feat: Update Kubernetes dependencies and improve intranet server handling

* commit 'aeef6f602b5d5b0c9b109dc33893cdb33ab75889': (33 commits)
  chore(manifests): add required userenvs and remove currently unused ones (#1954)
  fix: unify shell env name of cdn service with sysenv (#1951)
  feat(integration): integration server (#1948)
  refactor: change download to DaemonSet  and migrate to os-framework (#1942)
  feat(olares-app): update olares-app version to v1.5.8 (#1947)
  chore: clean up and migrate from legacy envs (#1946)
  tapr: fix minio policy was override when set multi bucket (#1945)
  system-server: fix rbac https provider bug (#1944)
  fix(app-service): retain legacy env rendering for migration (#1943)
  chore(manifests): clean up legacy env rendering in all files (#1941)
  olares: remove kubectl container from Olares.yaml (#1940)
  chore: get rid of legacy env injection for tailscale (#1939)
  Update docs/manual/get-started/install-olares.md
  system-server: add notification provider (#1938)
  feat(olares-app): update olares-app version to v1.5.7 (#1937)
  gpu(optimize): lower metrics collect interval to reduce lag (#1934)
  system-server: fix websocket rbac proxy tls bug (#1932)
  refactor: choose reverse proxy config during activation if enabled (#1935)
  fix: add addon charts image (#1931)
  adjust wording
  ...

cli/pkg/upgrade/1_12_2_20251020.go

@@ -11,6 +11,7 @@ import (
 	"github.com/beclab/Olares/cli/pkg/core/connector"
 	"github.com/beclab/Olares/cli/pkg/core/logger"
 	"github.com/beclab/Olares/cli/pkg/core/task"
+	"github.com/pkg/errors"
 	corev1 "k8s.io/api/core/v1"
 	apixclientset "k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
@@ -43,6 +44,12 @@ func (u upgrader_1_12_2_20251020) UpgradeSystemComponents() []task.Interface {
 			Retry:  3,
 			Delay:  5 * time.Second,
 		},
+		&task.LocalTask{
+			Name:   "UpgradeL4BflProxy",
+			Action: new(upgradeL4),
+			Retry:  3,
+			Delay:  5 * time.Second,
+		},
 	}
 	return append(pre, u.upgraderBase.UpgradeSystemComponents()...)
 }
@@ -140,6 +147,20 @@ func (d *deleteUserEnvsIfExists) Execute(runtime connector.Runtime) error {
 	return nil
 }
 
+type upgradeL4 struct {
+	common.KubeAction
+}
+
+func (u *upgradeL4) Execute(runtime connector.Runtime) error {
+	if _, err := runtime.GetRunner().SudoCmd(
+		"/usr/local/bin/kubectl set image deployment/l4-bfl-proxy proxy=beclab/l4-bfl-proxy:v0.3.5 -n os-network", false, true); err != nil {
+		return errors.Wrap(errors.WithStack(err), "failed to upgrade L4 network proxy")
+	}
+
+	logger.Infof("L4 upgrade to version v0.3.5 completed successfully")
+	return nil
+}
+
 func init() {
 	registerDailyUpgrader(upgrader_1_12_2_20251020{})
 }

cli/pkg/web5/jws/checkjws.go

@@ -39,7 +39,7 @@ func init() {
 			if err := os.MkdirAll(DIDCachePath, 0755); err != nil {
 				panic(fmt.Sprintf("failed to create directory: %v", err))
 			}
-		}else{
+		} else {
 			panic(fmt.Sprintf("failed to check directory: %v", err))
 		}
 	}
@@ -64,7 +64,7 @@ func init() {
 		if err != nil {
 			panic(fmt.Sprintf("failed to remove existing db: %v", err))
 		}
-		
+
 		// Try to create a new database
 		db, err = leveldb.OpenFile(dbPath, nil)
 		if err != nil {

daemon/cmd/terminusd/main.go

@@ -15,6 +15,7 @@ import (
 	"github.com/beclab/Olares/daemon/internel/mdns"
 	"github.com/beclab/Olares/daemon/internel/watcher"
 	"github.com/beclab/Olares/daemon/internel/watcher/cert"
+	intranetwatcher "github.com/beclab/Olares/daemon/internel/watcher/intranet"
 	"github.com/beclab/Olares/daemon/internel/watcher/system"
 	"github.com/beclab/Olares/daemon/internel/watcher/systemenv"
 	"github.com/beclab/Olares/daemon/internel/watcher/upgrade"
@@ -104,6 +105,7 @@ func main() {
 		upgrade.NewUpgradeWatcher(),
 		cert.NewCertWatcher(),
 		systemenv.NewSystemEnvWatcher(),
+		intranetwatcher.NewApplicationWatcher(),
 	}, func() {
 		if s != nil {
 			if err := s.Restart(); err != nil {
@@ -158,6 +160,7 @@ func main() {
 			panic(err)
 		}
 	}()
+
 	quit := make(chan os.Signal, 1)
 
 	signal.Notify(quit, syscall.SIGINT, syscall.SIGTERM)

