, SslCertificateConfig,
+    UpstreamConfig,
+};
+
+fn resolve_ids<'a, T>(ids: &[OverrideRef], map: &'a HashMap<Uuid, T>) -> Vec<&'a T> {
+    ids.iter().filter_map(|r| map.get(&r.id)).collect()
+}
+
+fn resolve_upstream_name(
+    upstream_id: Option<Uuid>,
+    upstreams: &HashMap<Uuid, UpstreamConfig>,
+) -> Option<&str> {
+    upstream_id
+        .and_then(|id| upstreams.get(&id))
+        .map(|u| u.name.as_str())
+}
+
+fn resolve_cache_zone_name(
+    zone_id: Option<Uuid>,
+    cache_zones: &HashMap<Uuid, CacheZoneConfig>,
+) -> Option<&str> {
+    zone_id
+        .and_then(|id| cache_zones.get(&id))
+        .map(|z| z.name.as_str())
+}
+
+fn resolve_limit_zone_name(
+    zone_id: Uuid,
+    limit_zones: &HashMap<Uuid, LimitZoneConfig>,
+) -> Option<&str> {
+    limit_zones.get(&zone_id).map(|z| z.name.as_str())
+}
+
+fn render_access_rules(
+    ids: &[OverrideRef],
+    access_rules: &HashMap<Uuid, AccessRuleConfig>,
+) -> Vec<String> {
+    resolve_ids(ids, access_rules)
+        .into_iter()
+        .map(|r| r.to_string())
+        .collect()
+}
+
+fn render_rewrite_rules(
+    ids: &[OverrideRef],
+    rewrite_rules: &HashMap<Uuid, RewriteRuleConfig>,
+) -> Vec<String> {
+    resolve_ids(ids, rewrite_rules)
+        .into_iter()
+        .map(|r| r.to_string())
+        .collect()
+}
+
+fn render_limit_rules(
+    ids: &[OverrideRef],
+    limit_rules: &HashMap<Uuid, LimitRuleConfig>,
+    limit_zones: &HashMap<Uuid, LimitZoneConfig>,
+) -> Vec<String> {
+    resolve_ids(ids, limit_rules)
+        .into_iter()
+        .filter_map(|rule| {
+            let zone_name = resolve_limit_zone_name(rule.zone_id, limit_zones)?;
+            Some(config::limit_rule::LimitRuleRender { rule, zone_name }.to_string())
+        })
+        .collect()
+}
+
+fn render_proxy_setting(
+    ids: &[OverrideRef],
+    proxy_settings: &HashMap<Uuid, ProxySettingConfig>,
+    cache_zones: &HashMap<Uuid, CacheZoneConfig>,
+) -> Option<String> {
+    let setting = resolve_ids(ids, proxy_settings).into_iter().next()?;
+    let cache_zone_name = resolve_cache_zone_name(setting.cache_zone, cache_zones);
+    Some(
+        config::proxy_setting::ProxySettingRender {
+            setting,
+            cache_zone_name,
+        }
+        .to_string(),
+    )
+}
+
+fn render_log_setting(
+    ids: &[OverrideRef],
+    log_settings: &HashMap<Uuid, LogSettingConfig>,
+) -> Option<String> {
+    let setting = resolve_ids(ids, log_settings).into_iter().next()?;
+    Some(setting.to_string())
+}
+
+fn render_ssl_cert(
+    ids: &[OverrideRef],
+    ssl_certificates: &HashMap<Uuid, SslCertificateConfig>,
+) -> Option<String> {
+    let cert = resolve_ids(ids, ssl_certificates).into_iter().next()?;
+    Some(cert.to_string())
+}
+
+pub struct NginxConfigRenderer;
+
+impl ProxyConfigRenderer for NginxConfigRenderer {
+    fn render(&self, config: &ProxyConfig) -> String {
+        let mut output = String::new();
+
+        // Global cache zones
+        for zone in config.cache_zones.values() {
+            writeln!(output, "{}", zone).ok();
+        }
+
+        // Limit request zones
+        for zone in config.limit_zones.values() {
+            writeln!(output, "{}", zone).ok();
+        }
+
+        // Upstream blocks
+        for upstream in config.upstreams.values() {
+            writeln!(output, "upstream {} {{", upstream.name).ok();
+            writeln!(output, "{}", upstream).ok();
+            writeln!(output, "}}").ok();
+            writeln!(output).ok();
+        }
+
+        // Server blocks
+        for sb in config.server_blocks.values() {
+            let access_rules = render_access_rules(&sb.access_rules, &config.access_rules);
+            let ssl_cert = render_ssl_cert(&sb.ssl_certificates, &config.ssl_certificates);
+            let log_setting = render_log_setting(&sb.log_settings, &config.log_settings);
+
+            // Render location blocks for this server
+            let locations: Vec<String> = resolve_ids(&sb.location_blocks, &config.location_blocks)
+                .into_iter()
+                .map(|lb| {
+                    let upstream_name =
+                        resolve_upstream_name(lb.proxy_pass_upstream_id, &config.upstreams);
+                    let lb_access_rules =
+                        render_access_rules(&lb.access_rules, &config.access_rules);
+                    let lb_rewrite_rules =
+                        render_rewrite_rules(&lb.rewrite_rules, &config.rewrite_rules);
+                    let lb_proxy_setting = render_proxy_setting(
+                        &lb.proxy_settings,
+                        &config.proxy_settings,
+                        &config.cache_zones,
+                    );
+                    let lb_limit_rules = render_limit_rules(
+                        &lb.limit_rules,
+                        &config.limit_rules,
+                        &config.limit_zones,
+                    );
+
+                    config::location_block::LocationBlockRender {
+                        block: lb,
+                        upstream_name,
+                        access_rules: &lb_access_rules,
+                        rewrite_rules: &lb_rewrite_rules,
+                        proxy_setting: lb_proxy_setting.as_deref(),
+                        limit_rules: &lb_limit_rules,
+                    }
+                    .to_string()
+                })
+                .collect();
+
+            let server = config::server_block::ServerBlockRender {
+                block: sb,
+                ssl_cert: ssl_cert.as_deref(),
+                locations: &locations,
+                access_rules: &access_rules,
+                log_setting: log_setting.as_deref(),
+            };
+
+            writeln!(output, "{}", server).ok();
+            writeln!(output).ok();
+        }
+
+        output
+    }
+}
+
+#[cfg(test)]
+#[allow(clippy::unwrap_used)]
+mod tests {
+    use super::*;
+    use crate::service::proxy::types::*;
+    use std::collections::HashMap;
+
+    fn make_id() -> uuid::Uuid {
+        uuid::Uuid::new_v4()
+    }
+
+    fn basic_proxy_config() -> ProxyConfig {
+        let upstream_id = make_id();
+        let location_id = make_id();
+        let server_id = make_id();
+
+        ProxyConfig {
+            id: make_id(),
+            name: "test".to_string(),
+            r#type: ProxyType::Nginx,
+            description: None,
+            parent_config_id: None,
+            upstreams: HashMap::from([(
+                upstream_id,
+                UpstreamConfig {
+                    id: upstream_id,
+                    name: "backend".to_string(),
+                    target_host: "127.0.0.1".to_string(),
+                    target_port: 3000,
+                    metadata: None,
+                    override_of_id: None,
+                    location_blocks: vec![OverrideRef {
+                        id: location_id,
+                        override_of_id: None,
+                    }],
+                },
+            )]),
+            location_blocks: HashMap::from([(
+                location_id,
+                LocationBlockConfig {
+                    id: location_id,
+                    server_id,
+                    path_pattern: "/api".to_string(),
+                    proxy_pass_upstream_id: Some(upstream_id),
+                    metadata: None,
+                    override_of_id: None,
+                    access_rules: vec![],
+                    limit_rules: vec![],
+                    proxy_settings: vec![],
+                    rewrite_rules: vec![],
+                },
+            )]),
+            server_blocks: HashMap::from([(
+                server_id,
+                ServerBlockConfig {
+                    id: server_id,
+                    server_name: Some(vec!["example.com".to_string()]),
+                    listen_port: 80,
+                    ssl_enabled: Some(false),
+                    override_of_id: None,
+                    access_rules: vec![],
+                    location_blocks: vec![OverrideRef {
+                        id: location_id,
+                        override_of_id: None,
+                    }],
+                    log_settings: vec![],
+                    ssl_certificates: vec![],
+                },
+            )]),
+            access_rules: HashMap::new(),
+            cache_zones: HashMap::new(),
+            limit_rules: HashMap::new(),
+            limit_zones: HashMap::new(),
+            log_settings: HashMap::new(),
+            proxy_settings: HashMap::new(),
+            rewrite_rules: HashMap::new(),
+            ssl_certificates: HashMap::new(),
+        }
+    }
+
+    #[test]
+    fn test_render_basic_nginx_config() {
+        let config = basic_proxy_config();
+        let renderer = NginxConfigRenderer;
+        let output = renderer.render(&config);
+
+        assert!(
+            output.contains("upstream backend {"),
+            "should contain upstream block"
+        );
+        assert!(
+            output.contains("server 127.0.0.1:3000;"),
+            "should contain upstream server"
+        );
+        assert!(output.contains("server {"), "should contain server block");
+        assert!(
+            output.contains("listen 80;"),
+            "should contain listen directive"
+        );
+        assert!(
+            output.contains("server_name example.com;"),
+            "should contain server name"
+        );
+        assert!(
+            output.contains("location /api {"),
+            "should contain location block"
+        );
+        assert!(
+            output.contains("proxy_pass http://backend;"),
+            "should contain proxy pass"
+        );
+    }
+
+    #[test]
+    fn test_render_config_with_cache_zone() {
+        let zone_id = make_id();
+        let mut config = basic_proxy_config();
+        config.cache_zones.insert(
+            zone_id,
+            CacheZoneConfig {
+                id: zone_id,
+                name: "mycache".to_string(),
+                path: "/var/cache/nginx".to_string(),
+                size: "10m".to_string(),
+                override_of_id: None,
+            },
+        );
+        let renderer = NginxConfigRenderer;
+        let output = renderer.render(&config);
+        assert!(
+            output.contains("proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=mycache:10m;")
+        );
+    }
+
+    #[test]
+    fn test_render_config_with_access_rules() {
+        let rule_id = make_id();
+        let mut config = basic_proxy_config();
+
+        // Get the server ID from the config
+        let sb_id = *config.server_blocks.keys().next().unwrap();
+
+        let rule = AccessRuleConfig {
+            id: rule_id,
+            r#type: "allow".to_string(),
+            ip_cidr: "192.168.1.0/24".to_string(),
+            description: None,
+            priority: 10,
+            override_of_id: None,
+        };
+        config.access_rules.insert(rule_id, rule);
+
+        // Add access rule ref to the server block
+        let sb = config.server_blocks.get_mut(&sb_id).unwrap();
+        sb.access_rules.push(OverrideRef {
+            id: rule_id,
+            override_of_id: None,
+        });
+
+        let renderer = NginxConfigRenderer;
+        let output = renderer.render(&config);
+        assert!(output.contains("allow 192.168.1.0/24;"));
+    }
+
+    #[test]
+    fn test_render_config_empty() {
+        let config = ProxyConfig {
+            id: make_id(),
+            name: "empty".to_string(),
+            r#type: ProxyType::Nginx,
+            description: None,
+            parent_config_id: None,
+            server_blocks: HashMap::new(),
+            upstreams: HashMap::new(),
+            access_rules: HashMap::new(),
+            cache_zones: HashMap::new(),
+            limit_rules: HashMap::new(),
+            limit_zones: HashMap::new(),
+            location_blocks: HashMap::new(),
+            log_settings: HashMap::new(),
+            proxy_settings: HashMap::new(),
+            rewrite_rules: HashMap::new(),
+            ssl_certificates: HashMap::new(),
+        };
+        let renderer = NginxConfigRenderer;
+        let output = renderer.render(&config);
+        assert!(output.is_empty() || output.trim().is_empty());
+    }
+
+    #[test]
+    fn test_render_config_with_limit_zone_and_rule() {
+        let mut config = basic_proxy_config();
+        let zone_id = make_id();
+        let location_id = *config.location_blocks.keys().next().unwrap();
+        let rule_id = make_id();
+
+        config.limit_zones.insert(
+            zone_id,
+            LimitZoneConfig {
+                id: zone_id,
+                name: "reqzone".to_string(),
+                key: "$binary_remote_addr".to_string(),
+                rate: "10r/s".to_string(),
+                override_of_id: None,
+            },
+        );
+
+        config.limit_rules.insert(
+            rule_id,
+            LimitRuleConfig {
+                id: rule_id,
+                location_id,
+                zone_id,
+                burst: Some(20),
+                nodelay: Some(true),
+                is_deleted: false,
+                override_of_id: None,
+            },
+        );
+
+        let lb = config.location_blocks.get_mut(&location_id).unwrap();
+        lb.limit_rules.push(OverrideRef {
+            id: rule_id,
+            override_of_id: None,
+        });
+
+        let renderer = NginxConfigRenderer;
+        let output = renderer.render(&config);
+        assert!(output.contains("limit_req_zone $binary_remote_addr zone=reqzone:10r/s;"));
+        assert!(output.contains("limit_req zone=reqzone burst=20 nodelay;"));
+    }
+
+    #[test]
+    fn test_render_config_with_ssl() {
+        let mut config = basic_proxy_config();
+        let cert_id = make_id();
+        let sb_id = *config.server_blocks.keys().next().unwrap();
+
+        config.ssl_certificates.insert(
+            cert_id,
+            SslCertificateConfig {
+                id: cert_id,
+                name: "test-cert".to_string(),
+                cert_path: "/etc/ssl/certs/test.pem".to_string(),
+                key_path: "/etc/ssl/private/test.key".to_string(),
+                expiry_date: chrono::Utc::now(),
+            },
+        );
+
+        let sb = config.server_blocks.get_mut(&sb_id).unwrap();
+        sb.ssl_enabled = Some(true);
+        sb.ssl_certificates.push(OverrideRef {
+            id: cert_id,
+            override_of_id: None,
+        });
+
+        let renderer = NginxConfigRenderer;
+        let output = renderer.render(&config);
+        assert!(output.contains("listen 80 ssl;"));
+        assert!(output.contains("ssl_certificate /etc/ssl/certs/test.pem;"));
+        assert!(output.contains("ssl_certificate_key /etc/ssl/private/test.key;"));
+    }
+}

