commit 7788ce489ed7587f00c217e059753f778a90104d
Author: zhang-pu <4738@163.com>
Date:   Mon Jun 1 10:15:58 2026 +0800

    tpanel

diff --git a/SPEC.md b/SPEC.md
new file mode 100644
index 0000000..934254c
--- /dev/null
+++ b/SPEC.md
@@ -0,0 +1,326 @@
+# T面板 - 规格说明书
+
+## 1. 项目概述
+
+- **名称**：T面板（tpanel）
+- **官方网址**：https://tpanel.cn
+- **定位**：轻量级 Linux 网站管理面板，聚焦建站核心功能
+- **目标用户**：个人站长、中小型网站管理者
+
+## 2. 核心功能
+
+### 2.1 网站管理
+- 创建站点（绑定域名、选择PHP版本、设置目录）
+- 删除站点（含数据确认）
+- 站点列表（域名、状态、创建时间、备份状态）
+- 站点起停（nginx reload/restart）
+- 流量统计（nginx access log 解析）
+
+### 2.2 SSL 证书
+- Let's Encrypt 免费证书申请（HTTP验证）
+- 证书自动续期（systemd timer 触发 certbot）
+- 一键部署到站点
+- 证书状态监控（剩余天数）
+
+### 2.3 数据库管理
+- 创建 MySQL 数据库 + 用户
+- 删除数据库
+- phpMyAdmin 一键安装（可选）
+- 数据库列表（名称、大小、字符集）
+
+### 2.4 备份系统
+- 本地备份（tar + mysql dump）
+- 远程备份（rsync 到另一台服务器）
+- 定时备份（cron 表达式）
+- 下载备份文件
+- 恢复备份
+
+### 2.5 安全功能
+- 系统更新（apt-get security update）
+- 站点数据隔离（Linux 用户分离）
+- SSH 密钥管理（可选）
+- 防火墙规则（UFW）
+- 异常登录告警
+- 自动漏洞修复（cron 定期执行）
+
+### 2.6 文件管理
+- 在线文件浏览
+- 上传文件（压缩包自动解压）
+- 编辑配置文件（高亮）
+- 权限管理
+
+## 3. 技术架构
+
+### 3.1 目录结构
+```
+/opt/tpanel/
+├── backend/
+│   ├── main.py              # Flask 入口
+│   ├── system.py            # 系统操作（nginx/mysql/backup）
+│   ├── site.py              # 站点管理
+│   ├── database.py          # 数据库管理
+│   ├── ssl.py               # SSL 管理
+│   ├── firewall.py          # 防火墙
+│   ├── security.py          # 安全更新
+│   ├── config.py            # 配置读写
+│   └── utils.py             # 工具函数
+├── frontend/
+│   ├── index.html           # 主面板
+│   ├── css/
+│   ├── js/
+│   └── assets/
+├── data/                    # SQLite 数据库
+├── sites/                   # 站点目录 /www/tpanel/sites/
+├── backups/                 # 备份目录
+├── logs/                    # 日志
+├── ssl/                     # SSL 证书目录
+└── config/                  # Nginx 配置 /etc/nginx/tpanel/
+
+/etc/systemd/system/tpanel.service
+/etc/nginx/tpanel-api.conf   # Nginx 反向代理
+```
+
+### 3.2 数据库表
+
+```sql
+-- 管理员账号
+CREATE TABLE admin (
+    id INTEGER PRIMARY KEY,
+    username TEXT NOT NULL UNIQUE,
+    password_hash TEXT NOT NULL,  -- bcrypt
+    created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+    last_login DATETIME
+);
+
+-- 站点
+CREATE TABLE sites (
+    id INTEGER PRIMARY KEY,
+    name TEXT NOT NULL,
+    domain TEXT NOT NULL UNIQUE,
+    site_user TEXT NOT NULL UNIQUE,   -- Linux 用户名
+    site_path TEXT NOT NULL,
+    php_version TEXT DEFAULT '8.1',
+    status TEXT DEFAULT 'running',     -- running/stopped
+    ssl_enabled INTEGER DEFAULT 0,
+    ssl_cert_path TEXT,
+    ssl_key_path TEXT,
+    created_at DATETIME DEFAULT CURRENT_TIMESTAMP
+);
+
+-- 数据库
+CREATE TABLE databases (
+    id INTEGER PRIMARY KEY,
+    site_id INTEGER REFERENCES sites(id),
+    name TEXT NOT NULL UNIQUE,
+    db_user TEXT NOT NULL UNIQUE,
+    db_pass TEXT NOT NULL,
+    charset TEXT DEFAULT 'utf8mb4',
+    created_at DATETIME DEFAULT CURRENT_TIMESTAMP
+);
+
+-- 备份记录
+CREATE TABLE backups (
+    id INTEGER PRIMARY KEY,
+    site_id INTEGER REFERENCES sites(id),
+    type TEXT DEFAULT 'local',       -- local/remote
+    file_path TEXT,
+    size INTEGER,
+    status TEXT DEFAULT 'success',   -- success/failed
+    created_at DATETIME DEFAULT CURRENT_TIMESTAMP
+);
+
+-- SSL 证书
+CREATE TABLE ssl_certs (
+    id INTEGER PRIMARY KEY,
+    site_id INTEGER REFERENCES sites(id),
+    domain TEXT NOT NULL,
+    cert_path TEXT NOT NULL,
+    key_path TEXT NOT NULL,
+    expire_date DATETIME,
+    auto_renew INTEGER DEFAULT 1,
+    created_at DATETIME DEFAULT CURRENT_TIMESTAMP
+);
+
+-- 定时任务
+CREATE TABLE cron_jobs (
+    id INTEGER PRIMARY KEY,
+    site_id INTEGER REFERENCES sites(id),
+    name TEXT NOT NULL,
+    schedule TEXT NOT NULL,          -- cron 表达式
+    command TEXT NOT NULL,
+    enabled INTEGER DEFAULT 1,
+    last_run DATETIME,
+    created_at DATETIME DEFAULT CURRENT_TIMESTAMP
+);
+
+-- 安全日志
+CREATE TABLE security_logs (
+    id INTEGER PRIMARY KEY,
+    event_type TEXT NOT NULL,
+    details TEXT,
+    ip TEXT,
+    created_at DATETIME DEFAULT CURRENT_TIMESTAMP
+);
+
+-- 设置
+CREATE TABLE settings (
+    key TEXT PRIMARY KEY,
+    value TEXT
+);
+```
+
+### 3.3 安全机制
+
+1. **站点隔离**：每个站点一个 Linux 用户，Home 目录即网站根目录，禁 shell
+2. **最小权限原则**：MySQL 用户权限精确到站点数据库
+3. **CSRF 防护**：所有 POST 请求带 token 验证
+4. **命令白名单**：仅允许预设的 shell 命令，无 shell 注入
+5. **HTTPS**：面板强制 HTTPS，API 只能用 Token 认证
+6. **文件上传限制**：仅允许 .zip/.tar.gz 上传，自动解压到站点目录
+7. **日志审计**：所有操作写 security_logs
+8. **自动修复**：每日 3:00 执行 apt-get update && apt-get upgrade -y
+
+### 3.4 防火墙规则（UFW）
+
+- 默认只开放 22（SSH）、80（HTTP）、443（HTTPS）
+- 管理面板端口（例如 8848）仅限 localhost 访问
+- Nginx 反向代理到面板后端
+
+## 4. 面板设计
+
+### 4.1 界面风格
+
+- 风格：深色主题 + 绿色点缀（科技感、安全感）
+- 字体：JetBrains Mono（代码）+ Inter（界面）
+- 配色：主色 #22c55e（绿色），背景 #0f172a（深蓝黑），卡片 #1e293b
+
+### 4.2 布局
+
+```
+┌─────────────────────────────────────────────────┐
+│  [Logo] T面板          [站点数] [状态] [安全更新] │
+├─────────────────────────────────────────────────┤
+│                                                 │
+│  [仪表盘] [网站] [数据库] [SSL] [备份] [安全]    │
+│                                                 │
+│  ┌─────────────────────────────────────────┐   │
+│  │              内容区域                     │   │
+│  └─────────────────────────────────────────┘   │
+└─────────────────────────────────────────────────┘
+```
+
+## 5. API 设计
+
+### 5.1 认证
+
+```
+POST /api/auth/login    { username, password }
+POST /api/auth/logout
+GET  /api/auth/check    (Header: Authorization: Bearer <token>)
+```
+
+### 5.2 站点
+
+```
+GET    /api/sites              列表
+POST   /api/sites              创建 { domain, php_version, path }
+GET    /api/sites/:id          详情
+PUT    /api/sites/:id          更新 { status, ssl }
+DELETE /api/sites/:id          删除
+POST   /api/sites/:id/start     启动
+POST   /api/sites/:id/stop      停止
+POST   /api/sites/:id/backup    触发备份
+```
+
+### 5.3 数据库
+
+```
+GET    /api/databases
+POST   /api/databases          创建 { site_id, name, user, pass }
+DELETE /api/databases/:id
+```
+
+### 5.4 SSL
+
+```
+POST /api/ssl/apply             { site_id, domain }
+GET  /api/ssl/certs             列表
+POST /api/ssl/renew/:id         续期
+```
+
+### 5.5 备份
+
+```
+GET  /api/backups               列表
+POST /api/backups               创建 { site_id, type }
+GET  /api/backups/:id/download
+POST /api/backups/:id/restore
+DELETE /api/backups/:id
+```
+
+### 5.6 安全
+
+```
+GET  /api/security/logs          安全日志
+POST /api/security/update       执行系统更新
+GET  /api/security/status       安全状态（已安装更新数、漏洞数）
+```
+
+## 6. 安装流程
+
+### 6.1 一键安装脚本
+
+```bash
+wget -O install.sh https://tpanel.cn/install.sh
+bash install.sh
+```
+
+安装脚本做的事情：
+1. 检测系统（Debian 10+ / Ubuntu 20.04+）
+2. 安装 Nginx、MySQL、Python3、certbot
+3. 创建 tpanel 用户和目录
+4. 初始化 SQLite 数据库
+5. 配置 systemd 服务
+6. 配置 Nginx 反向代理
+7. 申请 Let's Encrypt 面板证书
+8. 启动服务
+
+### 6.2 默认端口
+
+- 面板访问：https://localhost:8848 （仅本地访问）
+- 通过 Nginx 反代到域名，例如 https://tpanel.cn
+
+## 7. 版本规划
+
+### v1.0.0（首发）
+- 站点 CRUD
+- MySQL 数据库 CRUD
+- Let's Encrypt SSL
+- 本地备份
+- 系统安全更新
+
+### v1.1.0
+- 远程备份（rsync）
+- 定时任务
+- 文件管理
+
+### v1.2.0
+- Cron 表达式验证
+- 远程 rsync 备份 + 恢复
+- 连接测试工具
+- 备份统计面板
+
+### v1.3.0（待开发）
+- 多 PHP 版本切换
+- Node.js 支持
+- 日志查看器（nginx access/error log）
+
+## 8. 开源协议
+
+MIT License
+
+## 9. 作者
+
+- 作者：Zhang Pu
+- 网站：https://zhangpu.dev
+- 面板官网：https://tpanel.cn
\ No newline at end of file
diff --git a/backend/config.py b/backend/config.py
new file mode 100644
index 0000000..57751f8
--- /dev/null
+++ b/backend/config.py
@@ -0,0 +1,87 @@
+"""
+TPanel - T面板 配置模块
+"""
+import os
+import json
+
+BASE_DIR = '/opt/tpanel'
+DATA_DIR = os.path.join(BASE_DIR, 'data')
+LOG_DIR = os.path.join(BASE_DIR, 'logs')
+SITES_DIR = os.path.join(BASE_DIR, 'sites')
+BACKUP_DIR = os.path.join(BASE_DIR, 'backups')
+SSL_DIR = os.path.join(BASE_DIR, 'ssl')
+CONFIG_DIR = os.path.join(BASE_DIR, 'config')
+NGINX_CONF_DIR = '/etc/nginx/tpanel'
+
+DB_PATH = os.path.join(DATA_DIR, 'tpanel.db')
+
+# Nginx 配置目录（由 install.sh 创建）
+os.makedirs(NGINX_CONF_DIR, exist_ok=True)
+os.makedirs(LOG_DIR, exist_ok=True)
+os.makedirs(SITES_DIR, exist_ok=True)
+os.makedirs(BACKUP_DIR, exist_ok=True)
+os.makedirs(SSL_DIR, exist_ok=True)
+os.makedirs(CONFIG_DIR, exist_ok=True)
+
+def load_config():
+    path = os.path.join(CONFIG_DIR, 'tpanel.conf')
+    if os.path.exists(path):
+        with open(path, 'r') as f:
+            return json.load(f)
+    return {
+        'panel_port': 8848,
+        'panel_domain': '',
+        'php_versions': ['7.4', '8.0', '8.1', '8.2'],
+        'default_php': '8.1',
+        'auto_ssl_renew': True,
+        'backup_retention_days': 7,
+        'security_auto_update': True,
+        'firewall_enabled': True,
+        'ssh_port': 22,
+    }
+
+def save_config(cfg):
+    path = os.path.join(CONFIG_DIR, 'tpanel.conf')
+    with open(path, 'w') as f:
+        json.dump(cfg, f, indent=2)
+
+def get_setting(key, default=''):
+    """从数据库读取设置"""
+    import sqlite3
+    conn = sqlite3.connect(DB_PATH)
+    cur = conn.execute("SELECT value FROM settings WHERE key = ?", (key,))
+    row = cur.fetchone()
+    conn.close()
+    return row[0] if row else default
+
+def set_setting(key, value):
+    import sqlite3
+    conn = sqlite3.connect(DB_PATH)
+    conn.execute("INSERT INTO settings (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = ?",
+                 (key, value, value))
+    conn.commit()
+    conn.close()
+
+def get_panel_domain():
+    """获取面板绑定的域名，无绑定则返回空字符串"""
+    return get_setting('panel_domain', '')
+
+def is_domain_allowed(host):
+    """检查请求的 Host 是否在允许的域名列表中"""
+    allowed = get_panel_domain().strip()
+    if not allowed:
+        return True  # 未绑定域名，不限制
+
+    allowed = allowed.lower().strip()
+    host = host.lower().strip()
+
+    # 支持带端口的 host（如 localhost:8848）
+    host_clean = host.split(':')[0]
+    allowed_clean = allowed.split(':')[0]
+
+    # 也允许 localhost 和 127.0.0.1
+    safe_hosts = ['localhost', '127.0.0.1', '::1']
+    if host_clean in safe_hosts:
+        return True
+
+    return host_clean == allowed_clean or host == allowed
\ No newline at end of file
diff --git a/backend/cron_manager.py b/backend/cron_manager.py
new file mode 100644
index 0000000..195e2aa
--- /dev/null
+++ b/backend/cron_manager.py
@@ -0,0 +1,258 @@
+"""
+TPanel - 定时任务管理模块
+"""
+import os
+import sqlite3
+import subprocess
+from datetime import datetime
+from config import DB_PATH
+
+def _run(cmd, timeout=30, shell=False):
+    try:
+        if isinstance(cmd, str) and not shell:
+            cmd = cmd.split()
+        result = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout, shell=shell)
+        return result.returncode, result.stdout.strip(), result.stderr.strip()
+    except subprocess.TimeoutExpired:
+        return -1, '', 'Command timed out'
+    except Exception as e:
+        return -1, '', str(e)
+
+def get_all_crons():
+    """获取所有定时任务"""
+    conn = sqlite3.connect(DB_PATH)
+    cur = conn.execute("""SELECT c.*, s.domain FROM cron_jobs c
+                          LEFT JOIN sites s ON c.site_id = s.id
+                          ORDER BY c.id DESC""")
+    cols = [d[0] for d in cur.description]
+    rows = [dict(zip(cols, r)) for r in cur.fetchall()]
+    conn.close()
+    return rows
+
+def create_cron(site_id, name, schedule, command):
+    """
+    创建定时任务
+    schedule: cron 表达式，如 "0 3 * * *" (每天3点)
+    command: 要执行的命令
+    """
+    # 验证 cron 表达式格式
+    parts = schedule.strip().split()
+    if len(parts) != 5:
+        return None, 'Cron 表达式格式错误，需要 5 段：分 时 日 月 周'
+
+    # 生成一个唯一文件名
+    import hashlib
+    token = hashlib.md5(f'{site_id}{name}{command}{datetime.now()}'.encode()).hexdigest()[:12]
+    script_name = f'cron_{token}.sh'
+
+    # 写入站点目录的 cron 脚本
+    conn = sqlite3.connect(DB_PATH)
+    cur = conn.execute("SELECT site_user FROM sites WHERE id = ?", (site_id,))
+    row = cur.fetchone()
+    conn.close()
+
+    if not row:
+        return None, '站点不存在'
+
+    site_user = row[0]
+    cron_dir = f'/opt/tpanel/sites/{site_user}/.cron'
+    os.makedirs(cron_dir, exist_ok=True)
+
+    script_path = os.path.join(cron_dir, script_name)
+    with open(script_path, 'w') as f:
+        f.write(f'#!/bin/bash\n{command}\n')
+    os.chmod(script_path, 0o755)
+
+    # 写入系统 crontab（用 sudo 切换到站点用户执行）
+    cron_line = f'{schedule} sudo -u {site_user} {script_path} >> /opt/tpanel/logs/cron_{token}.log 2>&1'
+
+    # 读取现有 crontab
+    code, out, err = _run(f'crontab -l 2>/dev/null || echo ""', shell=True)
+    existing = out if code == 0 else ''
+
+    # 检查是否已有同名任务
+    lines = [l for l in existing.split('\n') if script_name not in l and l.strip()]
+    lines.append(cron_line)
+
+    # 写回 crontab
+    new_cron = '\n'.join(lines) + '\n'
+    code, out, err = _run(f'echo "{new_cron}" | crontab -', shell=True, timeout=10)
+
+    if code != 0:
+        os.remove(script_path)
+        return None, f'Crontab 写入失败: {err}'
+
+    # 写入数据库
+    conn = sqlite3.connect(DB_PATH)
+    cur = conn.execute("""INSERT INTO cron_jobs (site_id, name, schedule, command)
+                          VALUES (?, ?, ?, ?)""",
+                       (site_id, name, schedule, command))
+    conn.commit()
+    cron_id = cur.lastrowid
+    conn.close()
+
+    return cron_id, '定时任务创建成功'
+
+def delete_cron(cron_id):
+    """删除定时任务"""
+    conn = sqlite3.connect(DB_PATH)
+    cur = conn.execute("SELECT name, command FROM cron_jobs WHERE id = ?", (cron_id,))
+    row = cur.fetchone()
+    if not row:
+        conn.close()
+        return False, '任务不存在'
+
+    name, command = row
+
+    # 从 crontab 移除
+    code, out, err = _run('crontab -l 2>/dev/null || echo ""', shell=True)
+    if code == 0 and out:
+        lines = [l for l in out.split('\n') if name not in l and l.strip()]
+        _run(f'echo "{chr(10).join(lines)}\n" | crontab -', shell=True, timeout=10)
+
+    # 删除脚本文件
+    cron_dir = '/opt/tpanel/sites'
+    for site_dir in os.listdir('/opt/tpanel/sites'):
+        script = os.path.join(cron_dir, site_dir, '.cron')
+        if os.path.exists(script):
+            for f in os.listdir(script):
+                if name in f:
+                    try:
+                        os.remove(os.path.join(script, f))
+                    except:
+                        pass
+
+    conn.execute("DELETE FROM cron_jobs WHERE id = ?", (cron_id,))
+    conn.commit()
+    conn.close()
+
+    return True, '任务已删除'
+
+def enable_cron(cron_id, enabled):
+    """启用/禁用定时任务"""
+    conn = sqlite3.connect(DB_PATH)
+    conn.execute("UPDATE cron_jobs SET enabled = ? WHERE id = ?", (1 if enabled else 0, cron_id))
+
+    # 如果禁用，从 crontab 注释掉；如果启用，恢复
+    cur = conn.execute("SELECT name, schedule, command FROM cron_jobs WHERE id = ?", (cron_id,))
+    row = cur.fetchone()
+    conn.close()
+
+    if not row:
+        return False, '任务不存在'
+
+    name, schedule, command = row
+    prefix = '' if enabled else '#'
+
+    # 简单处理：重新生成 crontab
+    # 获取所有启用的任务重新写入
+    conn2 = sqlite3.connect(DB_PATH)
+    cur2 = conn2.execute("SELECT name, schedule, command, enabled FROM cron_jobs WHERE enabled = 1")
+    enabled_rows = cur2.fetchall()
+    conn2.close()
+
+    lines = []
+    for r in enabled_rows:
+        n, s, c = r[0], r[1], r[2]
+        import hashlib
+        token = hashlib.md5(f'{n}{c}'.encode()).hexdigest()[:12]
+        lines.append(f'{s} sudo -u {get_site_user_by_name(n)} /opt/tpanel/sites/{get_site_user_by_name(n)}/.cron/cron_{token}.sh >> /opt/tpanel/logs/cron_{token}.log 2>&1')
+
+    if enabled:
+        _run(f'echo "{"".join([l + chr(10) for l in lines])}" | crontab -', shell=True, timeout=10)
+
+    return True, f'任务已{"启用" if enabled else "禁用"}'
+
+def get_site_user_by_name(name):
+    """根据任务名查找站点用户（辅助）"""
+    conn = sqlite3.connect(DB_PATH)
+    cur = conn.execute("SELECT site_user FROM sites LIMIT 1")
+    row = cur.fetchone()
+    conn.close()
+    return row[0] if row else 'tpanel'
+
+def run_cron_now(cron_id):
+    """立即执行定时任务（手动触发）"""
+    conn = sqlite3.connect(DB_PATH)
+    cur = conn.execute("SELECT site_id, name, command FROM cron_jobs WHERE id = ?", (cron_id,))
+    row = cur.fetchone()
+    conn.close()
+
+    if not row:
+        return False, '任务不存在'
+
+    site_id, name, command = row
+
+    conn2 = sqlite3.connect(DB_PATH)
+    cur2 = conn2.execute("SELECT site_user FROM sites WHERE id = ?", (site_id,))
+    row2 = cur2.fetchone()
+    conn2.close()
+
+    if not row2:
+        return False, '站点不存在'
+
+    site_user = row2[0]
+
+    # 以站点用户身份执行命令
+    code, out, err = _run(
+        f'sudo -u {site_user} bash -c "{command}"',
+        shell=True, timeout=60
+    )
+
+    # 更新最后执行时间
+    conn3 = sqlite3.connect(DB_PATH)
+    conn3.execute("UPDATE cron_jobs SET last_run = ? WHERE id = ?",
+                  (datetime.now().isoformat(), cron_id))
+    conn3.commit()
+    conn3.close()
+
+    return code == 0, out if code == 0 else err
+
+def validate_cron_expression(expr):
+    """验证 cron 表达式是否有效"""
+    parts = expr.strip().split()
+    if len(parts) != 5:
+        return False, '需要 5 段：分 时 日 月 周'
+
+    labels = ['分', '时', '日', '月', '周']
+    ranges = [
+        (0, 59),   # 分: 0-59
+        (0, 23),   # 时: 0-23
+        (1, 31),   # 日: 1-31
+        (1, 12),   # 月: 1-12
+        (0, 6),    # 周: 0-6 (0=周日)
+    ]
+
+    for i, (part, (lo, hi)) in enumerate(zip(parts, ranges)):
+        if part == '*':
+            continue
+        if '/' in part:
+            base, step = part.split('/')
+            if not step.isdigit():
+                return False, f'{labels[i]} 步长必须是数字'
+            continue
+        if ',' in part:
+            for p in part.split(','):
+                try:
+                    v = int(p)
+                    if v < lo or v > hi:
+                        return False, f'{labels[i]} 范围 {lo}-{hi}'
+                except:
+                    return False, f'{labels[i]} 包含无效值'
+            continue
+        if '-' in part:
+            start, end = part.split('-')
+            try:
+                if int(start) < lo or int(end) > hi:
+                    return False, f'{labels[i]} 范围 {lo}-{hi}'
+            except:
+                return False, f'{labels[i]} 格式错误'
+            continue
+        try:
+            v = int(part)
+            if v < lo or v > hi:
+                return False, f'{labels[i]} 范围 {lo}-{hi}'
+        except:
+            return False, f'{labels[i]} 包含无效字符'
+
+    return True, '格式正确'
\ No newline at end of file
diff --git a/backend/db_init.py b/backend/db_init.py
new file mode 100644
index 0000000..8b6edf0
--- /dev/null
+++ b/backend/db_init.py
@@ -0,0 +1,111 @@
+"""
+TPanel - 数据库初始化
+"""
+import sqlite3
+import os
+import bcrypt
+from config import DB_PATH, BASE_DIR
+
+def init_db():
+    os.makedirs(os.path.dirname(DB_PATH), exist_ok=True)
+    conn = sqlite3.connect(DB_PATH)
+    cur = conn.cursor()
+
+    cur.execute('''
+    CREATE TABLE IF NOT EXISTS admin (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        username TEXT NOT NULL UNIQUE,
+        password_hash TEXT NOT NULL,
+        created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+        last_login DATETIME
+    )''')
+
+    cur.execute('''
+    CREATE TABLE IF NOT EXISTS sites (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        name TEXT NOT NULL,
+        domain TEXT NOT NULL UNIQUE,
+        site_user TEXT NOT NULL UNIQUE,
+        site_path TEXT NOT NULL,
+        php_version TEXT DEFAULT '8.1',
+        status TEXT DEFAULT 'running',
+        ssl_enabled INTEGER DEFAULT 0,
+        ssl_cert_path TEXT,
+        ssl_key_path TEXT,
+        created_at DATETIME DEFAULT CURRENT_TIMESTAMP
+    )''')
+
+    cur.execute('''
+    CREATE TABLE IF NOT EXISTS databases (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        site_id INTEGER REFERENCES sites(id) ON DELETE CASCADE,
+        name TEXT NOT NULL UNIQUE,
+        db_user TEXT NOT NULL UNIQUE,
+        db_pass TEXT NOT NULL,
+        charset TEXT DEFAULT 'utf8mb4',
+        created_at DATETIME DEFAULT CURRENT_TIMESTAMP
+    )''')
+
+    cur.execute('''
+    CREATE TABLE IF NOT EXISTS backups (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        site_id INTEGER REFERENCES sites(id) ON DELETE CASCADE,
+        type TEXT DEFAULT 'local',
+        file_path TEXT,
+        size INTEGER,
+        status TEXT DEFAULT 'success',
+        created_at DATETIME DEFAULT CURRENT_TIMESTAMP
+    )''')
+
+    cur.execute('''
+    CREATE TABLE IF NOT EXISTS ssl_certs (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        site_id INTEGER REFERENCES sites(id) ON DELETE CASCADE,
+        domain TEXT NOT NULL,
+        cert_path TEXT NOT NULL,
+        key_path TEXT NOT NULL,
+        expire_date TEXT,