daemon/go.mod

@@ -5,7 +5,7 @@ go 1.24.2
 toolchain go1.24.4
 
 replace (
-	bytetrade.io/web3os/app-service => github.com/beclab/app-service v0.2.33
+	bytetrade.io/web3os/app-service => github.com/beclab/app-service v0.4.23
 	bytetrade.io/web3os/backups-sdk => github.com/Above-Os/backups-sdk v0.1.17
 	bytetrade.io/web3os/bfl => github.com/beclab/bfl v0.3.36
 	k8s.io/api => k8s.io/api v0.34.0
@@ -20,7 +20,7 @@ require (
 	bytetrade.io/web3os/bfl v0.0.0-00010101000000-000000000000
 	github.com/Masterminds/semver/v3 v3.4.0
 	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2
-	github.com/beclab/Olares/cli v0.0.0-20251014053315-360e7e0f71c2
+	github.com/beclab/Olares/cli v0.0.0-20251016092744-6241cceceb89
 	github.com/containerd/containerd v1.7.28
 	github.com/distribution/distribution/v3 v3.0.0
 	github.com/dustin/go-humanize v1.0.1
@@ -32,6 +32,7 @@ require (
 	github.com/jochenvg/go-udev v0.0.0-20171110120927-d6b62d56d37b
 	github.com/joho/godotenv v1.5.1
 	github.com/klauspost/cpuid/v2 v2.2.8
+	github.com/labstack/echo/v4 v4.13.4
 	github.com/libp2p/go-netroute v0.2.2
 	github.com/mackerelio/go-osstat v0.2.5
 	github.com/muka/network_manager v0.0.0-20200903202308-ae5ede816e07
@@ -47,13 +48,13 @@ require (
 	github.com/txn2/txeh v1.5.5
 	go.opentelemetry.io/otel/trace v1.36.0
 	golang.org/x/crypto v0.41.0
-	golang.org/x/exp v0.0.0-20241108190413-2d47ceb2692f
+	golang.org/x/exp v0.0.0-20250819193227-8b4c13bb791b
 	golang.org/x/sys v0.35.0
-	k8s.io/api v0.34.0
-	k8s.io/apimachinery v0.34.0
+	k8s.io/api v0.34.1
+	k8s.io/apimachinery v0.34.1
 	k8s.io/client-go v12.0.0+incompatible
-	k8s.io/cri-api v0.31.0
-	k8s.io/cri-client v0.31.0
+	k8s.io/cri-api v0.34.1
+	k8s.io/cri-client v0.34.1
 	k8s.io/klog/v2 v2.130.1
 	k8s.io/mount-utils v0.31.0
 	k8s.io/utils v0.0.0-20250820121507-0af2bda4dd1d
@@ -86,6 +87,7 @@ require (
 	github.com/containerd/typeurl/v2 v2.2.3 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0 // indirect
+	github.com/dgrijalva/jwt-go v3.2.0+incompatible // indirect
 	github.com/distribution/reference v0.6.0 // indirect
 	github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c // indirect
 	github.com/ebitengine/purego v0.8.4 // indirect
@@ -115,6 +117,7 @@ require (
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/klauspost/compress v1.18.0 // indirect
+	github.com/labstack/gommon v0.4.2 // indirect
 	github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 // indirect
 	github.com/mailru/easyjson v0.9.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
@@ -155,12 +158,13 @@ require (
 	github.com/tklauser/numcpus v0.10.0 // indirect
 	github.com/valyala/bytebufferpool v1.0.0 // indirect
 	github.com/valyala/fasthttp v1.51.0 // indirect
+	github.com/valyala/fasttemplate v1.2.2 // indirect
 	github.com/valyala/tcplisten v1.0.0 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	github.com/yusufpapurcu/wmi v1.2.4 // indirect
 	go.opencensus.io v0.24.0 // indirect
 	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect
 	go.opentelemetry.io/otel v1.36.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.34.0 // indirect
@@ -170,17 +174,17 @@ require (
 	go.opentelemetry.io/proto/otlp v1.5.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.2 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/mod v0.26.0 // indirect
+	golang.org/x/mod v0.27.0 // indirect
 	golang.org/x/net v0.43.0 // indirect
 	golang.org/x/oauth2 v0.30.0 // indirect
 	golang.org/x/sync v0.16.0 // indirect
 	golang.org/x/term v0.34.0 // indirect
 	golang.org/x/text v0.28.0 // indirect
 	golang.org/x/time v0.12.0 // indirect
-	golang.org/x/tools v0.35.0 // indirect
+	golang.org/x/tools v0.36.0 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
 	google.golang.org/genproto v0.0.0-20250603155806-513f23925822 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20250528174236-200df99c418a // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20250603155806-513f23925822 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20250603155806-513f23925822 // indirect
 	google.golang.org/grpc v1.72.2 // indirect
 	google.golang.org/protobuf v1.36.8 // indirect
@@ -191,7 +195,7 @@ require (
 	howett.net/plist v1.0.0 // indirect
 	k8s.io/apiextensions-apiserver v0.34.0 // indirect
 	k8s.io/apiserver v0.34.0 // indirect
-	k8s.io/component-base v0.34.0 // indirect
+	k8s.io/component-base v0.34.1 // indirect
 	k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b // indirect
 	sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 // indirect
 	sigs.k8s.io/randfill v1.0.0 // indirect