apps/nxmesh-master/src/service/proxy/proxy_setting/mod.rs

@@ -0,0 +1,149 @@
+use sea_orm::{ActiveModelTrait, ActiveValue::Set, DatabaseConnection, EntityTrait, prelude::*};
+use uuid::Uuid;
+
+use crate::service::proxy::types::{ProxyServiceError, ProxyServiceResult, ProxySettingConfig};
+
+pub struct CreateProxySettingParams {
+    pub location_id: Uuid,
+    pub read_timeout: Option<i32>,
+    pub connect_timeout: Option<i32>,
+    pub buffer_size: Option<i32>,
+    pub cache_enabled: Option<bool>,
+    pub cache_zone: Option<Uuid>,
+    pub override_of_id: Option<Uuid>,
+}
+
+pub struct UpdateProxySettingParams {
+    pub location_id: Option<Uuid>,
+    pub read_timeout: Option<Option<i32>>,
+    pub connect_timeout: Option<Option<i32>>,
+    pub buffer_size: Option<Option<i32>>,
+    pub cache_enabled: Option<Option<bool>>,
+    pub cache_zone: Option<Option<Uuid>>,
+    pub override_of_id: Option<Option<Uuid>>,
+}
+
+#[cfg_attr(test, mockall::automock)]
+#[async_trait::async_trait]
+pub trait ProxySettingService: Send + Sync + 'static {
+    async fn get(&self, id: Uuid) -> ProxyServiceResult<ProxySettingConfig>;
+    async fn list_by_location(
+        &self,
+        location_id: Uuid,
+    ) -> ProxyServiceResult<Vec<ProxySettingConfig>>;
+    async fn create(
+        &self,
+        params: CreateProxySettingParams,
+    ) -> ProxyServiceResult<ProxySettingConfig>;
+    async fn update(
+        &self,
+        id: Uuid,
+        params: UpdateProxySettingParams,
+    ) -> ProxyServiceResult<ProxySettingConfig>;
+    async fn delete(&self, id: Uuid) -> ProxyServiceResult<bool>;
+}
+
+pub(crate) struct ProxySettingServiceImpl {
+    db: DatabaseConnection,
+}
+
+impl ProxySettingServiceImpl {
+    pub fn new(db: DatabaseConnection) -> Self {
+        Self { db }
+    }
+}
+
+#[async_trait::async_trait]
+impl ProxySettingService for ProxySettingServiceImpl {
+    async fn get(&self, id: Uuid) -> ProxyServiceResult<ProxySettingConfig> {
+        use crate::db::entities::proxy_setting;
+
+        let model = proxy_setting::Entity::find_by_id(id)
+            .one(&self.db)
+            .await?
+            .ok_or(ProxyServiceError::ConfigNotFound)?;
+
+        Ok(model.into())
+    }
+
+    async fn list_by_location(
+        &self,
+        location_id: Uuid,
+    ) -> ProxyServiceResult<Vec<ProxySettingConfig>> {
+        use crate::db::entities::proxy_setting;
+
+        let models = proxy_setting::Entity::find()
+            .filter(proxy_setting::Column::LocationId.eq(location_id))
+            .all(&self.db)
+            .await?;
+
+        Ok(models.into_iter().map(Into::into).collect())
+    }
+
+    async fn create(
+        &self,
+        params: CreateProxySettingParams,
+    ) -> ProxyServiceResult<ProxySettingConfig> {
+        use crate::db::entities::proxy_setting::ActiveModel;
+
+        let model = ActiveModel {
+            id: Set(Uuid::new_v4()),
+            location_id: Set(params.location_id),
+            read_timeout: Set(params.read_timeout),
+            connect_timeout: Set(params.connect_timeout),
+            buffer_size: Set(params.buffer_size),
+            cache_enabled: Set(params.cache_enabled),
+            cache_zone: Set(params.cache_zone),
+            override_of_id: Set(params.override_of_id),
+        };
+
+        let result = model.insert(&self.db).await?;
+        Ok(result.into())
+    }
+
+    async fn update(
+        &self,
+        id: Uuid,
+        params: UpdateProxySettingParams,
+    ) -> ProxyServiceResult<ProxySettingConfig> {
+        use crate::db::entities::proxy_setting::{ActiveModel, Entity as ProxySettingEntity};
+
+        let existing = ProxySettingEntity::find_by_id(id)
+            .one(&self.db)
+            .await?
+            .ok_or(ProxyServiceError::ConfigNotFound)?;
+
+        let mut model: ActiveModel = existing.into();
+        if let Some(location_id) = params.location_id {
+            model.location_id = Set(location_id);
+        }
+        if let Some(read_timeout) = params.read_timeout {
+            model.read_timeout = Set(read_timeout);
+        }
+        if let Some(connect_timeout) = params.connect_timeout {
+            model.connect_timeout = Set(connect_timeout);
+        }
+        if let Some(buffer_size) = params.buffer_size {
+            model.buffer_size = Set(buffer_size);
+        }
+        if let Some(cache_enabled) = params.cache_enabled {
+            model.cache_enabled = Set(cache_enabled);
+        }
+        if let Some(cache_zone) = params.cache_zone {
+            model.cache_zone = Set(cache_zone);
+        }
+        if let Some(override_of_id) = params.override_of_id {
+            model.override_of_id = Set(override_of_id);
+        }
+
+        let result = model.update(&self.db).await?;
+        Ok(result.into())
+    }
+
+    async fn delete(&self, id: Uuid) -> ProxyServiceResult<bool> {
+        let result = crate::db::entities::proxy_setting::Entity::delete_by_id(id)
+            .exec(&self.db)
+            .await?;
+        Ok(result.rows_affected > 0)
+    }
+}