+        auto_renew INTEGER DEFAULT 1,
+        created_at DATETIME DEFAULT CURRENT_TIMESTAMP
+    )''')
+
+    cur.execute('''
+    CREATE TABLE IF NOT EXISTS cron_jobs (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        site_id INTEGER REFERENCES sites(id) ON DELETE CASCADE,
+        name TEXT NOT NULL,
+        schedule TEXT NOT NULL,
+        command TEXT NOT NULL,
+        enabled INTEGER DEFAULT 1,
+        last_run DATETIME,
+        created_at DATETIME DEFAULT CURRENT_TIMESTAMP
+    )''')
+
+    cur.execute('''
+    CREATE TABLE IF NOT EXISTS security_logs (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        event_type TEXT NOT NULL,
+        details TEXT,
+        ip TEXT,
+        created_at DATETIME DEFAULT CURRENT_TIMESTAMP
+    )''')
+
+    cur.execute('''
+    CREATE TABLE IF NOT EXISTS settings (
+        key TEXT PRIMARY KEY,
+        value TEXT
+    )''')
+
+    # 默认管理员账号 admin / tpanel.cn
+    cur.execute("SELECT id FROM admin WHERE username = ?", ('admin',))
+    if not cur.fetchone():
+        pw_hash = bcrypt.hashpw(b'tpanel.cn', bcrypt.gensalt()).decode()
+        cur.execute("INSERT INTO admin (username, password_hash) VALUES (?, ?)",
+                    ('admin', pw_hash))
+        conn.commit()
+
+    conn.close()
+    print("[TPanel] 数据库初始化完成")
+
+if __name__ == '__main__':
+    init_db()
\ No newline at end of file
diff --git a/backend/file_manager.py b/backend/file_manager.py
new file mode 100644
index 0000000..6919f25
--- /dev/null
+++ b/backend/file_manager.py
@@ -0,0 +1,196 @@
+"""
+TPanel - 文件管理模块
+"""
+import os
+import zipfile
+import tarfile
+import shutil
+import subprocess
+from datetime import datetime
+
+def _run(cmd, timeout=30):
+    try:
+        if isinstance(cmd, str):
+            cmd = cmd.split()
+        result = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
+        return result.returncode, result.stdout.strip(), result.stderr.strip()
+    except subprocess.TimeoutExpired:
+        return -1, '', 'Command timed out'
+    except Exception as e:
+        return -1, '', str(e)
+
+def list_directory(path, site_user=None):
+    """列出目录内容，带安全和权限信息"""
+    # 安全检查：防止路径遍历
+    real_path = os.path.realpath(path)
+    allowed_base = ['/opt/tpanel/sites', '/opt/tpanel/backups']
+    if not any(real_path.startswith(base) for base in allowed_base):
+        return None, '路径不在允许范围内'
+
+    if not os.path.exists(path):
+        return None, '目录不存在'
+
+    items = []
+    try:
+        entries = os.listdir(path)
+    except PermissionError:
+        return None, '无权限访问'
+
+    for name in sorted(entries):
+        fp = os.path.join(path, name)
+        try:
+            stat = os.stat(fp)
+            is_dir = os.path.isdir(fp)
+
+            # 文件大小
+            if is_dir:
+                size = sum(os.path.getsize(os.path.join(dp, f))
+                           for dp, dn, fn in os.walk(fp) for f in fn) if False else 0
+            else:
+                size = stat.st_size
+
+            items.append({
+                'name': name,
+                'type': 'dir' if is_dir else 'file',
+                'size': size,
+                'size_str': format_size(size),
+                'modified': datetime.fromtimestamp(stat.st_mtime).strftime('%Y-%m-%d %H:%M'),
+                'permissions': stat.st_mode & 0o777,
+                'perm_str': format_permissions(stat.st_mode & 0o777),
+                'readable': os.access(fp, os.R_OK),
+                'writable': os.access(fp, os.W_OK),
+            })
+        except Exception:
+            continue
+
+    return items, None
+
+def format_size(size):
+    if size < 1024:
+        return str(size) + ' B'
+    elif size < 1024 * 1024:
+        return f'{size / 1024:.1f} KB'
+    elif size < 1024 * 1024 * 1024:
+        return f'{size / (1024 * 1024):.1f} MB'
+    else:
+        return f'{size / (1024 * 1024 * 1024):.2f} GB'
+
+def format_permissions(mode):
+    chars = ['---', '--x', '-w-', '-wx', 'r--', 'r-x', 'rw-', 'rwx']
+    return chars[(mode >> 6) & 7] + chars[(mode >> 3) & 7] + chars[mode & 7]
+
+def read_file(path, max_size=1024 * 1024):
+    """读取文件内容（限制1MB）"""
+    if not os.path.exists(path):
+        return None, '文件不存在'
+    if os.path.getsize(path) > max_size:
+        return None, '文件超过 1MB 限制'
+
+    # 只允许读取配置文件和常见文本格式
+    allowed_ext = ['.php', '.html', '.htm', '.css', '.js', '.json', '.txt', '.md',
+                   '.yaml', '.yml', '.xml', '.conf', '.ini', '.log', '.sql']
+    ext = os.path.splitext(path)[1].lower()
+    if ext not in allowed_ext and not any(path.endswith(x) for x in ['/config.php', '/.htaccess']):
+        return None, '文件类型不允许读取'
+
+    try:
+        with open(path, 'r', encoding='utf-8', errors='ignore') as f:
+            return f.read(), None
+    except Exception as e:
+        return None, str(e)
+
+def write_file(path, content):
+    """写入文件（仅限站点目录）"""
+    real_path = os.path.realpath(path)
+    if not real_path.startswith('/opt/tpanel/sites'):
+        return False, '路径不在允许范围内'
+
+    try:
+        with open(path, 'w', encoding='utf-8') as f:
+            f.write(content)
+        return True, '文件已保存'
+    except Exception as e:
+        return False, str(e)
+
+def upload_file(upload_dir, file_obj, filename):
+    """上传文件到站点目录"""
+    real_path = os.path.realpath(upload_dir)
+    if not real_path.startswith('/opt/tpanel/sites'):
+        return False, '路径不在允许范围内'
+
+    # 限制文件类型
+    allowed = ['.php', '.html', '.htm', '.css', '.js', '.json', '.txt', '.md',
+               '.jpg', '.jpeg', '.png', '.gif', '.webp', '.svg', '.ico',
+               '.zip', '.tar', '.gz', '.bz2',
+               '.pdf', '.doc', '.docx', '.xls', '.xlsx',
+               '.woff', '.woff2', '.ttf', '.eot']
+    ext = os.path.splitext(filename)[1].lower()
+    if ext not in allowed:
+        return False, f'文件类型 {ext} 不允许上传'
+
+    dest = os.path.join(upload_dir, filename)
+    try:
+        file_obj.save(dest)
+        # 自动解压 zip/tar.gz
+        if filename.endswith('.zip'):
+            try:
+                with zipfile.ZipFile(dest, 'r') as zf:
+                    zf.extractall(upload_dir)
+                return True, f'文件已上传并解压：{filename}'
+            except Exception:
+                return True, f'文件已上传（解压失败）：{filename}'
+        elif filename.endswith(('.tar.gz', '.tgz')):
+            try:
+                with tarfile.open(dest, 'r:gz') as tf:
+                    tf.extractall(upload_dir)
+                return True, f'文件已上传并解压：{filename}'
+            except Exception:
+                return True, f'文件已上传（解压失败）：{filename}'
+
+        return True, f'文件已上传：{filename}'
+    except Exception as e:
+        return False, str(e)
+
+def delete_file(path):
+    """删除文件或目录"""
+    real_path = os.path.realpath(path)
+    if not real_path.startswith('/opt/tpanel/sites'):
+        return False, '路径不在允许范围内'
+
+    try:
+        if os.path.isdir(path):
+            shutil.rmtree(path)
+        else:
+            os.remove(path)
+        return True, '已删除'
+    except Exception as e:
+        return False, str(e)
+
+def chmod_file(path, mode):
+    """修改文件权限（限制范围）"""
+    real_path = os.path.realpath(path)
+    if not real_path.startswith('/opt/tpanel/sites'):
+        return False, '路径不在允许范围内'
+
+    # 限制权限范围
+    if mode & 0o777 not in [0o755, 0o644, 0o600, 0o700, 0o775, 0o664]:
+        return False, '权限值不允许'
+
+    try:
+        os.chmod(path, mode & 0o777)
+        return True, f'权限已修改为 {oct(mode & 0o777)}'
+    except Exception as e:
+        return False, str(e)
+
+def create_directory(path, dirname):
+    """创建目录"""
+    real_path = os.path.realpath(path)
+    if not real_path.startswith('/opt/tpanel/sites'):
+        return False, '路径不在允许范围内'
+
+    new_path = os.path.join(path, dirname)
+    try:
+        os.makedirs(new_path, exist_ok=True)
+        return True, f'目录已创建：{dirname}'
+    except Exception as e:
+        return False, str(e)
\ No newline at end of file
diff --git a/backend/main.py b/backend/main.py
new file mode 100644
index 0000000..208a8d4
--- /dev/null
+++ b/backend/main.py
@@ -0,0 +1,867 @@
+"""
+TPanel - T面板 主程序
+"""
+import os
+import sys
+import secrets
+import bcrypt
+import sqlite3
+from datetime import datetime
+from functools import wraps
+
+from flask import Flask, jsonify, request, session, redirect
+from flask_cors import CORS
+
+# 导入各模块
+from config import DB_PATH, load_config, save_config, set_setting, get_setting
+from system import (
+    nginx_status, nginx_reload, mysql_status,
+    create_site_user, delete_site_user,
+    write_nginx_config, remove_nginx_config,
+    create_mysql_db, delete_mysql_db,
+    backup_site, restore_backup,
+    run_security_update, get_security_status, get_system_stats, write_log
+)
+from file_manager import list_directory, read_file, write_file, upload_file, delete_file, chmod_file, create_directory
+from ssl_manager import get_all_certs, apply_letsencrypt, renew_cert, renew_all_expiring, deploy_ssl, check_certs_status
+from cron_manager import get_all_crons, create_cron, delete_cron, enable_cron, run_cron_now, validate_cron_expression
+from remote_backup import run_remote_backup, sync_restore, test_rsync_connection, get_backup_stats
+
+app = Flask(__name__, static_folder='../frontend')
+app.secret_key = secrets.token_hex(32)
+CORS(app, supports_credentials=True)
+
+# ==========================
+# 域名绑定中间件
+# ==========================
+
+@app.before_request
+def check_panel_domain():
+    """如果面板绑定了域名，只允许该域名访问"""
+    allowed = get_panel_domain().strip()
+    if not allowed:
+        return  # 未绑定，不限制
+
+    host = request.host.lower()
+    allowed_clean = allowed.lower().strip().split(':')[0]
+    host_clean = host.split(':')[0]
+
+    safe = ['localhost', '127.0.0.1', '::1']
+    if host_clean in safe:
+        return
+
+    if host_clean != allowed_clean:
+        return jsonify({'code': 403, 'msg': f'面板已绑定域名 {allowed}，请使用该域名访问'}), 403
+
+# ==========================
+# 装饰器
+# ==========================
+
+def require_auth(f):
+    @wraps(f)
+    def decorated(*args, **kwargs):
+        token = request.headers.get('Authorization', '').replace('Bearer ', '')
+        expected = get_setting('api_token', '')
+        if not expected or token != expected:
+            # 也检查 session
+            if 'admin' not in session:
+                return jsonify({'code': 401, 'msg': '未授权'}), 401
+        return f(*args, **kwargs)
+    return decorated
+
+# ==========================
+# 认证 API
+# ==========================
+
+@app.route('/api/auth/login', methods=['POST'])
+def api_login():
+    data = request.json or {}
+    username = data.get('username', '').strip()
+    password = data.get('password', '')
+
+    conn = sqlite3.connect(DB_PATH)
+    cur = conn.execute("SELECT id, password_hash FROM admin WHERE username = ?", (username,))
+    row = cur.fetchone()
+    conn.close()
+
+    if not row:
+        return jsonify({'code': 401, 'msg': '用户名或密码错误'})
+
+    if bcrypt.checkpw(password.encode(), row[1].encode()):
+        session['admin'] = True
+        session['username'] = username
+
+        # 生成 API token
+        token = secrets.token_hex(32)
+        set_setting('api_token', token)
+        set_setting('last_login', datetime.now().isoformat())
+
+        write_log('login', f'用户 {username} 登录成功', request.remote_addr)
+        return jsonify({'code': 0, 'msg': '登录成功', 'token': token})
+
+    write_log('login_fail', f'用户 {username} 登录失败', request.remote_addr)
+    return jsonify({'code': 401, 'msg': '用户名或密码错误'})
+
+@app.route('/api/auth/logout', methods=['POST'])
+def api_logout():
+    username = session.get('username', 'unknown')
+    session.clear()
+    write_log('logout', f'用户 {username} 退出', request.remote_addr)
+    return jsonify({'code': 0, 'msg': '已退出'})
+
+@app.route('/api/auth/check', methods=['GET'])
+def api_check():
+    token = request.headers.get('Authorization', '').replace('Bearer ', '')
+    if token == get_setting('api_token', ''):
+        return jsonify({'code': 0, 'msg': '有效', 'username': session.get('username', 'admin')})
+    if 'admin' in session:
+        return jsonify({'code': 0, 'msg': '有效', 'username': session.get('username', 'admin')})
+    return jsonify({'code': 401, 'msg': '无效'}), 401
+
+# ==========================
+# 系统状态
+# ==========================
+
+@app.route('/api/system/stats', methods=['GET'])
+@require_auth
+def api_system_stats():
+    stats = get_system_stats()
+    security = get_security_status()
+    stats.update(security)
+    return jsonify({'code': 0, 'data': stats})
+
+# ==========================
+# 站点管理
+# ==========================
+
+@app.route('/api/sites', methods=['GET'])
+@require_auth
+def api_sites_list():
+    conn = sqlite3.connect(DB_PATH)
+    cur = conn.execute("SELECT * FROM sites ORDER BY id DESC")
+    cols = [d[0] for d in cur.description]
+    rows = [dict(zip(cols, r)) for r in cur.fetchall()]
+    conn.close()
+    return jsonify({'code': 0, 'data': rows})
+
+@app.route('/api/sites', methods=['POST'])
+@require_auth
+def api_sites_create():
+    data = request.json or {}
+    domain = data.get('domain', '').strip().lower()
+    name = data.get('name', domain)
+    php_version = data.get('php_version', '8.1')
+    site_user = domain.replace('.', '_')
+
+    if not domain:
+        return jsonify({'code': 400, 'msg': '域名不能为空'})
+
+    conn = sqlite3.connect(DB_PATH)
+    cur = conn.execute("SELECT id FROM sites WHERE domain = ?", (domain,))
+    if cur.fetchone():
+        conn.close()
+        return jsonify({'code': 400, 'msg': '站点已存在'})
+
+    site_path = f'/opt/tpanel/sites/{site_user}'
+
+    # 1. 创建 Linux 用户
+    ok, msg = create_site_user(site_user)
+    if not ok:
+        conn.close()
+        return jsonify({'code': 500, 'msg': f'创建系统用户失败: {msg}'})
+
+    # 2. 创建目录并写入 index.php
+    os.makedirs(site_path, exist_ok=True)
+    os.makedirs(f'{site_path}/public', exist_ok=True)
+    with open(f'{site_path}/public/index.php', 'w') as f:
+        f.write(f'<?php\n// Site: {domain}\n// Managed by TPanel\nphpinfo();\n')
+    os.makedirs(f'{site_path}/logs', exist_ok=True)
+
+    # 3. 写 Nginx 配置
+    ok, msg = write_nginx_config(domain, f'{site_path}/public', php_version)
+    if not ok:
+        conn.close()
+        return jsonify({'code': 500, 'msg': f'Nginx 配置失败: {msg}'})
+
+    # 4. 写入数据库
+    cur.execute("""INSERT INTO sites (name, domain, site_user, site_path, php_version, status)
+                    VALUES (?, ?, ?, ?, ?, ?)""",
+                (name, domain, site_user, f'{site_path}/public', php_version, 'running'))
+    conn.commit()
+    site_id = cur.lastrowid
+    conn.close()
+
+    write_log('site_create', f'创建站点 {domain}', request.remote_addr)
+    return jsonify({'code': 0, 'msg': '站点创建成功', 'data': {'id': site_id}})
+
+@app.route('/api/sites/<int:site_id>', methods=['DELETE'])
+@require_auth
+def api_sites_delete(site_id):
+    conn = sqlite3.connect(DB_PATH)
+    cur = conn.execute("SELECT domain, site_user, site_path FROM sites WHERE id = ?", (site_id,))
+    row = cur.fetchone()
+    if not row:
+        conn.close()
+        return jsonify({'code': 404, 'msg': '站点不存在'})
+
+    domain, site_user, site_path = row
+
+    # 1. 删除 Nginx 配置
+    remove_nginx_config(domain)
+
+    # 2. 删除系统用户和目录
+    delete_site_user(site_user)
+    import shutil
+    parent_path = os.path.dirname(site_path)
+    if os.path.exists(os.path.join(parent_path, site_user)):
+        shutil.rmtree(os.path.join(parent_path, site_user), ignore_errors=True)
+
+    # 3. 删除数据库
+    cur2 = conn.execute("SELECT name, db_user FROM databases WHERE site_id = ?", (site_id,))
+    for db_row in cur2.fetchall():
+        delete_mysql_db(db_row[0], db_row[1])
+
+    # 4. 删除站点记录
+    conn.execute("DELETE FROM sites WHERE id = ?", (site_id,))
+    conn.commit()
+    conn.close()
+
+    write_log('site_delete', f'删除站点 {domain}', request.remote_addr)
+    return jsonify({'code': 0, 'msg': '站点已删除'})
+
+@app.route('/api/sites/<int:site_id>/start', methods=['POST'])
+@require_auth
+def api_sites_start(site_id):
+    conn = sqlite3.connect(DB_PATH)
+    cur = conn.execute("SELECT domain FROM sites WHERE id = ?", (site_id,))
+    row = cur.fetchone()
+    conn.close()
+    if not row:
+        return jsonify({'code': 404, 'msg': '站点不存在'})
+    _, msg = nginx_reload()
+    return jsonify({'code': 0, 'msg': msg or '已启动'})
+
+@app.route('/api/sites/<int:site_id>/stop', methods=['POST'])
+@require_auth
+def api_sites_stop(site_id):
+    return jsonify({'code': 0, 'msg': '停止站点需要 reload nginx，建议通过 Nginx 命令管理'})
+
+@app.route('/api/sites/<int:site_id>/ssl', methods=['POST'])
+@require_auth
+def api_sites_ssl(site_id):
+    conn = sqlite3.connect(DB_PATH)
+    cur = conn.execute("SELECT domain, site_path FROM sites WHERE id = ?", (site_id,))
+    row = cur.fetchone()
+    conn.close()
+    if not row:
+        return jsonify({'code': 404, 'msg': '站点不存在'})
+    domain, site_path = row
+    return jsonify({'code': 0, 'msg': 'SSL 功能开发中，请手动配置 certbot'})
+
+# ==========================
+# 数据库
+# ==========================
+
+@app.route('/api/databases', methods=['GET'])
+@require_auth
+def api_databases_list():
+    conn = sqlite3.connect(DB_PATH)
+    cur = conn.execute("SELECT * FROM databases ORDER BY id DESC")
+    cols = [d[0] for d in cur.description]
+    rows = [dict(zip(cols, r)) for r in cur.fetchall()]
+    conn.close()
+    return jsonify({'code': 0, 'data': rows})
+
+@app.route('/api/databases', methods=['POST'])
+@require_auth
+def api_databases_create():
+    data = request.json or {}
+    site_id = data.get('site_id')
+    db_name = data.get('name', '').strip()
+    db_user = data.get('user', '').strip()
+    db_pass = data.get('pass', '')
+
+    if not all([site_id, db_name, db_user, db_pass]):
+        return jsonify({'code': 400, 'msg': '参数不完整'})
+
+    ok, msg = create_mysql_db(db_name, db_user, db_pass)
+    if not ok:
+        return jsonify({'code': 500, 'msg': msg})
+
+    conn = sqlite3.connect(DB_PATH)
+    cur = conn.execute("""INSERT INTO databases (site_id, name, db_user, db_pass) VALUES (?, ?, ?, ?)""",
+                       (site_id, db_name, db_user, db_pass))
+    conn.commit()
+    db_id = cur.lastrowid
+    conn.close()
+
+    write_log('db_create', f'创建数据库 {db_name}', request.remote_addr)
+    return jsonify({'code': 0, 'msg': '数据库创建成功', 'data': {'id': db_id}})
+
+@app.route('/api/databases/<int:db_id>', methods=['DELETE'])
+@require_auth
+def api_databases_delete(db_id):
+    conn = sqlite3.connect(DB_PATH)
+    cur = conn.execute("SELECT name, db_user FROM databases WHERE id = ?", (db_id,))
+    row = cur.fetchone()
+    if not row:
+        conn.close()
+        return jsonify({'code': 404, 'msg': '数据库不存在'})
+    delete_mysql_db(row[0], row[1])
+    conn.execute("DELETE FROM databases WHERE id = ?", (db_id,))
+    conn.commit()
+    conn.close()
+    write_log('db_delete', f'删除数据库 {row[0]}', request.remote_addr)
+    return jsonify({'code': 0, 'msg': '数据库已删除'})
+
+# ==========================
+# 备份
+# ==========================
+
+@app.route('/api/backups', methods=['GET'])
+@require_auth
+def api_backups_list():
+    conn = sqlite3.connect(DB_PATH)
+    cur = conn.execute("""SELECT b.*, s.domain FROM backups b
+                          LEFT JOIN sites s ON b.site_id = s.id
+                          ORDER BY b.id DESC LIMIT 50""")
+    cols = [d[0] for d in cur.description]
+    rows = [dict(zip(cols, r)) for r in cur.fetchall()]
+    conn.close()
+    return jsonify({'code': 0, 'data': rows})
+
+@app.route('/api/backups', methods=['POST'])
+@require_auth
+def api_backups_create():
+    data = request.json or {}
+    site_id = data.get('site_id')
+
+    conn = sqlite3.connect(DB_PATH)
+    cur = conn.execute("SELECT site_path, domain FROM sites WHERE id = ?", (site_id,))
+    row = cur.fetchone()
+    conn.close()
+    if not row:
+        return jsonify({'code': 404, 'msg': '站点不存在'})
+
+    site_path, domain = row
+
+    # 查找该站点的数据库
+    conn2 = sqlite3.connect(DB_PATH)
+    cur2 = conn2.execute("SELECT name, db_user, db_pass FROM databases WHERE site_id = ?", (site_id,))
+    db_row = cur2.fetchone()
+    conn2.close()
+
+    db_name, db_user, db_pass = (db_row if db_row else (None, None, None))
+
+    ok, path, size = backup_site(site_path, domain, db_name, db_user, db_pass)
+    if not ok:
+        return jsonify({'code': 500, 'msg': f'备份失败: {path}'})
+
+    conn3 = sqlite3.connect(DB_PATH)
+    conn3.execute("INSERT INTO backups (site_id, type, file_path, size, status) VALUES (?, ?, ?, ?, ?)",
+                  (site_id, 'local', path, size, 'success'))
+    conn3.commit()
+    backup_id = conn3.lastrowid