daemon/go.sum

@@ -24,10 +24,10 @@ github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPd
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
 github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3dyBCFEj5IhUbnKptjxatkF07cF2ak3yi77so=
 github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
-github.com/beclab/Olares/cli v0.0.0-20251014053315-360e7e0f71c2 h1:o/6MtztC5kx1I+rRK/39QxlNCW9nliXR/GcoZ+d+Yb4=
-github.com/beclab/Olares/cli v0.0.0-20251014053315-360e7e0f71c2/go.mod h1:iEvZxM6PnFxFRppneTzV3hgr2tIxDnsI3dhp4pi7pFg=
-github.com/beclab/app-service v0.2.33 h1:fsv9sTL7guTdU8z8sO5KIxxd1N5K+Rp4zORRebs+wmI=
-github.com/beclab/app-service v0.2.33/go.mod h1:Gpp5e2XPU/nHufT7ZBsRMZrYxpFbI6R4AEiKine+RhI=
+github.com/beclab/Olares/cli v0.0.0-20251016092744-6241cceceb89 h1:5s9hXV8K3faToQtE9DbiM7O6jt5kIiEsLAaKn6F0UfA=
+github.com/beclab/Olares/cli v0.0.0-20251016092744-6241cceceb89/go.mod h1:iEvZxM6PnFxFRppneTzV3hgr2tIxDnsI3dhp4pi7pFg=
+github.com/beclab/app-service v0.4.23 h1:6kjpq7rie62FafQRBGXtM9MQD3CEMGmrOC7aGPbvLJY=
+github.com/beclab/app-service v0.4.23/go.mod h1:0vEg3rv/DbR7dYznvTlXNXyYNn+TXNMaxz03GQYRWUQ=
 github.com/beclab/bfl v0.3.36 h1:PgeSPGc+XoONiwFsKq9xX8rqcL4kVM1G/ut0lYYj/js=
 github.com/beclab/bfl v0.3.36/go.mod h1:A82u38MxYk1C3Lqnm4iUUK4hBeY9HHIs+xU4V93OnJk=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
@@ -73,6 +73,8 @@ github.com/decred/dcrd/crypto/blake256 v1.1.0 h1:zPMNGQCm0g4QTY27fOCorQW7EryeQ/U
 github.com/decred/dcrd/crypto/blake256 v1.1.0/go.mod h1:2OfgNZ5wDpcsFmHmCK5gZTPcCXqlm2ArzUIkw9czNJo=
 github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0 h1:NMZiJj8QnKe1LgsbDayM4UoHwbvwDRwnI3hwNaAHRnc=
 github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0/go.mod h1:ZXNYxsqcloTdSy/rNShjYzMhyjf0LaoftYK0p+A3h40=
+github.com/dgrijalva/jwt-go v3.2.0+incompatible h1:7qlOGliEKZXTDg6OTjfoBKDXWrumCAMpl/TFQ4/5kLM=
+github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
 github.com/distribution/distribution/v3 v3.0.0 h1:q4R8wemdRQDClzoNNStftB2ZAfqOiN6UX90KJc4HjyM=
 github.com/distribution/distribution/v3 v3.0.0/go.mod h1:tRNuFoZsUdyRVegq8xGNeds4KLjwLCRin/tTo6i1DhU=
 github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
@@ -165,8 +167,8 @@ github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
 github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/gopacket v1.1.19 h1:ves8RnFZPGiFnTS0uPQStjwru6uO6h+nlr9j6fL7kF8=
 github.com/google/gopacket v1.1.19/go.mod h1:iJ8V8n6KS+z2U1A8pUwu8bW5SyEMkXJB8Yo/Vo+TKTo=
-github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db h1:097atOisP2aRj7vFgYQBbFN4U4JNXUNYpxael3UzMyo=
-github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db/go.mod h1:vavhavw2zAxS5dIdcRluK6cSGGPlZynqzFM8NdvU144=
+github.com/google/pprof v0.0.0-20250403155104-27863c87afa6 h1:BHT72Gu3keYf3ZEu2J0b1vyeLSOYI8bm5wbJM/8yDe8=
+github.com/google/pprof v0.0.0-20250403155104-27863c87afa6/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA=
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
@@ -178,6 +180,7 @@ github.com/hexops/gotextdiff v1.0.3 h1:gitA9+qJrrTCsiCl7+kh75nPqQt1cx4ZkudSTLoUq
 github.com/hexops/gotextdiff v1.0.3/go.mod h1:pSWU5MAI3yDq+fZBTazCSJysOMbxWL1BSow5/V2vxeg=
 github.com/hirochachacha/go-smb2 v1.1.0 h1:b6hs9qKIql9eVXAiN0M2wSFY5xnhbHAQoCwRKbaRTZI=
 github.com/hirochachacha/go-smb2 v1.1.0/go.mod h1:8F1A4d5EZzrGu5R7PU163UcMRDJQl4FtcxjBfsY8TZE=
+github.com/hpcloud/tail v1.0.0 h1:nfCOvKYfkgYP8hkirhJocXT2+zOD8yUNjXaWfTlyFKI=
 github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
 github.com/jaypipes/ghw v0.13.0 h1:log8MXuB8hzTNnSktqpXMHc0c/2k/WgjOMSUtnI1RV4=
 github.com/jaypipes/ghw v0.13.0/go.mod h1:In8SsaDqlb1oTyrbmTC14uy+fbBMvp+xdqX51MidlD8=
@@ -207,6 +210,10 @@ github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
+github.com/labstack/echo/v4 v4.13.4 h1:oTZZW+T3s9gAu5L8vmzihV7/lkXGZuITzTQkTEhcXEA=
+github.com/labstack/echo/v4 v4.13.4/go.mod h1:g63b33BZ5vZzcIUF8AtRH40DrTlXnx4UMC8rBdndmjQ=
+github.com/labstack/gommon v0.4.2 h1:F8qTUNXgG1+6WQmqoUWnz8WiEU60mXVVw0P4ht1WRA0=
+github.com/labstack/gommon v0.4.2/go.mod h1:QlUFxVM+SNXhDL/Z7YhocGIBYOiwB0mXm1+1bAPHPyU=
 github.com/libp2p/go-netroute v0.2.2 h1:Dejd8cQ47Qx2kRABg6lPwknU7+nBnFRpko45/fFPuZ8=
 github.com/libp2p/go-netroute v0.2.2/go.mod h1:Rntq6jUAH0l9Gg17w5bFGhcC9a+vk4KNXs6s7IljKYE=
 github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 h1:6E+4a0GO5zZEnZ81pIr0yLvtUWk2if982qA3F3QD6H4=