apps/nxmesh-master/src/service/proxy/repo.rs

@@ -1,27 +1,48 @@
 use std::collections::HashMap;
 
-use sea_orm::{DatabaseConnection, prelude::*};
+use sea_orm::{ActiveModelTrait, ActiveValue::Set, DatabaseConnection, prelude::*};
 
 use crate::service::proxy::types::{
-    Mergeable, OverrideRef, ProxyConfig, ProxyServiceError, ProxyServiceResult, ProxyType,
+    AgentConfigBinding, CreateProxyConfigParams, Mergeable, OverrideRef, ProxyConfig,
+    ProxyConfigSummary, ProxyServiceError, ProxyServiceResult, ProxyType, UpdateProxyConfigParams,
 };
 
 #[async_trait::async_trait]
 pub trait ProxyRepo: Send + Sync + 'static {
-    // get the raw config for the given proxy_id. This should return the config of the given proxy_id without merging it with its parent configs (if any).
     async fn get_proxy_raw_config(&self, proxy_id: uuid::Uuid) -> ProxyServiceResult<ProxyConfig>;
-
-    // get the raw config for the given proxy_id. This should return the config of the given proxy_id and all its parent configs (if any) without merging them. The returned vector is ordered from the leaf (given proxy_id) down to the root config (most specific to least specific).
     async fn get_proxy_raw_configs(
         &self,
         proxy_id: uuid::Uuid,
     ) -> ProxyServiceResult<Vec<ProxyConfig>>;
-
-    // get the merged config for the given proxy_id. This should merge the config of the given proxy_id with its parent configs (if any) and return the final merged config.
     async fn get_merged_proxy_config(
         &self,
         proxy_id: uuid::Uuid,
     ) -> ProxyServiceResult<ProxyConfig>;
+
+    // CRUD
+    async fn list_proxy_configs(&self) -> ProxyServiceResult<Vec<ProxyConfigSummary>>;
+    async fn create_proxy_config(
+        &self,
+        params: CreateProxyConfigParams,
+    ) -> ProxyServiceResult<ProxyConfigSummary>;
+    async fn update_proxy_config(
+        &self,
+        id: uuid::Uuid,
+        params: UpdateProxyConfigParams,
+    ) -> ProxyServiceResult<ProxyConfigSummary>;
+    async fn delete_proxy_config(&self, id: uuid::Uuid) -> ProxyServiceResult<bool>;
+
+    // Agent config binding
+    async fn get_active_agent_config(
+        &self,
+        agent_id: uuid::Uuid,
+    ) -> ProxyServiceResult<Option<ProxyConfigSummary>>;
+    async fn bind_agent_to_config(
+        &self,
+        agent_id: uuid::Uuid,
+        config_id: uuid::Uuid,
+    ) -> ProxyServiceResult<AgentConfigBinding>;
+    async fn unbind_agent(&self, agent_id: uuid::Uuid) -> ProxyServiceResult<bool>;
 }
 
 pub(crate) struct ProxyRepoImpl {
@@ -441,4 +462,163 @@ impl ProxyRepo for ProxyRepoImpl {
         }
         Ok(merged)
     }
+
+    // ── CRUD ──
+
+    async fn list_proxy_configs(&self) -> ProxyServiceResult<Vec<ProxyConfigSummary>> {
+        use crate::db::entities::proxy_config::Column;
+        use sea_orm::QueryOrder;
+
+        let configs = crate::db::entities::proxy_config::Entity::find()
+            .order_by(Column::UpdatedAt, sea_orm::Order::Desc)
+            .all(&self.db)
+            .await?;
+        Ok(configs.into_iter().map(Into::into).collect())
+    }
+
+    async fn create_proxy_config(
+        &self,
+        params: CreateProxyConfigParams,
+    ) -> ProxyServiceResult<ProxyConfigSummary> {
+        use crate::db::entities::proxy_config::ActiveModel;
+        let now = chrono::Utc::now().naive_utc();
+        let model = ActiveModel {
+            id: Set(uuid::Uuid::new_v4()),
+            name: Set(params.name),
+            description: Set(params.description),
+            is_template: Set(params.is_template),
+            created_at: Set(now),
+            updated_at: Set(now),
+        };
+        let result = model.insert(&self.db).await?;
+        Ok(result.into())
+    }
+
+    async fn update_proxy_config(
+        &self,
+        id: uuid::Uuid,
+        params: UpdateProxyConfigParams,
+    ) -> ProxyServiceResult<ProxyConfigSummary> {
+        use crate::db::entities::proxy_config::ActiveModel;
+        use crate::db::entities::proxy_config::Entity as ProxyConfigEntity;
+
+        let existing = ProxyConfigEntity::find_by_id(id)
+            .one(&self.db)
+            .await?
+            .ok_or(ProxyServiceError::ConfigNotFound)?;
+
+        let mut model: ActiveModel = existing.into();
+        if let Some(name) = params.name {
+            model.name = Set(name);
+        }
+        if let Some(description) = params.description {
+            model.description = Set(Some(description));
+        }
+        if let Some(is_template) = params.is_template {
+            model.is_template = Set(is_template);
+        }
+        model.updated_at = Set(chrono::Utc::now().naive_utc());
+
+        let result = model.update(&self.db).await?;
+        Ok(result.into())
+    }
+
+    async fn delete_proxy_config(&self, id: uuid::Uuid) -> ProxyServiceResult<bool> {
+        let result = crate::db::entities::proxy_config::Entity::delete_by_id(id)
+            .exec(&self.db)
+            .await?;
+        Ok(result.rows_affected > 0)
+    }
+
+    // ── Agent config binding ──
+
+    async fn get_active_agent_config(
+        &self,
+        agent_id: uuid::Uuid,
+    ) -> ProxyServiceResult<Option<ProxyConfigSummary>> {
+        use crate::db::entities::agent_config_binding::Column;
+        use crate::db::entities::proxy_config::Entity as ProxyConfigEntity;
+        use sea_orm::Condition;
+
+        let binding = crate::db::entities::agent_config_binding::Entity::find()
+            .filter(
+                Condition::all()
+                    .add(Column::AgentId.eq(agent_id))
+                    .add(Column::IsActive.eq(true)),
+            )
+            .one(&self.db)
+            .await?;
+
+        match binding {
+            Some(b) => {
+                let config = ProxyConfigEntity::find_by_id(b.config_id)
+                    .one(&self.db)
+                    .await?
+                    .ok_or(ProxyServiceError::ConfigNotFound)?;
+                Ok(Some(config.into()))
+            }
+            None => Ok(None),
+        }
+    }
+
+    async fn bind_agent_to_config(
+        &self,
+        agent_id: uuid::Uuid,
+        config_id: uuid::Uuid,
+    ) -> ProxyServiceResult<AgentConfigBinding> {
+        use crate::db::entities::agent_config_binding::ActiveModel;
+        use crate::db::entities::agent_config_binding::Column;
+        use sea_orm::Condition;
+
+        // Deactivate existing active binding for this agent
+        if let Some(existing) = crate::db::entities::agent_config_binding::Entity::find()
+            .filter(
+                Condition::all()
+                    .add(Column::AgentId.eq(agent_id))
+                    .add(Column::IsActive.eq(true)),
+            )
+            .one(&self.db)
+            .await?
+        {
+            let mut active: ActiveModel = existing.into();
+            active.is_active = Set(false);
+            active.update(&self.db).await?;
+        }
+
+        let now = chrono::Utc::now().naive_utc();
+        let model = ActiveModel {
+            id: Set(uuid::Uuid::new_v4()),
+            agent_id: Set(Some(agent_id)),
+            group_id: Set(None),
+            config_id: Set(config_id),
+            is_active: Set(true),
+            applied_at: Set(now),
+        };
+        let result = model.insert(&self.db).await?;
+        Ok(result.into())
+    }
+
+    async fn unbind_agent(&self, agent_id: uuid::Uuid) -> ProxyServiceResult<bool> {
+        use crate::db::entities::agent_config_binding::ActiveModel;
+        use crate::db::entities::agent_config_binding::Column;
+        use sea_orm::Condition;
+
+        let existing = crate::db::entities::agent_config_binding::Entity::find()
+            .filter(
+                Condition::all()
+                    .add(Column::AgentId.eq(agent_id))
+                    .add(Column::IsActive.eq(true)),
+            )
+            .one(&self.db)
+            .await?;
+
+        if let Some(b) = existing {
+            let mut active: ActiveModel = b.into();
+            active.is_active = Set(false);
+            active.update(&self.db).await?;
+            Ok(true)
+        } else {
+            Ok(false)
+        }
+    }
 }