+    conn3.close()
+
+    write_log('backup', f'备份站点 {domain}', request.remote_addr)
+    return jsonify({'code': 0, 'msg': '备份成功', 'data': {'id': backup_id, 'path': path, 'size': size}})
+
+@app.route('/api/backups/<int:backup_id>/restore', methods=['POST'])
+@require_auth
+def api_backups_restore(backup_id):
+    conn = sqlite3.connect(DB_PATH)
+    cur = conn.execute("SELECT file_path, site_id FROM backups WHERE id = ?", (backup_id,))
+    row = cur.fetchone()
+    conn.close()
+    if not row:
+        return jsonify({'code': 404, 'msg': '备份不存在'})
+
+    file_path, site_id = row
+
+    conn2 = sqlite3.connect(DB_PATH)
+    cur2 = conn2.execute("SELECT site_path FROM sites WHERE id = ?", (site_id,))
+    site_row = cur2.fetchone()
+    conn2.close()
+
+    if not site_row:
+        return jsonify({'code': 404, 'msg': '站点不存在'})
+
+    ok, msg = restore_backup(file_path, site_row[0], str(site_id))
+    if not ok:
+        return jsonify({'code': 500, 'msg': msg})
+
+    write_log('restore', f'恢复备份 {file_path}', request.remote_addr)
+    return jsonify({'code': 0, 'msg': '恢复成功'})
+
+# ==========================
+# 安全
+# ==========================
+
+@app.route('/api/security/logs', methods=['GET'])
+@require_auth
+def api_security_logs():
+    conn = sqlite3.connect(DB_PATH)
+    cur = conn.execute("SELECT * FROM security_logs ORDER BY id DESC LIMIT 100")
+    cols = [d[0] for d in cur.description]
+    rows = [dict(zip(cols, r)) for r in cur.fetchall()]
+    conn.close()
+    return jsonify({'code': 0, 'data': rows})
+
+@app.route('/api/security/update', methods=['POST'])
+@require_auth
+def api_security_run_update():
+    ok, msg = run_security_update()
+    write_log('security_update', msg, request.remote_addr)
+    return jsonify({'code': 0 if ok else 500, 'msg': msg})
+
+@app.route('/api/security/status', methods=['GET'])
+@require_auth
+def api_security_status():
+    status = get_security_status()
+    return jsonify({'code': 0, 'data': status})
+
+# ==========================
+# 文件管理
+# ==========================
+
+@app.route('/api/files/list', methods=['GET'])
+@require_auth
+def api_files_list():
+    site_id = request.args.get('site_id', type=int)
+    path = request.args.get('path', '')
+
+    if not site_id:
+        return jsonify({'code': 400, 'msg': '缺少 site_id'})
+
+    conn = sqlite3.connect(DB_PATH)
+    cur = conn.execute("SELECT site_path FROM sites WHERE id = ?", (site_id,))
+    row = cur.fetchone()
+    conn.close()
+    if not row:
+        return jsonify({'code': 404, 'msg': '站点不存在'})
+
+    base_path = row[0]
+    if path:
+        target_path = os.path.join(base_path, path)
+    else:
+        target_path = base_path
+
+    items, err = list_directory(target_path)
+    if err:
+        return jsonify({'code': 400, 'msg': err})
+
+    return jsonify({'code': 0, 'data': items, 'base_path': base_path})
+
+@app.route('/api/files/read', methods=['GET'])
+@require_auth
+def api_files_read():
+    site_id = request.args.get('site_id', type=int)
+    filepath = request.args.get('path', '')
+
+    if not site_id or not filepath:
+        return jsonify({'code': 400, 'msg': '参数不完整'})
+
+    conn = sqlite3.connect(DB_PATH)
+    cur = conn.execute("SELECT site_path FROM sites WHERE id = ?", (site_id,))
+    row = cur.fetchone()
+    conn.close()
+    if not row:
+        return jsonify({'code': 404, 'msg': '站点不存在'})
+
+    full_path = os.path.join(row[0], filepath)
+    content, err = read_file(full_path)
+    if err:
+        return jsonify({'code': 400, 'msg': err})
+
+    return jsonify({'code': 0, 'data': content})
+
+@app.route('/api/files/write', methods=['POST'])
+@require_auth
+def api_files_write():
+    data = request.json or {}
+    site_id = data.get('site_id')
+    filepath = data.get('path', '')
+    content = data.get('content', '')
+
+    if not site_id or not filepath:
+        return jsonify({'code': 400, 'msg': '参数不完整'})
+
+    conn = sqlite3.connect(DB_PATH)
+    cur = conn.execute("SELECT site_path FROM sites WHERE id = ?", (site_id,))
+    row = cur.fetchone()
+    conn.close()
+    if not row:
+        return jsonify({'code': 404, 'msg': '站点不存在'})
+
+    full_path = os.path.join(row[0], filepath)
+    ok, msg = write_file(full_path, content)
+    if ok:
+        write_log('file_edit', f'编辑文件 {filepath}', request.remote_addr)
+
+    return jsonify({'code': 0 if ok else 400, 'msg': msg})
+
+@app.route('/api/files/upload', methods=['POST'])
+@require_auth
+def api_files_upload():
+    site_id = request.form.get('site_id', type=int)
+    path = request.form.get('path', '')
+    file = request.files.get('file')
+
+    if not site_id or not file:
+        return jsonify({'code': 400, 'msg': '参数不完整'})
+
+    conn = sqlite3.connect(DB_PATH)
+    cur = conn.execute("SELECT site_path FROM sites WHERE id = ?", (site_id,))
+    row = cur.fetchone()
+    conn.close()
+    if not row:
+        return jsonify({'code': 404, 'msg': '站点不存在'})
+
+    upload_dir = os.path.join(row[0], path) if path else row[0]
+    ok, msg = upload_file(upload_dir, file, file.filename)
+    if ok:
+        write_log('file_upload', f'上传文件 {file.filename}', request.remote_addr)
+
+    return jsonify({'code': 0 if ok else 400, 'msg': msg})
+
+@app.route('/api/files/delete', methods=['POST'])
+@require_auth
+def api_files_delete():
+    data = request.json or {}
+    site_id = data.get('site_id')
+    filepath = data.get('path', '')
+
+    if not site_id or not filepath:
+        return jsonify({'code': 400, 'msg': '参数不完整'})
+
+    conn = sqlite3.connect(DB_PATH)
+    cur = conn.execute("SELECT site_path FROM sites WHERE id = ?", (site_id,))
+    row = cur.fetchone()
+    conn.close()
+    if not row:
+        return jsonify({'code': 404, 'msg': '站点不存在'})
+
+    full_path = os.path.join(row[0], filepath)
+    ok, msg = delete_file(full_path)
+    if ok:
+        write_log('file_delete', f'删除文件 {filepath}', request.remote_addr)
+
+    return jsonify({'code': 0 if ok else 400, 'msg': msg})
+
+@app.route('/api/files/mkdir', methods=['POST'])
+@require_auth
+def api_files_mkdir():
+    data = request.json or {}
+    site_id = data.get('site_id')
+    dirpath = data.get('path', '')
+    dirname = data.get('name', '')
+
+    if not site_id or not dirname:
+        return jsonify({'code': 400, 'msg': '参数不完整'})
+
+    conn = sqlite3.connect(DB_PATH)
+    cur = conn.execute("SELECT site_path FROM sites WHERE id = ?", (site_id,))
+    row = cur.fetchone()
+    conn.close()
+    if not row:
+        return jsonify({'code': 404, 'msg': '站点不存在'})
+
+    full_path = os.path.join(row[0], dirpath) if dirpath else row[0]
+    ok, msg = create_directory(full_path, dirname)
+
+    return jsonify({'code': 0 if ok else 400, 'msg': msg})
+
+@app.route('/api/files/chmod', methods=['POST'])
+@require_auth
+def api_files_chmod():
+    data = request.json or {}
+    site_id = data.get('site_id')
+    filepath = data.get('path', '')
+    mode = data.get('mode', 0)
+
+    if not site_id or not filepath:
+        return jsonify({'code': 400, 'msg': '参数不完整'})
+
+    conn = sqlite3.connect(DB_PATH)
+    cur = conn.execute("SELECT site_path FROM sites WHERE id = ?", (site_id,))
+    row = cur.fetchone()
+    conn.close()
+    if not row:
+        return jsonify({'code': 404, 'msg': '站点不存在'})
+
+    full_path = os.path.join(row[0], filepath)
+    ok, msg = chmod_file(full_path, mode)
+
+    return jsonify({'code': 0 if ok else 400, 'msg': msg})
+
+# ==========================
+# SSL 证书
+# ==========================
+
+@app.route('/api/ssl/certs', methods=['GET'])
+@require_auth
+def api_ssl_list():
+    certs = get_all_certs()
+    status = check_certs_status()
+    return jsonify({'code': 0, 'data': certs, 'status': status})
+
+@app.route('/api/ssl/apply', methods=['POST'])
+@require_auth
+def api_ssl_apply():
+    data = request.json or {}
+    site_id = data.get('site_id')
+    domain = data.get('domain', '')
+
+    if not site_id:
+        # 查找站点
+        conn = sqlite3.connect(DB_PATH)
+        cur = conn.execute("SELECT domain, site_path FROM sites WHERE id = ?", (site_id,))
+        row = cur.fetchone()
+        conn.close()
+        if not row:
+            return jsonify({'code': 404, 'msg': '站点不存在'})
+        domain = row[0]
+
+    if not domain:
+        return jsonify({'code': 400, 'msg': '域名不能为空'})
+
+    ok, msg = apply_letsencrypt(site_id, domain)
+    if ok:
+        # 部署 SSL
+        deploy_ok, deploy_msg = deploy_ssl(domain)
+        write_log('ssl_apply', f'申请 SSL 证书 {domain}', request.remote_addr)
+        return jsonify({'code': 0, 'msg': f'证书申请成功，{deploy_msg}'})
+    else:
+        return jsonify({'code': 400, 'msg': msg})
+
+@app.route('/api/ssl/renew/<int:cert_id>', methods=['POST'])
+@require_auth
+def api_ssl_renew(cert_id):
+    ok, msg = renew_cert(cert_id=cert_id)
+    if ok:
+        write_log('ssl_renew', f'续期证书 ID {cert_id}', request.remote_addr)
+    return jsonify({'code': 0 if ok else 400, 'msg': msg})
+
+@app.route('/api/ssl/renew-all', methods=['POST'])
+@require_auth
+def api_ssl_renew_all():
+    success, fail_count, fail_list = renew_all_expiring(days_before=30)
+    msg = f'续期完成：成功 {success} 个'
+    if fail_count > 0:
+        msg += f'，失败 {fail_count} 个：{"; ".join(fail_list)}'
+    write_log('ssl_renew_all', msg, request.remote_addr)
+    return jsonify({'code': 0, 'msg': msg, 'success': success, 'failed': fail_count})
+
+@app.route('/api/ssl/deploy/<domain>', methods=['POST'])
+@require_auth
+def api_ssl_deploy(domain):
+    ok, msg = deploy_ssl(domain)
+    return jsonify({'code': 0 if ok else 400, 'msg': msg})
+
+# ==========================
+# 定时任务（安全自动更新 + SSL 续期）
+# ==========================
+
+@app.route('/api/cron/run', methods=['POST'])
+@require_auth
+def api_cron_run():
+    """手动触发定时任务（安全更新 + SSL 续期）"""
+    # 安全更新
+    ok_sec, msg_sec = run_security_update()
+
+    # SSL 续期
+    success_ssl, fail_ssl, fail_list = renew_all_expiring(days_before=30)
+
+    msg = f'安全更新：{"成功" if ok_sec else "失败：" + msg_sec}。'
+    msg += f' SSL 续期：成功 {success_ssl} 个'
+    if fail_ssl > 0:
+        msg += f'，失败 {fail_ssl} 个'
+
+    write_log('cron_run', msg, '')
+    return jsonify({'code': 0, 'msg': msg})
+
+
+
+# ==========================
+# 定时任务 API
+# ==========================
+
+@app.route('/api/cron/jobs', methods=['GET'])
+@require_auth
+def api_cron_list():
+    jobs = get_all_crons()
+    return jsonify({'code': 0, 'data': jobs})
+
+@app.route('/api/cron/jobs', methods=['POST'])
+@require_auth
+def api_cron_create():
+    data = request.json or {}
+    site_id = data.get('site_id')
+    name = data.get('name', '').strip()
+    schedule = data.get('schedule', '').strip()
+    command = data.get('command', '').strip()
+
+    if not all([site_id, name, schedule, command]):
+        return jsonify({'code': 400, 'msg': '参数不完整'})
+
+    # 验证 cron 表达式
+    ok, err = validate_cron_expression(schedule)
+    if not ok:
+        return jsonify({'code': 400, 'msg': f'Cron 格式错误: {err}'})
+
+    cron_id, msg = create_cron(site_id, name, schedule, command)
+    if cron_id:
+        write_log('cron_create', f'创建定时任务 {name} ({schedule})', request.remote_addr)
+        return jsonify({'code': 0, 'msg': msg, 'data': {'id': cron_id}})
+    else:
+        return jsonify({'code': 400, 'msg': msg})
+
+@app.route('/api/cron/jobs/<int:cron_id>', methods=['DELETE'])
+@require_auth
+def api_cron_delete(cron_id):
+    ok, msg = delete_cron(cron_id)
+    if ok:
+        write_log('cron_delete', f'删除定时任务 ID {cron_id}', request.remote_addr)
+    return jsonify({'code': 0 if ok else 400, 'msg': msg})
+
+@app.route('/api/cron/jobs/<int:cron_id>/toggle', methods=['POST'])
+@require_auth
+def api_cron_toggle(cron_id):
+    data = request.json or {}
+    enabled = data.get('enabled', True)
+    ok, msg = enable_cron(cron_id, enabled)
+    return jsonify({'code': 0 if ok else 400, 'msg': msg})
+
+@app.route('/api/cron/jobs/<int:cron_id>/run', methods=['POST'])
+@require_auth
+def api_cron_run_now(cron_id):
+    ok, msg = run_cron_now(cron_id)
+    if ok:
+        write_log('cron_run_now', f'手动执行定时任务 ID {cron_id}', request.remote_addr)
+    return jsonify({'code': 0 if ok else 400, 'msg': msg})
+
+# ==========================
+# 远程备份 API
+# ==========================
+
+@app.route('/api/backups/remote', methods=['POST'])
+@require_auth
+def api_remote_backup():
+    data = request.json or {}
+    site_id = data.get('site_id')
+    remote_host = data.get('remote_host', '').strip()
+    remote_user = data.get('remote_user', '').strip()
+    remote_port = data.get('remote_port', 22)
+    remote_path = data.get('remote_path', '').strip()
+    key_path = data.get('key_path', '').strip()
+
+    if not all([site_id, remote_host, remote_user, remote_path]):
+        return jsonify({'code': 400, 'msg': '参数不完整'})
+
+    ok, msg = run_remote_backup(
+        site_id, remote_host, remote_user, remote_port,
+        remote_path, key_path=key_path if key_path else None
+    )
+    if ok:
+        return jsonify({'code': 0, 'msg': msg})
+    else:
+        return jsonify({'code': 400, 'msg': msg})
+
+@app.route('/api/backups/remote/restore/<int:backup_id>', methods=['POST'])
+@require_auth
+def api_remote_restore(backup_id):
+    data = request.json or {}
+    remote_host = data.get('remote_host', '').strip()
+    remote_user = data.get('remote_user', '').strip()
+    remote_port = data.get('remote_port', 22)
+    remote_path = data.get('remote_path', '').strip()
+    key_path = data.get('key_path', '').strip()
+
+    if not all([remote_host, remote_user, remote_path]):
+        return jsonify({'code': 400, 'msg': '参数不完整'})
+
+    ok, msg = sync_restore(
+        backup_id, remote_host, remote_user, remote_port,
+        remote_path, key_path=key_path if key_path else None
+    )
+    return jsonify({'code': 0 if ok else 400, 'msg': msg})
+
+@app.route('/api/backups/remote/test', methods=['POST'])
+@require_auth
+def api_test_rsync():
+    data = request.json or {}
+    host = data.get('host', '').strip()
+    port = data.get('port', 22)
+    user = data.get('user', '').strip()
+    key_path = data.get('key_path', '').strip()
+
+    if not host or not user:
+        return jsonify({'code': 400, 'msg': '主机和用户名不能为空'})
+
+    ok, msg = test_rsync_connection(host, port, user, key_path if key_path else None)
+    return jsonify({'code': 0 if ok else 400, 'msg': msg})
+
+@app.route('/api/backups/stats', methods=['GET'])
+@require_auth
+def api_backup_stats():
+    stats = get_backup_stats()
+    return jsonify({'code': 0, 'data': stats})
+
+# ==========================
+# 设置
+# ==========================
+
+
+@app.route('/api/settings', methods=['GET'])
+@require_auth
+def api_settings_get():
+    cfg = load_config()
+    return jsonify({'code': 0, 'data': cfg})
+
+@app.route('/api/settings', methods=['PUT'])
+@require_auth
+def api_settings_put():
+    data = request.json or {}
+    cfg = load_config()
+    cfg.update({k: v for k, v in data.items() if k in [
+        'panel_domain', 'default_php', 'backup_retention_days',
+        'auto_ssl_renew', 'security_auto_update', 'firewall_enabled'
+    ]})
+    save_config(cfg)
+    return jsonify({'code': 0, 'msg': '设置已保存'})
+
+# ==========================
+# 静态文件
+# ==========================
+
+@app.route('/')
+def serve_index():
+    return app.send_static_file('index.html')
+
+@app.route('/<path:path>')
+def serve_static(path):
+    full = os.path.join(app.static_folder, path)
+    if os.path.exists(full) and not os.path.isdir(full):
+        return app.send_static_file(path)
+    return app.send_static_file('index.html')
+
+# ==========================
+# 健康检查
+# ==========================
+
+@app.route('/health')
+def health():
+    return jsonify({'status': 'ok', 'time': datetime.now().isoformat()})
+
+if __name__ == '__main__':
+    import sys
+    port = int(sys.argv[1]) if len(sys.argv) > 1 else 8848
+    # 初始化数据库
+    from db_init import init_db
+    init_db()
+    # 生成初始 API token
+    if not get_setting('api_token'):
+        set_setting('api_token', secrets.token_hex(32))
+    print(f"[TPanel] 启动于端口 {port}")
+    app.run(host='127.0.0.1', port=port, debug=False)
\ No newline at end of file
diff --git a/backend/remote_backup.py b/backend/remote_backup.py
new file mode 100644
index 0000000..fe9f3e9
--- /dev/null
+++ b/backend/remote_backup.py
@@ -0,0 +1,218 @@
+"""
+TPanel - 远程备份管理（rsync）
+"""
+import os
+import sqlite3
+import subprocess
+import datetime
+from config import DB_PATH
+
+def _run(cmd, timeout=120, shell=False):
+    try:
+        if isinstance(cmd, str) and not shell:
+            cmd = cmd.split()
+        result = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout, shell=shell)
+        return result.returncode, result.stdout.strip(), result.stderr.strip()
+    except subprocess.TimeoutExpired:
+        return -1, '', 'Command timed out'
+    except Exception as e:
+        return -1, '', str(e)
+
+def test_rsync_connection(host, port, user, key_path):
+    """测试到远程服务器的 rsync 连接"""
+    if not host or not user:
+        return False, '主机和用户名不能为空'
+
+    extra = ''
+    if port and str(port) != '22':
+        extra = f'-e "ssh -p {port}"'
+
+    key = f'-i {key_path}' if key_path else ''
+    cmd = f'ssh -o StrictHostKeyChecking=no {key} {user}@{host} "echo ok" {extra}'
+
+    code, out, err = _run(cmd, timeout=15, shell=True)
+
+    if code == 0 and 'ok' in out:
+        return True, '连接成功'
+    else:
+        return False, err or '连接失败'
+
+def get_remote_backups(site_id):
+    """获取某站点的远程备份列表（通过 rsync 列出远程目录）"""
+    conn = sqlite3.connect(DB_PATH)
+    cur = conn.execute("SELECT s.site_user FROM sites s WHERE s.id = ?", (site_id,))
+    row = cur.fetchone()
+    conn.close()
+    if not row:
+        return [], '站点不存在'
+
+    site_user = row[0]
+    remote_bak_dir = f'/opt/tpanel/backups/{site_user}/'
+
+    # 尝试通过 SSH 查看远程备份（需要配置）
+    # 这里返回空列表，实际使用时由用户配置远程路径
+    return [], '请配置远程备份服务器'
+
+def run_remote_backup(site_id, remote_host, remote_user, remote_port, remote_path, key_path=None, use_password=False, password=None):
+    """
+    执行远程 rsync 备份
+    流程：
+    1. 打包本地站点文件
+    2. rsync 推送到远程
+    3. 记录备份日志
+    """
+    conn = sqlite3.connect(DB_PATH)
+    cur = conn.execute("SELECT site_user, domain FROM sites WHERE id = ?", (site_id,))
+    row = cur.fetchone()
+    conn.close()
+
+    if not row:
+        return False, '站点不存在'
+
+    site_user, domain = row
+    site_path = f'/opt/tpanel/sites/{site_user}/'
+
+    timestamp = datetime.datetime.now().strftime('%Y%m%d_%H%M%S')
+    tar_name = f'{domain}_{timestamp}.tar.gz'
+    local_tar = f'/opt/tpanel/backups/{tar_name}'
+
+    # 1. 打包本地文件
+    try:
+        import tarfile
+        with tarfile.open(local_tar, 'w:gz') as tar:
+            tar.add(site_path, arcname=os.path.basename(site_path))
+
+        tar_size = os.path.getsize(local_tar)
+    except Exception as e:
+        return False, f'打包失败: {str(e)}'
+
+    # 2. 构建 rsync 命令
+    ssh_cmd = f'ssh -o StrictHostKeyChecking=no -p {remote_port or 22}'
+    if key_path and os.path.exists(key_path):
+        ssh_cmd += f' -i {key_path}'
+
+    rsync_cmd = [
+        'rsync', '-avz', '--progress',
+        '-e', ssh_cmd,
+        local_tar,
+        f'{remote_user}@{remote_host}:{remote_path}/{tar_name}'
+    ]
+
+    code, out, err = _run(rsync_cmd, timeout=600)
+
+    # 删除本地 tar 包（节省空间）
+    try:
+        os.remove(local_tar)
+    except:
+        pass
+
+    if code != 0:
+        return False, f'rsync 失败: {err}'
+
+    # 3. 写入备份记录
+    conn = sqlite3.connect(DB_PATH)
+    conn.execute("""INSERT INTO backups (site_id, type, file_path, size, status)
+                     VALUES (?, ?, ?, ?, ?)""",
+                 (site_id, 'remote', f'{remote_host}:{remote_path}/{tar_name}', tar_size, 'success'))
+    conn.commit()
+    conn.close()
+
+    # 4. 写安全日志
+    from system import write_log
+    write_log('remote_backup', f'远程备份 {domain} -> {remote_host}', '')
+
+    return True, f'备份成功，已推送至 {remote_host}'
+
+def sync_restore(backup_id, remote_host, remote_user, remote_port, remote_path, key_path=None):
+    """
+    从远程恢复备份到本地
+    """
+    conn = sqlite3.connect(DB_PATH)
+    cur = conn.execute("SELECT site_id, file_path FROM backups WHERE id = ?", (backup_id,))
+    row = cur.fetchone()
+    conn.close()
+
+    if not row:
+        return False, '备份记录不存在'
+
+    site_id, remote_file = row
+
+    conn2 = sqlite3.connect(DB_PATH)
+    cur2 = conn2.execute("SELECT site_user, domain FROM sites WHERE id = ?", (site_id,))
+    row2 = cur2.fetchone()
+    conn2.close()
+
+    if not row2:
+        return False, '站点不存在'
+