@@ -259,14 +266,13 @@ github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f/go.mod h1:ZdcZmHo+
 github.com/nxadm/tail v1.4.11 h1:8feyoE3OzPrcshW5/MJ4sGESc5cqmGkGCWlco4l0bqY=
 github.com/nxadm/tail v1.4.11/go.mod h1:OTaG3NK980DZzxbRq6lEuzgU+mug70nY11sMd4JXXHc=
 github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
+github.com/onsi/ginkgo v1.7.0 h1:WSHQ+IS43OoUrWtD1/bbclrwK8TTH5hzp+umCiuxHgs=
 github.com/onsi/ginkgo v1.7.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
-github.com/onsi/ginkgo v1.16.5 h1:8xi0RTUf59SOSfEtZMvwTvXYMzG4gV23XVHOZiXNtnE=
-github.com/onsi/ginkgo v1.16.5/go.mod h1:+E8gABHa3K6zRBolWtd+ROzc/U5bkGt0FwiG042wbpU=
-github.com/onsi/ginkgo/v2 v2.21.0 h1:7rg/4f3rB88pb5obDgNZrNHrQ4e6WpjonchcpuBRnZM=
-github.com/onsi/ginkgo/v2 v2.21.0/go.mod h1:7Du3c42kxCUegi0IImZ1wUQzMBVecgIHjR1C+NkhLQo=
+github.com/onsi/ginkgo/v2 v2.25.2 h1:hepmgwx1D+llZleKQDMEvy8vIlCxMGt7W5ZxDjIEhsw=
+github.com/onsi/ginkgo/v2 v2.25.2/go.mod h1:43uiyQC4Ed2tkOzLsEYm7hnrb7UJTWHYNsuy3bG/snE=
 github.com/onsi/gomega v1.4.3/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
-github.com/onsi/gomega v1.35.1 h1:Cwbd75ZBPxFSuZ6T+rN/WCb/gOc6YgFBXLlZLhC7Ds4=
-github.com/onsi/gomega v1.35.1/go.mod h1:PvZbdDc8J6XJEpDK4HCuRBm8a6Fzp9/DmhC9C7yFlog=
+github.com/onsi/gomega v1.38.2 h1:eZCjf2xjZAqe+LeWvKb5weQ+NcPwX84kqJ0cZNxok2A=
+github.com/onsi/gomega v1.38.2/go.mod h1:W2MJcYxRGV63b418Ai34Ud0hEdTVXq9NW9+Sx6uXf3k=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
 github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
@@ -348,6 +354,8 @@ github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6Kllzaw
 github.com/valyala/bytebufferpool v1.0.0/go.mod h1:6bBcMArwyJ5K/AmCkWv1jt77kVWyCJ6HpOuEn7z0Csc=
 github.com/valyala/fasthttp v1.51.0 h1:8b30A5JlZ6C7AS81RsWjYMQmrZG6feChmgAolCl1SqA=
 github.com/valyala/fasthttp v1.51.0/go.mod h1:oI2XroL+lI7vdXyYoQk03bXBThfFl2cVdIA3Xl7cH8g=
+github.com/valyala/fasttemplate v1.2.2 h1:lxLXG0uE3Qnshl9QyaK6XJxMXlQZELvChBOCmQD0Loo=
+github.com/valyala/fasttemplate v1.2.2/go.mod h1:KHLXt3tVN2HBp8eijSv/kGJopbvo7S+qRAEEKiv+SiQ=
 github.com/valyala/tcplisten v1.0.0 h1:rBHj/Xf+E1tRGZyWIWwJDiRY0zc1Js+CV5DqwacVSA8=
 github.com/valyala/tcplisten v1.0.0/go.mod h1:T0xQ8SeCZGxckz9qRXTfG43PvQ/mcWh7FwZEA7Ioqkc=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
@@ -360,8 +368,8 @@ go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
 go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
 go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
 go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0 h1:x7wzEgXfnzJcHDwStJT+mxOz4etr2EcexjqhBvmoakw=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0/go.mod h1:rg+RlpR5dKwaS95IyyZqj5Wd4E13lk/msnTS0Xl9lJM=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 h1:q4XOmH/0opmeuJtPsbFNivyl7bCt7yRBbeEm2sC/XtQ=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0/go.mod h1:snMWehoOh2wsEwnvvwtDyFCxVeDAODenXHtn5vzrKjo=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 h1:F7Jx+6hwnZ41NSFTO5q4LYDtJRXBf2PD0rNBkeB/lus=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0/go.mod h1:UHB22Z8QsdRDrnAtX4PntOl36ajSxcdUMt1sF7Y6E7Q=
 go.opentelemetry.io/otel v1.36.0 h1:UumtzIklRBY6cI/lllNZlALOF5nNIzJVb16APdvgTXg=
@@ -380,6 +388,8 @@ go.opentelemetry.io/otel/trace v1.36.0 h1:ahxWNuqZjpdiFAyrIoQ4GIiAIhxAunQR6MUoKr
 go.opentelemetry.io/otel/trace v1.36.0/go.mod h1:gQ+OnDZzrybY4k4seLzPAWNwVBBVlF2szhehOBB/tGA=
 go.opentelemetry.io/proto/otlp v1.5.0 h1:xJvq7gMzB31/d406fB8U5CBdyQGw4P399D1aQWU/3i4=
 go.opentelemetry.io/proto/otlp v1.5.0/go.mod h1:keN8WnHxOy8PG0rQZjJJ5A2ebUoafqWp0eVQ4yIXvJ4=
+go.uber.org/automaxprocs v1.6.0 h1:O3y2/QNTOdbF+e/dpXNNW7Rx2hZ4sTIPyybbxyNqTUs=
+go.uber.org/automaxprocs v1.6.0/go.mod h1:ifeIMSnPZuznNm6jmdzmU3/bfk01Fe2fotchwEFJ8r8=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
@@ -397,8 +407,8 @@ golang.org/x/crypto v0.0.0-20200728195943-123391ffb6de/go.mod h1:LzIPMQfyMNhhGPh
 golang.org/x/crypto v0.41.0 h1:WKYxWedPGCTVVl5+WHSSrOBT0O8lx32+zxmHxijgXp4=
 golang.org/x/crypto v0.41.0/go.mod h1:pO5AFd7FA68rFak7rOAGVuygIISepHftHnr8dr6+sUc=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
-golang.org/x/exp v0.0.0-20241108190413-2d47ceb2692f h1:XdNn9LlyWAhLVp6P/i8QYBW+hlyhrhei9uErw2B5GJo=
-golang.org/x/exp v0.0.0-20241108190413-2d47ceb2692f/go.mod h1:D5SMRVC3C2/4+F/DB1wZsLRnSNimn2Sp/NPsCrsv8ak=
+golang.org/x/exp v0.0.0-20250819193227-8b4c13bb791b h1:DXr+pvt3nC887026GRP39Ej11UATqWDmWuS99x26cD0=