apps/nxmesh-master/src/service/proxy/rewrite_rule/mod.rs

@@ -0,0 +1,144 @@
+use sea_orm::{ActiveModelTrait, ActiveValue::Set, DatabaseConnection, EntityTrait, prelude::*};
+use uuid::Uuid;
+
+use crate::service::proxy::types::{ProxyServiceError, ProxyServiceResult, RewriteRuleConfig};
+
+pub struct CreateRewriteRuleParams {
+    pub location_id: Uuid,
+    pub pattern: String,
+    pub replacement: String,
+    pub flag: Option<String>,
+    pub priority: i32,
+    pub override_of_id: Option<Uuid>,
+}
+
+pub struct UpdateRewriteRuleParams {
+    pub location_id: Option<Uuid>,
+    pub pattern: Option<String>,
+    pub replacement: Option<String>,
+    pub flag: Option<Option<String>>,
+    pub priority: Option<i32>,
+    pub override_of_id: Option<Option<Uuid>>,
+}
+
+#[cfg_attr(test, mockall::automock)]
+#[async_trait::async_trait]
+pub trait RewriteRuleService: Send + Sync + 'static {
+    async fn get(&self, id: Uuid) -> ProxyServiceResult<RewriteRuleConfig>;
+    async fn list_by_location(
+        &self,
+        location_id: Uuid,
+    ) -> ProxyServiceResult<Vec<RewriteRuleConfig>>;
+    async fn create(
+        &self,
+        params: CreateRewriteRuleParams,
+    ) -> ProxyServiceResult<RewriteRuleConfig>;
+    async fn update(
+        &self,
+        id: Uuid,
+        params: UpdateRewriteRuleParams,
+    ) -> ProxyServiceResult<RewriteRuleConfig>;
+    async fn delete(&self, id: Uuid) -> ProxyServiceResult<bool>;
+}
+
+pub(crate) struct RewriteRuleServiceImpl {
+    db: DatabaseConnection,
+}
+
+impl RewriteRuleServiceImpl {
+    pub fn new(db: DatabaseConnection) -> Self {
+        Self { db }
+    }
+}
+
+#[async_trait::async_trait]
+impl RewriteRuleService for RewriteRuleServiceImpl {
+    async fn get(&self, id: Uuid) -> ProxyServiceResult<RewriteRuleConfig> {
+        use crate::db::entities::rewrite_rule;
+
+        let model = rewrite_rule::Entity::find_by_id(id)
+            .one(&self.db)
+            .await?
+            .ok_or(ProxyServiceError::ConfigNotFound)?;
+
+        Ok(model.into())
+    }
+
+    async fn list_by_location(
+        &self,
+        location_id: Uuid,
+    ) -> ProxyServiceResult<Vec<RewriteRuleConfig>> {
+        use crate::db::entities::rewrite_rule;
+
+        let models = rewrite_rule::Entity::find()
+            .filter(rewrite_rule::Column::LocationId.eq(location_id))
+            .all(&self.db)
+            .await?;
+
+        Ok(models.into_iter().map(Into::into).collect())
+    }
+
+    async fn create(
+        &self,
+        params: CreateRewriteRuleParams,
+    ) -> ProxyServiceResult<RewriteRuleConfig> {
+        use crate::db::entities::rewrite_rule::ActiveModel;
+
+        let model = ActiveModel {
+            id: Set(Uuid::new_v4()),
+            location_id: Set(params.location_id),
+            pattern: Set(params.pattern),
+            replacement: Set(params.replacement),
+            flag: Set(params.flag),
+            priority: Set(params.priority),
+            is_deleted: Set(false),
+            override_of_id: Set(params.override_of_id),
+        };
+
+        let result = model.insert(&self.db).await?;
+        Ok(result.into())
+    }
+
+    async fn update(
+        &self,
+        id: Uuid,
+        params: UpdateRewriteRuleParams,
+    ) -> ProxyServiceResult<RewriteRuleConfig> {
+        use crate::db::entities::rewrite_rule::{ActiveModel, Entity as RewriteRuleEntity};
+
+        let existing = RewriteRuleEntity::find_by_id(id)
+            .one(&self.db)
+            .await?
+            .ok_or(ProxyServiceError::ConfigNotFound)?;
+
+        let mut model: ActiveModel = existing.into();
+        if let Some(location_id) = params.location_id {
+            model.location_id = Set(location_id);
+        }
+        if let Some(pattern) = params.pattern {
+            model.pattern = Set(pattern);
+        }
+        if let Some(replacement) = params.replacement {
+            model.replacement = Set(replacement);
+        }
+        if let Some(flag) = params.flag {
+            model.flag = Set(flag);
+        }
+        if let Some(priority) = params.priority {
+            model.priority = Set(priority);
+        }
+        if let Some(override_of_id) = params.override_of_id {
+            model.override_of_id = Set(override_of_id);
+        }
+
+        let result = model.update(&self.db).await?;
+        Ok(result.into())
+    }
+
+    async fn delete(&self, id: Uuid) -> ProxyServiceResult<bool> {
+        let result = crate::db::entities::rewrite_rule::Entity::delete_by_id(id)
+            .exec(&self.db)
+            .await?;
+        Ok(result.rows_affected > 0)
+    }
+}