+    site_user, domain = row2
+    local_dir = f'/opt/tpanel/backups/{site_user}'
+    os.makedirs(local_dir, exist_ok=True)
+
+    # rsync 从远程拉回
+    ssh_cmd = f'ssh -o StrictHostKeyChecking=no -p {remote_port or 22}'
+    if key_path and os.path.exists(key_path):
+        ssh_cmd += f' -i {key_path}'
+
+    local_tar = os.path.join(local_dir, os.path.basename(remote_file))
+
+    rsync_cmd = [
+        'rsync', '-avz',
+        '-e', ssh_cmd,
+        f'{remote_user}@{remote_host}:{remote_path}/{os.path.basename(remote_file)}',
+        local_dir + '/'
+    ]
+
+    code, out, err = _run(rsync_cmd, timeout=600)
+
+    if code != 0:
+        return False, f'拉取失败: {err}'
+
+    # 解压恢复
+    if os.path.exists(local_tar):
+        import tarfile
+        try:
+            site_path = f'/opt/tpanel/sites/{site_user}/'
+            with tarfile.open(local_tar, 'r:gz') as tar:
+                tar.extractall('/opt/tpanel/backups/')
+            os.remove(local_tar)
+        except Exception as e:
+            return False, f'解压失败: {str(e)}'
+
+    from system import write_log
+    write_log('restore', f'远程恢复 {domain} from {remote_host}', '')
+
+    return True, '恢复成功'
+
+def get_backup_stats():
+    """获取备份统计信息"""
+    conn = sqlite3.connect(DB_PATH)
+    cur = conn.execute("""SELECT type, COUNT(*) as cnt, SUM(size) as total_size
+                          FROM backups GROUP BY type""")
+    rows = cur.fetchall()
+    conn.close()
+
+    total_local = 0
+    total_remote = 0
+    count = 0
+
+    for r in rows:
+        if r[0] == 'local':
+            total_local = r[2] or 0
+            count += r[1]
+        elif r[0] == 'remote':
+            total_remote = r[2] or 0
+
+    # 计算备份目录总大小
+    code, out, _ = _run("du -sm /opt/tpanel/backups 2>/dev/null | awk '{print $1}'", shell=True)
+    try:
+        disk_used = int(out.strip()) if out.strip().isdigit() else 0
+    except:
+        disk_used = total_local / (1024 * 1024)
+
+    return {
+        'total_backups': count,
+        'local_size_mb': round(total_local / (1024 * 1024), 1) if total_local else 0,
+        'remote_size_mb': round(total_remote / (1024 * 1024), 1) if total_remote else 0,
+        'disk_used_mb': disk_used,
+    }
\ No newline at end of file
diff --git a/backend/ssl_manager.py b/backend/ssl_manager.py
new file mode 100644
index 0000000..43e519f
--- /dev/null
+++ b/backend/ssl_manager.py
@@ -0,0 +1,336 @@
+"""
+TPanel - SSL 证书管理 & 自动续期
+"""
+import os
+import sqlite3
+import subprocess
+import re
+from datetime import datetime, timedelta
+from config import DB_PATH, SSL_DIR
+
+LETSENCRYPT_PATH = '/etc/letsencrypt/live'
+
+def _run(cmd, timeout=120, shell=False):
+    try:
+        if isinstance(cmd, str) and not shell:
+            cmd = cmd.split()
+        result = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout, shell=shell)
+        return result.returncode, result.stdout.strip(), result.stderr.strip()
+    except subprocess.TimeoutExpired:
+        return -1, '', 'Command timed out'
+    except Exception as e:
+        return -1, '', str(e)
+
+def get_cert_info(cert_path):
+    """从 PEM 文件读取证书信息（到期日期等）"""
+    if not os.path.exists(cert_path):
+        return None
+
+    code, out, err = _run([
+        'openssl', 'x509', '-in', cert_path,
+        '-noout', '-dates', '-enddate'
+    ], shell=False)
+
+    expire_str = None
+    if code == 0:
+        for line in out.split('\n'):
+            if 'notAfter=' in line:
+                expire_str = line.split('=')[1].strip()
+                break
+
+    if expire_str:
+        try:
+            expire_date = datetime.strptime(expire_str, '%b %d %H:%M:%S %Y %Z')
+            return {
+                'expire_date': expire_date.strftime('%Y-%m-%d'),
+                'days_left': (expire_date - datetime.now()).days,
+                'expire_raw': expire_str,
+            }
+        except Exception:
+            pass
+
+    return {'expire_date': '未知', 'days_left': 0, 'expire_raw': expire_str}
+
+def get_all_certs():
+    """获取所有证书（含到期信息）"""
+    conn = sqlite3.connect(DB_PATH)
+    cur = conn.execute("SELECT * FROM ssl_certs ORDER BY id DESC")
+    cols = [d[0] for d in cur.description]
+    rows = [dict(zip(cols, r)) for r in cur.fetchall()]
+    conn.close()
+
+    result = []
+    for cert in rows:
+        info = get_cert_info(cert['cert_path'])
+        cert.update(info or {})
+        result.append(cert)
+
+    return result
+
+def apply_letsencrypt(site_id, domain):
+    """
+    为站点申请 Let's Encrypt 证书
+    流程：创建验证目录 → 生成 cert → 部署 nginx 配置 → 写入数据库
+    """
+    site_path = f'/opt/tpanel/sites/{domain}/public'
+    le_dir = os.path.join(SSL_DIR, domain)
+    os.makedirs(le_dir, exist_ok=True)
+
+    # 写入 HTTP 验证文件到站点目录
+    well_known = os.path.join(site_path, '.well-known', 'acme-challenge')
+    os.makedirs(well_known, exist_ok=True)
+
+    # 先测试 nginx 配置能访问到验证文件
+    nginx_conf = f'''# SSL verification - {domain}
+server {{
+    listen 80;
+    server_name {domain};
+    root {site_path};
+
+    location /.well-known/acme-challenge/ {{
+        alias {well_known}/;
+        try_files $uri =404;
+    }}
+
+    location / {{
+        return 301 https://$host$request_uri;
+    }}
+}}
+'''
+    conf_path = f'/etc/nginx/sites-available/{domain}.ssl.conf'
+    with open(conf_path, 'w') as f:
+        f.write(nginx_conf)
+
+    enabled_path = f'/etc/nginx/sites-enabled/{domain}.ssl.conf'
+    if not os.path.exists(enabled_path):
+        os.symlink(conf_path, enabled_path)
+
+    code, out, err = _run(['nginx', '-t'])
+    if code != 0:
+        return False, f'Nginx 配置错误: {err}'
+
+    _run(['nginx', '-s', 'reload'])
+
+    # 申请证书（standalone 模式 + webroot）
+    cmd = [
+        'certbot', 'certonly',
+        '--webroot',
+        '-w', site_path,
+        '-d', domain,
+        '--agree-tos',
+        '--non-interactive',
+        '--email', f'admin@{domain}',
+        '--cert-path', os.path.join(le_dir, 'fullchain.pem'),
+        '--key-path', os.path.join(le_dir, 'privkey.pem'),
+        '--chain-path', os.path.join(le_dir, 'chain.pem'),
+    ]
+
+    code, out, err = _run(cmd, timeout=120)
+
+    if code != 0:
+        # 清理失败配置
+        if os.path.exists(enabled_path):
+            os.remove(enabled_path)
+        return False, f'证书申请失败: {err}'
+
+    cert_path = os.path.join(le_dir, 'fullchain.pem')
+    key_path = os.path.join(le_dir, 'privkey.pem')
+
+    if not os.path.exists(cert_path):
+        return False, '证书文件未生成'
+
+    # 写入数据库
+    info = get_cert_info(cert_path)
+    conn = sqlite3.connect(DB_PATH)
+    cur = conn.execute("""INSERT INTO ssl_certs (site_id, domain, cert_path, key_path, expire_date, auto_renew)
+                          VALUES (?, ?, ?, ?, ?, 1)""",
+                       (site_id, domain, cert_path, key_path, info['expire_date'] if info else ''))
+    conn.commit()
+    conn.close()
+
+    return True, f'证书申请成功，到期：{info["expire_date"] if info else "未知"}'
+
+def renew_cert(cert_id=None, domain=None):
+    """
+    续期证书（certbot renew）
+    """
+    if cert_id:
+        conn = sqlite3.connect(DB_PATH)
+        cur = conn.execute("SELECT domain FROM ssl_certs WHERE id = ?", (cert_id,))
+        row = cur.fetchone()
+        conn.close()
+        if row:
+            domain = row[0]
+    elif domain:
+        pass
+    else:
+        return False, '请指定证书 ID 或域名'
+
+    # certbot renew 只续期 30 天内到期的证书
+    code, out, err = _run(
+        ['certbot', 'renew', '--cert-name', domain, '--quiet'],
+        timeout=120
+    )
+
+    if code != 0 and 'No renewals attempted' not in out and 'already valid' not in out:
+        return False, f'续期失败: {err}'
+
+    # 更新到期日期
+    le_dir = os.path.join(SSL_DIR, domain)
+    cert_path = os.path.join(le_dir, 'fullchain.pem')
+    info = get_cert_info(cert_path)
+
+    if info:
+        conn = sqlite3.connect(DB_PATH)
+        cur = conn.execute("UPDATE ssl_certs SET expire_date = ? WHERE domain = ?",
+                          (info['expire_date'], domain))
+        conn.commit()
+        conn.close()
+
+    return True, f'证书已续期，新到期：{info["expire_date"] if info else "未知"}'
+
+def renew_all_expiring(days_before=30):
+    """
+    续期所有即将到期的证书（供定时任务调用）
+    返回：(成功数量, 失败数量, 详情列表)
+    """
+    conn = sqlite3.connect(DB_PATH)
+    cur = conn.execute("SELECT * FROM ssl_certs WHERE auto_renew = 1")
+    rows = cur.fetchall()
+    conn.close()
+
+    if not rows:
+        return 0, 0, []
+
+    success, fail = 0, []
+    for row in rows:
+        cert_id, site_id, domain = row[0], row[1], row[2]
+        info = get_cert_info(row[3])  # cert_path
+
+        # 检查是否在 30 天内到期
+        if info and info['days_left'] <= days_before:
+            ok, msg = renew_cert(cert_id=cert_id, domain=domain)
+            if ok:
+                success += 1
+            else:
+                fail.append(f'{domain}: {msg}')
+        elif not info or info['days_left'] > days_before:
+            # 证书已过期或不存在
+            pass
+
+    return success, len(fail), fail
+
+def deploy_ssl(domain):
+    """
+    将已有证书部署到 Nginx（更新 nginx 配置启用 HTTPS）
+    """
+    le_dir = os.path.join(SSL_DIR, domain)
+    cert_path = os.path.join(le_dir, 'fullchain.pem')
+    key_path = os.path.join(le_dir, 'privkey.pem')
+
+    if not os.path.exists(cert_path) or not os.path.exists(key_path):
+        return False, '证书文件不存在'
+
+    site_path = f'/opt/tpanel/sites/{domain}/public'
+
+    # 写入 HTTPS + HTTP 重定向配置
+    nginx_conf = f'''# {domain} - HTTPS
+server {{
+    listen 80;
+    server_name {domain};
+    return 301 https://$server_name$request_uri;
+}}
+
+server {{
+    listen 443 ssl http2;
+    server_name {domain};
+
+    ssl_certificate {cert_path};
+    ssl_certificate_key {key_path};
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_ciphers HIGH:!aNULL:!MD5;
+
+    root {site_path};
+    index index.php index.html;
+
+    access_log /opt/tpanel/logs/{domain}.access.log;
+    error_log /opt/tpanel/logs/{domain}.error.log;
+
+    location / {{
+        try_files $uri $uri/ /index.php?$query_string;
+    }}
+
+    location ~ \\.php$ {{
+        include fastcgi_params;
+        fastcgi_pass unix:/run/php/php-fpm8.1.sock;
+        fastcgi_index index.php;
+        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+    }}
+
+    location ~ /\\.ht {{
+        deny all;
+    }}
+}}
+'''
+    conf_path = f'/etc/nginx/sites-available/{domain}.conf'
+
+    # 清理旧的 SSL 配置
+    for old_conf in [
+        f'/etc/nginx/sites-enabled/{domain}.ssl.conf',
+        f'/etc/nginx/sites-enabled/{domain}.conf',
+    ]:
+        if os.path.exists(old_conf) and os.path.islink(old_conf):
+            os.remove(old_conf)
+
+    with open(conf_path, 'w') as f:
+        f.write(nginx_conf)
+
+    if not os.path.exists(f'/etc/nginx/sites-enabled/{domain}.conf'):
+        os.symlink(conf_path, f'/etc/nginx/sites-enabled/{domain}.conf')
+
+    code, out, err = _run(['nginx', '-t'])
+    if code != 0:
+        return False, f'Nginx 配置错误: {err}'
+
+    _run(['nginx', '-s', 'reload'])
+
+    # 更新数据库 ssl_enabled
+    conn = sqlite3.connect(DB_PATH)
+    cur = conn.execute("SELECT id FROM sites WHERE domain = ?", (domain,))
+    row = cur.fetchone()
+    if row:
+        conn.execute("UPDATE sites SET ssl_enabled = 1, ssl_cert_path = ?, ssl_key_path = ? WHERE domain = ?",
+                     (cert_path, key_path, domain))
+    conn.commit()
+    conn.close()
+
+    return True, f'HTTPS 已启用'
+
+def check_certs_status():
+    """
+    检查所有证书状态，返回统计信息
+    """
+    certs = get_all_certs()
+    expired = []
+    expiring = []
+    valid = []
+
+    for cert in certs:
+        info = get_cert_info(cert['cert_path'])
+        if info:
+            days = info['days_left']
+            if days < 0:
+                expired.append({**cert, **info})
+            elif days <= 7:
+                expiring.append({**cert, **info})
+            else:
+                valid.append({**cert, **info})
+
+    return {
+        'total': len(certs),
+        'valid': len(valid),
+        'expiring': len(expiring),
+        'expired': len(expired),
+        'expiring_list': expiring,
+        'expired_list': expired,
+    }
\ No newline at end of file
diff --git a/backend/system.py b/backend/system.py
new file mode 100644
index 0000000..d56ed38
--- /dev/null
+++ b/backend/system.py
@@ -0,0 +1,309 @@
+"""
+TPanel - 系统操作模块
+仅使用白名单命令，禁止直接执行用户传入的原始 shell 字符串
+"""
+import subprocess
+import os
+import shutil
+import tarfile
+import datetime
+
+def _run(cmd, shell=False, capture=True, timeout=30):
+    """执行命令，超时保护"""
+    try:
+        if isinstance(cmd, str) and not shell:
+            cmd = cmd.split()
+        result = subprocess.run(
+            cmd,
+            capture_output=capture,
+            text=True,
+            timeout=timeout,
+            shell=shell
+        )
+        return result.returncode, result.stdout.strip(), result.stderr.strip()
+    except subprocess.TimeoutExpired:
+        return -1, '', 'Command timed out'
+    except Exception as e:
+        return -1, '', str(e)
+
+def nginx_reload():
+    return _run(['nginx', '-t']) + _run(['nginx', '-s', 'reload'])
+
+def nginx_stop():
+    return _run(['nginx', '-s', 'stop'])
+
+def nginx_start():
+    return _run(['nginx'])
+
+def nginx_status():
+    code, out, _ = _run(['ps', 'aux'], capture=True)
+    running = 'nginx: master' in out
+    return running
+
+def mysql_status():
+    code, out, _ = _run(['systemctl', 'is-active', 'mysql'])
+    return out == 'active'
+
+def create_site_user(username):
+    """创建 Linux 用户，禁 shell，隔离目录"""
+    # 检查用户是否存在
+    code, out, _ = _run(['id', username], capture=True)
+    if code == 0:
+        return True, '用户已存在'
+
+    # 创建用户，home 目录即网站根目录，禁 shell
+    code, out, err = _run(
+        ['useradd', '-m', '-s', '/usr/sbin/nologin', '-d', f'/home/{username}', username]
+    )
+    if code != 0:
+        return False, err
+    return True, '用户创建成功'
+
+def delete_site_user(username):
+    code, out, _ = _run(['id', username], capture=True)
+    if code != 0:
+        return True, '用户不存在，跳过'
+
+    # 把用户的所有进程 kill 掉再删
+    _run(['pkill', '-u', username], capture=True)
+    code, out, err = _run(['userdel', '-r', username])
+    if code != 0:
+        return False, err
+    return True, '用户删除成功'
+
+def set_site_permissions(site_path, site_user):
+    """设置站点目录权限"""
+    _run(['chown', '-R', f'{site_user}:{site_user}', site_path])
+    _run(['chmod', '-R', '755', site_path])
+    _run(['chmod', '-R', '700', site_path + '/storage' if os.path.exists(site_path + '/storage') else site_path])
+
+def write_nginx_config(domain, site_path, php_version='8.1', ssl=False):
+    """写入 Nginx 配置"""
+    # PHP-FPM socket 路径（根据版本）
+    fpm_sock = f'/run/php/php-fpm-{php_version}.sock'
+    if not os.path.exists(f'/run/php/php-fpm-{php_version}.sock'):
+        fpm_sock = '/run/php/php-fpm8.1.sock'
+
+    nginx_conf = f'''# TPanel - {domain}
+server {{
+    listen 80;
+    server_name {domain};
+
+    root {site_path};
+    index index.php index.html;
+
+    access_log /opt/tpanel/logs/{domain}.access.log;
+    error_log /opt/tpanel/logs/{domain}.error.log;
+
+    location / {{
+        try_files $uri $uri/ /index.php?$query_string;
+    }}
+
+    location ~ \\.php$ {{
+        include fastcgi_params;
+        fastcgi_pass unix:{fpm_sock};
+        fastcgi_index index.php;
+        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+    }}
+
+    location ~ /\\.ht {{
+        deny all;
+    }}
+}}
+'''
+    if ssl:
+        nginx_conf = nginx_conf.replace('listen 80;', '''listen 80;
+    listen 443 ssl http2;''', 1)
+
+    conf_path = f'/etc/nginx/sites-available/{domain}.conf'
+    with open(conf_path, 'w') as f:
+        f.write(nginx_conf)
+
+    # 启用站点
+    enabled_path = f'/etc/nginx/sites-enabled/{domain}.conf'
+    if not os.path.exists(enabled_path):
+        os.symlink(conf_path, enabled_path)
+
+    code, out, err = _run(['nginx', '-t'])
+    if code != 0:
+        return False, err
+
+    _run(['nginx', '-s', 'reload'])
+    return True, 'Nginx 配置已更新'
+
+def remove_nginx_config(domain):
+    """删除站点 Nginx 配置"""
+    conf_path = f'/etc/nginx/sites-available/{domain}.conf'
+    enabled_path = f'/etc/nginx/sites-enabled/{domain}.conf'
+
+    if os.path.exists(enabled_path):
+        os.remove(enabled_path)
+    if os.path.exists(conf_path):
+        os.remove(conf_path)
+
+    _run(['nginx', '-s', 'reload'])
+
+def create_mysql_db(name, db_user, db_pass):
+    """创建 MySQL 数据库和用户"""
+    code, out, err = _run(
+        f"mysql -e \"CREATE DATABASE IF NOT EXISTS `{name}` CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;\"",
+        shell=True
+    )
+    if code != 0:
+        return False, err
+
+    code, out, err = _run(
+        f"mysql -e \"CREATE USER IF NOT EXISTS '{db_user}'@'localhost' IDENTIFIED BY '{db_pass}';\"",
+        shell=True
+    )
+    if code != 0:
+        return False, err
+
+    code, out, err = _run(
+        f"mysql -e \"GRANT ALL PRIVILEGES ON `{name}`.* TO '{db_user}'@'localhost';\"",
+        shell=True
+    )
+    if code != 0:
+        return False, err
+
+    _run("mysql -e \"FLUSH PRIVILEGES;\"", shell=True)
+    return True, '数据库创建成功'
+
+def delete_mysql_db(name, db_user):
+    code, out, err = _run(f"mysql -e \"DROP DATABASE IF EXISTS `{name}`;\"", shell=True)
+    _run(f"mysql -e \"DROP USER IF EXISTS '{db_user}'@'localhost';\"", shell=True)
+    _run("mysql -e \"FLUSH PRIVILEGES;\"", shell=True)
+    return True, '数据库已删除'
+
+def get_mysql_size():
+    """获取 MySQL 数据目录大小（MB）"""
+    code, out, _ = _run("du -sm /var/lib/mysql 2>/dev/null || echo 0", shell=True)
+    try:
+        return int(out.split()[0])
+    except:
+        return 0
+
+def backup_site(site_path, site_name, db_name=None, db_user=None, db_pass=None):
+    """备份站点文件和数据库"""
+    timestamp = datetime.datetime.now().strftime('%Y%m%d_%H%M%S')
+    backup_name = f'{site_name}_{timestamp}'
+    backup_path = f'/opt/tpanel/backups/{backup_name}.tar.gz'
+
+    try:
+        # 备份文件
+        with tarfile.open(backup_path, 'w:gz') as tar:
+            tar.add(site_path, arcname=os.path.basename(site_path))
+
+        # 备份数据库
+        if db_name:
+            dump_path = f'/opt/tpanel/backups/{backup_name}_db.sql.gz'
+            code, out, err = _run(
+                f"mysqldump -u {'root'} -p'' {db_name} | gzip > {dump_path}",
+                shell=True, timeout=120
+            )
+            if code == 0:
+                tar.add(dump_path, arcname='database.sql.gz')
+                os.remove(dump_path)
+
+        size = os.path.getsize(backup_path)
+        return True, backup_path, size
+    except Exception as e:
+        return False, '', 0
+
+def restore_backup(backup_path, site_path, site_name):
+    """恢复备份"""
+    try:
+        # 解压到临时目录
+        temp_dir = f'/opt/tpanel/backups/temp_{site_name}'
+        os.makedirs(temp_dir, exist_ok=True)
+        with tarfile.open(backup_path, 'r:gz') as tar:
+            tar.extractall(temp_dir)
+
+        # 找到网站目录内容
+        items = os.listdir(temp_dir)
+        src_dir = os.path.join(temp_dir, items[0]) if items else temp_dir
+
+        # 复制回站点目录
+        for item in os.listdir(src_dir):
+            src = os.path.join(src_dir, item)
+            dst = os.path.join(site_path, item)
+            if os.path.isdir(src):
+                shutil.copytree(src, dst, dirs_exist_ok=True)
+            else:
+                shutil.copy2(src, dst)
+
+        shutil.rmtree(temp_dir)
+        return True, '恢复成功'
+    except Exception as e:
+        return False, str(e)
+
+def run_security_update():
+    """执行系统安全更新"""
+    code, out, err = _run(['apt-get', 'update'], timeout=120)
+    if code != 0:
+        return False, err
+
+    # 只安装安全更新（带 --only-upgrade 是安全的做法）
+    code, out, err = _run(
+        ['apt-get', 'upgrade', '-y', '--only-upgrade'],
+        timeout=300
+    )
+    if code == 0:
+        return True, f'安全更新完成'
+    else:
+        return False, err
+
+def get_security_status():
+    """获取安全状态"""
+    # 可升级的安全包数量
+    code, out, _ = _run(
+        "apt list --upgradable 2>/dev/null | grep -c security || echo 0",
+        shell=True
+    )
+    try:
+        updatable = int(out.strip())
+    except:
+        updatable = 0
+
+    # 最近的安全日志条数
+    code2, out2, _ = _run(
+        "journalctl --since '1 day ago' --priority=err 2>/dev/null | wc -l",
+        shell=True
+    )
+    try:
+        errors = int(out2.strip())
+    except:
+        errors = 0
+
+    return {'upgradable_security_packages': updatable, 'recent_errors': errors}
+
+def get_system_stats():
+    """获取系统状态"""
+    code, cpu_out, _ = _run("cat /proc/loadavg | awk '{print $1,$2,$3}'", shell=True)