+golang.org/x/exp v0.0.0-20250819193227-8b4c13bb791b/go.mod h1:4QTo5u+SEIbbKW1RacMZq1YEfOBqeXa19JeshGi+zc4=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
 golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
@@ -406,8 +416,8 @@ golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPI
 golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.26.0 h1:EGMPT//Ezu+ylkCijjPc+f4Aih7sZvaAr+O3EHBxvZg=
-golang.org/x/mod v0.26.0/go.mod h1:/j6NAhSk8iQ723BGAUyoAcn7SlD7s15Dp9Nd/SfeaFQ=
+golang.org/x/mod v0.27.0 h1:kb+q2PyFnEADO2IEF935ehFUXlWiNjJWtRNgBLSfbxQ=
+golang.org/x/mod v0.27.0/go.mod h1:rWI627Fq0DEoudcK+MBkNkCe0EetEaDSwJJkCcjpazc=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -471,8 +481,8 @@ golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtn
 golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.35.0 h1:mBffYraMEf7aa0sB+NuKnuCy8qI/9Bughn8dC2Gu5r0=
-golang.org/x/tools v0.35.0/go.mod h1:NKdj5HkL/73byiZSJjqJgKn3ep7KjFkBOkR/Hps3VPw=
+golang.org/x/tools v0.36.0 h1:kWS0uv/zsvHEle1LbV5LE8QujrxB3wfQyxHfhOk0Qkg=
+golang.org/x/tools v0.36.0/go.mod h1:WBDiHKJK8YgLHlcQPYQzNCkUxUypCaa5ZegCVutKm+s=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -486,8 +496,8 @@ google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98
 google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
 google.golang.org/genproto v0.0.0-20250603155806-513f23925822 h1:rHWScKit0gvAPuOnu87KpaYtjK5zBMLcULh7gxkCXu4=
 google.golang.org/genproto v0.0.0-20250603155806-513f23925822/go.mod h1:HubltRL7rMh0LfnQPkMH4NPDFEWp0jw3vixw7jEM53s=
-google.golang.org/genproto/googleapis/api v0.0.0-20250528174236-200df99c418a h1:SGktgSolFCo75dnHJF2yMvnns6jCmHFJ0vE4Vn2JKvQ=
-google.golang.org/genproto/googleapis/api v0.0.0-20250528174236-200df99c418a/go.mod h1:a77HrdMjoeKbnd2jmgcWdaS++ZLZAEq3orIOAEIKiVw=
+google.golang.org/genproto/googleapis/api v0.0.0-20250603155806-513f23925822 h1:oWVWY3NzT7KJppx2UKhKmzPq4SRe0LdCijVRwvGeikY=
+google.golang.org/genproto/googleapis/api v0.0.0-20250603155806-513f23925822/go.mod h1:h3c4v36UTKzUiuaOKQ6gr3S+0hovBtUrXzTG/i3+XEc=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20250603155806-513f23925822 h1:fc6jSaCT0vBduLYZHYrBBNY4dsWuvgyff9noRNDdBeE=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20250603155806-513f23925822/go.mod h1:qQ0YXyHHx3XkvlzUtpXDkS29lDSafHMZBAZDc03LQ3A=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
@@ -513,6 +523,7 @@ gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntN
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/evanphx/json-patch.v4 v4.12.0 h1:n6jtcsulIzXPJaxegRbvFNNrZDjbij7ny3gmSPG+6V4=
 gopkg.in/evanphx/json-patch.v4 v4.12.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
+gopkg.in/fsnotify.v1 v1.4.7 h1:xOHLXZwVvI9hhs+cLKq5+I5onOuwQLhQwiu63xxlHs4=
 gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
 gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
@@ -537,12 +548,12 @@ k8s.io/apiserver v0.34.0 h1:Z51fw1iGMqN7uJ1kEaynf2Aec1Y774PqU+FVWCFV3Jg=
 k8s.io/apiserver v0.34.0/go.mod h1:52ti5YhxAvewmmpVRqlASvaqxt0gKJxvCeW7ZrwgazQ=
 k8s.io/client-go v0.34.0 h1:YoWv5r7bsBfb0Hs2jh8SOvFbKzzxyNo0nSb0zC19KZo=
 k8s.io/client-go v0.34.0/go.mod h1:ozgMnEKXkRjeMvBZdV1AijMHLTh3pbACPvK7zFR+QQY=
-k8s.io/component-base v0.34.0 h1:bS8Ua3zlJzapklsB1dZgjEJuJEeHjj8yTu1gxE2zQX8=
-k8s.io/component-base v0.34.0/go.mod h1:RSCqUdvIjjrEm81epPcjQ/DS+49fADvGSCkIP3IC6vg=
-k8s.io/cri-api v0.31.0 h1:6o0XrhWlc1/zseGCh+aMScdXCg5nT6KCGdyx7HQkSKo=
-k8s.io/cri-api v0.31.0/go.mod h1:Po3TMAYH/+KrZabi7QiwQI4a692oZcUOUThd/rqwxrI=
-k8s.io/cri-client v0.31.0 h1:lu+Fq1h9GYIJO0PiWX1tH5KEhbD4H52grWss4CVMlqc=
-k8s.io/cri-client v0.31.0/go.mod h1:rAZ0wx1Yqq4XwfL89Hvzl6rCbnkK0k/rm4DuW48O1+I=
+k8s.io/component-base v0.34.1 h1:v7xFgG+ONhytZNFpIz5/kecwD+sUhVE6HU7qQUiRM4A=
+k8s.io/component-base v0.34.1/go.mod h1:mknCpLlTSKHzAQJJnnHVKqjxR7gBeHRv0rPXA7gdtQ0=
+k8s.io/cri-api v0.34.1 h1:n2bU++FqqJq0CNjP/5pkOs0nIx7aNpb1Xa053TecQkM=
+k8s.io/cri-api v0.34.1/go.mod h1:4qVUjidMg7/Z9YGZpqIDygbkPWkg3mkS1PvOx/kpHTE=
+k8s.io/cri-client v0.34.1 h1:eq6FcEPDDL379w0WhPnItj2egsMZqOtU7nv1JaJmwP0=
+k8s.io/cri-client v0.34.1/go.mod h1:Dq6mKWV2ugO5tMv4xqVgcQ8vD7csP//e4KkzcFi2Pio=
 k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
 k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
 k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b h1:MloQ9/bdJyIu9lb1PzujOPolHyvO06MXG5TUIj2mNAA=