apps/nxmesh-master/src/service/proxy/server_block/mod.rs

@@ -0,0 +1,202 @@
+use sea_orm::{ActiveModelTrait, ActiveValue::Set, DatabaseConnection, EntityTrait, prelude::*};
+use uuid::Uuid;
+
+use crate::service::proxy::types::{
+    OverrideRef, ProxyServiceError, ProxyServiceResult, ServerBlockConfig,
+};
+
+pub struct CreateServerBlockParams {
+    pub config_id: Uuid,
+    pub server_name: Option<Vec<String>>,
+    pub listen_port: i32,
+    pub ssl_enabled: Option<bool>,
+    pub ssl_cert_id: Option<Uuid>,
+    pub override_of_id: Option<Uuid>,
+}
+
+pub struct UpdateServerBlockParams {
+    pub server_name: Option<Option<Vec<String>>>,
+    pub listen_port: Option<i32>,
+    pub ssl_enabled: Option<Option<bool>>,
+    pub ssl_cert_id: Option<Option<Uuid>>,
+    pub override_of_id: Option<Option<Uuid>>,
+}
+
+#[cfg_attr(test, mockall::automock)]
+#[async_trait::async_trait]
+pub trait ServerBlockService: Send + Sync + 'static {
+    async fn get(&self, id: Uuid) -> ProxyServiceResult<ServerBlockConfig>;
+    async fn list_by_config(&self, config_id: Uuid) -> ProxyServiceResult<Vec<ServerBlockConfig>>;
+    async fn create(
+        &self,
+        params: CreateServerBlockParams,
+    ) -> ProxyServiceResult<ServerBlockConfig>;
+    async fn update(
+        &self,
+        id: Uuid,
+        params: UpdateServerBlockParams,
+    ) -> ProxyServiceResult<ServerBlockConfig>;
+    async fn delete(&self, id: Uuid) -> ProxyServiceResult<bool>;
+}
+
+pub(crate) struct ServerBlockServiceImpl {
+    db: DatabaseConnection,
+}
+
+impl ServerBlockServiceImpl {
+    pub fn new(db: DatabaseConnection) -> Self {
+        Self { db }
+    }
+
+    async fn build_with_children(
+        &self,
+        model: crate::db::entities::server_block::Model,
+    ) -> ProxyServiceResult<ServerBlockConfig> {
+        use crate::db::entities::{access_rule, location_block, log_setting};
+
+        let access_rules = access_rule::Entity::find()
+            .filter(access_rule::Column::ServerId.eq(model.id))
+            .all(&self.db)
+            .await?
+            .into_iter()
+            .map(|a| OverrideRef {
+                id: a.id,
+                override_of_id: a.override_of_id,
+            })
+            .collect();
+
+        let location_blocks = location_block::Entity::find()
+            .filter(location_block::Column::ServerId.eq(model.id))
+            .all(&self.db)
+            .await?
+            .into_iter()
+            .map(|l| OverrideRef {
+                id: l.id,
+                override_of_id: l.override_of_id,
+            })
+            .collect();
+
+        let log_settings = log_setting::Entity::find()
+            .filter(log_setting::Column::ServerId.eq(model.id))
+            .all(&self.db)
+            .await?
+            .into_iter()
+            .map(|l| OverrideRef {
+                id: l.id,
+                override_of_id: l.override_of_id,
+            })
+            .collect();
+
+        let ssl_certificates = model
+            .ssl_cert_id
+            .map(|id| {
+                vec![OverrideRef {
+                    id,
+                    override_of_id: None,
+                }]
+            })
+            .unwrap_or_default();
+
+        Ok(ServerBlockConfig {
+            id: model.id,
+            server_name: model.server_name,
+            listen_port: model.listen_port,
+            ssl_enabled: model.ssl_enabled,
+            override_of_id: model.override_of_id,
+            access_rules,
+            location_blocks,
+            log_settings,
+            ssl_certificates,
+        })
+    }
+}
+
+#[async_trait::async_trait]
+impl ServerBlockService for ServerBlockServiceImpl {
+    async fn get(&self, id: Uuid) -> ProxyServiceResult<ServerBlockConfig> {
+        use crate::db::entities::server_block;
+
+        let model = server_block::Entity::find_by_id(id)
+            .one(&self.db)
+            .await?
+            .ok_or(ProxyServiceError::ConfigNotFound)?;
+
+        self.build_with_children(model).await
+    }
+
+    async fn list_by_config(&self, config_id: Uuid) -> ProxyServiceResult<Vec<ServerBlockConfig>> {
+        use crate::db::entities::server_block;
+
+        let models = server_block::Entity::find()
+            .filter(server_block::Column::ConfigId.eq(config_id))
+            .all(&self.db)
+            .await?;
+
+        let mut results = Vec::with_capacity(models.len());
+        for m in models {
+            results.push(self.build_with_children(m).await?);
+        }
+        Ok(results)
+    }
+
+    async fn create(
+        &self,
+        params: CreateServerBlockParams,
+    ) -> ProxyServiceResult<ServerBlockConfig> {
+        use crate::db::entities::server_block::ActiveModel;
+
+        let id = Uuid::new_v4();
+        let model = ActiveModel {
+            id: Set(id),
+            config_id: Set(params.config_id),
+            server_name: Set(params.server_name),
+            listen_port: Set(params.listen_port),
+            ssl_enabled: Set(params.ssl_enabled),
+            ssl_cert_id: Set(params.ssl_cert_id),
+            override_of_id: Set(params.override_of_id),
+        };
+
+        let result = model.insert(&self.db).await?;
+        self.build_with_children(result).await
+    }
+
+    async fn update(
+        &self,
+        id: Uuid,
+        params: UpdateServerBlockParams,
+    ) -> ProxyServiceResult<ServerBlockConfig> {
+        use crate::db::entities::server_block::{ActiveModel, Entity as ServerBlockEntity};
+
+        let existing = ServerBlockEntity::find_by_id(id)
+            .one(&self.db)
+            .await?
+            .ok_or(ProxyServiceError::ConfigNotFound)?;
+
+        let mut model: ActiveModel = existing.into();
+        if let Some(server_name) = params.server_name {
+            model.server_name = Set(server_name);
+        }
+        if let Some(listen_port) = params.listen_port {
+            model.listen_port = Set(listen_port);
+        }
+        if let Some(ssl_enabled) = params.ssl_enabled {
+            model.ssl_enabled = Set(ssl_enabled);
+        }
+        if let Some(ssl_cert_id) = params.ssl_cert_id {
+            model.ssl_cert_id = Set(ssl_cert_id);
+        }
+        if let Some(override_of_id) = params.override_of_id {
+            model.override_of_id = Set(override_of_id);
+        }
+
+        let result = model.update(&self.db).await?;
+        self.build_with_children(result).await
+    }
+
+    async fn delete(&self, id: Uuid) -> ProxyServiceResult<bool> {
+        let result = crate::db::entities::server_block::Entity::delete_by_id(id)
+            .exec(&self.db)
+            .await?;
+        Ok(result.rows_affected > 0)
+    }
+}

apps/nxmesh-master/src/service/proxy/service.rs

@@ -0,0 +1,96 @@
+use std::collections::HashMap;
+
+use sea_orm::DatabaseConnection;
+
+use super::nginx::NginxConfigRenderer;
+use super::repo::{ProxyRepo, ProxyRepoImpl};
+use super::types::{
+    AgentConfigBinding, CreateProxyConfigParams, ProxyConfig, ProxyConfigSummary,
+    ProxyServiceError, ProxyServiceResult, ProxyType, UpdateProxyConfigParams,
+};
+use super::{ProxyConfigRenderer, ProxyServiceTrait};
+
+pub struct ProxyServiceImpl {
+    repo: Box<dyn ProxyRepo>,
+    renderers: HashMap<ProxyType, Box<dyn ProxyConfigRenderer>>,
+}
+
+impl ProxyServiceImpl {
+    pub fn new(db: DatabaseConnection) -> Self {
+        let mut renderers: HashMap<ProxyType, Box<dyn ProxyConfigRenderer>> = HashMap::new();
+        renderers.insert(ProxyType::Nginx, Box::new(NginxConfigRenderer));
+        Self {
+            repo: Box::new(ProxyRepoImpl::new(db)),
+            renderers,
+        }
+    }
+}
+
+#[async_trait::async_trait]
+impl ProxyServiceTrait for ProxyServiceImpl {
+    async fn get_proxy_config(&self, proxy_id: uuid::Uuid) -> ProxyServiceResult<ProxyConfig> {
+        self.repo.get_merged_proxy_config(proxy_id).await
+    }
+
+    async fn render_config(&self, proxy_id: uuid::Uuid) -> ProxyServiceResult<String> {
+        let config = self.repo.get_merged_proxy_config(proxy_id).await?;
+        let renderer = self
+            .renderers
+            .get(&config.r#type)
+            .ok_or(ProxyServiceError::RendererNotFound)?;
+        Ok(renderer.render(&config))
+    }
+
+    async fn list_configs(&self) -> ProxyServiceResult<Vec<ProxyConfigSummary>> {
+        self.repo.list_proxy_configs().await
+    }
+
+    async fn create_config(
+        &self,
+        params: CreateProxyConfigParams,
+    ) -> ProxyServiceResult<ProxyConfigSummary> {
+        self.repo.create_proxy_config(params).await
+    }
+
+    async fn update_config(
+        &self,
+        id: uuid::Uuid,
+        params: UpdateProxyConfigParams,
+    ) -> ProxyServiceResult<ProxyConfigSummary> {
+        self.repo.update_proxy_config(id, params).await
+    }
+
+    async fn delete_config(&self, id: uuid::Uuid) -> ProxyServiceResult<bool> {
+        self.repo.delete_proxy_config(id).await
+    }
+
+    async fn get_active_agent_config(
+        &self,
+        agent_id: uuid::Uuid,
+    ) -> ProxyServiceResult<Option<ProxyConfigSummary>> {
+        self.repo.get_active_agent_config(agent_id).await
+    }
+
+    async fn bind_agent(
+        &self,
+        agent_id: uuid::Uuid,
+        config_id: uuid::Uuid,
+    ) -> ProxyServiceResult<AgentConfigBinding> {
+        self.repo.bind_agent_to_config(agent_id, config_id).await
+    }
+
+    async fn unbind_agent(&self, agent_id: uuid::Uuid) -> ProxyServiceResult<bool> {
+        self.repo.unbind_agent(agent_id).await
+    }
+}
+
+impl ProxyServiceImpl {
+    pub async fn render_config(&self, proxy_id: uuid::Uuid) -> ProxyServiceResult<String> {
+        let config = self.repo.get_merged_proxy_config(proxy_id).await?;
+        let renderer = self
+            .renderers
+            .get(&config.r#type)
+            .ok_or(ProxyServiceError::RendererNotFound)?;
+        Ok(renderer.render(&config))
+    }
+}