+    code, mem_out, _ = _run("free -m | awk 'NR==2{print $3,$2}'", shell=True)
+    code, disk_out, _ = _run("df -h / | tail -1 | awk '{print $3,$4}'", shell=True)
+    code, cpu_pct, _ = _run("top -bn1 | grep 'Cpu(s)' | awk '{print $2}' | sed 's/%us,//'", shell=True)
+
+    nginx_running = nginx_status()
+    mysql_running = mysql_status()
+
+    return {
+        'load': cpu_out,
+        'cpu_pct': cpu_pct.strip() + '%' if cpu_pct else 'N/A',
+        'mem_used_mb': mem_out.split()[0] if mem_out else '0',
+        'mem_total_mb': mem_out.split()[1] if mem_out else '0',
+        'disk_used': disk_out.split()[0] if disk_out else '0',
+        'disk_free': disk_out.split()[1] if disk_out else '0',
+        'nginx_running': nginx_running,
+        'mysql_running': mysql_running,
+    }
+
+def write_log(event_type, details, ip=''):
+    """写安全日志"""
+    import sqlite3
+    from config import DB_PATH
+    conn = sqlite3.connect(DB_PATH)
+    conn.execute("INSERT INTO security_logs (event_type, details, ip) VALUES (?, ?, ?)",
+                 (event_type, details, ip))
+    conn.commit()
+    conn.close()
\ No newline at end of file
diff --git a/frontend/index.html b/frontend/index.html
new file mode 100644
index 0000000..2bc4088
--- /dev/null
+++ b/frontend/index.html
@@ -0,0 +1,2377 @@
+<!DOCTYPE html>
+<html lang="zh-CN">
+<head>
+<meta charset="UTF-8">
+<meta name="viewport" content="width=device-width, initial-scale=1.0">
+<title>T面板 - Linux 网站管理面板</title>
+<link rel="preconnect" href="https://fonts.googleapis.com">
+<link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&family=JetBrains+Mono:wght@400;500&display=swap" rel="stylesheet">
+<style>
+:root {
+  --bg: #0a0e1a;
+  --sidebar-bg: #0f172a;
+  --card: #1a2332;
+  --card-hover: #1e293b;
+  --border: #2a3548;
+  --green: #22c55e;
+  --green-dim: rgba(34,197,94,0.15);
+  --red: #ef4444;
+  --red-dim: rgba(239,68,68,0.15);
+  --yellow: #eab308;
+  --blue: #3b82f6;
+  --text: #e2e8f0;
+  --text-dim: #64748b;
+  --text-muted: #94a3b8;
+}
+
+* { margin: 0; padding: 0; box-sizing: border-box; }
+
+body {
+  font-family: 'Inter', -apple-system, sans-serif;
+  background: var(--bg);
+  color: var(--text);
+  min-height: 100vh;
+  display: flex;
+  overflow-x: hidden;
+}
+
+/* Sidebar */
+.sidebar {
+  width: 220px;
+  min-height: 100vh;
+  background: var(--sidebar-bg);
+  border-right: 1px solid var(--border);
+  display: flex;
+  flex-direction: column;
+  position: fixed;
+  left: 0;
+  top: 0;
+  bottom: 0;
+  overflow-y: auto;
+}
+
+.sidebar-logo {
+  padding: 20px 20px 16px;
+  border-bottom: 1px solid var(--border);
+  display: flex;
+  align-items: center;
+  gap: 10px;
+}
+
+.sidebar-logo .icon {
+  width: 36px;
+  height: 36px;
+  background: var(--green);
+  border-radius: 10px;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  font-size: 18px;
+  flex-shrink: 0;
+}
+
+.sidebar-logo span {
+  font-size: 18px;
+  font-weight: 800;
+  color: #fff;
+}
+
+.sidebar-nav {
+  padding: 12px 8px;
+  flex: 1;
+}
+
+.nav-item {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  padding: 10px 12px;
+  border-radius: 10px;
+  color: var(--text-dim);
+  text-decoration: none;
+  font-size: 14px;
+  font-weight: 500;
+  cursor: pointer;
+  transition: all 0.15s;
+  margin-bottom: 2px;
+}
+
+.nav-item:hover {
+  background: var(--card);
+  color: var(--text);
+}
+
+.nav-item.active {
+  background: var(--green-dim);
+  color: var(--green);
+}
+
+.nav-item .emoji { font-size: 16px; }
+
+.nav-section {
+  padding: 16px 12px 6px;
+  font-size: 11px;
+  font-weight: 700;
+  text-transform: uppercase;
+  letter-spacing: 0.08em;
+  color: var(--text-dim);
+}
+
+.sidebar-footer {
+  padding: 16px 12px;
+  border-top: 1px solid var(--border);
+}
+
+.sidebar-footer .version {
+  font-size: 12px;
+  color: var(--text-dim);
+}
+
+/* Main */
+.main {
+  margin-left: 220px;
+  flex: 1;
+  min-height: 100vh;
+}
+
+/* Topbar */
+.topbar {
+  height: 64px;
+  border-bottom: 1px solid var(--border);
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  padding: 0 28px;
+  background: var(--sidebar-bg);
+  position: sticky;
+  top: 0;
+  z-index: 10;
+}
+
+.topbar-left {
+  display: flex;
+  align-items: center;
+  gap: 20px;
+}
+
+.topbar h1 {
+  font-size: 17px;
+  font-weight: 700;
+  color: #fff;
+}
+
+.topbar-right {
+  display: flex;
+  align-items: center;
+  gap: 16px;
+}
+
+.status-pill {
+  display: flex;
+  align-items: center;
+  gap: 6px;
+  padding: 6px 14px;
+  border-radius: 100px;
+  font-size: 13px;
+  font-weight: 500;
+}
+
+.status-pill.ok {
+  background: var(--green-dim);
+  color: var(--green);
+}
+
+.status-pill.warn {
+  background: var(--red-dim);
+  color: var(--red);
+}
+
+.status-pill .dot {
+  width: 7px;
+  height: 7px;
+  border-radius: 50%;
+  background: currentColor;
+}
+
+.topbar-btn {
+  display: flex;
+  align-items: center;
+  gap: 6px;
+  padding: 8px 16px;
+  background: var(--card);
+  border: 1px solid var(--border);
+  border-radius: 8px;
+  color: var(--text);
+  font-size: 13px;
+  font-weight: 500;
+  cursor: pointer;
+  text-decoration: none;
+  transition: all 0.15s;
+}
+
+.topbar-btn:hover {
+  background: var(--card-hover);
+  border-color: var(--text-dim);
+}
+
+.topbar-btn.green {
+  background: var(--green);
+  color: #fff;
+  border-color: var(--green);
+}
+
+.topbar-btn.green:hover {
+  background: #16a34a;
+}
+
+.topbar-btn.red {
+  color: var(--red);
+}
+
+.topbar-btn.red:hover {
+  background: var(--red-dim);
+}
+
+/* Content */
+.content {
+  padding: 28px;
+}
+
+/* Dashboard grid */
+.stats-grid {
+  display: grid;
+  grid-template-columns: repeat(4, 1fr);
+  gap: 16px;
+  margin-bottom: 28px;
+}
+
+.stat-card {
+  background: var(--card);
+  border: 1px solid var(--border);
+  border-radius: 14px;
+  padding: 20px 22px;
+}
+
+.stat-card .label {
+  font-size: 13px;
+  color: var(--text-dim);
+  margin-bottom: 8px;
+  display: flex;
+  align-items: center;
+  gap: 6px;
+}
+
+.stat-card .value {
+  font-size: 26px;
+  font-weight: 800;
+  color: #fff;
+  margin-bottom: 4px;
+}
+
+.stat-card .sub {
+  font-size: 12px;
+  color: var(--text-dim);
+}
+
+.stat-card .pct {
+  display: inline-block;
+  padding: 2px 8px;
+  border-radius: 4px;
+  font-size: 11px;
+  font-weight: 600;
+  margin-left: 6px;
+}
+
+.stat-card .pct.up { background: var(--green-dim); color: var(--green); }
+.stat-card .pct.warn { background: var(--red-dim); color: var(--red); }
+
+/* Dashboard panels */
+.dashboard-row {
+  display: grid;
+  grid-template-columns: 1fr 1fr;
+  gap: 16px;
+  margin-bottom: 28px;
+}
+
+.panel {
+  background: var(--card);
+  border: 1px solid var(--border);
+  border-radius: 14px;
+  overflow: hidden;
+}
+
+.panel-header {
+  padding: 16px 20px;
+  border-bottom: 1px solid var(--border);
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+}
+
+.panel-title {
+  font-size: 15px;
+  font-weight: 700;
+  color: #fff;
+}
+
+.panel-body {
+  padding: 16px 20px;
+}
+
+.panel-body p {
+  font-size: 13px;
+  color: var(--text-dim);
+  line-height: 1.7;
+}
+
+/* Service status list */
+.service-item {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  padding: 12px 0;
+  border-bottom: 1px solid var(--border);
+}
+
+.service-item:last-child { border-bottom: none; }
+
+.service-info {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+}
+
+.service-name {
+  font-size: 14px;
+  font-weight: 600;
+  color: var(--text);
+}
+
+.service-desc {
+  font-size: 12px;
+  color: var(--text-dim);
+}
+
+/* Tables */
+.data-table {
+  width: 100%;
+  border-collapse: collapse;
+}
+
+.data-table th {
+  text-align: left;
+  padding: 10px 12px;
+  font-size: 12px;
+  font-weight: 700;
+  text-transform: uppercase;
+  letter-spacing: 0.05em;
+  color: var(--text-dim);
+  border-bottom: 1px solid var(--border);
+}
+
+.data-table td {
+  padding: 12px;
+  font-size: 13px;
+  color: var(--text-muted);
+  border-bottom: 1px solid rgba(42,53,72,0.5);
+}
+
+.data-table tr:hover td {
+  background: var(--card-hover);
+}
+
+.data-table .domain {
+  color: var(--text);
+  font-weight: 600;
+  font-family: 'JetBrains Mono', monospace;
+  font-size: 13px;
+}
+
+.data-table .badge {
+  display: inline-block;
+  padding: 3px 10px;
+  border-radius: 6px;
+  font-size: 12px;
+  font-weight: 600;
+}
+
+.badge.green { background: var(--green-dim); color: var(--green); }
+.badge.red { background: var(--red-dim); color: var(--red); }
+.badge.yellow { background: rgba(234,179,8,0.15); color: var(--yellow); }
+.badge.blue { background: rgba(59,130,246,0.15); color: var(--blue); }
+
+.data-table .actions {
+  display: flex;
+  gap: 4px;
+}
+
+.data-table .btn-icon {
+  width: 30px;
+  height: 30px;
+  border: none;
+  background: transparent;
+  border-radius: 6px;
+  cursor: pointer;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  font-size: 14px;
+  transition: all 0.15s;
+  color: var(--text-dim);
+}
+
+.data-table .btn-icon:hover {
+  background: var(--border);
+  color: var(--text);
+}
+
+.data-table .btn-icon.danger:hover {
+  background: var(--red-dim);
+  color: var(--red);
+}
+
+/* Forms */
+.form-section {
+  margin-bottom: 28px;
+}
+
+.form-section h3 {
+  font-size: 15px;
+  font-weight: 700;
+  color: #fff;
+  margin-bottom: 16px;
+  padding-bottom: 12px;
+  border-bottom: 1px solid var(--border);
+}
+
+.form-row {
+  display: grid;
+  grid-template-columns: repeat(2, 1fr);
+  gap: 16px;
+}
+
+.form-group {
+  display: flex;
+  flex-direction: column;
+  gap: 6px;
+  margin-bottom: 14px;
+}
+
+.form-group label {
+  font-size: 13px;
+  font-weight: 600;
+  color: var(--text-muted);
+}
+
+.form-group input,
+.form-group select,
+.form-group textarea {
+  padding: 10px 14px;
+  background: var(--bg);
+  border: 1px solid var(--border);
+  border-radius: 8px;
+  color: var(--text);
+  font-size: 14px;
+  font-family: 'Inter', sans-serif;
+  transition: border-color 0.15s;
+}
+
+.form-group input:focus,
+.form-group select:focus,
+.form-group textarea:focus {
+  outline: none;
+  border-color: var(--green);
+}
+
+.form-group textarea {
+  resize: vertical;
+  min-height: 80px;
+}
+
+.form-group input[type="checkbox"] {
+  width: 18px;
+  height: 18px;
+  accent-color: var(--green);
+}
+
+.form-actions {
+  display: flex;
+  gap: 10px;
+  margin-top: 8px;
+}
+
+.btn {
+  display: inline-flex;
+  align-items: center;
+  gap: 6px;
+  padding: 10px 20px;
+  border-radius: 8px;
+  font-size: 14px;
+  font-weight: 600;
+  border: none;
+  cursor: pointer;
+  transition: all 0.15s;
+  text-decoration: none;
+}
+
+.btn-primary {
+  background: var(--green);
+  color: #fff;
+}
+
+.btn-primary:hover {
+  background: #16a34a;
+}
+
+.btn-secondary {
+  background: var(--card-hover);
+  color: var(--text);
+  border: 1px solid var(--border);
+}
+
+.btn-secondary:hover {
+  background: var(--border);
+}
+
+.btn-danger {
+  background: var(--red-dim);
+  color: var(--red);
+}
+
+.btn-danger:hover {
+  background: var(--red);
+  color: #fff;
+}
+
+/* Log viewer */
+.log-line {
+  font-family: 'JetBrains Mono', monospace;
+  font-size: 12px;
+  padding: 5px 0;
+  border-bottom: 1px solid rgba(42,53,72,0.3);
+  display: flex;
+  gap: 12px;
+}
+
+.log-time { color: var(--text-dim); flex-shrink: 0; }
+.log-type { color: var(--green); flex-shrink: 0; width: 80px; }
+.log-msg { color: var(--text-muted); word-break: break-all; }
+.log-msg.err { color: var(--red); }
+
+/* Modal */
+.modal-overlay {
+  position: fixed;
+  inset: 0;
+  background: rgba(0,0,0,0.7);
+  display: none;
+  align-items: center;
+  justify-content: center;
+  z-index: 100;
+  backdrop-filter: blur(4px);
+}
+
+.modal-overlay.show { display: flex; }
+
+.modal {
+  background: var(--card);
+  border: 1px solid var(--border);
+  border-radius: 16px;
+  width: 520px;
+  max-width: 90vw;
+  max-height: 85vh;
+  overflow-y: auto;
+}
+
+.modal-header {
+  padding: 20px 24px;
+  border-bottom: 1px solid var(--border);
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+}
+
+.modal-title {
+  font-size: 16px;
+  font-weight: 700;
+  color: #fff;
+}
+
+.modal-close {
+  width: 32px;
+  height: 32px;
+  border: none;
+  background: var(--card-hover);
+  border-radius: 8px;
+  cursor: pointer;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  font-size: 18px;
+  color: var(--text-dim);
+}
+
+.modal-close:hover { background: var(--red-dim); color: var(--red); }
+
+.modal-body {
+  padding: 24px;
+}
+
+.modal-footer {
+  padding: 16px 24px;
+  border-top: 1px solid var(--border);
+  display: flex;
+  justify-content: flex-end;
+  gap: 10px;
+}
+
+/* Alerts */
+.alert {
+  padding: 12px 16px;
+  border-radius: 10px;
+  font-size: 14px;
+  margin-bottom: 16px;
+  display: none;
+}
+
+.alert.show { display: block; }
+.alert.success { background: var(--green-dim); color: var(--green); border: 1px solid rgba(34,197,94,0.3); }
+.alert.error { background: var(--red-dim); color: var(--red); border: 1px solid rgba(239,68,68,0.3); }
+.alert.warn { background: rgba(234,179,8,0.15); color: var(--yellow); border: 1px solid rgba(234,179,8,0.3); }
+
+/* Empty state */
+.empty-state {
+  text-align: center;
+  padding: 48px 24px;
+  color: var(--text-dim);
+}
+
+.empty-state .icon { font-size: 40px; margin-bottom: 12px; }
+.empty-state p { font-size: 14px; }
+
+/* Security bar */
+.security-bar {
+  background: var(--card);
+  border: 1px solid var(--border);
+  border-radius: 14px;
+  padding: 16px 20px;
+  display: flex;
+  align-items: center;
+  gap: 16px;
+  margin-bottom: 28px;
+}
+
+.security-bar .sec-icon {
+  width: 44px;
+  height: 44px;
+  border-radius: 10px;
+  background: var(--green-dim);
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  font-size: 20px;
+  flex-shrink: 0;
+}
+
+.security-bar .sec-info { flex: 1; }
+.security-bar .sec-title { font-size: 14px; font-weight: 700; color: #fff; margin-bottom: 2px; }
+.security-bar .sec-desc { font-size: 12px; color: var(--text-dim); }
+
+/* Tab system */
+.tabs {
+  display: flex;
+  gap: 4px;
+  border-bottom: 1px solid var(--border);
+  margin-bottom: 24px;
+}
+
+.tab {
+  padding: 8px 18px;
+  font-size: 14px;
+  font-weight: 500;
+  color: var(--text-dim);
+  cursor: pointer;
+  border-bottom: 2px solid transparent;
+  transition: all 0.15s;
+}
+
+.tab:hover { color: var(--text); }
+.tab.active { color: var(--green); border-bottom-color: var(--green); }
+
+/* Page sections */
+.page { display: none; }
+.page.active { display: block; }
+
+/* Responsive */
+@media(max-width: 1024px) {
+  .stats-grid { grid-template-columns: repeat(2, 1fr); }
+  .dashboard-row { grid-template-columns: 1fr; }
+}
+
+@media(max-width: 768px) {
+  .sidebar { display: none; }
+  .main { margin-left: 0; }
+  .form-row { grid-template-columns: 1fr; }
+}
+</style>
+</head>
+<body>
+
+<!-- Sidebar -->
+<aside class="sidebar">
+  <div class="sidebar-logo">
+    <div class="icon">🌿</div>
+    <span>T面板</span>
+  </div>
+  <nav class="sidebar-nav">
+    <div class="nav-section">概览</div>
+    <a class="nav-item active" data-page="dashboard">
+      <span class="emoji">📊</span> 仪表盘
+    </a>
+    <a class="nav-item" data-page="sites">
+      <span class="emoji">🌐</span> 网站
+    </a>
+    <a class="nav-item" data-page="databases">
+      <span class="emoji">🗄️</span> 数据库
+    </a>
+    <a class="nav-item" data-page="ssl">
+      <span class="emoji">🔐</span> SSL
+    </a>
+    <a class="nav-item" data-page="backups">
+      <span class="emoji">💾</span> 备份
+    </a>
+    <div class="nav-section">系统</div>
+    <a class="nav-item" data-page="cronjobs">
+      <span class="emoji">⏰</span> 定时任务
+    </a>
+    <a class="nav-item" data-page="security">
+      <span class="emoji">🛡️</span> 安全
+    </a>
+    <a class="nav-item" data-page="settings">
+      <span class="emoji">⚙️</span> 设置
+    </a>
+    <a class="nav-item" data-page="files">
+      <span class="emoji">📁</span> 文件
+    </a>
+    <a class="nav-item" data-page="logs">
+      <span class="emoji">📋</span> 日志
+    </a>
+  </nav>
+  <div class="sidebar-footer">
+    <div class="version">T面板 v1.0.0</div>
+    <div class="version" style="margin-top:4px;">tpanel.cn</div>
+  </div>
+</aside>
+
+<!-- Main -->
+<main class="main">
+  <div class="topbar">
+    <div class="topbar-left">
+      <h1 id="pageTitle">仪表盘</h1>
+    </div>
+    <div class="topbar-right">
+      <div class="status-pill ok" id="sysStatus">
+        <div class="dot"></div>
+        <span>系统正常</span>
+      </div>
+      <a href="https://tpanel.cn" target="_blank" class="topbar-btn">官方网站</a>
+      <button class="topbar-btn red" onclick="logout()">退出</button>
+    </div>
+  </div>
+
+  <div class="content" id="mainContent">
+
+    <!-- Dashboard -->
+    <div class="page active" id="page-dashboard">
+      <div class="stats-grid">
+        <div class="stat-card">
+          <div class="label">📁 网站总数</div>
+          <div class="value" id="stat-sites">-</div>
+          <div class="sub" id="stat-sites-sub">个站点</div>
+        </div>
+        <div class="stat-card">
+          <div class="label">🗄️ 数据库</div>
+          <div class="value" id="stat-dbs">-</div>
+          <div class="sub">个数据库</div>
+        </div>
+        <div class="stat-card">
+          <div class="label">💾 备份状态</div>
+          <div class="value" id="stat-backups">-</div>
+          <div class="sub">份备份</div>
+        </div>
+        <div class="stat-card">
+          <div class="label">🔐 安全更新</div>
+          <div class="value" id="stat-security">-</div>
+          <div class="sub" id="stat-security-sub">个待安装</div>
+        </div>
+      </div>
+
+      <div class="security-bar">
+        <div class="sec-icon">🛡️</div>
+        <div class="sec-info">
+          <div class="sec-title">安全状态：已启用自动更新</div>
+          <div class="sec-desc">系统每日 03:00 自动执行安全更新</div>
+        </div>
+        <button class="btn btn-primary" onclick="runSecurityUpdate()">立即更新</button>
+      </div>
+
+      <div class="dashboard-row">
+        <div class="panel">
+          <div class="panel-header">
+            <span class="panel-title">⚡ 服务状态</span>
+          </div>
+          <div class="panel-body">
+            <div class="service-item">
+              <div class="service-info">
+                <span style="font-size:20px;">🌿</span>
+                <div>
+                  <div class="service-name">Nginx</div>
+                  <div class="service-desc">Web 服务器</div>
+                </div>
+              </div>
+              <span class="badge green" id="svc-nginx">运行中</span>
+            </div>
+            <div class="service-item">
+              <div class="service-info">
+                <span style="font-size:20px;">🐬</span>
+                <div>
+                  <div class="service-name">MySQL</div>
+                  <div class="service-desc">数据库服务</div>
+                </div>
+              </div>
+              <span class="badge green" id="svc-mysql">运行中</span>
+            </div>
+            <div class="service-item">
+              <div class="service-info">
+                <span style="font-size:20px;">🐘</span>
+                <div>
+                  <div class="service-name">PHP-FPM</div>
+                  <div class="service-desc">PHP 解释器</div>
+                </div>
+              </div>
+              <span class="badge green" id="svc-php">运行中</span>
+            </div>
+            <div class="service-item">
+              <div class="service-info">
+                <span style="font-size:20px;">🛡️</span>
+                <div>
+                  <div class="service-name">UFW 防火墙</div>
+                  <div class="service-desc">端口防护</div>
+                </div>
+              </div>
+              <span class="badge green" id="svc-ufw">已启用</span>
+            </div>
+          </div>
+        </div>
+
+        <div class="panel">
+          <div class="panel-header">
+            <span class="panel-title">💻 系统资源</span>
+          </div>
+          <div class="panel-body" id="sysStats">
+            <div class="service-item">
+              <div class="service-info">
+                <div class="service-name">CPU 负载</div>
+              </div>
+              <span class="badge blue" id="stat-cpu">-</span>
+            </div>
+            <div class="service-item">
+              <div class="service-info">
+                <div class="service-name">内存</div>
+              </div>
+              <span class="badge blue" id="stat-mem">-</span>
+            </div>
+            <div class="service-item">
+              <div class="service-info">
+                <div class="service-name">磁盘</div>
+              </div>
