站点接入、缓存与回源、安全防护、证书管理、日志分析、节点运维，这些都在同一个主控里管理，不用自己拼几套开源组件。能力按领域分组，日常运维和日志分析也在其中。 Site onboarding, caching and origin pull, security, certificate management, log analytics and node operations are all managed from the same control plane, so you do not have to assemble several open-source components yourself. The capabilities are grouped by domain, with day-to-day operations and log analytics among them.
每张卡片先说这个领域能做什么，底部的标签列出对应的具体功能项。Each card says what its domain covers, and the tags underneath list the concrete features in it.
域名接入、监听组、源站池负载均衡、主动健康检查和自动故障切换都在这一层。缓存有策略配置和刷新下发，分内存、磁盘两级。This covers domain onboarding, listener groups, origin-pool load balancing, active health checks and automatic failover. The cache has rules and purge push, and it runs in two tiers, memory and disk.
WAF 规则、IP 黑白名单和访问限速都可以配。CC 防护能在多个节点之间协同封禁，另外还有多种 JS Challenge、地域访问控制和慢速攻击防护。WAF rules, IP allow and deny lists, and rate limiting. CC defense coordinates bans across nodes. Several JS Challenge types, geo access control and slow-attack protection are available as well.
证书可以手动上传，也可以走 ACME 自动签发和续期（Let's Encrypt、ZeroSSL）。证书策略分兼容优先和性能优先两种，另外支持 CNAME Target，以及阿里云、Cloudflare、DNSPod 等 DNS 服务商的授权接入。Upload certificates manually, or let ACME issue and renew them automatically (Let's Encrypt, ZeroSSL). There are two certificate strategies, compatibility first and performance first, plus CNAME target support and DNS credentials for Aliyun, Cloudflare and DNSPod.
日志覆盖访问、流量、缓存、错误、回源和高可用。做日志分析时可以选择接入外置 ClickHouse，另有探测概览、CNAME / IP 可用性监控和实例审计。Logs cover access, traffic, cache, errors, origin pull and high availability. Log analytics can optionally connect to an external ClickHouse. There is also a probe overview, CNAME / IP availability monitoring and instance audit.
边缘节点和回源中继在同一处管理。cdn-agent 支持签名在线升级，配置实时下发，节点侧用本地缓存做容错。健康心跳、备份恢复和任务队列也都有。Edge nodes and origin relays are managed in one place. cdn-agent supports signed online upgrades, config is pushed live, and nodes fall back to their locally cached copy. Heartbeats, backup and restore, and a task queue are included too.
REST API 配 API Token，接口按 OpenAPI 3.0 规范描述。边缘规则、脚本模板和 Edge KV 都支持，系统命名空间和用户命名空间相互隔离。写操作都会记进审计日志。A REST API with API tokens, described by an OpenAPI 3.0 spec. Edge rules, script templates and Edge KV are supported, with the system and user namespaces kept separate. Every write goes into the audit log.
升级、配置下发、审计和备份都留痕：改了什么、谁改的、怎么退回去，都查得到。Upgrades, config push, audit and backup all leave a trail: what changed, who changed it, and how to roll it back.
cdn-agent 下载升级包后，会校验 SHA-256 摘要与 Ed25519 签名，随后执行原子替换并重启，避免加载被篡改的二进制文件。After downloading an upgrade package, cdn-agent checks its SHA-256 digest and Ed25519 signature, then replaces the binary atomically and restarts, which avoids loading a tampered binary.
配置通过 gRPC Watch 增量实时下发；节点将最新配置持久化到本地。即使暂时与主控断连，也可继续使用最近一次有效配置提供服务。Config is pushed incrementally over gRPC Watch; nodes persist the latest config locally, so even when briefly disconnected from the control plane they keep serving from the last valid config.
写操作都会自动记进审计日志。配合 admin、operator、viewer 三级角色权限，谁在什么时候改了什么都查得到。Every write operation goes into the audit log. Together with the admin, operator and viewer roles, that makes it possible to trace who changed what and when.
备份可以创建，也可以下载。恢复前会先做检查，并保留回滚点，配置改错了能退回去。Backups can be created and downloaded. A restore runs its pre-restore checks first and keeps a rollback point, so a bad configuration change can be undone.
节点用安装脚本加注册令牌接入，状态靠双向 gRPC 心跳同步，不用往节点上分发 SSH 凭据或密码。Nodes are onboarded with an install script and an enrollment token, and state syncs over a bidirectional gRPC heartbeat. No SSH credentials or passwords are distributed to the nodes.
日志分析依赖外置 ClickHouse，这个组件是可选部署。没接入时，相关页面是空状态，内容分发主链路不受影响。Log analytics relies on an external ClickHouse, which is an optional deployment. Without it the related pages show an empty state, and the main content-delivery path is unaffected.
按节点数和授权站点数（以根域名 Zone 计）透明计费。选哪一档看实际部署规模，选哪个版本看您需要哪些高级功能与服务。Transparent pricing, based on licensed node count and licensed sites counted per root-domain Zone. The tier follows your deployment size; the edition follows which advanced capabilities and services you need.