apps/nxmesh-master/src/service/proxy/ssl_certificate/mod.rs

@@ -0,0 +1,123 @@
+use chrono::Utc;
+use sea_orm::{ActiveModelTrait, ActiveValue::Set, DatabaseConnection, EntityTrait, prelude::*};
+use uuid::Uuid;
+
+use crate::service::proxy::types::{ProxyServiceError, ProxyServiceResult, SslCertificateConfig};
+
+pub struct CreateSslCertificateParams {
+    pub name: String,
+    pub cert_path: String,
+    pub key_path: String,
+    pub expiry_date: chrono::DateTime<Utc>,
+}
+
+pub struct UpdateSslCertificateParams {
+    pub name: Option<String>,
+    pub cert_path: Option<String>,
+    pub key_path: Option<String>,
+    pub expiry_date: Option<chrono::DateTime<Utc>>,
+}
+
+#[cfg_attr(test, mockall::automock)]
+#[async_trait::async_trait]
+pub trait SslCertificateService: Send + Sync + 'static {
+    async fn get(&self, id: Uuid) -> ProxyServiceResult<SslCertificateConfig>;
+    async fn list(&self) -> ProxyServiceResult<Vec<SslCertificateConfig>>;
+    async fn create(
+        &self,
+        params: CreateSslCertificateParams,
+    ) -> ProxyServiceResult<SslCertificateConfig>;
+    async fn update(
+        &self,
+        id: Uuid,
+        params: UpdateSslCertificateParams,
+    ) -> ProxyServiceResult<SslCertificateConfig>;
+    async fn delete(&self, id: Uuid) -> ProxyServiceResult<bool>;
+}
+
+pub(crate) struct SslCertificateServiceImpl {
+    db: DatabaseConnection,
+}
+
+impl SslCertificateServiceImpl {
+    pub fn new(db: DatabaseConnection) -> Self {
+        Self { db }
+    }
+}
+
+#[async_trait::async_trait]
+impl SslCertificateService for SslCertificateServiceImpl {
+    async fn get(&self, id: Uuid) -> ProxyServiceResult<SslCertificateConfig> {
+        use crate::db::entities::ssl_certificate;
+
+        let model = ssl_certificate::Entity::find_by_id(id)
+            .one(&self.db)
+            .await?
+            .ok_or(ProxyServiceError::ConfigNotFound)?;
+
+        Ok(model.into())
+    }
+
+    async fn list(&self) -> ProxyServiceResult<Vec<SslCertificateConfig>> {
+        use crate::db::entities::ssl_certificate;
+
+        let models = ssl_certificate::Entity::find().all(&self.db).await?;
+
+        Ok(models.into_iter().map(Into::into).collect())
+    }
+
+    async fn create(
+        &self,
+        params: CreateSslCertificateParams,
+    ) -> ProxyServiceResult<SslCertificateConfig> {
+        use crate::db::entities::ssl_certificate::ActiveModel;
+
+        let model = ActiveModel {
+            id: Set(Uuid::new_v4()),
+            name: Set(params.name),
+            cert_path: Set(params.cert_path),
+            key_path: Set(params.key_path),
+            expiry_date: Set(params.expiry_date.naive_utc()),
+        };
+
+        let result = model.insert(&self.db).await?;
+        Ok(result.into())
+    }
+
+    async fn update(
+        &self,
+        id: Uuid,
+        params: UpdateSslCertificateParams,
+    ) -> ProxyServiceResult<SslCertificateConfig> {
+        use crate::db::entities::ssl_certificate::{ActiveModel, Entity as SslCertificateEntity};
+
+        let existing = SslCertificateEntity::find_by_id(id)
+            .one(&self.db)
+            .await?
+            .ok_or(ProxyServiceError::ConfigNotFound)?;
+
+        let mut model: ActiveModel = existing.into();
+        if let Some(name) = params.name {
+            model.name = Set(name);
+        }
+        if let Some(cert_path) = params.cert_path {
+            model.cert_path = Set(cert_path);
+        }
+        if let Some(key_path) = params.key_path {
+            model.key_path = Set(key_path);
+        }
+        if let Some(expiry_date) = params.expiry_date {
+            model.expiry_date = Set(expiry_date.naive_utc());
+        }
+
+        let result = model.update(&self.db).await?;
+        Ok(result.into())
+    }
+
+    async fn delete(&self, id: Uuid) -> ProxyServiceResult<bool> {
+        let result = crate::db::entities::ssl_certificate::Entity::delete_by_id(id)
+            .exec(&self.db)
+            .await?;
+        Ok(result.rows_affected > 0)
+    }
+}

apps/nxmesh-master/src/service/proxy/types.rs

@@ -1,20 +1,20 @@
 use std::collections::HashMap;
 
-#[derive(Debug)]
+#[derive(Debug, thiserror::Error)]
 pub enum ProxyServiceError {
+    #[error("proxy config not found")]
     ConfigNotFound,
-    InvalidConfig,
-    DatabaseError(sea_orm::DbErr),
-}
-
-impl From<sea_orm::DbErr> for ProxyServiceError {
-    fn from(err: sea_orm::DbErr) -> Self {
-        ProxyServiceError::DatabaseError(err)
-    }
+    #[error("invalid proxy config: {0}")]
+    InvalidConfig(String),
+    #[error("no renderer registered for this proxy type")]
+    RendererNotFound,
+    #[error("database error: {0}")]
+    DatabaseError(#[from] sea_orm::DbErr),
 }
 
 pub type ProxyServiceResult<T> = Result<T, ProxyServiceError>;
 
+#[derive(Hash, Eq, PartialEq, Clone, Debug)]
 pub enum ProxyType {
     Nginx,
 }
@@ -34,10 +34,8 @@ pub fn merge_override_vecs(
     mut child: Vec<OverrideRef>,
     parent: Vec<OverrideRef>,
 ) -> Vec<OverrideRef> {
-    let overridden_ids: std::collections::HashSet<uuid::Uuid> = child
-        .iter()
-        .filter_map(|r| r.override_of_id)
-        .collect();
+    let overridden_ids: std::collections::HashSet<uuid::Uuid> =
+        child.iter().filter_map(|r| r.override_of_id).collect();
     for item in parent {
         if !overridden_ids.contains(&item.id) {
             child.push(item);
@@ -76,7 +74,8 @@ impl Mergeable<ProxyConfig> for ProxyConfig {
 
         macro_rules! merge_overridable_field {
             ($field:ident) => {
-                let overridden: HashSet<uuid::Uuid> = self.$field
+                let overridden: HashSet<uuid::Uuid> = self
+                    .$field
                     .values()
                     .filter_map(|v| v.override_of_id())
                     .collect();
@@ -90,7 +89,8 @@ impl Mergeable<ProxyConfig> for ProxyConfig {
 
         // server_blocks: merge matching entries (field-level), handle overrides
         {
-            let overridden: HashSet<uuid::Uuid> = self.server_blocks
+            let overridden: HashSet<uuid::Uuid> = self
+                .server_blocks
                 .values()
                 .filter_map(|sb| sb.override_of_id)
                 .collect();
@@ -167,27 +167,26 @@ impl
 
 impl Mergeable<ServerBlockConfig> for ServerBlockConfig {
     fn merge(&mut self, other: ServerBlockConfig) {
-        if let Some(server_name) = other.server_name {
-            self.server_name = Some(server_name);
+        // self (child) overrides other (parent): keep child's values, fill gaps from parent
+        if self.server_name.is_none() {
+            self.server_name = other.server_name;
         }
-        self.listen_port = other.listen_port;
-        if let Some(ssl_enabled) = other.ssl_enabled {
-            self.ssl_enabled = Some(ssl_enabled);
+        // listen_port is non-optional, child always keeps its own
+        if self.ssl_enabled.is_none() {
+            self.ssl_enabled = other.ssl_enabled;
+        }
+        if self.override_of_id.is_none() {
+            self.override_of_id = other.override_of_id;
         }
-        self.override_of_id = other.override_of_id;
 
-        self.access_rules = merge_override_vecs(
-            std::mem::take(&mut self.access_rules),
-            other.access_rules,
-        );
+        self.access_rules =
+            merge_override_vecs(std::mem::take(&mut self.access_rules), other.access_rules);
         self.location_blocks = merge_override_vecs(
             std::mem::take(&mut self.location_blocks),
             other.location_blocks,
         );
-        self.log_settings = merge_override_vecs(
-            std::mem::take(&mut self.log_settings),
-            other.log_settings,
-        );
+        self.log_settings =
+            merge_override_vecs(std::mem::take(&mut self.log_settings), other.log_settings);
         self.ssl_certificates = merge_override_vecs(
             std::mem::take(&mut self.ssl_certificates),
             other.ssl_certificates,
@@ -247,6 +246,7 @@ impl From<crate::db::entities::access_rule::Model> for AccessRuleConfig {
 pub struct CacheZoneConfig {
     pub id: uuid::Uuid,
     pub name: String,
+    pub path: String,
     pub size: String,
     pub override_of_id: Option<uuid::Uuid>,
 }
@@ -256,6 +256,7 @@ impl From<crate::db::entities::cache_zone::Model> for CacheZoneConfig {
         CacheZoneConfig {
             id: model.id,
             name: model.name,
+            path: model.path,
             size: model.size_limit,
             override_of_id: model.override_of_id,
         }
@@ -447,32 +448,380 @@ impl From<crate::db::entities::rewrite_rule::Model> for RewriteRuleConfig {
 // ── Overridable implementations ──
 