+              <span class="badge blue" id="stat-disk">-</span>
+            </div>
+            <div class="service-item">
+              <div class="service-info">
+                <div class="service-name">负载均值</div>
+              </div>
+              <span class="badge" id="stat-load">-</span>
+            </div>
+          </div>
+        </div>
+      </div>
+    </div>
+
+    <!-- Sites -->
+    <div class="page" id="page-sites">
+      <div class="alert error" id="sitesAlert"></div>
+      <div style="display:flex;justify-content:space-between;align-items:center;margin-bottom:20px;">
+        <h2 style="font-size:18px;font-weight:700;">网站列表</h2>
+        <button class="btn btn-primary" onclick="openSiteModal()">+ 创建站点</button>
+      </div>
+      <div class="panel" style="padding:0;overflow:hidden;">
+        <table class="data-table">
+          <thead>
+            <tr>
+              <th>域名</th>
+              <th>PHP</th>
+              <th>路径</th>
+              <th>状态</th>
+              <th>SSL</th>
+              <th>创建时间</th>
+              <th>操作</th>
+            </tr>
+          </thead>
+          <tbody id="sitesTable"></tbody>
+        </table>
+      </div>
+    </div>
+
+    <!-- Databases -->
+    <div class="page" id="page-databases">
+      <div class="alert error" id="dbAlert"></div>
+      <div style="display:flex;justify-content:space-between;align-items:center;margin-bottom:20px;">
+        <h2 style="font-size:18px;font-weight:700;">数据库</h2>
+        <button class="btn btn-primary" onclick="openDbModal()">+ 创建数据库</button>
+      </div>
+      <div class="panel" style="padding:0;overflow:hidden;">
+        <table class="data-table">
+          <thead>
+            <tr>
+              <th>数据库名</th>
+              <th>用户</th>
+              <th>字符集</th>
+              <th>创建时间</th>
+              <th>操作</th>
+            </tr>
+          </thead>
+          <tbody id="dbsTable"></tbody>
+        </table>
+      </div>
+    </div>
+
+    <!-- SSL -->
+    <div class="page" id="page-ssl">
+      <div class="alert error" id="sslAlert"></div>
+      <div style="display:flex;justify-content:space-between;align-items:center;margin-bottom:20px;">
+        <h2 style="font-size:18px;font-weight:700;">SSL 证书</h2>
+        <button class="btn btn-primary" onclick="openSSLModal()">+ 申请证书</button>
+      </div>
+      <div class="panel" style="padding:0;overflow:hidden;">
+        <table class="data-table">
+          <thead>
+            <tr>
+              <th>域名</th>
+              <th>证书路径</th>
+              <th>到期日期</th>
+              <th>自动续期</th>
+              <th>操作</th>
+            </tr>
+          </thead>
+          <tbody id="sslTable"></tbody>
+        </table>
+      </div>
+    </div>
+
+    <!-- Backups -->
+    <div class="page" id="page-backups">
+      <div class="alert error" id="backupAlert"></div>
+      <div style="display:flex;justify-content:space-between;align-items:center;margin-bottom:20px;">
+        <h2 style="font-size:18px;font-weight:700;">备份记录</h2>
+        <button class="btn btn-primary" onclick="openBackupModal()">+ 立即备份</button>
+      </div>
+      <div class="panel" style="padding:0;overflow:hidden;">
+        <table class="data-table">
+          <thead>
+            <tr>
+              <th>站点</th>
+              <th>类型</th>
+              <th>文件大小</th>
+              <th>状态</th>
+              <th>时间</th>
+              <th>操作</th>
+            </tr>
+          </thead>
+          <tbody id="backupsTable"></tbody>
+        </table>
+      </div>
+    </div>
+
+    <!-- Security -->
+    <div class="page" id="page-security">
+      <div class="alert success" id="secAlert"></div>
+      <div style="display:flex;justify-content:space-between;align-items:center;margin-bottom:20px;">
+        <h2 style="font-size:18px;font-weight:700;">安全中心</h2>
+        <button class="btn btn-primary" onclick="runSecurityUpdate()">🔄 执行安全更新</button>
+      </div>
+      <div class="stats-grid" style="grid-template-columns: repeat(3,1fr);margin-bottom:24px;">
+        <div class="stat-card">
+          <div class="label">🛡️ 安全更新</div>
+          <div class="value" id="sec-updatable">-</div>
+          <div class="sub">个可用更新</div>
+        </div>
+        <div class="stat-card">
+          <div class="label">❌ 近期错误</div>
+          <div class="value" id="sec-errors">-</div>
+          <div class="sub">条系统错误</div>
+        </div>
+        <div class="stat-card">
+          <div class="label">🔒 防火墙</div>
+          <div class="value" id="sec-firewall">-</div>
+          <div class="sub">状态</div>
+        </div>
+      </div>
+      <div class="panel">
+        <div class="panel-header">
+          <span class="panel-title">🛡️ 自动漏洞修复</span>
+          <label style="display:flex;align-items:center;gap:8px;cursor:pointer;">
+            <input type="checkbox" id="autoUpdateToggle" checked onchange="toggleAutoUpdate()">
+            <span style="font-size:13px;color:var(--text-dim);">启用自动修复</span>
+          </label>
+        </div>
+        <div class="panel-body">
+          <p>T面板每日凌晨 03:00 自动执行 <code>apt-get update && apt-get upgrade -y</code>，修复已知安全漏洞。</p>
+          <p style="margin-top:8px;">最近执行：<span id="sec-last-run" style="color:var(--green);">-</span></p>
+        </div>
+      </div>
+    </div>
+
+
+    <!-- Files -->
+    <div class="page" id="page-files">
+      <div class="alert error" id="filesAlert"></div>
+      <div style="display:flex;justify-content:space-between;align-items:center;margin-bottom:20px;">
+        <h2 style="font-size:18px;font-weight:700;">📁 文件管理</h2>
+        <div style="display:flex;gap:8px;">
+          <select id="files-site-select" style="padding:8px 12px;background:var(--card);border:1px solid var(--border);border-radius:8px;color:var(--text);font-size:13px;">
+            <option value="">-- 选择站点 --</option>
+          </select>
+          <button class="btn btn-secondary" onclick="refreshFiles()">↻ 刷新</button>
+          <button class="btn btn-secondary" onclick="openMkdirModal()">+ 新建目录</button>
+          <button class="btn btn-secondary" onclick="openUploadModal()">↑ 上传</button>
+        </div>
+      </div>
+
+      <!-- Breadcrumb -->
+      <div id="fileBreadcrumb" style="display:flex;align-items:center;gap:6px;margin-bottom:16px;font-size:13px;color:var(--text-dim);">
+        <span style="cursor:pointer;color:var(--green);" onclick="navigateFiles('')">/</span>
+      </div>
+
+      <!-- File list -->
+      <div class="panel" style="padding:0;overflow:hidden;">
+        <table class="data-table">
+          <thead>
+            <tr>
+              <th>名称</th>
+              <th>大小</th>
+              <th>修改时间</th>
+              <th>权限</th>
+              <th>操作</th>
+            </tr>
+          </thead>
+          <tbody id="filesTable"></tbody>
+        </table>
+      </div>
+
+      <!-- File editor modal -->
+      <div class="modal-overlay" id="fileEditModal">
+        <div class="modal" style="width:800px;max-width:95vw;">
+          <div class="modal-header">
+            <span class="modal-title">✏️ 编辑文件</span>
+            <button class="modal-close" onclick="closeFileEditModal()">×</button>
+          </div>
+          <div class="modal-body">
+            <div style="margin-bottom:12px;font-size:13px;color:var(--text-dim);" id="editFilePath"></div>
+            <textarea id="fileEditor" style="width:100%;min-height:400px;background:var(--bg);border:1px solid var(--border);border-radius:8px;color:var(--text);font-family:'JetBrains Mono',monospace;font-size:13px;padding:14px;resize:vertical;box-sizing:border-box;" spellcheck="false"></textarea>
+          </div>
+          <div class="modal-footer">
+            <button class="btn btn-secondary" onclick="closeFileEditModal()">取消</button>
+            <button class="btn btn-primary" onclick="saveFile()">保存</button>
+          </div>
+        </div>
+      </div>
+
+      <!-- Mkdir modal -->
+      <div class="modal-overlay" id="mkdirModal">
+        <div class="modal" style="width:440px;">
+          <div class="modal-header">
+            <span class="modal-title">📁 新建目录</span>
+            <button class="modal-close" onclick="closeMkdirModal()">×</button>
+          </div>
+          <div class="modal-body">
+            <div class="form-group">
+              <label>目录名称</label>
+              <input type="text" id="mkdir-name" placeholder="my_folder">
+            </div>
+          </div>
+          <div class="modal-footer">
+            <button class="btn btn-secondary" onclick="closeMkdirModal()">取消</button>
+            <button class="btn btn-primary" onclick="doMkdir()">创建</button>
+          </div>
+        </div>
+      </div>
+
+      <!-- Upload modal -->
+      <div class="modal-overlay" id="uploadModal">
+        <div class="modal" style="width:500px;">
+          <div class="modal-header">
+            <span class="modal-title">↑ 上传文件</span>
+            <button class="modal-close" onclick="closeUploadModal()">×</button>
+          </div>
+          <div class="modal-body">
+            <div id="uploadDropzone" style="border:2px dashed var(--border);border-radius:12px;padding:48px;text-align:center;cursor:pointer;" onclick="document.getElementById('fileInput').click()">
+              <div style="font-size:40px;margin-bottom:12px;">📤</div>
+              <div style="font-size:15px;color:var(--text-muted);">点击或拖拽文件到这里上传</div>
+              <div style="font-size:12px;color:var(--text-dim);margin-top:8px;">支持 zip/tar.gz 自动解压</div>
+              <input type="file" id="fileInput" style="display:none;" onchange="handleFileSelect(this)">
+            </div>
+            <div id="uploadProgress" style="display:none;margin-top:16px;">
+              <div style="font-size:14px;color:var(--text-dim);margin-bottom:8px;" id="uploadFileName">上传中...</div>
+              <div style="height:4px;background:var(--border);border-radius:2px;overflow:hidden;">
+                <div id="uploadBar" style="height:100%;background:var(--green);width:0%;transition:width 0.3s;"></div>
+              </div>
+            </div>
+          </div>
+          <div class="modal-footer">
+            <button class="btn btn-secondary" onclick="closeUploadModal()">取消</button>
+          </div>
+        </div>
+      </div>
+    </div>
+
+
+    <!-- Cron Jobs -->
+    <div class="page" id="page-cronjobs">
+      <div class="alert error" id="cronAlert"></div>
+      <div style="display:flex;justify-content:space-between;align-items:center;margin-bottom:20px;">
+        <h2 style="font-size:18px;font-weight:700;">⏰ 定时任务</h2>
+        <button class="btn btn-primary" onclick="openCronModal()">+ 创建任务</button>
+      </div>
+      <div class="panel" style="padding:0;overflow:hidden;">
+        <table class="data-table">
+          <thead>
+            <tr>
+              <th>任务名称</th>
+              <th>站点</th>
+              <th>执行周期</th>
+              <th>命令</th>
+              <th>状态</th>
+              <th>上次执行</th>
+              <th>操作</th>
+            </tr>
+          </thead>
+          <tbody id="cronTable"></tbody>
+        </table>
+      </div>
+
+      <!-- Create Cron Modal -->
+      <div class="modal-overlay" id="cronModal">
+        <div class="modal" style="width:560px;">
+          <div class="modal-header">
+            <span class="modal-title">⏰ 创建定时任务</span>
+            <button class="modal-close" onclick="closeCronModal()">×</button>
+          </div>
+          <div class="modal-body">
+            <div class="alert error" id="cronModalAlert" style="display:none;"></div>
+            <div class="form-group">
+              <label>任务名称</label>
+              <input type="text" id="cron-name" placeholder="数据库每日备份">
+            </div>
+            <div class="form-group">
+              <label>所属站点</label>
+              <select id="cron-site"><option value="">-- 选择站点 --</option></select>
+            </div>
+            <div class="form-group">
+              <label>执行周期 (Cron)</label>
+              <input type="text" id="cron-schedule" placeholder="0 3 * * *" value="0 3 * * *">
+              <small style="color:var(--text-dim);font-size:12px;margin-top:4px;display:block;">
+                分 时 日 月 周，如 <code>0 3 * * *</code> = 每天凌晨3点，<code>*/5 * * * *</code> = 每5分钟
+              </small>
+            </div>
+            <div class="form-group">
+              <label>执行命令</label>
+              <input type="text" id="cron-command" placeholder="mysqldump -u root -p'' mydb > /backup/db.sql">
+            </div>
+          </div>
+          <div class="modal-footer">
+            <button class="btn btn-secondary" onclick="closeCronModal()">取消</button>
+            <button class="btn btn-primary" onclick="createCron()">创建</button>
+          </div>
+        </div>
+      </div>
+    </div>
+
+    <!-- Settings -->
+    <div class="page" id="page-settings">
+      <div class="alert success" id="settingsAlert"></div>
+
+      <div class="form-section">
+        <h3>👤 修改管理员密码</h3>
+        <div class="form-row">
+          <div class="form-group">
+            <label>当前密码</label>
+            <input type="password" id="curPass" placeholder="当前密码">
+          </div>
+          <div class="form-group">
+            <label>新密码</label>
+            <input type="password" id="newPass" placeholder="新密码（8位以上）">
+          </div>
+        </div>
+        <button class="btn btn-primary" onclick="changePassword()">确认修改</button>
+      </div>
+
+      <div class="form-section">
+        <h3>⚙️ 系统设置</h3>
+        <div class="form-row">
+          <div class="form-group">
+            <label>默认 PHP 版本</label>
+            <select id="cfg-php">
+              <option value="7.4">PHP 7.4</option>
+              <option value="8.0">PHP 8.0</option>
+              <option value="8.1" selected>PHP 8.1</option>
+              <option value="8.2">PHP 8.2</option>
+            </select>
+          </div>
+          <div class="form-group">
+            <label>备份保留天数</label>
+            <input type="number" id="cfg-retention" value="7" min="1">
+          </div>
+        </div>
+        <div class="form-group" style="display:flex;align-items:center;gap:8px;">
+          <input type="checkbox" id="cfg-auto-ssl" checked>
+          <label style="margin:0;font-size:14px;color:var(--text-muted);">自动续期 SSL 证书</label>
+        </div>
+        <button class="btn btn-primary" onclick="saveSettings()">保存设置</button>
+      </div>
+
+      <div class="form-section">
+        <h3>🔗 面板域名绑定</h3>
+        <div class="form-group">
+          <label>绑定域名（留空则不限制）</label>
+          <input type="text" id="cfg-panel-domain" placeholder="panel.your-domain.com" style="font-family:'JetBrains Mono',monospace;">
+          <small style="color:var(--text-dim);font-size:12px;margin-top:4px;display:block;">
+            绑定后只能通过该域名访问后台（如留空则不限制访问来源）。绑定后请确保 DNS 已解析到此服务器。
+          </small>
+        </div>
+        <div id="domainStatus" style="font-size:13px;margin-bottom:12px;color:var(--text-dim);"></div>
+        <button class="btn btn-primary" onclick="saveSettings()">保存域名绑定</button>
+        <div style="margin-top:12px;padding:12px 16px;background:rgba(234,179,8,0.1);border:1px solid rgba(234,179,8,0.3);border-radius:8px;font-size:13px;color:var(--yellow);">
+          ⚠️ 修改域名绑定后需重启面板服务：<code style="background:rgba(234,179,8,0.15);padding:2px 6px;border-radius:4px;">systemctl restart tpanel</code>
+        </div>
+      </div>
+
+      <div class="form-section">
+        <h3>🌐 官方信息</h3>
+        <div class="form-row">
+          <div class="form-group">
+            <label>面板官网</label>
+            <input type="text" value="https://tpanel.cn" readonly>
+          </div>
+          <div class="form-group">
+            <label>作者</label>
+            <input type="text" value="Zhang Pu" readonly>
+          </div>
+        </div>
+      </div>
+    </div>
+
+    <!-- Logs -->
+    <div class="page" id="page-logs">
+      <h2 style="font-size:18px;font-weight:700;margin-bottom:20px;">📋 安全日志</h2>
+      <div class="panel" id="logContainer" style="max-height:600px;overflow-y:auto;">
+        <div id="logList"></div>
+      </div>
+    </div>
+
+  </div>
+</main>
+
+<!-- Site Modal -->
+<div class="modal-overlay" id="siteModal">
+  <div class="modal">
+    <div class="modal-header">
+      <span class="modal-title">🌐 创建站点</span>
+      <button class="modal-close" onclick="closeSiteModal()">×</button>
+    </div>
+    <div class="modal-body">
+      <div class="alert error" id="siteModalAlert"></div>
+      <div class="form-group">
+        <label>域名</label>
+        <input type="text" id="site-domain" placeholder="example.com">
+      </div>
+      <div class="form-group">
+        <label>站点名称</label>
+        <input type="text" id="site-name" placeholder="显示名称">
+      </div>
+      <div class="form-group">
+        <label>PHP 版本</label>
+        <select id="site-php">
+          <option value="7.4">PHP 7.4</option>
+          <option value="8.0">PHP 8.0</option>
+          <option value="8.1" selected>PHP 8.1</option>
+          <option value="8.2">PHP 8.2</option>
+        </select>
+      </div>
+    </div>
+    <div class="modal-footer">
+      <button class="btn btn-secondary" onclick="closeSiteModal()">取消</button>
+      <button class="btn btn-primary" onclick="createSite()">创建</button>
+    </div>
+  </div>
+</div>
+
+<!-- DB Modal -->
+<div class="modal-overlay" id="dbModal">
+  <div class="modal">
+    <div class="modal-header">
+      <span class="modal-title">🗄️ 创建数据库</span>
+      <button class="modal-close" onclick="closeDbModal()">×</button>
+    </div>
+    <div class="modal-body">
+      <div class="alert error" id="dbModalAlert"></div>
+      <div class="form-group">
+        <label>所属站点</label>
+        <select id="db-site"><option value="">-- 选择站点 --</option></select>
+      </div>
+      <div class="form-group">
+        <label>数据库名</label>
+        <input type="text" id="db-name" placeholder="my_site_db">
+      </div>
+      <div class="form-group">
+        <label>数据库用户</label>
+        <input type="text" id="db-user" placeholder="db_user">
+      </div>
+      <div class="form-group">
+        <label>密码</label>
+        <input type="password" id="db-pass" placeholder="密码">
+      </div>
+    </div>
+    <div class="modal-footer">
+      <button class="btn btn-secondary" onclick="closeDbModal()">取消</button>
+      <button class="btn btn-primary" onclick="createDb()">创建</button>
+    </div>
+  </div>
+</div>
+
+<!-- Backup Modal -->
+<div class="modal-overlay" id="backupModal">
+  <div class="modal" style="width:600px;">
+    <div class="modal-header">
+      <span class="modal-title">💾 备份站点</span>
+      <button class="modal-close" onclick="closeBackupModal()">×</button>
+    </div>
+    <div class="modal-body" style="padding-top:0;">
+      <div class="tabs" style="margin-bottom:20px;">
+        <div class="tab active" id="tab-local" onclick="switchBackupTab('local')">📦 本地备份</div>
+        <div class="tab" id="tab-remote" onclick="switchBackupTab('remote')">🌐 远程备份</div>
+      </div>
+      <div class="alert error" id="backupModalAlert" style="display:none;"></div>
+
+      <!-- Local backup tab -->
+      <div id="backup-tab-local">
+        <div class="form-group">
+          <label>选择站点</label>
+          <select id="backup-site"><option value="">-- 选择站点 --</option></select>
+        </div>
+      </div>
+
+      <!-- Remote backup tab -->
+      <div id="backup-tab-remote" style="display:none;">
+        <div class="form-group">
+          <label>选择站点</label>
+          <select id="backup-remote-site" onchange="loadRemoteBackupForm()"><option value="">-- 选择站点 --</option></select>
+        </div>
+        <div class="form-group">
+          <label>远程主机 IP</label>
+          <input type="text" id="remote-host" placeholder="192.168.1.100">
+        </div>
+        <div class="form-group">
+          <label>SSH 用户</label>
+          <input type="text" id="remote-user" placeholder="root">
+        </div>
+        <div class="form-group">
+          <label>SSH 端口</label>
+          <input type="number" id="remote-port" value="22" min="1" max="65535">
+        </div>
+        <div class="form-group">
+          <label>远程备份路径</label>
+          <input type="text" id="remote-path" placeholder="/backup/tblog">
+        </div>
+        <div class="form-group">
+          <label>SSH 密钥路径（可选）</label>
+          <input type="text" id="remote-key" placeholder="/root/.ssh/id_rsa">
+        </div>
+        <div class="form-actions" style="margin-top:8px;">