daemon/internel/intranet/dns.go

@@ -0,0 +1,143 @@
+package intranet
+
+import (
+	"errors"
+	"net"
+	"slices"
+
+	"github.com/beclab/Olares/daemon/pkg/nets"
+	"github.com/eball/zeroconf"
+	"k8s.io/klog/v2"
+)
+
+type DNSConfig struct {
+	Domain string
+}
+
+type instanceServer struct {
+	queryServer *zeroconf.Server
+	host        *DNSConfig
+}
+
+type mDNSServer struct {
+	servers map[string]*instanceServer
+}
+
+func NewMDNSServer() (*mDNSServer, error) {
+	s := &mDNSServer{
+		servers: make(map[string]*instanceServer),
+	}
+	return s, nil
+}
+
+func (s *mDNSServer) Close() {
+	if s.servers != nil {
+		for host, server := range s.servers {
+			if server == nil {
+				continue
+			}
+
+			// Shutdown the mDNS server
+			server.queryServer.Shutdown()
+			s.servers[host] = nil
+			klog.Info("Intranet mDNS server closed, ", host)
+		}
+	}
+}
+
+func (s *mDNSServer) StartAll() error {
+	iface, err := s.findIntranetInterface()
+	if err != nil {
+		klog.Error("find intranet interface error, ", err)
+		return err
+	}
+
+	for domain := range s.servers {
+		if s.servers[domain] != nil {
+			continue
+		}
+
+		klog.Infof("Registering mDNS service for domain: %s", domain)
+		// Register the mDNS service
+		var err error
+		server, err := zeroconf.Register("olares", "_http._tcp", "local.", domain, 80, []string{"txtv=0", "lo=1", "la=0", "path=/"}, []net.Interface{*iface})
+		if err != nil {
+			klog.Errorf("Failed to register mDNS service for domain %s: %v", domain, err)
+			return err
+		}
+
+		s.servers[domain] = &instanceServer{
+			queryServer: server,
+			host:        &DNSConfig{Domain: domain},
+		}
+	}
+	klog.Info("Intranet mDNS server started")
+	return nil
+}
+
+// SetHosts sets the hosts for the mDNS server
+// if reset is true, it will remove all existing hosts before adding new ones
+func (s *mDNSServer) SetHosts(hosts []DNSConfig, reset bool) {
+	for _, host := range hosts {
+		if host.Domain == "" {
+			continue
+		}
+
+		if server, exists := s.servers[host.Domain]; !exists {
+			s.servers[host.Domain] = nil
+		} else {
+
+			if reset {
+				server.queryServer.Shutdown()
+				s.servers[host.Domain] = nil
+			}
+		}
+	}
+
+	// remove not exist hosts
+	for domain := range s.servers {
+		if slices.ContainsFunc(hosts, func(a DNSConfig) bool {
+			return a.Domain == domain
+		}) {
+			continue
+		}
+
+		klog.Info("removing domain ", domain)
+		s.servers[domain].queryServer.Shutdown()
+		delete(s.servers, domain)
+	}
+}
+
+func (s *mDNSServer) findIntranetInterface() (*net.Interface, error) {
+	ips, err := nets.GetInternalIpv4Addr()
+	if err != nil {
+		return nil, err
+	}
+
+	if len(ips) == 0 {
+		return nil, errors.New("cannot get any ip on server")
+	}
+
+	hostIp, err := nets.GetHostIp()
+	if err != nil {
+		klog.Error("get host ip error, ", err)
+	}
+
+	// host ip in priority, next is the ethernet ip-
+	var (
+		iface *net.Interface
+	)
+
+	for _, i := range ips {
+		if i.IP == hostIp {
+			iface = i.Iface
+			break
+		}
+	}
+
+	if iface == nil {
+		iface = ips[0].Iface
+	}
+
+	return iface, nil
+}

daemon/internel/intranet/proxy.go

@@ -0,0 +1,109 @@
+package intranet
+
+import (
+	"context"
+	"crypto/tls"
+	"net"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+
+	"github.com/labstack/echo/v4"
+	"github.com/labstack/echo/v4/middleware"
+	"k8s.io/klog/v2"
+)
+
+var _ middleware.ProxyBalancer = (*proxyServer)(nil)
+
+type proxyServer struct {
+	proxy     *echo.Echo
+	dnsServer string
+}
+
+func NewProxyServer() (*proxyServer, error) {
+	p := &proxyServer{
+		proxy:     echo.New(),
+		dnsServer: "10.233.0.3:53", // default k8s dns service
+	}
+	return p, nil
+}
+
+func (p *proxyServer) Start() error {
+	klog.Info("Starting intranet proxy server...")
+	config := middleware.DefaultProxyConfig
+	config.Balancer = p
+	config.Transport = p.initTransport()
+
+	p.proxy.Use(middleware.Logger())
+	p.proxy.Use(middleware.Recover())
+	p.proxy.Use(
+		func(next echo.HandlerFunc) echo.HandlerFunc {
+			return func(c echo.Context) error {
+				if strings.HasSuffix(c.Request().Host, ".olares.local") {
+					return next(c)
+				}
+
+				// not a intranet request, redirect to https
+				redirect := middleware.HTTPSRedirect()
+				return redirect(next)(c)
+			}
+		},
+	)
+	p.proxy.Use(middleware.ProxyWithConfig(config))
+
+	return p.proxy.Start(":80")
+}
+
+func (p *proxyServer) Close() error {
+	if p.proxy != nil {
+		return p.proxy.Close()
+	}
+	return nil
+}
+
+// AddTarget implements middleware.ProxyBalancer.
+func (p *proxyServer) AddTarget(*middleware.ProxyTarget) bool {
+	return true
+}
+
+// Next implements middleware.ProxyBalancer.
+func (p *proxyServer) Next(c echo.Context) *middleware.ProxyTarget {
+	proxyPass, err := url.Parse("https://" + c.Request().Host)
+	if err != nil {
+		klog.Error("parse proxy target error, ", err)
+		return nil
+	}
+	return &middleware.ProxyTarget{URL: proxyPass}
+}
+
+// RemoveTarget implements middleware.ProxyBalancer.
+func (p *proxyServer) RemoveTarget(string) bool {
+	return true
+}
+
+func (p *proxyServer) initTransport() http.RoundTripper {
+	transport := &http.Transport{
+		Proxy: http.ProxyFromEnvironment,
+		DialContext: p.customDialContext(&net.Dialer{
+			Timeout:   30 * time.Second,
+			KeepAlive: 1800 * time.Second,
+			DualStack: true,
+		}),
+		MaxIdleConns:          100,
+		IdleConnTimeout:       10 * time.Second,
+		ExpectContinueTimeout: 1 * time.Second,
+		TLSClientConfig:       &tls.Config{InsecureSkipVerify: true},
+	}
+
+	return transport
+}
+
+func (p *proxyServer) customDialContext(d *net.Dialer) func(ctx context.Context, network, addr string) (net.Conn, error) {
+	return func(ctx context.Context, network, addr string) (net.Conn, error) {
+		_, port, _ := net.SplitHostPort(addr)
+		// Force proxying to localhost
+		addr = net.JoinHostPort("127.0.0.1", port)
+		return d.DialContext(ctx, network, addr)
+	}
+}

daemon/internel/intranet/server.go

@@ -0,0 +1,92 @@
+package intranet
+
+import "k8s.io/klog/v2"
+
+type Server struct {
+	dnsServer   *mDNSServer
+	proxyServer *proxyServer
+	started     bool
+}
+
+type ServerOptions struct {
+	Hosts []DNSConfig
+}
+
+func (s *Server) Close() {
+	if !s.started {
+		return
+	}
+
+	if s.dnsServer != nil {
+		s.dnsServer.Close()
+	}
+
+	if s.proxyServer != nil {
+		s.proxyServer.Close()
+	}
+
+	s.started = false
+	klog.Info("Intranet server closed")
+}
+
+func NewServer() (*Server, error) {
+	dnsServer, err := NewMDNSServer()
+	if err != nil {
+		return nil, err
+	}
+
+	proxyServer, err := NewProxyServer()
+	if err != nil {
+		return nil, err
+	}
+
+	return &Server{
+		dnsServer:   dnsServer,
+		proxyServer: proxyServer,
+	}, nil
+}
+
+func (s *Server) IsStarted() bool {
+	return s.started
+}
+
+func (s *Server) Start(o *ServerOptions) error {
+	if s.started {
+		return nil
+	}
+
+	if s.dnsServer != nil {
+		s.dnsServer.SetHosts(o.Hosts, true)
+		err := s.dnsServer.StartAll()
+		if err != nil {
+			klog.Error("start intranet dns server error, ", err)
+			return err
+		}
+	}
+
+	if s.proxyServer != nil {
+		err := s.proxyServer.Start()
+		if err != nil {
+			klog.Error("start intranet proxy server error, ", err)
+			return err
+		}
+	}
+
+	s.started = true
+	klog.Info("Intranet server started")
+	return nil
+}
+
+func (s *Server) Reload(o *ServerOptions) error {
+	if s.dnsServer != nil {
+		s.dnsServer.SetHosts(o.Hosts, false)
+		err := s.dnsServer.StartAll()
+		if err != nil {
+			klog.Error("reload intranet dns server error, ", err)
+			return err
+		}
+	}
+
+	klog.Info("Intranet server reloaded")
+	return nil
+}

daemon/internel/watcher/intranet/watchers.go

@@ -0,0 +1,146 @@
+package intranet
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	"github.com/beclab/Olares/daemon/internel/intranet"
+	"github.com/beclab/Olares/daemon/internel/watcher"
+	"github.com/beclab/Olares/daemon/pkg/cluster/state"
+	"github.com/beclab/Olares/daemon/pkg/utils"
+	"k8s.io/klog/v2"
+)
+
+var _ watcher.Watcher = &applicationWatcher{}
+
+type applicationWatcher struct {
+	intranetServer *intranet.Server
+}
+
+func NewApplicationWatcher() *applicationWatcher {
+	return &applicationWatcher{}
+}
+
+func (w *applicationWatcher) Watch(ctx context.Context) {
+	switch state.CurrentState.TerminusState {
+	case state.NotInstalled, state.Uninitialized, state.InitializeFailed:
+		// Stop the intranet server if it's running
+		if w.intranetServer != nil {
+			w.intranetServer.Close()
+			w.intranetServer = nil
+			klog.Info("Intranet server stopped due to cluster state: ", state.CurrentState.TerminusState)
+		}
+	default:
+		if w.intranetServer == nil {
+			var err error
+			w.intranetServer, err = intranet.NewServer()
+			if err != nil {
+				klog.Error("failed to create intranet server: ", err)
+				return
+			}
+
+		}
+
+		o, err := w.loadServerConfig(ctx)
+		if err != nil {
+			klog.Error("load intranet server config error, ", err)
+			return
+		}
+
+		if w.intranetServer.IsStarted() {
+			// Reload the intranet server config
+			err = w.intranetServer.Reload(o)
+			if err != nil {
+				klog.Error("reload intranet server config error, ", err)
+				return
+			}
+			klog.Info("Intranet server config reloaded")
+		} else {
+			// Start the intranet server
+			err = w.intranetServer.Start(o)
+			if err != nil {
+				klog.Error("start intranet server error, ", err)
+				return
+			}
+			klog.Info("Intranet server started")
+		}
+	}
+}
+
+func (w *applicationWatcher) loadServerConfig(ctx context.Context) (*intranet.ServerOptions, error) {
+	if w.intranetServer == nil {
+		klog.Warning("intranet server is nil")
+		return nil, nil
+	}
+
+	urls, err := utils.GetApplicationUrlAll(ctx)
+	if err != nil {
+		klog.Error("get application urls error, ", err)
+		return nil, err
+	}
+
+	var hosts []intranet.DNSConfig
+	for _, url := range urls {
+		urlToken := strings.Split(url, ".")
+		if len(urlToken) > 2 {
+			domain := strings.Join([]string{urlToken[0], urlToken[1], "olares"}, ".")
+
+			hosts = append(hosts, intranet.DNSConfig{
+				Domain: domain,
+			})
+		}
+	}
+
+	dynamicClient, err := utils.GetDynamicClient()
+	if err != nil {
+		err = fmt.Errorf("failed to get dynamic client: %v", err)
+		klog.Error(err.Error())
+		return nil, err
+	}
+
+	users, err := utils.ListUsers(ctx, dynamicClient)
+	if err != nil {
+		err = fmt.Errorf("failed to list users: %v", err)
+		klog.Error(err.Error())
+		return nil, err
+	}
+
+	adminUser, err := utils.GetAdminUser(ctx, dynamicClient)
+	if err != nil {
+		err = fmt.Errorf("failed to get admin user: %v", err)
+		klog.Error(err.Error())
+		return nil, err
+	}
+
+	for _, user := range users {
+		domain := fmt.Sprintf("%s.olares", user.GetName())
+		hosts = append(hosts, intranet.DNSConfig{
+			Domain: domain,
+		})
+
+		domain = fmt.Sprintf("desktop.%s.olares", user.GetName())
+		hosts = append(hosts, intranet.DNSConfig{
+			Domain: domain,
+		})
+
+		domain = fmt.Sprintf("auth.%s.olares", user.GetName())
+		hosts = append(hosts, intranet.DNSConfig{
+			Domain: domain,
+		})
+
+		if user.GetAnnotations()["bytetrade.io/is-ephemeral"] == "true" {
+			domain = fmt.Sprintf("wizard-%s.%s.olares", user.GetName(), adminUser.GetName())
+			hosts = append(hosts, intranet.DNSConfig{
+				Domain: domain,
+			})
+		}
+	}
+
+	options := &intranet.ServerOptions{
+		Hosts: hosts,
+	}
+
+	// reload intranet server config
+	return options, nil
+}

daemon/pkg/cluster/state/current.go

@@ -476,6 +476,11 @@ func WatchStatus(ctx context.Context, watchers []watcher.Watcher, postWatch func
 			}
 
 			for _, w := range watchers {
+				if w == nil {
+					klog.Warning("watcher is nil")
+					continue
+				}
+
 				w.Watch(ctx)
 			}
 

daemon/pkg/containerd/api.go

@@ -2,11 +2,12 @@ package containerd
 
 import (
 	"fmt"
+	"strings"
+
 	"github.com/containerd/containerd/reference"
 	"github.com/gofiber/fiber/v2"
 	criruntimev1 "k8s.io/cri-api/pkg/apis/runtime/v1"
 	"k8s.io/klog/v2"
-	"strings"
 )
 
 var (
@@ -154,7 +155,7 @@ func ListRegistries(ctx *fiber.Ctx) ([]*Registry, error) {
 				nameToRegistries[host] = &Registry{Name: host}
 			}
 			nameToRegistries[host].ImageCount += 1
-			nameToRegistries[host].ImageSize += image.Size_
+			nameToRegistries[host].ImageSize += image.Size
 		}
 	}
 	var registries []*Registry
@@ -245,7 +246,7 @@ func PruneImages(ctx *fiber.Ctx) (*PruneImageResult, error) {
 		}
 		res.Images = append(res.Images, image)
 		res.Count += 1
-		res.Size += image.Size_
+		res.Size += image.Size
 	}
 	return res, nil
 }

daemon/pkg/utils/k8s.go

@@ -25,6 +25,7 @@ import (
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	sysv1 "bytetrade.io/web3os/app-service/api/sys.bytetrade.io/v1alpha1"
+	"bytetrade.io/web3os/app-service/pkg/generated/clientset/versioned"
 )
 
 const (
@@ -63,6 +64,22 @@ func GetDynamicClient() (dynamic.Interface, error) {
 	return client, nil
 }
 
+func GetAppClientSet() (versioned.Clientset, error) {
+	config, err := ctrl.GetConfig()
+	if err != nil {
+		klog.Error("get k8s config error, ", err)
+		return versioned.Clientset{}, err
+	}
+
+	client, err := versioned.NewForConfig(config)
+	if err != nil {
+		klog.Error("get app clientset error, ", err)
+		return versioned.Clientset{}, err
+	}
+
+	return *client, nil
+}
+
 func IsTerminusInitialized(ctx context.Context, client dynamic.Interface) (initialized bool, failed bool, err error) {
 	users, err := client.Resource(UserGVR).List(ctx, metav1.ListOptions{})
 	if err != nil {
@@ -535,3 +552,33 @@ func GetNodesPressure(ctx context.Context, client kubernetes.Interface) (map[str
 
 	return status, nil
 }
+
+func GetApplicationUrlAll(ctx context.Context) ([]string, error) {
+	var urls []string
+
+	clientset, err := GetAppClientSet()
+	if err != nil {
+		klog.Error("get app clientset error, ", err)
+		return nil, err
+	}
+
+	apps, err := clientset.AppV1alpha1().Applications().List(ctx, metav1.ListOptions{})
+	if err != nil {
+		klog.Error("list applications error, ", err)
+		return nil, err
+	}
+
+	for _, app := range apps.Items {
+		entrances, err := app.GenEntranceURL(ctx)
+		if err != nil {
+			klog.Error("generate application entrance url error, ", err, ", ", app.Name)
+			continue
+		}
+
+		for _, entrance := range entrances {
+			urls = append(urls, entrance.URL)
+		}
+	}
+
+	return urls, nil
+}

framework/authelia/.olares/config/cluster/deploy/auth_backend_deploy.yaml

@@ -429,7 +429,7 @@ spec:
           privileged: true
       containers:      
       - name: authelia
-        image: beclab/auth:0.2.35
+        image: beclab/auth:0.2.36
         imagePullPolicy: IfNotPresent
         ports:
         - containerPort: 9091

framework/bfl/.olares/config/launcher/templates/bfl_deploy.yaml

@@ -304,7 +304,7 @@ spec:
         - name: BACKUP_SERVER
           value: backup-server.os-framework:8082
         - name: L4_PROXY_IMAGE_VERSION
-          value: v0.3.4
+          value: v0.3.5
         - name: L4_PROXY_SERVICE_ACCOUNT
           value: os-network-internal
         - name: L4_PROXY_NAMESPACE
@@ -317,7 +317,7 @@ spec:
               apiVersion: v1
               fieldPath: spec.nodeName
       - name: ingress
-        image: beclab/bfl-ingress:v0.3.22
+        image: beclab/bfl-ingress:v0.3.23
         imagePullPolicy: IfNotPresent
         env:
         - name: AUTHELIA_AUTH_URL