 impl Overridable for ServerBlockConfig {
-    fn override_of_id(&self) -> Option<uuid::Uuid> { self.override_of_id }
+    fn override_of_id(&self) -> Option<uuid::Uuid> {
+        self.override_of_id
+    }
 }
 impl Overridable for UpstreamConfig {
-    fn override_of_id(&self) -> Option<uuid::Uuid> { self.override_of_id }
+    fn override_of_id(&self) -> Option<uuid::Uuid> {
+        self.override_of_id
+    }
 }
 impl Overridable for AccessRuleConfig {
-    fn override_of_id(&self) -> Option<uuid::Uuid> { self.override_of_id }
+    fn override_of_id(&self) -> Option<uuid::Uuid> {
+        self.override_of_id
+    }
 }
 impl Overridable for CacheZoneConfig {
-    fn override_of_id(&self) -> Option<uuid::Uuid> { self.override_of_id }
+    fn override_of_id(&self) -> Option<uuid::Uuid> {
+        self.override_of_id
+    }
 }
 impl Overridable for LimitRuleConfig {
-    fn override_of_id(&self) -> Option<uuid::Uuid> { self.override_of_id }
+    fn override_of_id(&self) -> Option<uuid::Uuid> {
+        self.override_of_id
+    }
 }
 impl Overridable for LimitZoneConfig {
-    fn override_of_id(&self) -> Option<uuid::Uuid> { self.override_of_id }
+    fn override_of_id(&self) -> Option<uuid::Uuid> {
+        self.override_of_id
+    }
 }
 impl Overridable for LocationBlockConfig {
-    fn override_of_id(&self) -> Option<uuid::Uuid> { self.override_of_id }
+    fn override_of_id(&self) -> Option<uuid::Uuid> {
+        self.override_of_id
+    }
 }
 impl Overridable for LogSettingConfig {
-    fn override_of_id(&self) -> Option<uuid::Uuid> { self.override_of_id }
+    fn override_of_id(&self) -> Option<uuid::Uuid> {
+        self.override_of_id
+    }
 }
 impl Overridable for ProxySettingConfig {
-    fn override_of_id(&self) -> Option<uuid::Uuid> { self.override_of_id }
+    fn override_of_id(&self) -> Option<uuid::Uuid> {
+        self.override_of_id
+    }
 }
 impl Overridable for RewriteRuleConfig {
-    fn override_of_id(&self) -> Option<uuid::Uuid> { self.override_of_id }
+    fn override_of_id(&self) -> Option<uuid::Uuid> {
+        self.override_of_id
+    }
+}
+
+// ── CRUD types ──
+
+pub struct ProxyConfigSummary {
+    pub id: uuid::Uuid,
+    pub name: String,
+    pub description: Option<String>,
+    pub is_template: bool,
+    pub created_at: chrono::DateTime<chrono::Utc>,
+    pub updated_at: chrono::DateTime<chrono::Utc>,
+}
+
+impl From<crate::db::entities::proxy_config::Model> for ProxyConfigSummary {
+    fn from(m: crate::db::entities::proxy_config::Model) -> Self {
+        Self {
+            id: m.id,
+            name: m.name,
+            description: m.description,
+            is_template: m.is_template,
+            created_at: m.created_at.and_utc(),
+            updated_at: m.updated_at.and_utc(),
+        }
+    }
+}
+
+pub struct CreateProxyConfigParams {
+    pub name: String,
+    pub description: Option<String>,
+    pub is_template: bool,
+}
+
+pub struct UpdateProxyConfigParams {
+    pub name: Option<String>,
+    pub description: Option<String>,
+    pub is_template: Option<bool>,
+}
+
+// ── Agent config binding ──
+
+pub struct AgentConfigBinding {
+    pub id: uuid::Uuid,
+    pub agent_id: Option<uuid::Uuid>,
+    pub group_id: Option<uuid::Uuid>,
+    pub config_id: uuid::Uuid,
+    pub is_active: bool,
+    pub applied_at: chrono::DateTime<chrono::Utc>,
+}
+
+impl From<crate::db::entities::agent_config_binding::Model> for AgentConfigBinding {
+    fn from(m: crate::db::entities::agent_config_binding::Model) -> Self {
+        Self {
+            id: m.id,
+            agent_id: m.agent_id,
+            group_id: m.group_id,
+            config_id: m.config_id,
+            is_active: m.is_active,
+            applied_at: m.applied_at.and_utc(),
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::collections::HashMap;
+
+    fn make_id() -> uuid::Uuid {
+        uuid::Uuid::new_v4()
+    }
+
+    #[test]
+    fn test_merge_override_vecs_child_overrides_parent() {
+        let parent_id = make_id();
+        let child_id = make_id();
+        let child = vec![OverrideRef {
+            id: child_id,
+            override_of_id: Some(parent_id),
+        }];
+        let parent = vec![OverrideRef {
+            id: parent_id,
+            override_of_id: None,
+        }];
+        let result = merge_override_vecs(child, parent);
+        assert_eq!(result.len(), 1);
+        assert_eq!(result[0].id, child_id);
+    }
+
+    #[test]
+    fn test_merge_override_vecs_removes_overridden_parent() {
+        let parent_id = make_id();
+        let child_override = make_id();
+        let child = vec![OverrideRef {
+            id: child_override,
+            override_of_id: Some(parent_id),
+        }];
+        let parent = vec![OverrideRef {
+            id: parent_id,
+            override_of_id: None,
+        }];
+        let result = merge_override_vecs(child, parent);
+        assert_eq!(result.len(), 1);
+        assert_eq!(result[0].id, child_override);
+    }
+
+    #[test]
+    fn test_merge_override_vecs_empty_child() {
+        let parent = vec![OverrideRef {
+            id: make_id(),
+            override_of_id: None,
+        }];
+        let result = merge_override_vecs(vec![], parent.clone());
+        assert_eq!(result.len(), 1);
+        assert_eq!(result[0].id, parent[0].id);
+    }
+
+    #[test]
+    fn test_server_block_merge_child_overrides_parent() {
+        let id = make_id();
+        let mut child = ServerBlockConfig {
+            id,
+            server_name: Some(vec!["child.example.com".to_string()]),
+            listen_port: 443,
+            ssl_enabled: Some(true),
+            override_of_id: None,
+            access_rules: vec![],
+            location_blocks: vec![],
+            log_settings: vec![],
+            ssl_certificates: vec![],
+        };
+        let parent = ServerBlockConfig {
+            id,
+            server_name: Some(vec!["parent.example.com".to_string()]),
+            listen_port: 80,
+            ssl_enabled: Some(false),
+            override_of_id: None,
+            access_rules: vec![],
+            location_blocks: vec![],
+            log_settings: vec![],
+            ssl_certificates: vec![],
+        };
+        child.merge(parent);
+        // child keeps its own values (self overrides other)
+        assert_eq!(
+            child.server_name,
+            Some(vec!["child.example.com".to_string()])
+        );
+        assert_eq!(child.listen_port, 443);
+        assert_eq!(child.ssl_enabled, Some(true));
+    }
+
+    #[test]
+    fn test_server_block_merge_fills_from_parent() {
+        let id = make_id();
+        let mut child = ServerBlockConfig {
+            id,
+            server_name: None,
+            listen_port: 443,
+            ssl_enabled: None,
+            override_of_id: None,
+            access_rules: vec![],
+            location_blocks: vec![],
+            log_settings: vec![],
+            ssl_certificates: vec![],
+        };
+        let parent = ServerBlockConfig {
+            id,
+            server_name: Some(vec!["parent.example.com".to_string()]),
+            listen_port: 80,
+            ssl_enabled: Some(false),
+            override_of_id: None,
+            access_rules: vec![],
+            location_blocks: vec![],
+            log_settings: vec![],
+            ssl_certificates: vec![],
+        };
+        child.merge(parent);
+        // child fills missing optional fields from parent
+        assert_eq!(
+            child.server_name,
+            Some(vec!["parent.example.com".to_string()])
+        );
+        assert_eq!(child.listen_port, 443); // non-optional: child keeps its own
+        assert_eq!(child.ssl_enabled, Some(false));
+    }
+
+    #[test]
+    fn test_proxy_config_merge_server_block_overrides() {
+        let sb_id = make_id();
+        let child_sb = ServerBlockConfig {
+            id: sb_id,
+            server_name: Some(vec!["child.example.com".to_string()]),
+            listen_port: 443,
+            ssl_enabled: Some(true),
+            override_of_id: Some(make_id()),
+            access_rules: vec![],
+            location_blocks: vec![],
+            log_settings: vec![],
+            ssl_certificates: vec![],
+        };
+        let parent_sb = ServerBlockConfig {
+            id: sb_id,
+            server_name: Some(vec!["parent.example.com".to_string()]),
+            listen_port: 80,
+            ssl_enabled: Some(false),
+            override_of_id: None,
+            access_rules: vec![],
+            location_blocks: vec![],
+            log_settings: vec![],
+            ssl_certificates: vec![],
+        };
+        let parent_id = make_id();
+        let mut child_proxy = ProxyConfig {
+            id: parent_id,
+            name: "child".to_string(),
+            r#type: ProxyType::Nginx,
+            description: None,
+            parent_config_id: None,
+            server_blocks: HashMap::from([(child_sb.id, child_sb)]),
+            upstreams: HashMap::new(),
+            access_rules: HashMap::new(),
+            cache_zones: HashMap::new(),
+            limit_rules: HashMap::new(),
+            limit_zones: HashMap::new(),
+            location_blocks: HashMap::new(),
+            log_settings: HashMap::new(),
+            proxy_settings: HashMap::new(),
+            rewrite_rules: HashMap::new(),
+            ssl_certificates: HashMap::new(),
+        };
+        let parent_proxy = ProxyConfig {
+            id: make_id(),
+            name: "parent".to_string(),
+            r#type: ProxyType::Nginx,
+            description: None,
+            parent_config_id: None,
+            server_blocks: HashMap::from([(parent_sb.id, parent_sb)]),
+            upstreams: HashMap::new(),
+            access_rules: HashMap::new(),
+            cache_zones: HashMap::new(),
+            limit_rules: HashMap::new(),
+            limit_zones: HashMap::new(),
+            location_blocks: HashMap::new(),
+            log_settings: HashMap::new(),
+            proxy_settings: HashMap::new(),
+            rewrite_rules: HashMap::new(),
+            ssl_certificates: HashMap::new(),
+        };
+        child_proxy.merge(parent_proxy);
+        assert_eq!(child_proxy.server_blocks.len(), 1);
+        let merged_sb = &child_proxy.server_blocks[&sb_id];
+        assert_eq!(
+            merged_sb.server_name,
+            Some(vec!["child.example.com".to_string()])
+        );
+        assert_eq!(merged_sb.listen_port, 443);
+        assert_eq!(merged_sb.ssl_enabled, Some(true));
+    }
+
+    #[test]
+    fn test_proxy_config_merge_adds_parent_server_block() {
+        let child_sb_id = make_id();
+        let parent_sb_id = make_id();
+        let child_sb = ServerBlockConfig {
+            id: child_sb_id,
+            server_name: Some(vec!["child.example.com".to_string()]),
+            listen_port: 443,
+            ssl_enabled: Some(true),
+            override_of_id: None,
+            access_rules: vec![],
+            location_blocks: vec![],
+            log_settings: vec![],
+            ssl_certificates: vec![],
+        };
+        let parent_sb = ServerBlockConfig {
+            id: parent_sb_id,
+            server_name: Some(vec!["parent.example.com".to_string()]),
+            listen_port: 80,
+            ssl_enabled: None,
+            override_of_id: None,
+            access_rules: vec![],
+            location_blocks: vec![],
+            log_settings: vec![],
+            ssl_certificates: vec![],
+        };
+        let parent_id = make_id();
+        let mut child_proxy = ProxyConfig {
+            id: parent_id,
+            name: "child".to_string(),
+            r#type: ProxyType::Nginx,
+            description: None,
+            parent_config_id: None,
+            server_blocks: HashMap::from([(child_sb.id, child_sb)]),
+            upstreams: HashMap::new(),
+            access_rules: HashMap::new(),
+            cache_zones: HashMap::new(),
+            limit_rules: HashMap::new(),
+            limit_zones: HashMap::new(),
+            location_blocks: HashMap::new(),
+            log_settings: HashMap::new(),
+            proxy_settings: HashMap::new(),
+            rewrite_rules: HashMap::new(),
+            ssl_certificates: HashMap::new(),
+        };
+        let parent_proxy = ProxyConfig {
+            id: make_id(),
+            name: "parent".to_string(),
+            r#type: ProxyType::Nginx,
+            description: None,
+            parent_config_id: None,
+            server_blocks: HashMap::from([(parent_sb.id, parent_sb)]),
+            upstreams: HashMap::new(),
+            access_rules: HashMap::new(),
+            cache_zones: HashMap::new(),
+            limit_rules: HashMap::new(),
+            limit_zones: HashMap::new(),
+            location_blocks: HashMap::new(),
+            log_settings: HashMap::new(),
+            proxy_settings: HashMap::new(),
+            rewrite_rules: HashMap::new(),
+            ssl_certificates: HashMap::new(),
+        };
+        child_proxy.merge(parent_proxy);
+        assert_eq!(child_proxy.server_blocks.len(), 2);
+        // Both child and parent server blocks should be present
+        assert!(child_proxy.server_blocks.contains_key(&child_sb_id));
+        assert!(child_proxy.server_blocks.contains_key(&parent_sb_id));
+    }
 }