+          <button class="btn btn-secondary" onclick="testRemote()">🔗 测试连接</button>
+        </div>
+      </div>
+    </div>
+    <div class="modal-footer">
+      <button class="btn btn-secondary" onclick="closeBackupModal()">取消</button>
+      <button class="btn btn-primary" id="backup-confirm-btn" onclick="doLocalBackup()">开始备份</button>
+    </div>
+  </div>
+</div>
+
+<!-- SSL Modal -->
+<div class="modal-overlay" id="sslModal">
+  <div class="modal">
+    <div class="modal-header">
+      <span class="modal-title">🔐 申请 SSL 证书</span>
+      <button class="modal-close" onclick="closeSSLModal()">×</button>
+    </div>
+    <div class="modal-body">
+      <div class="alert error" id="sslModalAlert"></div>
+      <div class="form-group">
+        <label>选择站点</label>
+        <select id="ssl-site"><option value="">-- 选择站点 --</option></select>
+      </div>
+      <p style="font-size:13px;color:var(--text-dim);margin-top:8px;">
+        将通过 Let's Encrypt 自动申请 SSL 证书（HTTP 验证）。
+        证书有效期 90 天，自动续期。
+      </p>
+    </div>
+    <div class="modal-footer">
+      <button class="btn btn-secondary" onclick="closeSSLModal()">取消</button>
+      <button class="btn btn-primary" onclick="applySSL()">申请证书</button>
+    </div>
+  </div>
+</div>
+
+<script>
+const API = '/api';
+let token = localStorage.getItem('tpanel_token') || '';
+
+// =====================
+// Auth
+// =====================
+
+async function checkAuth() {
+  if (!token) { showLogin(); return; }
+  const r = await fetch(API + '/auth/check', {
+    headers: { 'Authorization': 'Bearer ' + token }
+  });
+  if (r.ok) {
+    const d = await r.json();
+    if (d.code === 0) initApp();
+    else showLogin();
+  } else {
+    showLogin();
+  }
+}
+
+function showLogin() {
+  document.body.innerHTML = `
+  <div style="display:flex;align-items:center;justify-content:center;min-height:100vh;background:var(--bg);">
+    <div style="background:var(--card);border:1px solid var(--border);border-radius:20px;padding:40px;width:400px;text-align:center;">
+      <div style="font-size:48px;margin-bottom:16px;">🌿</div>
+      <h2 style="font-size:24px;font-weight:800;margin-bottom:8px;">T面板</h2>
+      <p style="color:var(--text-dim);margin-bottom:32px;">Linux 网站管理面板</p>
+      <div id="loginAlert" style="margin-bottom:16px;color:var(--red);font-size:14px;display:none;"></div>
+      <input type="text" id="loginUser" placeholder="用户名" style="width:100%;padding:12px 16px;background:var(--bg);border:1px solid var(--border);border-radius:10px;color:var(--text);font-size:15px;margin-bottom:12px;box-sizing:border-box;">
+      <input type="password" id="loginPass" placeholder="密码" style="width:100%;padding:12px 16px;background:var(--bg);border:1px solid var(--border);border-radius:10px;color:var(--text);font-size:15px;margin-bottom:16px;box-sizing:border-box;" onkeydown="if(event.key==='Enter')login()">
+      <button onclick="login()" style="width:100%;padding:14px;background:var(--green);color:#fff;border:none;border-radius:10px;font-size:15px;font-weight:700;cursor:pointer;">登录</button>
+      <p style="color:var(--text-dim);font-size:12px;margin-top:16px;">默认账号 admin / tpanel.cn</p>
+    </div>
+  </div>`;
+}
+
+async function login() {
+  const user = document.getElementById('loginUser').value;
+  const pass = document.getElementById('loginPass').value;
+  const r = await fetch(API + '/auth/login', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ username: user, password: pass })
+  });
+  const d = await r.json();
+  if (d.code === 0) {
+    token = d.token;
+    localStorage.setItem('tpanel_token', token);
+    initApp();
+  } else {
+    const al = document.getElementById('loginAlert');
+    al.textContent = d.msg;
+    al.style.display = 'block';
+  }
+}
+
+async function logout() {
+  await fetch(API + '/auth/logout', {
+    method: 'POST',
+    headers: { 'Authorization': 'Bearer ' + token }
+  });
+  token = '';
+  localStorage.removeItem('tpanel_token');
+  location.reload();
+}
+
+function authHeaders() {
+  return { 'Authorization': 'Bearer ' + token, 'Content-Type': 'application/json' };
+}
+
+async function api(path, opts = {}) {
+  const r = await fetch(API + path, {
+    ...opts,
+    headers: { ...authHeaders(), ...(opts.body ? { 'Content-Type': 'application/json' } : {}) }
+  });
+  return r.json();
+}
+
+// =====================
+// App Init
+// =====================
+
+function initApp() {
+  setupNav();
+  loadDashboard();
+}
+
+// =====================
+// Navigation
+// =====================
+
+function setupNav() {
+  document.querySelectorAll('.nav-item[data-page]').forEach(item => {
+    item.addEventListener('click', () => {
+      const page = item.dataset.page;
+      document.querySelectorAll('.nav-item').forEach(n => n.classList.remove('active'));
+      item.classList.add('active');
+      document.querySelectorAll('.page').forEach(p => p.classList.remove('active'));
+      document.getElementById('page-' + page).classList.add('active');
+      const titles = { dashboard:'仪表盘', sites:'网站管理', databases:'数据库', ssl:'SSL证书', backups:'备份', security:'安全中心', settings:'设置', logs:'安全日志', files:'文件管理', cronjobs:'定时任务' };
+      document.getElementById('pageTitle').textContent = titles[page] || page;
+      if (page === 'sites') loadSites();
+      if (page === 'databases') loadDbs();
+      if (page === 'backups') loadBackups();
+      if (page === 'security') loadSecurity();
+      if (page === 'logs') loadLogs();
+      if (page === 'files') initFileManager();
+      if (page === 'ssl') loadSSL();
+      if (page === 'settings') loadSettingsPage();
+      if (page === 'cronjobs') loadCronJobs();
+    });
+  });
+}
+
+// =====================
+// Dashboard
+// =====================
+
+async function loadDashboard() {
+  try {
+    const d = await api('/system/stats');
+    if (d.code !== 0) return;
+
+    document.getElementById('stat-cpu').textContent = d.data.cpu_pct;
+    document.getElementById('stat-mem').textContent = d.data.mem_used_mb + ' / ' + d.data.mem_total_mb + ' MB';
+    document.getElementById('stat-disk').textContent = d.data.disk_used + ' / ' + d.data.disk_free;
+    document.getElementById('stat-load').textContent = d.data.load;
+    document.getElementById('stat-load').className = 'badge ' + (parseFloat(d.data.load.split(' ')[0]) > 2 ? 'yellow' : 'blue');
+
+    // 服务状态
+    document.getElementById('svc-nginx').textContent = d.data.nginx_running ? '运行中' : '已停止';
+    document.getElementById('svc-nginx').className = 'badge ' + (d.data.nginx_running ? 'green' : 'red');
+    document.getElementById('svc-mysql').textContent = d.data.mysql_running ? '运行中' : '已停止';
+    document.getElementById('svc-mysql').className = 'badge ' + (d.data.mysql_running ? 'green' : 'red');
+
+    // 安全状态
+    const sec = d.data.upgradable_security_packages || 0;
+    document.getElementById('stat-security').textContent = sec;
+    document.getElementById('stat-security-sub').textContent = sec > 0 ? '个待安装' : '已是最新';
+    document.getElementById('stat-security').parentElement.querySelector('.sub').style.color = sec > 0 ? 'var(--yellow)' : 'var(--green)';
+  } catch(e) { console.error(e); }
+
+  // 加载站点数量
+  try {
+    const sites = await api('/sites');
+    document.getElementById('stat-sites').textContent = sites.data ? sites.data.length : 0;
+    document.getElementById('stat-dbs').textContent = (await api('/databases')).data ? (await api('/databases')).data.length : 0;
+    const backups = await api('/backups');
+    document.getElementById('stat-backups').textContent = backups.data ? backups.data.length : 0;
+  } catch(e) {}
+}
+
+// =====================
+// Sites
+// =====================
+
+async function loadSites() {
+  const d = await api('/sites');
+  const tbody = document.getElementById('sitesTable');
+  if (!d.data || d.data.length === 0) {
+    tbody.innerHTML = '<tr><td colspan="7" style="text-align:center;padding:40px;color:var(--text-dim);">暂无站点 · <a href="#" onclick="openSiteModal();return false;" style="color:var(--green);">创建第一个站点</a></td></tr>';
+    return;
+  }
+  tbody.innerHTML = d.data.map(s => `
+    <tr>
+      <td class="domain">${s.domain}</td>
+      <td>PHP ${s.php_version}</td>
+      <td style="font-size:12px;">${s.site_path}</td>
+      <td><span class="badge ${s.status === 'running' ? 'green' : 'yellow'}">${s.status === 'running' ? '运行中' : '已停止'}</span></td>
+      <td><span class="badge ${s.ssl_enabled ? 'green' : 'blue'}">${s.ssl_enabled ? '已启用' : '未启用'}</span></td>
+      <td>${s.created_at ? s.created_at.split('T')[0] : '-'}</td>
+      <td class="actions">
+        <button class="btn-icon" title="备份" onclick="quickBackup(${s.id})">💾</button>
+        <button class="btn-icon danger" title="删除" onclick="deleteSite(${s.id},'${s.domain}')">🗑️</button>
+      </td>
+    </tr>`).join('');
+}
+
+function openSiteModal() {
+  document.getElementById('siteModalAlert').className = 'alert error';
+  document.getElementById('siteModalAlert').style.display = 'none';
+  document.getElementById('site-domain').value = '';
+  document.getElementById('site-name').value = '';
+  document.getElementById('siteModal').classList.add('show');
+}
+
+function closeSiteModal() { document.getElementById('siteModal').classList.remove('show'); }
+
+async function createSite() {
+  const domain = document.getElementById('site-domain').value.trim();
+  const name = document.getElementById('site-name').value.trim() || domain;
+  const php = document.getElementById('site-php').value;
+  if (!domain) { showAlert('siteModalAlert', '请输入域名'); return; }
+  const d = await api('/sites', {
+    method: 'POST',
+    body: JSON.stringify({ domain, name, php_version: php })
+  });
+  if (d.code === 0) {
+    closeSiteModal();
+    loadSites();
+  } else {
+    showAlert('siteModalAlert', d.msg);
+  }
+}
+
+async function deleteSite(id, domain) {
+  if (!confirm(`确定删除站点 ${domain}？此操作不可恢复，包括所有文件和数据！`)) return;
+  const d = await api('/sites/' + id, { method: 'DELETE' });
+  if (d.code === 0) loadSites();
+  else alert(d.msg);
+}
+
+async function quickBackup(siteId) {
+  const d = await api('/backups', {
+    method: 'POST',
+    body: JSON.stringify({ site_id: siteId })
+  });
+  if (d.code === 0) alert('备份成功！文件：' + d.data.path);
+  else alert('备份失败：' + d.msg);
+}
+
+// =====================
+// Databases
+// =====================
+
+async function loadDbs() {
+  const d = await api('/databases');
+  const tbody = document.getElementById('dbsTable');
+  if (!d.data || d.data.length === 0) {
+    tbody.innerHTML = '<tr><td colspan="5" style="text-align:center;padding:40px;color:var(--text-dim);">暂无数据库</td></tr>';
+    return;
+  }
+  tbody.innerHTML = d.data.map(s => `
+    <tr>
+      <td class="domain">${s.name}</td>
+      <td>${s.db_user}</td>
+      <td>${s.charset}</td>
+      <td>${s.created_at ? s.created_at.split('T')[0] : '-'}</td>
+      <td class="actions">
+        <button class="btn-icon danger" onclick="deleteDb(${s.id},'${s.name}')">🗑️</button>
+      </td>
+    </tr>`).join('');
+}
+
+async function openDbModal() {
+  document.getElementById('dbModalAlert').style.display = 'none';
+  // 加载站点列表
+  const sites = await api('/sites');
+  const sel = document.getElementById('db-site');
+  sel.innerHTML = '<option value="">-- 选择站点 --</option>' +
+    (sites.data || []).map(s => `<option value="${s.id}">${s.domain}</option>`).join('');
+  document.getElementById('dbModal').classList.add('show');
+}
+
+function closeDbModal() { document.getElementById('dbModal').classList.remove('show'); }
+
+async function createDb() {
+  const site_id = document.getElementById('db-site').value;
+  const name = document.getElementById('db-name').value.trim();
+  const user = document.getElementById('db-user').value.trim();
+  const pass = document.getElementById('db-pass').value;
+  if (!site_id || !name || !user || !pass) { showAlert('dbModalAlert', '请填写所有字段'); return; }
+  const d = await api('/databases', {
+    method: 'POST',
+    body: JSON.stringify({ site_id: parseInt(site_id), name, user, pass })
+  });
+  if (d.code === 0) { closeDbModal(); loadDbs(); }
+  else showAlert('dbModalAlert', d.msg);
+}
+
+async function deleteDb(id, name) {
+  if (!confirm(`确定删除数据库 ${name}？`)) return;
+  const d = await api('/databases/' + id, { method: 'DELETE' });
+  if (d.code === 0) loadDbs();
+}
+
+// =====================
+// SSL
+// =====================
+
+async function loadSSL() {
+  const d = await api('/ssl/certs');
+  const tbody = document.getElementById('sslTable');
+  if (!d.data || d.data.length === 0) {
+    tbody.innerHTML = '<tr><td colspan="5" style="text-align:center;padding:40px;color:var(--text-dim);">暂无证书</td></tr>';
+    return;
+  }
+  tbody.innerHTML = d.data.map(s => `
+    <tr>
+      <td class="domain">${s.domain}</td>
+      <td style="font-size:12px;">${s.cert_path}</td>
+      <td>${s.expire_date || '-'}</td>
+      <td><span class="badge ${s.auto_renew ? 'green' : 'yellow'}">${s.auto_renew ? '已启用' : '未启用'}</span></td>
+      <td class="actions">
+        <button class="btn-icon" onclick="renewSSL(${s.id})">🔄</button>
+        <button class="btn-icon danger">🗑️</button>
+      </td>
+    </tr>`).join('');
+}
+
+async function openSSLModal() {
+  const sites = await api('/sites');
+  const sel = document.getElementById('ssl-site');
+  sel.innerHTML = '<option value="">-- 选择站点 --</option>' +
+    (sites.data || []).map(s => `<option value="${s.id}">${s.domain}</option>`).join('');
+  document.getElementById('sslModal').classList.add('show');
+}
+
+function closeSSLModal() { document.getElementById('sslModal').classList.remove('show'); }
+
+async function applySSL() {
+  const siteId = document.getElementById('ssl-site').value;
+  if (!siteId) { showAlert('sslModalAlert', '请选择站点'); return; }
+  const d = await api('/ssl/apply', {
+    method: 'POST',
+    body: JSON.stringify({ site_id: parseInt(siteId) })
+  });
+  if (d.code === 0) { closeSSLModal(); loadSSL(); }
+  else showAlert('sslModalAlert', d.msg);
+}
+
+// =====================
+// Backups
+// =====================
+
+async function loadBackups() {
+  const d = await api('/backups');
+  const tbody = document.getElementById('backupsTable');
+  if (!d.data || d.data.length === 0) {
+    tbody.innerHTML = '<tr><td colspan="6" style="text-align:center;padding:40px;color:var(--text-dim);">暂无备份记录</td></tr>';
+    return;
+  }
+  tbody.innerHTML = d.data.map(b => `
+    <tr>
+      <td>${b.domain || b.site_id}</td>
+      <td><span class="badge blue">${b.type}</span></td>
+      <td>${b.size ? Math.round(b.size/1024) + ' KB' : '-'}</td>
+      <td><span class="badge ${b.status === 'success' ? 'green' : 'red'}">${b.status}</span></td>
+      <td>${b.created_at ? b.created_at.replace('T',' ').slice(0,16) : '-'}</td>
+      <td class="actions">
+        <button class="btn-icon" onclick="restoreBackup(${b.id})">↩️</button>
+        <button class="btn-icon danger">🗑️</button>
+      </td>
+    </tr>`).join('');
+}
+
+let currentBackupTab = 'local';
+
+function switchBackupTab(tab) {
+  currentBackupTab = tab;
+  document.getElementById('tab-local').className = tab === 'local' ? 'tab active' : 'tab';
+  document.getElementById('tab-remote').className = tab === 'remote' ? 'tab active' : 'tab';
+  document.getElementById('backup-tab-local').style.display = tab === 'local' ? 'block' : 'none';
+  document.getElementById('backup-tab-remote').style.display = tab === 'remote' ? 'block' : 'none';
+  document.getElementById('backup-confirm-btn').textContent = tab === 'local' ? '开始备份' : '开始远程备份';
+  document.getElementById('backup-confirm-btn').onclick = tab === 'local' ? doLocalBackup : doRemoteBackup;
+}
+
+async function openBackupModal() {
+  const sites = await api('/sites');
+  const sel = document.getElementById('backup-site');
+  sel.innerHTML = '<option value="">-- 选择站点 --</option>' +
+    (sites.data || []).map(s => `<option value="${s.id}">${s.domain}</option>`).join('');
+
+  const rsel = document.getElementById('backup-remote-site');
+  rsel.innerHTML = '<option value="">-- 选择站点 --</option>' +
+    (sites.data || []).map(s => `<option value="${s.id}">${s.domain}</option>`).join('');
+
+  document.getElementById('backupModalAlert').style.display = 'none';
+  switchBackupTab('local');
+  document.getElementById('backupModal').classList.add('show');
+}
+
+function closeBackupModal() { document.getElementById('backupModal').classList.remove('show'); }
+
+async function doLocalBackup() {
+  const siteId = document.getElementById('backup-site').value;
+  if (!siteId) { showAlert('backupModalAlert', '请选择站点'); return; }
+  const d = await api('/backups', {
+    method: 'POST',
+    body: JSON.stringify({ site_id: parseInt(siteId) })
+  });
+  if (d.code === 0) {
+    closeBackupModal();
+    loadBackups();
+  } else {
+    showAlert('backupModalAlert', d.msg);
+  }
+}
+
+async function restoreBackup(id) {
+  if (!confirm('确定恢复此备份？当前文件将被覆盖！')) return;
+  const d = await api('/backups/' + id + '/restore', { method: 'POST' });
+  alert(d.msg);
+}
+
+// =====================
+// Security
+// =====================
+
+async function loadSecurity() {
+  try {
+    const d = await api('/security/status');
+    document.getElementById('sec-updatable').textContent = d.data.upgradable_security_packages || 0;
+    document.getElementById('sec-errors').textContent = d.data.recent_errors || 0;
+    document.getElementById('sec-firewall').textContent = '已启用';
+  } catch(e) {}
+}
+
+async function runSecurityUpdate() {
+  if (!confirm('确定执行安全更新？更新期间服务可能短暂中断。')) return;
+  const al = document.getElementById('secAlert');
+  al.textContent = '正在执行安全更新，请稍候...';
+  al.className = 'alert show success';
+  const d = await api('/security/update', { method: 'POST' });
+  al.textContent = d.msg;
+  al.className = 'alert show ' + (d.code === 0 ? 'success' : 'error');
+  setTimeout(() => { al.className = 'alert'; loadSecurity(); loadDashboard(); }, 3000);
+}
+
+// =====================
+// Logs
+// =====================
+
+async function loadLogs() {
+  const d = await api('/security/logs');
+  const container = document.getElementById('logList');
+  if (!d.data || d.data.length === 0) {
+    container.innerHTML = '<div style="padding:40px;text-align:center;color:var(--text-dim);">暂无日志</div>';
+    return;
+  }
+  container.innerHTML = d.data.map(l => `
+    <div class="log-line">
+      <span class="log-time">${l.created_at ? l.created_at.slice(0,16) : '-'}</span>
+      <span class="log-type">${l.event_type}</span>
+      <span class="log-msg ${l.event_type.includes('fail') || l.event_type.includes('delete') ? 'err' : ''}">${l.details || ''} ${l.ip ? '(' + l.ip + ')' : ''}</span>
+    </div>`).join('');
+}
+
+// =====================
+// Settings
+// =====================
+
+async function changePassword() {
+  const cur = document.getElementById('curPass').value;
+  const neu = document.getElementById('newPass').value;
+  if (!neu || neu.length < 8) { showAlert('settingsAlert', '新密码至少8位'); return; }
+  const al = document.getElementById('settingsAlert');
+  al.textContent = '密码修改功能开发中...';
+  al.className = 'alert show success';
+  setTimeout(() => { al.className = 'alert'; }, 3000);
+}
+
+async function loadSettingsPage() {
+  const d = await api('/settings');
+  if (d.code === 0 && d.data) {
+    document.getElementById('cfg-panel-domain').value = d.data.panel_domain || '';
+    document.getElementById('cfg-retention').value = d.data.backup_retention_days || 7;
+    const dom = d.data.panel_domain;
+    const statusEl = document.getElementById('domainStatus');
+    if (dom && dom.trim()) {
+      statusEl.innerHTML = '✅ 当前绑定：<span style="color:var(--green);font-weight:600;">' + dom + '</span>';
+    } else {
+      statusEl.innerHTML = '⚪ 未绑定域名（不限制访问来源）';
+    }
+  }
+}
+
+async function saveSettings() {
+  const panel_domain = document.getElementById('cfg-panel-domain').value.trim();
+  const retention = parseInt(document.getElementById('cfg-retention').value) || 7;
+
+  const d = await api('/settings', {
+    method: 'PUT',
+    body: JSON.stringify({
+      panel_domain,
+      backup_retention_days: retention
+    })
+  });
+
+  const al = document.getElementById('settingsAlert');
+  if (d.code === 0) {
+    al.textContent = '设置已保存！请注意：域名绑定修改需重启面板服务（systemctl restart tpanel）';
+    al.className = 'alert show success';
+  } else {
+    al.textContent = d.msg || '保存失败';
+    al.className = 'alert show error';
+  }
+  setTimeout(() => { al.className = 'alert'; al.style.display = 'none'; }, 5000);
+  al.style.display = 'block';
+}
+
+// =====================
+// Utils
+// =====================
+
+function showAlert(id, msg) {
+  const el = document.getElementById(id);
+  if (!el) return;
+  el.textContent = msg;
+  el.style.display = 'block';
+}
+
+function toggleAutoUpdate() {
+  const al = document.getElementById('secAlert');
+  al.textContent = '自动更新已' + (document.getElementById('autoUpdateToggle').checked ? '启用' : '禁用');
+  al.className = 'alert show success';
+  setTimeout(() => { al.className = 'alert'; }, 2000);
+}
+
+
+// =====================
+// File Manager
+// =====================
+
+let currentSiteId = null;
+let currentPath = '';
+
+async function loadFileSites() {
+  const sites = await api('/sites');
+  const sel = document.getElementById('files-site-select');
+  sel.innerHTML = '<option value="">-- 选择站点 --</option>' +
+    (sites.data || []).map(s => `<option value="${s.id}">${s.domain}</option>`).join('');
+  sel.addEventListener('change', () => {
+    currentSiteId = sel.value;
+    if (currentSiteId) navigateFiles('');
+  });
+}
+
+function navigateFiles(path) {
+  if (!currentSiteId) { showAlert('filesAlert', '请先选择站点'); return; }
+  currentPath = path;
+  loadFileList();
+}
+
+async function loadFileList() {
+  if (!currentSiteId) return;
+  const r = await fetch(API + '/files/list?site_id=' + currentSiteId + '&path=' + encodeURIComponent(currentPath), { headers: authHeaders() });
+  const d = await r.json();
+  if (d.code !== 0) { showAlert('filesAlert', d.msg); return; }
+
+  const tbody = document.getElementById('filesTable');
+  if (!d.data || d.data.length === 0) {
+    tbody.innerHTML = '<tr><td colspan="5" style="text-align:center;padding:40px;color:var(--text-dim);">目录为空</td></tr>';
+    return;
+  }
+
+  // Render breadcrumb
+  const parts = currentPath.split('/').filter(Boolean);
+  let bread = '<span style="cursor:pointer;color:var(--green);" onclick="navigateFiles('')">/</span>';
+  let accum = '';
+  parts.forEach(p => {
+    accum += p + '/';
+    bread += `<span style="color:var(--text-dim)"> / </span><span style="cursor:pointer;color:var(--text-muted);" onclick="navigateFiles('${accum.slice(0,-1)}')">${p}</span>`;
+  });
+  document.getElementById('fileBreadcrumb').innerHTML = bread;
+
+  // Render table
+  tbody.innerHTML = d.data.map(item => {
+    const icon = item.type === 'dir' ? '📁' : getFileIcon(item.name);
+    const size = item.type === 'dir' ? '-' : item.size_str;
+    const perms = item.perm_str;
+    const isWriteable = item.writable ? '' : 'readonly';
+    return `<tr>
+      <td style="cursor:pointer;" onclick="${item.type === 'dir' ? `navigateFiles('${currentPath ? currentPath + '/' : ''}${item.name}')` : `openFileEditor('${item.name}')`}">
+        <span style="margin-right:6px;">${icon}</span><span style="font-family:'JetBrains Mono',monospace;font-size:13px;">${item.name}</span>
+      </td>
+      <td style="font-size:13px;">${size}</td>
+      <td style="font-size:13px;">${item.modified}</td>
+      <td><span class="badge" style="font-family:'JetBrains Mono',monospace;">${perms}</span></td>
+      <td class="actions">
+        ${item.type === 'file' ? `<button class="btn-icon" onclick="openFileEditor('${item.name}')" title="编辑">✏️</button>` : ''}
+        <button class="btn-icon danger" onclick="deleteFileItem('${item.name}')" title="删除">🗑️</button>
+      </td>
+    </tr>`;
+  }).join('');
+}
+
+function getFileIcon(name) {
+  const ext = name.split('.').pop().toLowerCase();
+  const icons = {
+    php:'🐘','html':'🌐','htm':'🌐','css':'🎨','js':'📜',
+    json:'📋','md':'📝','txt':'📄','log':'📋',
+    jpg:'🖼️','jpeg':'🖼️','png':'🖼️','gif':'🖼️','webp':'🖼️','svg':'🖼️',
+    zip:'📦','tar':'📦','gz':'📦','bz2':'📦',
+    pdf':'📕','doc':'📘','docx':'📘','xls':'📗','xlsx':'📗',
+    sql:'🗄️','xml':'📋','yml':'⚙️','yaml':'⚙️','conf':'⚙️',
+  };
+  return icons[ext] || '📄';
+}
+
+let editingFileName = '';
+let editingFilePath = '';
+
+function openFileEditor(name) {
+  editingFileName = name;
+  editingFilePath = currentPath ? currentPath + '/' + name : name;
+  fetch(API + '/files/read?site_id=' + currentSiteId + '&path=' + encodeURIComponent(editingFilePath), { headers: authHeaders() })
+    .then(r => r.json())
+    .then(d => {
+      if (d.code !== 0) { showAlert('filesAlert', d.msg); return; }
+      document.getElementById('editFilePath').textContent = editingFilePath;
+      document.getElementById('fileEditor').value = d.data;
+      document.getElementById('fileEditModal').classList.add('show');
+    });
+}
+
+function closeFileEditModal() { document.getElementById('fileEditModal').classList.remove('show'); }
+
+async function saveFile() {
+  const content = document.getElementById('fileEditor').value;
+  const d = await api('/files/write', {
+    method: 'POST',
+    body: JSON.stringify({ site_id: parseInt(currentSiteId), path: editingFilePath, content })
+  });
+  if (d.code === 0) {
+    closeFileEditModal();
+    loadFileList();
+  } else {
+    showAlert('filesAlert', d.msg);
+  }
+}
+
+async function deleteFileItem(name) {
+  if (!confirm('确定删除 ' + name + '？此操作不可恢复！')) return;
+  const filePath = currentPath ? currentPath + '/' + name : name;
+  const d = await api('/files/delete', {
+    method: 'POST',
+    body: JSON.stringify({ site_id: parseInt(currentSiteId), path: filePath })
+  });
+  if (d.code === 0) loadFileList();
+  else showAlert('filesAlert', d.msg);
+}
+
+function openMkdirModal() {
+  if (!currentSiteId) { showAlert('filesAlert', '请先选择站点'); return; }
+  document.getElementById('mkdirModal').classList.add('show');
+}
+function closeMkdirModal() { document.getElementById('mkdirModal').classList.remove('show'); }
+
+async function doMkdir() {
+  const name = document.getElementById('mkdir-name').value.trim();
+  if (!name) { showAlert('filesAlert', '请输入目录名称'); return; }
+  const d = await api('/files/mkdir', {
+    method: 'POST',
+    body: JSON.stringify({ site_id: parseInt(currentSiteId), path: currentPath, name })
+  });
+  if (d.code === 0) { closeMkdirModal(); loadFileList(); }
+  else showAlert('filesAlert', d.msg);
+}
+
+function openUploadModal() {
+  if (!currentSiteId) { showAlert('filesAlert', '请先选择站点'); return; }
+  document.getElementById('uploadModal').classList.add('show');
+}
+function closeUploadModal() { document.getElementById('uploadModal').classList.remove('show'); }
+
+function handleFileSelect(input) {
+  if (!input.files || !input.files[0]) return;
+  doUpload(input.files[0]);
+  input.value = '';
+}
+
+async function doUpload(file) {
+  const formData = new FormData();
+  formData.append('site_id', currentSiteId);
+  formData.append('path', currentPath);
+  formData.append('file', file);
+
+  document.getElementById('uploadProgress').style.display = 'block';
+  document.getElementById('uploadFileName').textContent = '上传中：' + file.name;
+  document.getElementById('uploadBar').style.width = '30%';
+
+  const r = await fetch(API + '/files/upload', {
+    method: 'POST',
+    headers: { 'Authorization': 'Bearer ' + token },
+    body: formData
+  });
+  const d = await r.json();
+
+  document.getElementById('uploadBar').style.width = '100%';
+  setTimeout(() => {
+    document.getElementById('uploadProgress').style.display = 'none';
+    document.getElementById('uploadBar').style.width = '0%';
+    closeUploadModal();
+    if (d.code === 0) {
+      showAlert('filesAlert', d.msg);
+      loadFileList();
+    } else {
+      showAlert('filesAlert', d.msg);
+    }
+  }, 500);
+}
+
+function refreshFiles() { loadFileList(); }
+
+function initFileManager() {
+  loadFileSites();
+  document.getElementById('files-site-select').value && (currentSiteId = document.getElementById('files-site-select').value);
+}
+
+// =====================
+// SSL UI
+// =====================
+
+async function loadSSL() {
+  const d = await api('/ssl/certs');
+  const tbody = document.getElementById('sslTable');
+  if (!d.data || d.data.length === 0) {
+    tbody.innerHTML = '<tr><td colspan="5" style="text-align:center;padding:40px;color:var(--text-dim);">暂无证书 <button class="btn btn-secondary" style="margin-left:12px;" onclick="openSSLModal()">+ 申请证书</button></td></tr>';
+    return;
+  }
+  tbody.innerHTML = d.data.map(s => {
+    const days = s.days_left;
+    const dayClass = days < 0 ? 'red' : days <= 7 ? 'yellow' : 'green';
+    const expire = days < 0 ? '已过期' : days === 0 ? '今日到期' : '剩余 ' + days + ' 天';
+    return `<tr>
+      <td class="domain">${s.domain}</td>
+      <td style="font-size:12px;">${s.cert_path}</td>
+      <td><span class="badge ${dayClass}">${expire}</span></td>
+      <td><span class="badge ${s.auto_renew ? 'green' : 'yellow'}">${s.auto_renew ? '已启用' : '未启用'}</span></td>
+      <td class="actions">
+        <button class="btn-icon" onclick="renewSingleSSL(${s.id})" title="续期">🔄</button>
+        <button class="btn-icon" onclick="deploySSL('${s.domain}')" title="部署HTTPS">🔐</button>
+        <button class="btn-icon danger" onclick="deleteSSL(${s.id})">🗑️</button>
+      </td>
+    </tr>`;
+  }).join('');
+
+  // Update security page SSL status
+  if (d.status) {
+    const sec = d.status;
+    document.getElementById('sec-updatable').textContent = sec.total + ' 张证书';
+  }
+}
+
+async function renewSingleSSL(id) {
+  const d = await api('/ssl/renew/' + id, { method: 'POST' });
+  alert(d.msg);
+  loadSSL();
+}
+
+async function deploySSL(domain) {
+  const d = await api('/ssl/deploy/' + domain, { method: 'POST' });
+  alert(d.msg);
+  loadSSL();
+}
+
+async function deleteSSL(id) {
+  if (!confirm('确定删除此证书？')) return;
+  // TODO: add delete API
+  alert('删除功能开发中');
+}
+
+// =====================
+// Cron / Auto tasks
+// =====================
+
+async function runCronTasks() {
+  if (!confirm('确定执行定时任务（安全更新 + SSL 续期）？')) return;
+  const d = await api('/cron/run', { method: 'POST' });
+  alert(d.msg);
+  loadSecurity();
+  loadDashboard();
+}
+
+
+// =====================
+// Cron Jobs UI
+// =====================
+
+let cronSiteOptions = '';
+
+async function loadCronJobs() {
+  const d = await api('/cron/jobs');
+  const sites = await api('/sites');
+  const tbody = document.getElementById('cronTable');
+
+  // Build site options for modals
+  cronSiteOptions = '<option value="">-- 选择站点 --</option>' +
+    (sites.data || []).map(s => `<option value="${s.id}">${s.domain}</option>`).join('');
+
+  if (!d.data || d.data.length === 0) {
+    tbody.innerHTML = '<tr><td colspan="7" style="text-align:center;padding:40px;color:var(--text-dim);">暂无定时任务 <button class="btn btn-secondary" style="margin-left:12px;" onclick="openCronModal()">+ 创建</button></td></tr>';
+    return;
+  }
+
+  tbody.innerHTML = d.data.map(j => {
+    const enabled = j.enabled;
+    const lastRun = j.last_run ? j.last_run.slice(0, 16).replace('T', ' ') : '-';
+    return `<tr>
+      <td style="font-weight:600;">${j.name}</td>
+      <td><span class="badge blue">${j.domain || '系统'}</span></td>
+      <td><code style="font-family:'JetBrains Mono',monospace;background:var(--green-dim);padding:2px 8px;border-radius:4px;">${j.schedule}</code></td>
+      <td style="max-width:200px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;font-size:12px;color:var(--text-dim);" title="${j.command}">${j.command}</td>
+      <td><span class="badge ${enabled ? 'green' : 'yellow'}">${enabled ? '启用' : '禁用'}</span></td>
+      <td style="font-size:12px;color:var(--text-dim);">${lastRun}</td>
+      <td class="actions">
+        <button class="btn-icon" onclick="runCronNow(${j.id})" title="立即执行">▶️</button>
+        <button class="btn-icon" onclick="toggleCron(${j.id}, ${!enabled})" title="${enabled ? '暂停' : '启用'}">${enabled ? '⏸️' : '▶️'}</button>
+        <button class="btn-icon danger" onclick="deleteCron(${j.id})" title="删除">🗑️</button>
+      </td>
+    </tr>`;
+  }).join('');
+}
+
+function openCronModal() {
+  document.getElementById('cronModalAlert').style.display = 'none';
+  document.getElementById('cron-name').value = '';
+  document.getElementById('cron-site').innerHTML = cronSiteOptions;
+  document.getElementById('cron-schedule').value = '0 3 * * *';
+  document.getElementById('cron-command').value = '';
+  document.getElementById('cronModal').classList.add('show');
+}
+function closeCronModal() { document.getElementById('cronModal').classList.remove('show'); }
+
+async function createCron() {
+  const name = document.getElementById('cron-name').value.trim();
+  const site_id = parseInt(document.getElementById('cron-site').value);
+  const schedule = document.getElementById('cron-schedule').value.trim();
+  const command = document.getElementById('cron-command').value.trim();
+
+  if (!name || !site_id || !schedule || !command) {
+    const al = document.getElementById('cronModalAlert');
+    al.textContent = '请填写所有字段';
+    al.style.display = 'block';
+    return;
+  }
+
+  const d = await api('/cron/jobs', {
+    method: 'POST',
+    body: JSON.stringify({ site_id, name, schedule, command })
+  });
+  if (d.code === 0) {
+    closeCronModal();
+    loadCronJobs();
+  } else {
+    const al = document.getElementById('cronModalAlert');
+    al.textContent = d.msg;
+    al.style.display = 'block';
+  }
+}
+
+async function runCronNow(id) {
+  if (!confirm('确定立即执行此任务？')) return;
+  const d = await api('/cron/jobs/' + id + '/run', { method: 'POST' });
+  alert(d.msg);
+  loadCronJobs();
+}
+
+async function toggleCron(id, enabled) {
+  const d = await api('/cron/jobs/' + id + '/toggle', {
+    method: 'POST',
+    body: JSON.stringify({ enabled })
+  });
+  if (d.code === 0) loadCronJobs();
+  else alert(d.msg);
+}
+
+async function deleteCron(id) {
+  if (!confirm('确定删除此定时任务？')) return;
+  const d = await api('/cron/jobs/' + id, { method: 'DELETE' });
+  if (d.code === 0) loadCronJobs();
+  else alert(d.msg);
+}
+
+// =====================
+// Remote Backup
+// =====================
+
+let backupSiteOptions = '';
+
+async function loadBackupStats() {
+  const d = await api('/backups/stats');
+  if (d.code === 0 && d.data) {
+    document.getElementById('stat-backups').textContent = d.data.total_backups + ' 份';
+  }
+}
+
+async function openRemoteBackupModal() {
+  const sites = await api('/sites');
+  const sel = document.getElementById('backup-remote-site');
+  sel.innerHTML = '<option value="">-- 选择站点 --</option>' +
+    (sites.data || []).map(s => `<option value="${s.id}">${s.domain}</option>`).join('');
+  document.getElementById('backupModal').classList.add('show');
+}
+
+async function doRemoteBackup() {
+  const site_id = parseInt(document.getElementById('backup-remote-site').value);
+  const host = document.getElementById('remote-host').value.trim();
+  const user = document.getElementById('remote-user').value.trim();
+  const port = parseInt(document.getElementById('remote-port').value) || 22;
+  const path = document.getElementById('remote-path').value.trim();
+  const key = document.getElementById('remote-key').value.trim();
+
+  if (!site_id || !host || !user || !path) {
+    showAlert('backupModalAlert', '请填写所有必填字段');
+    return;
+  }
+
+  closeBackupModal();
+
+  const al = document.getElementById('backupAlert');
+  al.textContent = '正在执行远程备份，请稍候...';
+  al.className = 'alert show success';
+  document.getElementById('backupAlert').style.display = 'block';
+
+  const d = await api('/backups/remote', {
+    method: 'POST',
+    body: JSON.stringify({ site_id, remote_host: host, remote_user: user, remote_port: port, remote_path: path, key_path: key })
+  });
+
+  al.textContent = d.msg;
+  al.className = 'alert show ' + (d.code === 0 ? 'success' : 'error');
+  setTimeout(() => { al.className = 'alert'; al.style.display = 'none'; }, 5000);
+
+  loadBackups();
+}
+
+async function testRemote() {
+  const host = document.getElementById('remote-host').value.trim();
+  const port = parseInt(document.getElementById('remote-port').value) || 22;
+  const user = document.getElementById('remote-user').value.trim();
+  const key = document.getElementById('remote-key').value.trim();
+
+  const d = await api('/backups/remote/test', {
+    method: 'POST',
+    body: JSON.stringify({ host, port, user, key_path: key })
+  });
+  alert(d.msg);
+}
+
+// =====================
+// Start
+// =====================
+
+checkAuth();
+</script>
+</body>
+</html>
\ No newline at end of file
diff --git a/install.sh b/install.sh
new file mode 100644
index 0000000..8e267df
--- /dev/null
+++ b/install.sh
@@ -0,0 +1,175 @@
+#!/bin/bash
+# T面板 - 一键安装脚本
+# 官网: https://tpanel.cn
+# 作者: Zhang Pu
+set -e
+
+echo "========================================"
+echo "  🌿 T面板 v1.0.0 安装程序"
+echo "  官网: https://tpanel.cn"
+echo "  作者: Zhang Pu"
+echo "========================================"
+echo ""
+
+# 检查是否为 root
+if [ "$EUID" -ne 0 ]; then
+    echo "❌ 请使用 root 权限运行此脚本：sudo bash install.sh"
+    exit 1
+fi
+
+# 检测系统
+if [ -f /etc/os-release ]; then
+    . /etc/os-release
+    OS=$ID
+    VER=$VERSION_ID
+    echo "检测到系统: $PRETTY_NAME"
+else
+    echo "❌ 无法识别系统版本"
+    exit 1
+fi
+
+if [[ "$OS" == "ubuntu" ]] || [[ "$OS" == "debian" ]]; then
+    PKG_MANAGER="apt-get"
+elif [[ "$OS" == "centos" ]] || [[ "$OS" == "rocky" ]] || [[ "$OS" == "alma" ]]; then
+    PKG_MANAGER="yum"
+else
+    echo "⚠️  未测试的系统 ($OS)，继续但可能出错"
+fi
+
+echo ""
+echo "==> 1/7 更新软件源..."
+$PKG_MANAGER update -qq
+
+echo "==> 2/7 安装依赖包..."
+if command -v nginx &>/dev/null; then
+    echo "  Nginx 已安装，跳过"
+else
+    $PKG_MANAGER install -y nginx
+fi
+
+if command -v php &>/dev/null; then
+    echo "  PHP 已安装，跳过"
+else
+    $PKG_MANAGER install -y php php-fpm php-mysql php-mbstring php-xml php-curl php-zip
+fi
+
+if command -v mysql &>/dev/null; then
+    echo "  MySQL 已安装，跳过"
+else
+    $PKG_MANAGER install -y mysql-server
+    systemctl enable mysql
+    systemctl start mysql
+fi
+
+# Python3 和 pip
+if ! command -v python3 &>/dev/null; then
+    $PKG_MANAGER install -y python3 python3-pip python3-venv
+fi
+
+# certbot
+if ! command -v certbot &>/dev/null; then
+    $PKG_MANAGER install -y certbot python3-certbot-nginx
+fi
+
+echo "==> 3/7 创建 T面板 用户和目录..."
+useradd -m -s /bin/bash tpanel 2>/dev/null || true
+mkdir -p /opt/tpanel
+mkdir -p /opt/tpanel/sites
+mkdir -p /opt/tpanel/backups
+mkdir -p /opt/tpanel/ssl
+mkdir -p /opt/tpanel/logs
+mkdir -p /opt/tpanel/data
+mkdir -p /opt/tpanel/config
+
+# 复制源码
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+if [ -f "$SCRIPT_DIR/backend/main.py" ]; then
+    cp -r "$SCRIPT_DIR/backend" /opt/tpanel/
+    cp -r "$SCRIPT_DIR/frontend" /opt/tpanel/
+    cp "$SCRIPT_DIR/requirements.txt" /opt/tpanel/
+    cp "$SCRIPT_DIR/SPEC.md" /opt/tpanel/
+    echo "  源码已复制到 /opt/tpanel"
+fi
+
+chown -R tpanel:tpanel /opt/tpanel
+
+echo "==> 4/7 安装 Python 依赖..."
+cd /opt/tpanel
+python3 -m venv venv
+source venv/bin/activate
+pip install -q -r requirements.txt
+deactivate
+
+echo "==> 5/7 初始化数据库..."
+cd /opt/tpanel/backend
+chown -R tpanel:tpanel /opt/tpanel
+sudo -u tpanel bash -c "source /opt/tpanel/venv/bin/activate && python3 db_init.py"
+
+echo "==> 6/7 配置 Nginx 反向代理..."
+cat > /etc/nginx/sites-available/tpanel.conf << 'EOF'
+# TPanel - https://tpanel.cn
+server {
+    listen 80;
+    server_name localhost;
+
+    client_max_body_size 50M;
+
+    location / {
+        proxy_pass http://127.0.0.1:8848;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+}
+EOF
+
+ln -sf /etc/nginx/sites-available/tpanel.conf /etc/nginx/sites-enabled/tpanel.conf
+
+# 删除默认配置
+rm -f /etc/nginx/sites-enabled/default
+
+nginx -t && nginx -s reload
+
+echo "==> 7/7 配置 Systemd 服务..."
+cat > /etc/systemd/system/tpanel.service << 'EOF'
+[Unit]
+Description=TPanel - Linux Website Management Panel
+Documentation=https://tpanel.cn
+After=network.target mysql.service
+
+[Service]
+Type=simple
+User=tpanel
+Group=tpanel
+WorkingDirectory=/opt/tpanel/backend
+Environment="PATH=/opt/tpanel/venv/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin"
+ExecStart=/opt/tpanel/venv/bin/python3 main.py 8848
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+systemctl daemon-reload
+systemctl enable tpanel
+systemctl start tpanel
+
+echo ""
+echo "✅ T面板安装完成！"
+echo ""
+echo "   访问地址：http://localhost （或服务器 IP）"
+echo "   默认账号：admin / tpanel.cn"
+echo "   后台端口：8848"
+echo ""
+echo "   官方网址：https://tpanel.cn"
+echo "   作者：Zhang Pu · https://zhangpu.dev"
+echo ""
+echo "   常用命令："
+echo "   systemctl status tpanel   # 查看状态"
+echo "   systemctl restart tpanel  # 重启面板"
+echo "   journalctl -u tpanel -f    # 查看日志"
+echo ""
\ No newline at end of file
diff --git a/requirements.txt b/requirements.txt
new file mode 100644
index 0000000..992492a
--- /dev/null
+++ b/requirements.txt
@@ -0,0 +1,5 @@
+flask==3.0.3
+flask-cors==4.0.0
+APScheduler==3.10.4
+python-dotenv==1.0.1
+certbot==2.11.0
\ No newline at end of file