apps/nxmesh-master/src/service/proxy/upstream/mod.rs

@@ -0,0 +1,141 @@
+use sea_orm::{ActiveModelTrait, ActiveValue::Set, DatabaseConnection, EntityTrait, prelude::*};
+use uuid::Uuid;
+
+use crate::service::proxy::types::{
+    ProxyServiceError, ProxyServiceResult, UpstreamConfig,
+};
+
+pub struct CreateUpstreamParams {
+    pub config_id: Uuid,
+    pub name: String,
+    pub target_host: String,
+    pub target_port: i32,
+    pub metadata: Option<serde_json::Value>,
+    pub override_of_id: Option<Uuid>,
+}
+
+pub struct UpdateUpstreamParams {
+    pub name: Option<String>,
+    pub target_host: Option<String>,
+    pub target_port: Option<i32>,
+    pub metadata: Option<Option<serde_json::Value>>,
+    pub override_of_id: Option<Option<Uuid>>,
+}
+
+fn model_to_config(model: crate::db::entities::upstream::Model) -> UpstreamConfig {
+    UpstreamConfig {
+        id: model.id,
+        name: model.name,
+        target_host: model.target_host,
+        target_port: model.target_port,
+        metadata: model.metadata,
+        override_of_id: model.override_of_id,
+        location_blocks: vec![],
+    }
+}
+
+#[cfg_attr(test, mockall::automock)]
+#[async_trait::async_trait]
+pub trait UpstreamService: Send + Sync + 'static {
+    async fn get(&self, id: Uuid) -> ProxyServiceResult<UpstreamConfig>;
+    async fn list_by_config(&self, config_id: Uuid) -> ProxyServiceResult<Vec<UpstreamConfig>>;
+    async fn create(&self, params: CreateUpstreamParams) -> ProxyServiceResult<UpstreamConfig>;
+    async fn update(
+        &self,
+        id: Uuid,
+        params: UpdateUpstreamParams,
+    ) -> ProxyServiceResult<UpstreamConfig>;
+    async fn delete(&self, id: Uuid) -> ProxyServiceResult<bool>;
+}
+
+pub(crate) struct UpstreamServiceImpl {
+    db: DatabaseConnection,
+}
+
+impl UpstreamServiceImpl {
+    pub fn new(db: DatabaseConnection) -> Self {
+        Self { db }
+    }
+}
+
+#[async_trait::async_trait]
+impl UpstreamService for UpstreamServiceImpl {
+    async fn get(&self, id: Uuid) -> ProxyServiceResult<UpstreamConfig> {
+        use crate::db::entities::upstream;
+
+        let model = upstream::Entity::find_by_id(id)
+            .one(&self.db)
+            .await?
+            .ok_or(ProxyServiceError::ConfigNotFound)?;
+
+        Ok(model_to_config(model))
+    }
+
+    async fn list_by_config(&self, config_id: Uuid) -> ProxyServiceResult<Vec<UpstreamConfig>> {
+        use crate::db::entities::upstream;
+
+        let models = upstream::Entity::find()
+            .filter(upstream::Column::ConfigId.eq(config_id))
+            .all(&self.db)
+            .await?;
+
+        Ok(models.into_iter().map(model_to_config).collect())
+    }
+
+    async fn create(&self, params: CreateUpstreamParams) -> ProxyServiceResult<UpstreamConfig> {
+        use crate::db::entities::upstream::ActiveModel;
+
+        let model = ActiveModel {
+            id: Set(Uuid::new_v4()),
+            config_id: Set(params.config_id),
+            name: Set(params.name),
+            target_host: Set(params.target_host),
+            target_port: Set(params.target_port),
+            metadata: Set(params.metadata),
+            override_of_id: Set(params.override_of_id),
+        };
+
+        let result = model.insert(&self.db).await?;
+        Ok(model_to_config(result))
+    }
+
+    async fn update(
+        &self,
+        id: Uuid,
+        params: UpdateUpstreamParams,
+    ) -> ProxyServiceResult<UpstreamConfig> {
+        use crate::db::entities::upstream::{ActiveModel, Entity as UpstreamEntity};
+
+        let existing = UpstreamEntity::find_by_id(id)
+            .one(&self.db)
+            .await?
+            .ok_or(ProxyServiceError::ConfigNotFound)?;
+
+        let mut model: ActiveModel = existing.into();
+        if let Some(name) = params.name {
+            model.name = Set(name);
+        }
+        if let Some(target_host) = params.target_host {
+            model.target_host = Set(target_host);
+        }
+        if let Some(target_port) = params.target_port {
+            model.target_port = Set(target_port);
+        }
+        if let Some(metadata) = params.metadata {
+            model.metadata = Set(metadata);
+        }
+        if let Some(override_of_id) = params.override_of_id {
+            model.override_of_id = Set(override_of_id);
+        }
+
+        let result = model.update(&self.db).await?;
+        Ok(model_to_config(result))
+    }
+
+    async fn delete(&self, id: Uuid) -> ProxyServiceResult<bool> {
+        let result = crate::db::entities::upstream::Entity::delete_by_id(id)
+            .exec(&self.db)
+            .await?;
+        Ok(result.rows_affected > 0)
+    }
+}

justfile

@@ -54,7 +54,7 @@ dev-master *ARGS:
 
 dev-agent *ARGS:
     @echo "🔧 Starting Rust agent..."
-    cargo watch -w apps/nxmesh-agent -x 'run --bin nxmesh-agent -- {{ ARGS }}'
+    cargo watch -w apps/nxmesh-agent -x 'run --bin nxmesh-agent --release -- {{ ARGS }}'
 
 # Start Vite frontend development server
 dev-frontend: