diff --git a/EdgeAdmin/web/views/@default/@layout.html b/EdgeAdmin/web/views/@default/@layout.html
index d643d3a..708bdc6 100644
--- a/EdgeAdmin/web/views/@default/@layout.html
+++ b/EdgeAdmin/web/views/@default/@layout.html
@@ -86,7 +86,7 @@
             <a href="" class="item" title="switch language" @click.prevent="switchLang" v-show="false"><i class="icon language"></i> </a>
 
             <!-- 背景颜色 -->
-            <a href="" class="item" title="点击切换界面风格" @click.prevent="changeTheme()"><i class="icon adjust"></i></a>
+            <a href="" class="item" title="点击切换界面风格" @click.prevent="changeTheme()" v-if="false"><i class="icon adjust"></i></a>
 
             <!-- 企业版 -->
            <!-- <a :href="'/settings/authority'" class="item" title="商业版" :v-if="teaIsPlus"><i class="icon gem outline yellow"></i></a>-->
@@ -154,4 +154,4 @@
 {$echo "footer"}
 
 </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/EdgeAdmin/web/views/@default/@layout_override.css b/EdgeAdmin/web/views/@default/@layout_override.css
index 9e33757..3fb1b56 100644
--- a/EdgeAdmin/web/views/@default/@layout_override.css
+++ b/EdgeAdmin/web/views/@default/@layout_override.css
@@ -1,9 +1,9 @@
 /* 全局字体大小调整 - 增加 10% */
 html {
-  font-size: 15.4px !important; /* 14px * 1.1 = 15.4px */
+  font-size: 16px !important;
 }
 body {
-  font-size: 15.4px !important; /* 14px * 1.1 = 15.4px */
+  font-size: 16px !important;
 }
 .ui.toggle.checkbox input:focus:checked ~ .box:before,
 .ui.toggle.checkbox input:focus:checked ~ label:before {
@@ -77,4 +77,42 @@ body.swal2-shown {
   background: rgba(230, 230, 230, 0.35) !important;
   border-radius: 3px;
 }
-/*# sourceMappingURL=@layout_override.css.map */
\ No newline at end of file
+:root {
+  --admin-top-nav-bg: #0a1f3f;
+  --admin-side-menu-bg: #102a4d;
+}
+.top-nav.theme1,
+.top-nav.theme2,
+.top-nav.theme3,
+.top-nav.theme4,
+.top-nav.theme5,
+.top-nav.theme6,
+.top-nav.theme7 {
+  background: var(--admin-top-nav-bg) !important;
+}
+.main-menu.theme1,
+.main-menu.theme2,
+.main-menu.theme3,
+.main-menu.theme4,
+.main-menu.theme5,
+.main-menu.theme6,
+.main-menu.theme7,
+.main-menu.theme1 .menu,
+.main-menu.theme2 .menu,
+.main-menu.theme3 .menu,
+.main-menu.theme4 .menu,
+.main-menu.theme5 .menu,
+.main-menu.theme6 .menu,
+.main-menu.theme7 .menu {
+  background: var(--admin-side-menu-bg) !important;
+}
+.main-menu .ui.menu .item.separator,
+.main-menu .ui.menu .sub-items .item.separator {
+  display: none !important;
+  border: 0 !important;
+  height: 0 !important;
+  min-height: 0 !important;
+  padding: 0 !important;
+  margin: 0 !important;
+}
+/*# sourceMappingURL=@layout_override.css.map */
diff --git a/EdgeAdmin/web/views/@default/@layout_override.less b/EdgeAdmin/web/views/@default/@layout_override.less
index ab0cf55..a831635 100644
--- a/EdgeAdmin/web/views/@default/@layout_override.less
+++ b/EdgeAdmin/web/views/@default/@layout_override.less
@@ -1,10 +1,10 @@
 // 全局字体大小调整 - 增加 10%
 html {
-	font-size: 15.4px !important; // 14px * 1.1 = 15.4px
+	font-size: 16px !important;
 }
 
 body {
-	font-size: 15.4px !important; // 14px * 1.1 = 15.4px
+	font-size: 16px !important;
 }
 
 // labels
@@ -106,3 +106,47 @@ body.swal2-shown {
 		min-width: 5em;
 	}
 }
+
+// Menu background colors only
+:root {
+	--admin-top-nav-bg: #0a1f3f;
+	--admin-side-menu-bg: #102a4d;
+}
+
+.top-nav.theme1,
+.top-nav.theme2,
+.top-nav.theme3,
+.top-nav.theme4,
+.top-nav.theme5,
+.top-nav.theme6,
+.top-nav.theme7 {
+	background: var(--admin-top-nav-bg) !important;
+}
+
+.main-menu.theme1,
+.main-menu.theme2,
+.main-menu.theme3,
+.main-menu.theme4,
+.main-menu.theme5,
+.main-menu.theme6,
+.main-menu.theme7,
+.main-menu.theme1 .menu,
+.main-menu.theme2 .menu,
+.main-menu.theme3 .menu,
+.main-menu.theme4 .menu,
+.main-menu.theme5 .menu,
+.main-menu.theme6 .menu,
+.main-menu.theme7 .menu {
+	background: var(--admin-side-menu-bg) !important;
+}
+
+// Hide menu separators
+.main-menu .ui.menu .item.separator,
+.main-menu .ui.menu .sub-items .item.separator {
+	display: none !important;
+	border: 0 !important;
+	height: 0 !important;
+	min-height: 0 !important;
+	padding: 0 !important;
+	margin: 0 !important;
+}
diff --git a/EdgeAdmin/web/views/@default/index/index.css b/EdgeAdmin/web/views/@default/index/index.css
index 190ac7b..1f86819 100644
--- a/EdgeAdmin/web/views/@default/index/index.css
+++ b/EdgeAdmin/web/views/@default/index/index.css
@@ -25,7 +25,8 @@ body.login-page {
 body.login-page > div {
   position: relative;
   width: 100%;
-  height: 100%;
+  height: 100vh;
+  min-height: 100vh;
 }
 
 .bg-layer {
@@ -241,4 +242,22 @@ body.login-page > div {
     padding: 30px 18px;
   }
 }
+/* SweetAlert2 fallback on login page */
+body.login-page.swal2-height-auto {
+  height: 100% !important;
+}
+
+body.login-page .swal2-container {
+  position: fixed !important;
+  inset: 0 !important;
+  z-index: 20000 !important;
+  display: flex !important;
+  align-items: center !important;
+  justify-content: center !important;
+  padding: 0.625em !important;
+}
+
+body.login-page .swal2-container.swal2-backdrop-show {
+  background: rgba(0, 0, 0, 0.42) !important;
+}
 /*# sourceMappingURL=index.css.map */
diff --git a/EdgeAdmin/web/views/@default/index/index.less b/EdgeAdmin/web/views/@default/index/index.less
index 971e424..dc6922e 100644
--- a/EdgeAdmin/web/views/@default/index/index.less
+++ b/EdgeAdmin/web/views/@default/index/index.less
@@ -25,7 +25,8 @@ body.login-page {
 body.login-page > div {
     position: relative;
     width: 100%;
-    height: 100%;
+    height: 100vh;
+    min-height: 100vh;
 }
 
 .bg-layer {
@@ -241,3 +242,22 @@ body.login-page > div {
         padding: 30px 18px;
     }
 }
+
+/* SweetAlert2 fallback on login page */
+body.login-page.swal2-height-auto {
+    height: 100% !important;
+}
+
+body.login-page .swal2-container {
+    position: fixed !important;
+    inset: 0 !important;
+    z-index: 20000 !important;
+    display: flex !important;
+    align-items: center !important;
+    justify-content: center !important;
+    padding: 0.625em !important;
+}
+
+body.login-page .swal2-container.swal2-backdrop-show {
+    background: rgba(0, 0, 0, 0.42) !important;
+}
diff --git a/EdgeUser/web/views/@default/@layout.html b/EdgeUser/web/views/@default/@layout.html
index 01eadcc..b66981f 100644
--- a/EdgeUser/web/views/@default/@layout.html
+++ b/EdgeUser/web/views/@default/@layout.html
@@ -32,9 +32,9 @@
 
     {$if not (eq .teaThemeBackgroundColor "")}
     <style>
-        .top-nav,
-        .main-menu,
-        .main-menu .menu {
+        .top-nav.user-theme-enabled,
+        .main-menu.user-theme-enabled,
+        .main-menu.user-theme-enabled .menu {
             background: #{$.teaThemeBackgroundColor} !important;
         }
     </style>
@@ -43,7 +43,7 @@
     <script type="text/javascript">
         (function () {
             try {
-                var savedColor = localStorage.getItem("themeColor");
+                var savedColor = null;
                 if (savedColor) {
                     var styleId = "theme-color-custom";
                     var styleEl = document.getElementById(styleId);
@@ -87,7 +87,7 @@
                 <a href="/docs" class="item" :class="{active: teaMenu == 'docs'}"><i class="icon file"></i><span
                         class="hover-span"><span>文档</span></span></a>
                 <!-- 自定义主题颜色 -->
-                <theme-color-picker></theme-color-picker>
+                <theme-color-picker v-if="false"></theme-color-picker>
                 <a href="/" class="item" v-show="teaShowIndexPage">
                     <i class="icon home"></i><span class="hover-span"><span>首页</span></span>
                 </a>
@@ -160,4 +160,4 @@
 
 </body>
 
-</html>
\ No newline at end of file
+</html>
diff --git a/EdgeUser/web/views/@default/@layout_override.css b/EdgeUser/web/views/@default/@layout_override.css
index 09ae6f5..30f8521 100644
--- a/EdgeUser/web/views/@default/@layout_override.css
+++ b/EdgeUser/web/views/@default/@layout_override.css
@@ -1,9 +1,9 @@
 /* 全局字体大小调整 - 增加 10% */
 html {
-  font-size: 15.4px !important; /* 14px * 1.1 = 15.4px */
+  font-size: 16px !important;
 }
 body {
-  font-size: 15.4px !important; /* 14px * 1.1 = 15.4px */
+  font-size: 16px !important;
 }
 .ui.toggle.checkbox input:focus:checked ~ .box:before,
 .ui.toggle.checkbox input:focus:checked ~ label:before {
@@ -60,6 +60,47 @@ textarea::-webkit-scrollbar {
 select.dropdown {
   height: auto !important;
 }
+:root {
+  --admin-top-nav-bg: #0a1f3f;
+  --admin-side-menu-bg: #102a4d;
+}
+.top-nav,
+.top-nav.theme1,
+.top-nav.theme2,
+.top-nav.theme3,
+.top-nav.theme4,
+.top-nav.theme5,
+.top-nav.theme6,
+.top-nav.theme7 {
+  background: var(--admin-top-nav-bg) !important;
+}
+.main-menu,
+.main-menu.theme1,
+.main-menu.theme2,
+.main-menu.theme3,
+.main-menu.theme4,
+.main-menu.theme5,
+.main-menu.theme6,
+.main-menu.theme7,
+.main-menu .menu,
+.main-menu.theme1 .menu,
+.main-menu.theme2 .menu,
+.main-menu.theme3 .menu,
+.main-menu.theme4 .menu,
+.main-menu.theme5 .menu,
+.main-menu.theme6 .menu,
+.main-menu.theme7 .menu {
+  background: var(--admin-side-menu-bg) !important;
+}
+.main-menu .ui.menu .item.separator,
+.main-menu .ui.menu .sub-items .item.separator {
+  display: none !important;
+  border: 0 !important;
+  height: 0 !important;
+  min-height: 0 !important;
+  padding: 0 !important;
+  margin: 0 !important;
+}
 .left-box .menu .item.active {
   background: rgba(230, 230, 230, 0.35) !important;
   border-radius: 3px;
@@ -73,4 +114,4 @@ select.dropdown {
 .main-menu .ui.menu .sub-items .item.active {
   background: rgba(230, 230, 230, 0.55) !important;
 }
-/*# sourceMappingURL=@layout_override.css.map */
\ No newline at end of file
+/*# sourceMappingURL=@layout_override.css.map */
diff --git a/EdgeUser/web/views/@default/@layout_override.less b/EdgeUser/web/views/@default/@layout_override.less
index 850b50e..0ed75ee 100644
--- a/EdgeUser/web/views/@default/@layout_override.less
+++ b/EdgeUser/web/views/@default/@layout_override.less
@@ -1,10 +1,10 @@
 // 全局字体大小调整 - 增加 10%
 html {
-	font-size: 15.4px !important; // 14px * 1.1 = 15.4px
+	font-size: 16px !important;
 }
 
 body {
-	font-size: 15.4px !important; // 14px * 1.1 = 15.4px
+	font-size: 16px !important;
 }
 
 // labels
@@ -77,4 +77,50 @@ textarea::-webkit-scrollbar {
 // dropdown
 select.dropdown {
 	height: auto !important;
-}
\ No newline at end of file
+}
+
+// Menu background colors and separator cleanup
+:root {
+	--admin-top-nav-bg: #0a1f3f;
+	--admin-side-menu-bg: #102a4d;
+}
+
+.top-nav,
+.top-nav.theme1,
+.top-nav.theme2,
+.top-nav.theme3,
+.top-nav.theme4,
+.top-nav.theme5,
+.top-nav.theme6,
+.top-nav.theme7 {
+	background: var(--admin-top-nav-bg) !important;
+}
+
+.main-menu,
+.main-menu.theme1,
+.main-menu.theme2,
+.main-menu.theme3,
+.main-menu.theme4,
+.main-menu.theme5,
+.main-menu.theme6,
+.main-menu.theme7,
+.main-menu .menu,
+.main-menu.theme1 .menu,
+.main-menu.theme2 .menu,
+.main-menu.theme3 .menu,
+.main-menu.theme4 .menu,
+.main-menu.theme5 .menu,
+.main-menu.theme6 .menu,
+.main-menu.theme7 .menu {
+	background: var(--admin-side-menu-bg) !important;
+}
+
+.main-menu .ui.menu .item.separator,
+.main-menu .ui.menu .sub-items .item.separator {
+	display: none !important;
+	border: 0 !important;
+	height: 0 !important;
+	min-height: 0 !important;
+	padding: 0 !important;
+	margin: 0 !important;
+}
diff --git a/EdgeUser/web/views/@default/index/index.css b/EdgeUser/web/views/@default/index/index.css
index 1194a2f..35d4d5f 100644
--- a/EdgeUser/web/views/@default/index/index.css
+++ b/EdgeUser/web/views/@default/index/index.css
@@ -1,45 +1,261 @@
-.form-box {
-  position: fixed;
-  top: 2.5em;
-  bottom: 0;
-  left: 0;
-  right: 0;
+:root {
+  --primary-color: #0066ff;
+  --hover-color: #0052cc;
+  --bg-gradient-start: #0a192f;
+  --bg-gradient-end: #112240;
+  --text-main: #333333;
+  --text-sub: #888888;
+  --border-color: #e5e7eb;
 }
-form {
-  position: fixed;
-  width: 21em;
+
+html,
+body {
+  width: 100%;
+  height: 100%;
+  margin: 0;
+}
+
+body.login-page {
+  font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif;
+  overflow: hidden;
+  background: linear-gradient(135deg, var(--bg-gradient-start) 0%, #1e3a8a 100%);
+  position: relative;
+}
+
+body.login-page > div {
+  position: relative;
+  width: 100%;
+  height: 100vh;
+  min-height: 100vh;
+}
+
+.bg-layer {
+  position: absolute;
+  inset: 0;
+  z-index: 0;
+  overflow: hidden;
+}
+
+.tech-bg {
+  position: absolute;
+  inset: 0;
+  opacity: 0.1;
+  background-image: radial-gradient(#ffffff 1px, transparent 1px), radial-gradient(#ffffff 1px, transparent 1px);
+  background-size: 40px 40px;
+  background-position: 0 0, 20px 20px;
+}
+
+.glow-circle {
+  position: absolute;
+  width: 800px;
+  height: 800px;
   top: 50%;
   left: 50%;
-  margin-left: -10em;
-  margin-top: -16em;
+  transform: translate(-50%, -50%);
+  border-radius: 50%;
+  background: radial-gradient(circle, rgba(0, 102, 255, 0.1) 0%, rgba(0, 0, 0, 0) 70%);
+  pointer-events: none;
 }
-form .header {
+
+.login-shell {
+  position: relative;
+  z-index: 10;
+  width: 100%;
+  height: 100%;
+}
+
+.form-box {
+  width: 100%;
+  height: 100%;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  padding: 20px;
+}
+
+.login-card {
+  background: #ffffff;
+  width: 100%;
+  max-width: 460px;
+  padding: 48px 40px;
+  border-radius: 12px;
+  box-shadow: 0 25px 50px -12px rgba(0, 0, 0, 0.5);
+  backdrop-filter: blur(10px);
+}
+
+.card-header {
   text-align: center;
-  font-size: 1em !important;
+  margin-bottom: 32px;
 }
-form p {
-  font-size: 0.8em;
-  margin-top: 0.3em;
-  margin-bottom: 0;
-  font-weight: normal;
-  padding: 0;
+
+.brand-logo {
+  display: inline-flex;
+  align-items: center;
+  gap: 10px;
+  margin-bottom: 12px;
 }
-form .comment {
-  margin-top: 0.5em;
-  padding: 0.5em;
-  color: gray;
+
+.logo-icon {
+  width: 36px;
+  height: 36px;
+  background: var(--primary-color);
+  border-radius: 6px;
+  color: #ffffff;
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
 }
-form .register-box {
+
+.logo-icon i.icon {
+  margin: 0 !important;
+  font-size: 16px;
+}
+
+.logo-text {
+  font-size: 24px;
+  font-weight: 700;
+  color: var(--text-main);
+  line-height: 1;
+}
+
+.header-title {
+  font-size: 16px;
+  color: var(--text-sub);
+  font-weight: 400;
+  margin: 0;
+}
+
+.login-form {
+  margin: 0;
+}
+
+.login-form .input-group {
+  margin-bottom: 24px;
+}
+
+.login-form .input-label {
+  display: block;
+  font-size: 14px;
+  color: var(--text-main);
+  margin-bottom: 8px;
+  font-weight: 500;
+}
+
+.login-form .input-field-wrapper {
+  position: relative;
+}
+
+.login-form .ui.left.icon.input {
+  width: 100%;
+}
+
+.login-form .ui.left.icon.input .input-icon {
+  color: #9ca3af;
+  transition: color 0.3s;
+}
+
+.login-form .ui.left.icon.input input {
+  width: 100%;
+  height: 46px;
+  padding: 12px 16px 12px 42px;
+  font-size: 15px !important;
+  border: 1px solid var(--border-color);
+  border-radius: 6px;
+  outline: none;
+  color: var(--text-main);
+  background: #f9fafb;
+  transition: all 0.2s ease;
+}
+
+.login-form .ui.left.icon.input input::placeholder {
+  color: #9ca3af;
+}
+
+.login-form .ui.left.icon.input input:focus {
+  background: #ffffff;
+  border-color: var(--primary-color);
+  box-shadow: 0 0 0 3px rgba(0, 102, 255, 0.1);
+}
+
+.login-form .ui.left.icon.input:focus-within .input-icon {
+  color: var(--primary-color);
+}
+
+.remember-wrap {
+  margin-top: -4px;
+  margin-bottom: 10px;
+}
+
+.remember-wrap .ui.checkbox label {
+  font-size: 13px;
+  color: #6b7280;
+}
+
+.submit-btn.ui.button.primary {
+  width: 100%;
+  margin-top: 10px;
+  height: 50px;
+  border: none;
+  border-radius: 6px;
+  background: var(--primary-color);
+  color: #ffffff;
+  font-size: 16px !important;
+  font-weight: 600;
+  box-shadow: 0 4px 6px -1px rgba(0, 102, 255, 0.2);
+  transition: background 0.2s ease, transform 0.2s ease;
+}
+
+.submit-btn.ui.button.primary:hover {
+  background: var(--hover-color);
+  transform: translateY(-1px);
+}
+
+.register-box {
   text-align: center;
-  margin-top: 1em;
+  margin-top: 12px;
+  font-size: 13px;
 }
-@media screen and (max-width: 512px) {
-  form {
-    width: 80%;
-    margin-left: -40%;
-  }
+
+.register-box a {
+  color: #4183c4;
 }
+
 .disabled {
   color: #ccc !important;
 }
-/*# sourceMappingURL=index.css.map */
\ No newline at end of file
+
+@media screen and (max-width: 768px) {
+  body.login-page {
+    overflow: auto;
+  }
+
+  .form-box {
+    padding: 14px;
+  }
+
+  .login-card {
+    max-width: 100%;
+    margin: 0;
+    padding: 30px 18px;
+  }
+}
+/* SweetAlert2 fallback on login page */
+body.login-page.swal2-height-auto {
+  height: 100% !important;
+}
+
+body.login-page .swal2-container {
+  position: fixed !important;
+  inset: 0 !important;
+  z-index: 20000 !important;
+  display: flex !important;
+  align-items: center !important;
+  justify-content: center !important;
+  padding: 0.625em !important;
+}
+
+body.login-page .swal2-container.swal2-backdrop-show {
+  background: rgba(0, 0, 0, 0.42) !important;
+}
+
+/*# sourceMappingURL=index.css.map */
diff --git a/EdgeUser/web/views/@default/index/index.html b/EdgeUser/web/views/@default/index/index.html
index 956bf38..6a57656 100644
--- a/EdgeUser/web/views/@default/index/index.html
+++ b/EdgeUser/web/views/@default/index/index.html
@@ -1,13 +1,13 @@
 <!DOCTYPE html>
 <html lang="zh">
 <head>
-	<meta http-equiv="Content-Type" content="text/html; charset=utf-8"/>
+	<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
 	{$if eq .faviconFileId 0}
-	<link rel="shortcut icon" href="/images/favicon.png"/>
+	<link rel="shortcut icon" href="/images/favicon.png" />
 	{$else}
-	<link rel="shortcut icon" href="/ui/image/{$ .faviconFileId}"/>
+	<link rel="shortcut icon" href="/ui/image/{$ .faviconFileId}" />
 	{$end}
-	<title>登录{$ htmlEncode .systemName}</title>
+	<title>&#30331;&#24405;{$ htmlEncode .systemName}</title>
 	<meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=0">
 	{$TEA.VUE}
 	{$TEA.SEMANTIC}
@@ -23,49 +23,81 @@
 	</style>
 	{$end}
 </head>
-<body style="background-image: url(/images/bg.jpg);width: 100% !important;height: 100% !important;background-size: cover !important;">
+
+<body class="login-page">
 <div>
-	{$template "/menu"}
-
-	<div class="form-box">
-		<form method="post" class="ui form" data-tea-action="$" data-tea-before="submitBefore" data-tea-done="submitDone" data-tea-success="submitSuccess" autocomplete="off">
-			<csrf-token></csrf-token>
-			<input type="hidden" name="password" v-model="passwordMd5"/>
-			<input type="hidden" name="token" v-model="token"/>
-			<div class="ui segment stacked">
-				<div class="ui header">
-					登录{$ htmlEncode .systemName}
-				</div>
-				<div class="ui field">
-					<div class="ui left icon input">
-						<i class="ui user icon small"></i>
-						<input type="text" name="username" v-model="username" :placeholder="usernamePlaceholder" maxlength="200" ref="usernameRef" @input="changeUsername"/>
-					</div>
-				</div>
-				<div class="ui field">
-					<div class="ui left icon input">
-						<i class="ui lock icon small"></i>
-						<input type="password" v-model="password" placeholder="请输入密码" maxlength="200" @input="changePassword()" ref="passwordRef"/>
-					</div>
-				</div>
-				<div class="ui field" v-show="showOTP">
-					<div class="ui left icon input">
-						<i class="ui barcode icon"></i>
-						<input type="text" name="otpCode" placeholder="请输入OTP动态密码" maxlength="6"/>
-					</div>
-				</div>
-
-				<button class="ui button primary fluid" type="submit" v-if="!isSubmitting">登录</button>
-				<button class="ui button primary fluid disabled" type="submit" v-if="isSubmitting">登录中...</button>
-
-				<div v-if="canRegister" class="register-box">
-					<a href="/register">注册新用户<span v-if="!canResetPassword">&nbsp; &raquo;</span></a><span v-if="canResetPassword"> &nbsp; <span class="disabled">|</span> &nbsp; <a href="/account/reset">找回密码</a></span>
-				</div>
-			</div>
-		</form>
+	<div class="bg-layer">
+		<div class="tech-bg"></div>
+		<div class="glow-circle"></div>
 	</div>
 
+	<div class="login-shell">
+		{$template "/menu"}
+
+		<div class="form-box">
+			<div class="login-card">
+				<div class="card-header">
+					<div class="brand-logo">
+						<span class="logo-icon"><i class="shield alternate icon"></i></span>
+						<span class="logo-text">{$ htmlEncode .systemName}</span>
+					</div>
+					<p class="header-title">&#26032;&#19968;&#20195; Web&#19982;APP &#24212;&#29992;&#38450;&#25252;&#24179;&#21488;</p>
+				</div>
+
+				<form method="post" class="ui form login-form" data-tea-action="$" data-tea-before="submitBefore" data-tea-done="submitDone" data-tea-success="submitSuccess" autocomplete="off">
+					<csrf-token></csrf-token>
+					<input type="hidden" name="password" v-model="passwordMd5"/>
+					<input type="hidden" name="token" v-model="token"/>
+
+					<div class="ui field input-group">
+						<label class="input-label">&#36134;&#21495;</label>
+						<div class="input-field-wrapper">
+							<div class="ui left icon input">
+								<i class="ui user icon small input-icon"></i>
+								<input type="text" name="username" v-model="username" :placeholder="usernamePlaceholder" maxlength="200" ref="usernameRef" @input="changeUsername"/>
+							</div>
+						</div>
+					</div>
+
+					<div class="ui field input-group">
+						<label class="input-label">&#23494;&#30721;</label>
+						<div class="input-field-wrapper">
+							<div class="ui left icon input">
+								<i class="ui lock icon small input-icon"></i>
+								<input type="password" v-model="password" placeholder="&#35831;&#36755;&#20837;&#23494;&#30721;" maxlength="200" @input="changePassword()" ref="passwordRef"/>
+							</div>
+						</div>
+					</div>
+
+					<div class="ui field input-group" v-show="showOTP">
+						<label class="input-label">&#23433;&#20840;&#39564;&#35777;</label>
+						<div class="input-field-wrapper">
+							<div class="ui left icon input">
+								<i class="ui barcode icon input-icon"></i>
+								<input type="text" name="otpCode" placeholder="&#35831;&#36755;&#20837; OTP &#21160;&#24577;&#30721;" maxlength="6"/>
+							</div>
+						</div>
+					</div>
+
+					<div class="ui field remember-wrap" v-if="false">
+						<div class="ui checkbox">
+							<input type="checkbox" name="remember" value="1" checked="checked"/>
+							<label>&#22312;&#36825;&#21488;&#30005;&#33041;&#19978;&#35760;&#20303;&#30331;&#24405;&#65288;14&#22825;&#65289;</label>
+						</div>
+					</div>
+
+					<button class="ui button primary fluid submit-btn" type="submit" v-if="!isSubmitting">&#30331;&#24405;</button>
+					<button class="ui button primary fluid disabled submit-btn" type="submit" disabled="disabled" v-if="isSubmitting">&#30331;&#24405;&#20013;...</button>
+
+					<div v-if="canRegister" class="register-box">
+						<a href="/register">&#27880;&#20876;&#26032;&#29992;&#25143;<span v-if="!canResetPassword">&nbsp; &raquo;</span></a><span v-if="canResetPassword"> &nbsp; <span class="disabled">|</span> &nbsp; <a href="/account/reset">&#25214;&#22238;&#23494;&#30721;</a></span>
+					</div>
+				</form>
+			</div>
+		</div>
+	</div>
 </div>
 
 </body>
-</html>
\ No newline at end of file
+
+</html>
diff --git a/EdgeUser/web/views/@default/index/index.js b/EdgeUser/web/views/@default/index/index.js
index aefc84a..b7ae997 100644
--- a/EdgeUser/web/views/@default/index/index.js
+++ b/EdgeUser/web/views/@default/index/index.js
@@ -4,26 +4,44 @@ Tea.context(function () {
 	this.passwordMd5 = "";
 	this.encodedFrom = window.encodeURIComponent(this.from);
 
-	this.showOTP = false
+	this.showOTP = false;
+	this.isSubmitting = false;
 
-	this.isSubmitting = false
+	this.usernamePlaceholder = "\u8bf7\u8f93\u5165\u7528\u6237\u540d";
+	let loginMethods = [];
+	if (this.emailCanLogin) {
+		loginMethods.push("\u90ae\u7bb1");
+	}
+	if (this.mobileCanLogin) {
+		loginMethods.push("\u624b\u673a\u53f7\u7801");
+	}
+	if (loginMethods.length > 0) {
+		this.usernamePlaceholder += "/" + loginMethods.join("/");
+	}
+
+	this.refreshPlaceholders = function () {
+		let usernameInput = document.querySelector("form input[name='username']");
+		if (usernameInput != null) {
+			usernameInput.setAttribute("placeholder", this.usernamePlaceholder);
+		}
+
+		let passwordInput = document.querySelector("form input[type='password']");
+		if (passwordInput != null) {
+			passwordInput.setAttribute("placeholder", "\u8bf7\u8f93\u5165\u5bc6\u7801");
+		}
+
+		let otpInput = document.querySelector("form input[name='otpCode']");
+		if (otpInput != null) {
+			otpInput.setAttribute("placeholder", "\u8bf7\u8f93\u5165 OTP \u52a8\u6001\u7801");
+		}
+	};
 
 	this.$delay(function () {
 		this.$find("form input[name='username']").focus();
 		this.changePassword();
-	})
-
-	this.usernamePlaceholder = "请输入用户名"
-	var loginMethods = []
-	if (this.emailCanLogin) {
-		loginMethods.push("邮箱")
-	}
-	if (this.mobileCanLogin) {
-		loginMethods.push("手机号码")
-	}
-	if (loginMethods.length > 0) {
-		this.usernamePlaceholder += "/" + loginMethods.join("/")
-	}
+		this.refreshPlaceholders();
+		setTimeout(() => this.refreshPlaceholders(), 200);
+	});
 
 	this.changeUsername = function () {
 		this.$post("/checkOTP")
@@ -31,27 +49,29 @@ Tea.context(function () {
 				username: this.username
 			})
 			.success(function (resp) {
-				this.showOTP = resp.data.requireOTP
-			})
-	}
+				this.showOTP = resp.data.requireOTP;
+				this.$delay(function () {
+					this.refreshPlaceholders();
+				});
+			});
+	};
 
 	this.changePassword = function () {
 		this.passwordMd5 = md5(this.password.trim());
-	}
+	};
 
-	// 更多选项
 	this.moreOptionsVisible = false;
 	this.showMoreOptions = function () {
 		this.moreOptionsVisible = !this.moreOptionsVisible;
-	}
+	};
 
 	this.submitBefore = function () {
 		this.isSubmitting = true;
-	}
+	};
 
 	this.submitDone = function () {
 		this.isSubmitting = false;
-	}
+	};
 
 	this.submitSuccess = function () {
 		if (this.from.length == 0) {
@@ -59,5 +79,5 @@ Tea.context(function () {
 		} else {
 			window.location = this.from;
 		}
-	}
-})
\ No newline at end of file
+	};
+});
diff --git a/EdgeUser/web/views/@default/index/index.less b/EdgeUser/web/views/@default/index/index.less
index 3de4de7..bd6f251 100644
--- a/EdgeUser/web/views/@default/index/index.less
+++ b/EdgeUser/web/views/@default/index/index.less
@@ -1,51 +1,260 @@
-.form-box {
-    position: fixed;
-    top: 2.5em;
-    bottom: 0;
-    left: 0;
-    right: 0;
+:root {
+    --primary-color: #0066ff;
+    --hover-color: #0052cc;
+    --bg-gradient-start: #0a192f;
+    --bg-gradient-end: #112240;
+    --text-main: #333333;
+    --text-sub: #888888;
+    --border-color: #e5e7eb;
 }
 
-form {
-    position: fixed;
-    width: 21em;
+html,
+body {
+    width: 100%;
+    height: 100%;
+    margin: 0;
+}
+
+body.login-page {
+    font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif;
+    overflow: hidden;
+    background: linear-gradient(135deg, var(--bg-gradient-start) 0%, #1e3a8a 100%);
+    position: relative;
+}
+
+body.login-page > div {
+    position: relative;
+    width: 100%;
+    height: 100vh;
+    min-height: 100vh;
+}
+
+.bg-layer {
+    position: absolute;
+    inset: 0;
+    z-index: 0;
+    overflow: hidden;
+}
+
+.tech-bg {
+    position: absolute;
+    inset: 0;
+    opacity: 0.1;
+    background-image: radial-gradient(#ffffff 1px, transparent 1px), radial-gradient(#ffffff 1px, transparent 1px);
+    background-size: 40px 40px;
+    background-position: 0 0, 20px 20px;
+}
+
+.glow-circle {
+    position: absolute;
+    width: 800px;
+    height: 800px;
     top: 50%;
     left: 50%;
-    margin-left: -10em;
-    margin-top: -16em;
-
-	.header {
-		text-align: center;
-		font-size: 1em !important;
-	}
-
-	p {
-		font-size: 0.8em;
-		margin-top: 0.3em;
-		margin-bottom: 0;
-		font-weight: normal;
-		padding: 0;
-	}
-
-	.comment {
-		margin-top: 0.5em;
-		padding: 0.5em;
-		color: gray;
-	}
-
-	.register-box {
-		text-align: center;
-		margin-top: 1em;
-	}
+    transform: translate(-50%, -50%);
+    border-radius: 50%;
+    background: radial-gradient(circle, rgba(0, 102, 255, 0.1) 0%, rgba(0, 0, 0, 0) 70%);
+    pointer-events: none;
 }
 
-@media screen and (max-width: 512px) {
-    form {
-        width: 80%;
-        margin-left: -40%;
-    }
+.login-shell {
+    position: relative;
+    z-index: 10;
+    width: 100%;
+    height: 100%;
+}
+
+.form-box {
+    width: 100%;
+    height: 100%;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    padding: 20px;
+}
+
+.login-card {
+    background: #ffffff;
+    width: 100%;
+    max-width: 460px;
+    padding: 48px 40px;
+    border-radius: 12px;
+    box-shadow: 0 25px 50px -12px rgba(0, 0, 0, 0.5);
+    backdrop-filter: blur(10px);
+}
+
+.card-header {
+    text-align: center;
+    margin-bottom: 32px;
+}
+
+.brand-logo {
+    display: inline-flex;
+    align-items: center;
+    gap: 10px;
+    margin-bottom: 12px;
+}
+
+.logo-icon {
+    width: 36px;
+    height: 36px;
+    background: var(--primary-color);
+    border-radius: 6px;
+    color: #ffffff;
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+}
+
+.logo-icon i.icon {
+    margin: 0 !important;
+    font-size: 16px;
+}
+
+.logo-text {
+    font-size: 24px;
+    font-weight: 700;
+    color: var(--text-main);
+    line-height: 1;
+}
+
+.header-title {
+    font-size: 16px;
+    color: var(--text-sub);
+    font-weight: 400;
+    margin: 0;
+}
+
+.login-form {
+    margin: 0;
+}
+
+.login-form .input-group {
+    margin-bottom: 24px;
+}
+
+.login-form .input-label {
+    display: block;
+    font-size: 14px;
+    color: var(--text-main);
+    margin-bottom: 8px;
+    font-weight: 500;
+}
+
+.login-form .input-field-wrapper {
+    position: relative;
+}
+
+.login-form .ui.left.icon.input {
+    width: 100%;
+}
+
+.login-form .ui.left.icon.input .input-icon {
+    color: #9ca3af;
+    transition: color 0.3s;
+}
+
+.login-form .ui.left.icon.input input {
+    width: 100%;
+    height: 46px;
+    padding: 12px 16px 12px 42px;
+    font-size: 15px !important;
+    border: 1px solid var(--border-color);
+    border-radius: 6px;
+    outline: none;
+    color: var(--text-main);
+    background: #f9fafb;
+    transition: all 0.2s ease;
+}
+
+.login-form .ui.left.icon.input input::placeholder {
+    color: #9ca3af;
+}
+
+.login-form .ui.left.icon.input input:focus {
+    background: #ffffff;
+    border-color: var(--primary-color);
+    box-shadow: 0 0 0 3px rgba(0, 102, 255, 0.1);
+}
+
+.login-form .ui.left.icon.input:focus-within .input-icon {
+    color: var(--primary-color);
+}
+
+.remember-wrap {
+    margin-top: -4px;
+    margin-bottom: 10px;
+}
+
+.remember-wrap .ui.checkbox label {
+    font-size: 13px;
+    color: #6b7280;
+}
+
+.submit-btn.ui.button.primary {
+    width: 100%;
+    margin-top: 10px;
+    height: 50px;
+    border: none;
+    border-radius: 6px;
+    background: var(--primary-color);
+    color: #ffffff;
+    font-size: 16px !important;
+    font-weight: 600;
+    box-shadow: 0 4px 6px -1px rgba(0, 102, 255, 0.2);
+    transition: background 0.2s ease, transform 0.2s ease;
+}
+
+.submit-btn.ui.button.primary:hover {
+    background: var(--hover-color);
+    transform: translateY(-1px);
+}
+
+.register-box {
+    text-align: center;
+    margin-top: 12px;
+    font-size: 13px;
+}
+
+.register-box a {
+    color: #4183c4;
 }
 
 .disabled {
-	color: #ccc !important;
-}
\ No newline at end of file
+    color: #ccc !important;
+}
+
+@media screen and (max-width: 768px) {
+    body.login-page {
+        overflow: auto;
+    }
+
+    .form-box {
+        padding: 14px;
+    }
+
+    .login-card {
+        max-width: 100%;
+        margin: 0;
+        padding: 30px 18px;
+    }
+}
+
+/* SweetAlert2 fallback on login page */
+body.login-page.swal2-height-auto {
+    height: 100% !important;
+}
+
+body.login-page .swal2-container {
+    position: fixed !important;
+    inset: 0 !important;
+    z-index: 20000 !important;
+    display: flex !important;
+    align-items: center !important;
+    justify-content: center !important;
+    padding: 0.625em !important;
+}
+
+body.login-page .swal2-container.swal2-backdrop-show {
+    background: rgba(0, 0, 0, 0.42) !important;
+}
diff --git a/EdgeUser/web/views/@default/login/index.css b/EdgeUser/web/views/@default/login/index.css
index 1194a2f..1a24765 100644
--- a/EdgeUser/web/views/@default/login/index.css
+++ b/EdgeUser/web/views/@default/login/index.css
@@ -1,45 +1,262 @@
-.form-box {
-  position: fixed;
-  top: 2.5em;
-  bottom: 0;
-  left: 0;
-  right: 0;
+:root {
+  --primary-color: #0066ff;
+  --hover-color: #0052cc;
+  --bg-gradient-start: #0a192f;
+  --bg-gradient-end: #112240;
+  --text-main: #333333;
+  --text-sub: #888888;
+  --border-color: #e5e7eb;
 }
-form {
-  position: fixed;
-  width: 21em;
+
+html,
+body {
+  width: 100%;
+  height: 100%;
+  margin: 0;
+}
+
+body.login-page {
+  font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif;
+  overflow: hidden;
+  background: linear-gradient(135deg, var(--bg-gradient-start) 0%, #1e3a8a 100%);
+  position: relative;
+}
+
+body.login-page > div {
+  position: relative;
+  width: 100%;
+  height: 100vh;
+  min-height: 100vh;
+}
+
+.bg-layer {
+  position: absolute;
+  inset: 0;
+  z-index: 0;
+  overflow: hidden;
+}
+
+.tech-bg {
+  position: absolute;
+  inset: 0;
+  opacity: 0.1;
+  background-image: radial-gradient(#ffffff 1px, transparent 1px), radial-gradient(#ffffff 1px, transparent 1px);
+  background-size: 40px 40px;
+  background-position: 0 0, 20px 20px;
+}
+
+.glow-circle {
+  position: absolute;
+  width: 800px;
+  height: 800px;
   top: 50%;
   left: 50%;
-  margin-left: -10em;
-  margin-top: -16em;
+  transform: translate(-50%, -50%);
+  border-radius: 50%;
+  background: radial-gradient(circle, rgba(0, 102, 255, 0.1) 0%, rgba(0, 0, 0, 0) 70%);
+  pointer-events: none;
 }
-form .header {
+
+.login-shell {
+  position: relative;
+  z-index: 10;
+  width: 100%;
+  height: 100%;
+}
+
+.form-box {
+  width: 100%;
+  height: 100%;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  padding: 20px;
+}
+
+.login-card {
+  background: #ffffff;
+  width: 100%;
+  max-width: 460px;
+  padding: 48px 40px;
+  border-radius: 12px;
+  box-shadow: 0 25px 50px -12px rgba(0, 0, 0, 0.5);
+  backdrop-filter: blur(10px);
+}
+
+.card-header {
   text-align: center;
-  font-size: 1em !important;
+  margin-bottom: 32px;
 }
-form p {
-  font-size: 0.8em;
-  margin-top: 0.3em;
-  margin-bottom: 0;
-  font-weight: normal;
-  padding: 0;
+
+.brand-logo {
+  display: inline-flex;
+  align-items: center;
+  gap: 10px;
+  margin-bottom: 12px;
 }
-form .comment {
-  margin-top: 0.5em;
-  padding: 0.5em;
-  color: gray;
+
+.logo-icon {
+  width: 36px;
+  height: 36px;
+  background: var(--primary-color);
+  border-radius: 6px;
+  color: #ffffff;
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
 }
-form .register-box {
+
+.logo-icon i.icon {
+  margin: 0 !important;
+  font-size: 16px;
+}
+
+.logo-text {
+  font-size: 24px;
+  font-weight: 700;
+  color: var(--text-main);
+  line-height: 1;
+}
+
+.header-title {
+  font-size: 16px;
+  color: var(--text-sub);
+  font-weight: 400;
+  margin: 0;
+}
+
+.login-form {
+  margin: 0;
+}
+
+.login-form .input-group {
+  margin-bottom: 24px;
+}
+
+.login-form .input-label {
+  display: block;
+  font-size: 14px;
+  color: var(--text-main);
+  margin-bottom: 8px;
+  font-weight: 500;
+}
+
+.login-form .input-field-wrapper {
+  position: relative;
+}
+
+.login-form .ui.left.icon.input {
+  width: 100%;
+}
+
+.login-form .ui.left.icon.input .input-icon {
+  color: #9ca3af;
+  transition: color 0.3s;
+}
+
+.login-form .ui.left.icon.input input {
+  width: 100%;
+  height: 46px;
+  padding: 12px 16px 12px 42px;
+  font-size: 15px !important;
+  border: 1px solid var(--border-color);
+  border-radius: 6px;
+  outline: none;
+  color: var(--text-main);
+  background: #f9fafb;
+  transition: all 0.2s ease;
+}
+
+.login-form .ui.left.icon.input input::placeholder {
+  color: #9ca3af;
+}
+
+.login-form .ui.left.icon.input input:focus {
+  background: #ffffff;
+  border-color: var(--primary-color);
+  box-shadow: 0 0 0 3px rgba(0, 102, 255, 0.1);
+}
+
+.login-form .ui.left.icon.input:focus-within .input-icon {
+  color: var(--primary-color);
+}
+
+.remember-wrap {
+  margin-top: -4px;
+  margin-bottom: 10px;
+}
+
+.remember-wrap .ui.checkbox label {
+  font-size: 13px;
+  color: #6b7280;
+}
+
+.submit-btn.ui.button.primary {
+  width: 100%;
+  margin-top: 10px;
+  height: 50px;
+  border: none;
+  border-radius: 6px;
+  background: var(--primary-color);
+  color: #ffffff;
+  font-size: 16px !important;
+  font-weight: 600;
+  box-shadow: 0 4px 6px -1px rgba(0, 102, 255, 0.2);
+  transition: background 0.2s ease, transform 0.2s ease;
+}
+
+.submit-btn.ui.button.primary:hover {
+  background: var(--hover-color);
+  transform: translateY(-1px);
+}
+
+.register-box {
   text-align: center;
-  margin-top: 1em;
+  margin-top: 12px;
+  font-size: 13px;
 }
-@media screen and (max-width: 512px) {
-  form {
-    width: 80%;
-    margin-left: -40%;
-  }
+
+.register-box a {
+  color: #4183c4;
 }
+
 .disabled {
   color: #ccc !important;
 }
-/*# sourceMappingURL=index.css.map */
\ No newline at end of file
+
+@media screen and (max-width: 768px) {
+  body.login-page {
+    overflow: auto;
+  }
+
+  .form-box {
+    padding: 14px;
+  }
+
+  .login-card {
+    max-width: 100%;
+    margin: 0;
+    padding: 30px 18px;
+  }
+}
+
+/* SweetAlert2 fallback on login page */
+body.login-page.swal2-height-auto {
+  height: 100% !important;
+}
+
+body.login-page .swal2-container {
+  position: fixed !important;
+  inset: 0 !important;
+  z-index: 20000 !important;
+  display: flex !important;
+  align-items: center !important;
+  justify-content: center !important;
+  padding: 0.625em !important;
+}
+
+body.login-page .swal2-container.swal2-backdrop-show {
+  background: rgba(0, 0, 0, 0.42) !important;
+}
+
+/*# sourceMappingURL=index.css.map */
diff --git a/EdgeUser/web/views/@default/login/index.html b/EdgeUser/web/views/@default/login/index.html
index 3d60c12..6a57656 100644
--- a/EdgeUser/web/views/@default/login/index.html
+++ b/EdgeUser/web/views/@default/login/index.html
@@ -1,13 +1,13 @@
 <!DOCTYPE html>
 <html lang="zh">
 <head>
-	<meta http-equiv="Content-Type" content="text/html; charset=utf-8"/>
+	<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
 	{$if eq .faviconFileId 0}
-	<link rel="shortcut icon" href="/images/favicon.png"/>
+	<link rel="shortcut icon" href="/images/favicon.png" />
 	{$else}
-	<link rel="shortcut icon" href="/ui/image/{$ .faviconFileId}"/>
+	<link rel="shortcut icon" href="/ui/image/{$ .faviconFileId}" />
 	{$end}
-	<title>登录{$ htmlEncode .systemName}</title>
+	<title>&#30331;&#24405;{$ htmlEncode .systemName}</title>
 	<meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=0">
 	{$TEA.VUE}
 	{$TEA.SEMANTIC}
@@ -23,58 +23,81 @@
 	</style>
 	{$end}
 </head>
-<body style="background-image: url(/images/bg.jpg);width: 100% !important;height: 100% !important;background-size: cover !important;">
+
+<body class="login-page">
 <div>
-	{$template "/menu"}
-
-	<div class="form-box">
-		<form method="post" class="ui form" data-tea-action="$" data-tea-before="submitBefore" data-tea-done="submitDone" data-tea-success="submitSuccess" autocomplete="off">
-			<csrf-token></csrf-token>
-			<input type="hidden" name="password" v-model="passwordMd5"/>
-			<input type="hidden" name="token" v-model="token"/>
-			<div class="ui segment stacked">
-				<div class="ui header">
-					登录{$ htmlEncode .systemName}
-				</div>
-				<div class="ui field">
-					<div class="ui left icon input">
-						<i class="ui user icon small"></i>
-						<input type="text" name="username" v-model="username" :placeholder="usernamePlaceholder" maxlength="200" ref="usernameRef" @input="changeUsername"/>
-					</div>
-				</div>
-				<div class="ui field">
-					<div class="ui left icon input">
-						<i class="ui lock icon small"></i>
-						<input type="password" v-model="password" placeholder="请输入密码" maxlength="200" @input="changePassword()" ref="passwordRef"/>
-					</div>
-				</div>
-				<div class="ui field" v-show="showOTP">
-					<div class="ui left icon input">
-						<i class="ui barcode icon"></i>
-						<input type="text" name="otpCode" placeholder="请输入OTP动态密码" maxlength="6"/>
-					</div>
-				</div>
-				<div class="ui field">
-					<a href="" @click.prevent="showMoreOptions()">更多选项 <i class="icon angle" :class="{down:!moreOptionsVisible, up:moreOptionsVisible}"></i> </a>
-				</div>
-				<div class="ui field" v-show="moreOptionsVisible">
-					<div class="ui checkbox">
-						<input type="checkbox" name="remember" value="1" checked="checked"/>
-						<label>在这个电脑上记住登录（14天）</label>
-					</div>
-				</div>
-
-				<button class="ui button primary fluid" type="submit" v-if="!isSubmitting">登录</button>
-				<button class="ui button primary fluid disabled" type="submit" v-if="isSubmitting">登录中...</button>
-
-				<div v-if="canRegister" class="register-box">
-					<a href="/register">注册新用户<span v-if="!canResetPassword">&nbsp; &raquo;</span></a><span v-if="canResetPassword"> &nbsp; <span class="disabled">|</span> &nbsp; <a href="/account/reset">找回密码</a></span>
-				</div>
-			</div>
-		</form>
+	<div class="bg-layer">
+		<div class="tech-bg"></div>
+		<div class="glow-circle"></div>
 	</div>
 
+	<div class="login-shell">
+		{$template "/menu"}
+
+		<div class="form-box">
+			<div class="login-card">
+				<div class="card-header">
+					<div class="brand-logo">
+						<span class="logo-icon"><i class="shield alternate icon"></i></span>
+						<span class="logo-text">{$ htmlEncode .systemName}</span>
+					</div>
+					<p class="header-title">&#26032;&#19968;&#20195; Web&#19982;APP &#24212;&#29992;&#38450;&#25252;&#24179;&#21488;</p>
+				</div>
+
+				<form method="post" class="ui form login-form" data-tea-action="$" data-tea-before="submitBefore" data-tea-done="submitDone" data-tea-success="submitSuccess" autocomplete="off">
+					<csrf-token></csrf-token>
+					<input type="hidden" name="password" v-model="passwordMd5"/>
+					<input type="hidden" name="token" v-model="token"/>
+
+					<div class="ui field input-group">
+						<label class="input-label">&#36134;&#21495;</label>
+						<div class="input-field-wrapper">
+							<div class="ui left icon input">
+								<i class="ui user icon small input-icon"></i>
+								<input type="text" name="username" v-model="username" :placeholder="usernamePlaceholder" maxlength="200" ref="usernameRef" @input="changeUsername"/>
+							</div>
+						</div>
+					</div>
+
+					<div class="ui field input-group">
+						<label class="input-label">&#23494;&#30721;</label>
+						<div class="input-field-wrapper">
+							<div class="ui left icon input">
+								<i class="ui lock icon small input-icon"></i>
+								<input type="password" v-model="password" placeholder="&#35831;&#36755;&#20837;&#23494;&#30721;" maxlength="200" @input="changePassword()" ref="passwordRef"/>
+							</div>
+						</div>
+					</div>
+
+					<div class="ui field input-group" v-show="showOTP">
+						<label class="input-label">&#23433;&#20840;&#39564;&#35777;</label>
+						<div class="input-field-wrapper">
+							<div class="ui left icon input">
+								<i class="ui barcode icon input-icon"></i>
+								<input type="text" name="otpCode" placeholder="&#35831;&#36755;&#20837; OTP &#21160;&#24577;&#30721;" maxlength="6"/>
+							</div>
+						</div>
+					</div>
+
+					<div class="ui field remember-wrap" v-if="false">
+						<div class="ui checkbox">
+							<input type="checkbox" name="remember" value="1" checked="checked"/>
+							<label>&#22312;&#36825;&#21488;&#30005;&#33041;&#19978;&#35760;&#20303;&#30331;&#24405;&#65288;14&#22825;&#65289;</label>
+						</div>
+					</div>
+
+					<button class="ui button primary fluid submit-btn" type="submit" v-if="!isSubmitting">&#30331;&#24405;</button>
+					<button class="ui button primary fluid disabled submit-btn" type="submit" disabled="disabled" v-if="isSubmitting">&#30331;&#24405;&#20013;...</button>
+
+					<div v-if="canRegister" class="register-box">
+						<a href="/register">&#27880;&#20876;&#26032;&#29992;&#25143;<span v-if="!canResetPassword">&nbsp; &raquo;</span></a><span v-if="canResetPassword"> &nbsp; <span class="disabled">|</span> &nbsp; <a href="/account/reset">&#25214;&#22238;&#23494;&#30721;</a></span>
+					</div>
+				</form>
+			</div>
+		</div>
+	</div>
 </div>
 
 </body>
-</html>
\ No newline at end of file
+
+</html>
diff --git a/EdgeUser/web/views/@default/login/index.js b/EdgeUser/web/views/@default/login/index.js
index 1b1db34..b7ae997 100644
--- a/EdgeUser/web/views/@default/login/index.js
+++ b/EdgeUser/web/views/@default/login/index.js
@@ -1,26 +1,47 @@
 Tea.context(function () {
+	this.username = "";
+	this.password = "";
+	this.passwordMd5 = "";
 	this.encodedFrom = window.encodeURIComponent(this.from);
 
-	this.showOTP = false
+	this.showOTP = false;
+	this.isSubmitting = false;
 
-	this.isSubmitting = false
+	this.usernamePlaceholder = "\u8bf7\u8f93\u5165\u7528\u6237\u540d";
+	let loginMethods = [];
+	if (this.emailCanLogin) {
+		loginMethods.push("\u90ae\u7bb1");
+	}
+	if (this.mobileCanLogin) {
+		loginMethods.push("\u624b\u673a\u53f7\u7801");
+	}
+	if (loginMethods.length > 0) {
+		this.usernamePlaceholder += "/" + loginMethods.join("/");
+	}
+
+	this.refreshPlaceholders = function () {
+		let usernameInput = document.querySelector("form input[name='username']");
+		if (usernameInput != null) {
+			usernameInput.setAttribute("placeholder", this.usernamePlaceholder);
+		}
+
+		let passwordInput = document.querySelector("form input[type='password']");
+		if (passwordInput != null) {
+			passwordInput.setAttribute("placeholder", "\u8bf7\u8f93\u5165\u5bc6\u7801");
+		}
+
+		let otpInput = document.querySelector("form input[name='otpCode']");
+		if (otpInput != null) {
+			otpInput.setAttribute("placeholder", "\u8bf7\u8f93\u5165 OTP \u52a8\u6001\u7801");
+		}
+	};
 
 	this.$delay(function () {
 		this.$find("form input[name='username']").focus();
 		this.changePassword();
-	})
-
-	this.usernamePlaceholder = "请输入用户名"
-	var loginMethods = []
-	if (this.emailCanLogin) {
-		loginMethods.push("邮箱")
-	}
-	if (this.mobileCanLogin) {
-		loginMethods.push("手机号码")
-	}
-	if (loginMethods.length > 0) {
-		this.usernamePlaceholder += "/" + loginMethods.join("/")
-	}
+		this.refreshPlaceholders();
+		setTimeout(() => this.refreshPlaceholders(), 200);
+	});
 
 	this.changeUsername = function () {
 		this.$post("/checkOTP")
@@ -28,27 +49,29 @@ Tea.context(function () {
 				username: this.username
 			})
 			.success(function (resp) {
-				this.showOTP = resp.data.requireOTP
-			})
-	}
+				this.showOTP = resp.data.requireOTP;
+				this.$delay(function () {
+					this.refreshPlaceholders();
+				});
+			});
+	};
 
 	this.changePassword = function () {
 		this.passwordMd5 = md5(this.password.trim());
-	}
+	};
 
-	// 更多选项
 	this.moreOptionsVisible = false;
 	this.showMoreOptions = function () {
 		this.moreOptionsVisible = !this.moreOptionsVisible;
-	}
+	};
 
 	this.submitBefore = function () {
 		this.isSubmitting = true;
-	}
+	};
 
 	this.submitDone = function () {
 		this.isSubmitting = false;
-	}
+	};
 
 	this.submitSuccess = function () {
 		if (this.from.length == 0) {
@@ -56,5 +79,5 @@ Tea.context(function () {
 		} else {
 			window.location = this.from;
 		}
-	}
-})
\ No newline at end of file
+	};
+});
diff --git a/EdgeUser/web/views/@default/login/index.less b/EdgeUser/web/views/@default/login/index.less
index 3de4de7..bd6f251 100644
--- a/EdgeUser/web/views/@default/login/index.less
+++ b/EdgeUser/web/views/@default/login/index.less
@@ -1,51 +1,260 @@
-.form-box {
-    position: fixed;
-    top: 2.5em;
-    bottom: 0;
-    left: 0;
-    right: 0;
+:root {
+    --primary-color: #0066ff;
+    --hover-color: #0052cc;
+    --bg-gradient-start: #0a192f;
+    --bg-gradient-end: #112240;
+    --text-main: #333333;
+    --text-sub: #888888;
+    --border-color: #e5e7eb;
 }
 
-form {
-    position: fixed;
-    width: 21em;
+html,
+body {
+    width: 100%;
+    height: 100%;
+    margin: 0;
+}
+
+body.login-page {
+    font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif;
+    overflow: hidden;
+    background: linear-gradient(135deg, var(--bg-gradient-start) 0%, #1e3a8a 100%);
+    position: relative;
+}
+
+body.login-page > div {
+    position: relative;
+    width: 100%;
+    height: 100vh;
+    min-height: 100vh;
+}
+
+.bg-layer {
+    position: absolute;
+    inset: 0;
+    z-index: 0;
+    overflow: hidden;
+}
+
+.tech-bg {
+    position: absolute;
+    inset: 0;
+    opacity: 0.1;
+    background-image: radial-gradient(#ffffff 1px, transparent 1px), radial-gradient(#ffffff 1px, transparent 1px);
+    background-size: 40px 40px;
+    background-position: 0 0, 20px 20px;
+}
+
+.glow-circle {
+    position: absolute;
+    width: 800px;
+    height: 800px;
     top: 50%;
     left: 50%;
-    margin-left: -10em;
-    margin-top: -16em;
-
-	.header {
-		text-align: center;
-		font-size: 1em !important;
-	}
-
-	p {
-		font-size: 0.8em;
-		margin-top: 0.3em;
-		margin-bottom: 0;
-		font-weight: normal;
-		padding: 0;
-	}
-
-	.comment {
-		margin-top: 0.5em;
-		padding: 0.5em;
-		color: gray;
-	}
-
-	.register-box {
-		text-align: center;
-		margin-top: 1em;
-	}
+    transform: translate(-50%, -50%);
+    border-radius: 50%;
+    background: radial-gradient(circle, rgba(0, 102, 255, 0.1) 0%, rgba(0, 0, 0, 0) 70%);
+    pointer-events: none;
 }
 
-@media screen and (max-width: 512px) {
-    form {
-        width: 80%;
-        margin-left: -40%;
-    }
+.login-shell {
+    position: relative;
+    z-index: 10;
+    width: 100%;
+    height: 100%;
+}
+
+.form-box {
+    width: 100%;
+    height: 100%;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    padding: 20px;
+}
+
+.login-card {
+    background: #ffffff;
+    width: 100%;
+    max-width: 460px;
+    padding: 48px 40px;
+    border-radius: 12px;
+    box-shadow: 0 25px 50px -12px rgba(0, 0, 0, 0.5);
+    backdrop-filter: blur(10px);
+}
+
+.card-header {
+    text-align: center;
+    margin-bottom: 32px;
+}
+
+.brand-logo {
+    display: inline-flex;
+    align-items: center;
+    gap: 10px;
+    margin-bottom: 12px;
+}
+
+.logo-icon {
+    width: 36px;
+    height: 36px;
+    background: var(--primary-color);
+    border-radius: 6px;
+    color: #ffffff;
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+}
+
+.logo-icon i.icon {
+    margin: 0 !important;
+    font-size: 16px;
+}
+
+.logo-text {
+    font-size: 24px;
+    font-weight: 700;
+    color: var(--text-main);
+    line-height: 1;
+}
+
+.header-title {
+    font-size: 16px;
+    color: var(--text-sub);
+    font-weight: 400;
+    margin: 0;
+}
+
+.login-form {
+    margin: 0;
+}
+
+.login-form .input-group {
+    margin-bottom: 24px;
+}
+
+.login-form .input-label {
+    display: block;
+    font-size: 14px;
+    color: var(--text-main);
+    margin-bottom: 8px;
+    font-weight: 500;
+}
+
+.login-form .input-field-wrapper {
+    position: relative;
+}
+
+.login-form .ui.left.icon.input {
+    width: 100%;
+}
+
+.login-form .ui.left.icon.input .input-icon {
+    color: #9ca3af;
+    transition: color 0.3s;
+}
+
+.login-form .ui.left.icon.input input {
+    width: 100%;
+    height: 46px;
+    padding: 12px 16px 12px 42px;
+    font-size: 15px !important;
+    border: 1px solid var(--border-color);
+    border-radius: 6px;
+    outline: none;
+    color: var(--text-main);
+    background: #f9fafb;
+    transition: all 0.2s ease;
+}
+
+.login-form .ui.left.icon.input input::placeholder {
+    color: #9ca3af;
+}
+
+.login-form .ui.left.icon.input input:focus {
+    background: #ffffff;
+    border-color: var(--primary-color);
+    box-shadow: 0 0 0 3px rgba(0, 102, 255, 0.1);
+}
+
+.login-form .ui.left.icon.input:focus-within .input-icon {
+    color: var(--primary-color);
+}
+
+.remember-wrap {
+    margin-top: -4px;
+    margin-bottom: 10px;
+}
+
+.remember-wrap .ui.checkbox label {
+    font-size: 13px;
+    color: #6b7280;
+}
+
+.submit-btn.ui.button.primary {
+    width: 100%;
+    margin-top: 10px;
+    height: 50px;
+    border: none;
+    border-radius: 6px;
+    background: var(--primary-color);
+    color: #ffffff;
+    font-size: 16px !important;
+    font-weight: 600;
+    box-shadow: 0 4px 6px -1px rgba(0, 102, 255, 0.2);
+    transition: background 0.2s ease, transform 0.2s ease;
+}
+
+.submit-btn.ui.button.primary:hover {
+    background: var(--hover-color);
+    transform: translateY(-1px);
+}
+
+.register-box {
+    text-align: center;
+    margin-top: 12px;
+    font-size: 13px;
+}
+
+.register-box a {
+    color: #4183c4;
 }
 
 .disabled {
-	color: #ccc !important;
-}
\ No newline at end of file
+    color: #ccc !important;
+}
+
+@media screen and (max-width: 768px) {
+    body.login-page {
+        overflow: auto;
+    }
+
+    .form-box {
+        padding: 14px;
+    }
+
+    .login-card {
+        max-width: 100%;
+        margin: 0;
+        padding: 30px 18px;
+    }
+}
+
+/* SweetAlert2 fallback on login page */
+body.login-page.swal2-height-auto {
+    height: 100% !important;
+}
+
+body.login-page .swal2-container {
+    position: fixed !important;
+    inset: 0 !important;
+    z-index: 20000 !important;
+    display: flex !important;
+    align-items: center !important;
+    justify-content: center !important;
+    padding: 0.625em !important;
+}
+
+body.login-page .swal2-container.swal2-backdrop-show {
+    background: rgba(0, 0, 0, 0.42) !important;
+}
diff --git a/config.xml b/config.xml
deleted file mode 100644
index 7097024..0000000
--- a/config.xml
+++ /dev/null
@@ -1,1984 +0,0 @@
-<!--
-  NOTE: User and query level settings are set up in "users.xml" file.
-  If you have accidentally specified user-level settings here, server won't start.
-  You can either move the settings to the right place inside "users.xml" file
-   or add <skip_check_for_incorrect_settings>1</skip_check_for_incorrect_settings> here.
--->
-<clickhouse>
-    <logger>
-        <!-- Possible levels [1]:
-
-          - none (turns off logging)
-          - fatal
-          - critical
-          - error
-          - warning
-          - notice
-          - information
-          - debug
-          - trace
-          - test (not for production usage)
-
-            [1]: https://github.com/pocoproject/poco/blob/poco-1.9.4-release/Foundation/include/Poco/Logger.h#L105-L114
-        -->
-        <level>warning</level>
-
-        <!-- Startup level is used to set the root logger level at server startup.
-             It is useful for debugging startup issues.
-             The root logger level will be reset to the default level after the server is fully initialized -->
-        <!-- <startup_level>trace</startup_level> -->
-       <!-- Shutdown level is used to set the root logger level at server Shutdown.
-             It is useful for debugging shutdown issues -->
-        <!-- <shutdown_level>trace</shutdown_level> -->
-
-        <log>/var/log/clickhouse-server/clickhouse-server.log</log>
-        <errorlog>/var/log/clickhouse-server/clickhouse-server.err.log</errorlog>
-        <!-- Rotation policy
-             See https://github.com/pocoproject/poco/blob/poco-1.9.4-release/Foundation/include/Poco/FileChannel.h#L54-L85
-          -->
-        <size>1000M</size>
-        <count>10</count>
-
-        <!-- <console>1</console> --> <!-- Default behavior is autodetection (log to console if not daemon mode and is tty) -->
-        <!-- <console_log_level>trace</console_log_level> -->
-
-        <!-- <use_syslog>0</use_syslog> -->
-        <!-- <syslog_level>trace</syslog_level> -->
-
-        <!-- <stream_compress>0</stream_compress> -->
-
-        <!-- By default logging happens in different threads so it does not block the execution
-             If the amount of messages waiting to be flushed is too large, new messages will be dropped.
-        -->
-        <!-- <async>1</async> -->
-        <!-- <async_queue_max_size>100000</async_queue_max_size> -->
-
-        <!-- Per level overrides (legacy):
-
-        For example to suppress logging of the ConfigReloader you can use:
-        NOTE: levels.logger is reserved, see below.
-        -->
-        <!--
-        <levels>
-          <ConfigReloader>none</ConfigReloader>
-        </levels>
-        -->
-
-        <!-- Per level overrides:
-
-        For example to suppress logging of the RBAC for default user you can use:
-        (But please note that the logger name maybe changed from version to version, even after minor upgrade)
-        -->
-        <!--
-        <levels>
-          <logger>
-            <name>ContextAccess (default)</name>
-            <level>none</level>
-          </logger>
-          <logger>
-            <name>DatabaseOrdinary (test)</name>
-            <level>none</level>
-          </logger>
-        </levels>
-        -->
-
-        <!-- Structured log formatting:
-
-        You can specify log format(for now, JSON only).
-        It can be done either on a per-channel (log, errorlog, console, syslog) level (set `channel`, i.e. `<channel>console</channel>') or for all channels (omit `channel`).
-        The log will be printed in specified format like JSON, example:
-
-        {"date_time":"1650918987.180175","thread_name":"#1","thread_id":"254545","level":"Trace","query_id":"","logger_name":"BaseDaemon","message":"Received signal 2","source_file":"../base/daemon/BaseDaemon.cpp; virtual void SignalListener::run()","source_line":"192"}
-        {"date_time_utc":"2024-11-06T09:06:09Z","thread_name":"#1","thread_id":"254545","level":"Trace","query_id":"","logger_name":"BaseDaemon","message":"Received signal 2","source_file":"../base/daemon/BaseDaemon.cpp; virtual void SignalListener::run()","source_line":"192"}
-        To enable JSON logging support, please uncomment the entire <formatting> tag below.
-
-        a) You can modify key names by changing values under tag values inside <names> tag.
-        For example, to change DATE_TIME to MY_DATE_TIME, you can do like:
-            <date_time>MY_DATE_TIME</date_time>
-            <date_time_utc>MY_UTC_DATE_TIME</date_time_utc>
-        b) You can stop unwanted log properties from appearing in logs. To do so, you can simply comment out (recommended)
-        that property from this file.
-        For example, if you do not want your log to print query_id, you can comment out only <query_id> tag.
-        However, if you comment out all the tags under <names>, the program will print default values for as
-        below.
-        -->
-        <!--
-        <formatting>
-            <type>json</type>
-            <channel></channel>
-            <names>
-                <date_time>date_time</date_time>
-                <date_time_utc>date_time_utc</date_time_utc>
-                <thread_name>thread_name</thread_name>
-                <thread_id>thread_id</thread_id>
-                <level>level</level>
-                <query_id>query_id</query_id>
-                <logger_name>logger_name</logger_name>
-                <message>message</message>
-                <source_file>source_file</source_file>
-                <source_line>source_line</source_line>
-            </names>
-        </formatting>
-        -->
-    </logger>
-
-    <url_scheme_mappers>
-        <s3>
-            <to>https://{bucket}.s3.amazonaws.com</to>
-        </s3>
-        <gs>
-            <to>https://storage.googleapis.com/{bucket}</to>
-        </gs>
-        <oss>
-            <to>https://{bucket}.oss.aliyuncs.com</to>
-        </oss>
-    </url_scheme_mappers>
-
-    <!-- Add headers to response in options request. OPTIONS method is used in CORS preflight requests. -->
-    <http_options_response>
-        <header>
-            <name>Access-Control-Allow-Origin</name>
-            <value>*</value>
-        </header>
-        <header>
-            <name>Access-Control-Allow-Headers</name>
-            <value>origin, x-requested-with, x-clickhouse-format, x-clickhouse-user, x-clickhouse-key, Authorization</value>
-        </header>
-        <header>
-            <name>Access-Control-Allow-Methods</name>
-            <value>POST, GET, OPTIONS</value>
-        </header>
-        <header>
-            <name>Access-Control-Max-Age</name>
-            <value>86400</value>
-        </header>
-    </http_options_response>
-
-    <!-- The name that will be shown in the clickhouse-client.
-         By default, anything with "production" will be highlighted in red in query prompt.
-    -->
-    <!--display_name>production</display_name-->
-
-    <!-- Port for HTTP API. See also 'https_port' for secure connections.
-         This interface is also used by ODBC and JDBC drivers (DataGrip, Dbeaver, ...)
-         and by most of the web interfaces (embedded UI, Grafana, Redash, ...).
-      -->
-    <http_port>8123</http_port>
-
-    <!-- Port for interaction by native protocol with:
-         - clickhouse-client and other native ClickHouse tools (clickhouse-benchmark);
-         - clickhouse-server with other clickhouse-servers for distributed query processing;
-         - ClickHouse drivers and applications supporting native protocol
-         (this protocol is also informally called as "the TCP protocol");
-         See also 'tcp_port_secure' for secure connections.
-    -->
-    <tcp_port>9000</tcp_port>
-
-    <!-- Chunked capabilities for native protocol by server.
-         Can be enabled separately for send and receive channels.
-         Supported modes:
-         - chunked - server requires from client to have chunked enabled;
-         - chunked_optional - server supports both chunked and notchunked protocol;
-         - notchunked - server requires from client notchunked protocol (current default);
-         - notchunked_optional - server supports both chunked and notchunked protocol.
-     -->
-    <!--
-    <proto_caps>
-        <send>notchunked_optional</send>
-        <recv>notchunked_optional</recv>
-    </proto_caps>
-    -->
-
-    <!-- Compatibility with MySQL protocol.
-         ClickHouse will pretend to be MySQL for applications connecting to this port.
-    -->
-    <mysql_port>9004</mysql_port>
-
-    <!-- Compatibility with PostgreSQL protocol.
-         ClickHouse will pretend to be PostgreSQL for applications connecting to this port.
-    -->
-    <postgresql_port>9005</postgresql_port>
-
-    <!-- HTTP API with TLS (HTTPS).
-         You have to configure certificate to enable this interface.
-         See the OpenSSL section below.
-    -->
-    <https_port>8443</https_port>
-
-    <!-- Native interface with TLS.
-         You have to configure certificate to enable this interface.
-         See the OpenSSL section below.
-    -->
-    <!-- <tcp_port_secure>9440</tcp_port_secure> -->
-
-    <!-- Native interface wrapped with PROXYv1 protocol
-         PROXYv1 header is sent for every connection.
-         ClickHouse will extract information about proxy-forwarded client address from the header.
-    -->
-    <!-- <tcp_with_proxy_port>9011</tcp_with_proxy_port> -->
-
-    <!-- Port for communication between replicas. Used for data exchange.
-         It provides low-level data access between servers.
-         This port should not be accessible from untrusted networks.
-         See also 'interserver_http_credentials'.
-         Data transferred over connections to this port should not go through untrusted networks.
-         See also 'interserver_https_port'.
-      -->
-    <interserver_http_port>9009</interserver_http_port>
-
-    <!-- Port for communication between replicas with TLS.
-         You have to configure certificate to enable this interface.
-         See the OpenSSL section below.
-         See also 'interserver_http_credentials'.
-      -->
-    <!-- <interserver_https_port>9010</interserver_https_port> -->
-
-    <!-- Hostname that is used by other replicas to request this server.
-         If not specified, then it is determined analogous to 'hostname -f' command.
-         This setting could be used to switch replication to another network interface
-         (the server may be connected to multiple networks via multiple addresses)
-      -->
-
-    <!--
-    <interserver_http_host>example.clickhouse.com</interserver_http_host>
-    -->
-
-    <!-- Port for the SSH server which allows to connect and execute
-         queries in an interactive fashion using the embedded client over the PTY.
-    -->
-    <!-- <tcp_ssh_port>9022</tcp_ssh_port> -->
-
-    <ssh_server>
-        <!-- The public part of the host key will be written to the known_hosts file
-             on the SSH client side on the first connect.
-        -->
-        <!-- <host_rsa_key>path_to_the_ssh_key</host_rsa_key> -->
-        <!-- <host_ecdsa_key>path_to_the_ssh_key</host_ecdsa_key> -->
-        <!-- <host_ed25519_key>path_to_the_ssh_key</host_ed25519_key> -->
-
-        <!-- Unlocks the possibility to pass the client options as environment
-             variables in the form of: ssh -o SetEnv="key1=value1 key2=value2".
-             This is considered unsafe and should be used with caution.
-        -->
-        <!-- <enable_client_options_passing>false</enable_client_options_passing>-->
-    </ssh_server>
-
-    <!-- You can specify credentials for authentication between replicas.
-         This is required when interserver_https_port is accessible from untrusted networks,
-         and also recommended to avoid SSRF attacks from possibly compromised services in your network.
-      -->
-    <!--<interserver_http_credentials>
-        <user>interserver</user>
-        <password></password>
-    </interserver_http_credentials>-->
-
-    <!-- Listen specified address.
-         Use :: (wildcard IPv6 address), if you want to accept connections both with IPv4 and IPv6 from everywhere.
-         Notes:
-         If you open connections from wildcard address, make sure that at least one of the following measures is applied:
-         - server is protected by firewall and not accessible from untrusted networks;
-         - all users are restricted to subset of network addresses (see users.xml);
-         - all users have strong passwords, only secure (TLS) interfaces are accessible, or connections are only made via TLS interfaces.
-         - users without password have readonly access.
-         See also: https://www.shodan.io/search?query=clickhouse
-      -->
-    <listen_host>::</listen_host>
-
-
-    <!-- Same for hosts without support for IPv6: -->
-    <!-- <listen_host>0.0.0.0</listen_host> -->
-
-    <!-- Default values - try listen localhost on IPv4 and IPv6. -->
-    <!--
-    <listen_host>::1</listen_host>
-    <listen_host>127.0.0.1</listen_host>
-    -->
-
-    <!-- <interserver_listen_host>::</interserver_listen_host> -->
-    <!-- Listen host for communication between replicas. Used for data exchange -->
-    <!-- Default values - equal to listen_host -->
-
-    <!-- Don't exit if IPv6 or IPv4 networks are unavailable while trying to listen. -->
-    <!-- <listen_try>0</listen_try> -->
-
-    <!-- Allow multiple servers to listen on the same address:port. This is not recommended.
-      -->
-    <!-- <listen_reuse_port>0</listen_reuse_port> -->
-
-    <!-- <listen_backlog>4096</listen_backlog> -->
-
-    <!-- <max_connections>4096</max_connections> -->
-
-    <!-- For 'Connection: keep-alive' in HTTP 1.1 -->
-    <keep_alive_timeout>10</keep_alive_timeout>
-
-    <!-- Enable verbose output in /replicas_status handler. -->
-    <!-- <enable_verbose_replicas_status/>true<enable_verbose_replicas_status>-->
-
-    <!-- Enable stacktrace in default http handler. -->
-    <!-- <enable_http_stacktrace/>true<enable_http_stacktrace>-->
-
-    <!-- gRPC protocol (see src/Server/grpc_protos/clickhouse_grpc.proto for the API) -->
-    <!-- <grpc_port>9100</grpc_port> -->
-    <grpc>
-        <enable_ssl>false</enable_ssl>
-
-        <!-- The following two files are used only if enable_ssl=1 -->
-        <ssl_cert_file>/path/to/ssl_cert_file</ssl_cert_file>
-        <ssl_key_file>/path/to/ssl_key_file</ssl_key_file>
-
-        <!-- Whether server will request client for a certificate -->
-        <ssl_require_client_auth>false</ssl_require_client_auth>
-
-        <!-- The following file is used only if ssl_require_client_auth=1 -->
-        <ssl_ca_cert_file>/path/to/ssl_ca_cert_file</ssl_ca_cert_file>
-
-        <!-- Default transport compression type (can be overridden by client, see the transport_compression_type field in QueryInfo).
-             Supported algorithms: none, deflate, gzip, stream_gzip -->
-        <transport_compression_type>none</transport_compression_type>
-
-        <!-- Default transport compression level. Supported levels: 0..3 -->
-        <transport_compression_level>0</transport_compression_level>
-
-        <!-- Send/receive message size limits in bytes. -1 means unlimited -->
-        <max_send_message_size>-1</max_send_message_size>
-        <max_receive_message_size>-1</max_receive_message_size>
-
-        <!-- Enable if you want very detailed logs -->
-        <verbose_logs>false</verbose_logs>
-    </grpc>
-
-    <!-- Used with https_port and tcp_port_secure. Full ssl options list: https://github.com/ClickHouse-Extras/poco/blob/master/NetSSL_OpenSSL/include/Poco/Net/SSLManager.h#L71
-         Note: ClickHouse Cloud https://clickhouse.com/cloud always has secure connections configured.
-    -->
-    <openSSL>
-        <server> <!-- Used for https server AND secure tcp port -->
-            <!-- openssl req -subj "/CN=localhost" -new -newkey rsa:2048 -days 365 -nodes -x509 -keyout /etc/clickhouse-server/server.key -out /etc/clickhouse-server/server.crt -->
-            <certificateFile>/etc/clickhouse-server/server.crt</certificateFile>
-            <privateKeyFile>/etc/clickhouse-server/server.key</privateKeyFile>
-            <!-- dhparams are optional. You can delete the <dhParamsFile> element.
-                 To generate dhparams, use the following command:
-                  openssl dhparam -out /etc/clickhouse-server/dhparam.pem 4096
-                 Only file format with BEGIN DH PARAMETERS is supported.
-              -->
-            <!-- <dhParamsFile>/etc/clickhouse-server/dhparam.pem</dhParamsFile>-->
-            <verificationMode>none</verificationMode>
-            <loadDefaultCAFile>true</loadDefaultCAFile>
-            <cacheSessions>true</cacheSessions>
-            <disableProtocols>sslv2,sslv3</disableProtocols>
-            <preferServerCiphers>true</preferServerCiphers>
-
-            <invalidCertificateHandler>
-                <!-- The server, in contrast to the client, cannot ask about the certificate interactively.
-                     The only reasonable option is to reject.
-                -->
-                <name>RejectCertificateHandler</name>
-            </invalidCertificateHandler>
-        </server>
-
-        <client> <!-- Used for connecting to https dictionary source and secured Zookeeper communication -->
-            <loadDefaultCAFile>true</loadDefaultCAFile>
-            <cacheSessions>true</cacheSessions>
-            <disableProtocols>sslv2,sslv3</disableProtocols>
-            <preferServerCiphers>true</preferServerCiphers>
-            <!-- Use for self-signed: <verificationMode>none</verificationMode> -->
-            <invalidCertificateHandler>
-                <!-- Use for self-signed: <name>AcceptCertificateHandler</name> -->
-                <name>RejectCertificateHandler</name>
-            </invalidCertificateHandler>
-        </client>
-    </openSSL>
-
-    <!-- Let's Encrypt certificate provider configuration -->
-    <!--
-    <acme>
-        <email>someone@example.com</email>
-        <terms_of_service_agreed>true</terms_of_service_agreed>
-        <domains>
-            <domain>example.com</domain>
-        </domains>
-    </acme>
-    -->
-
-    <!-- Default root page on http[s] server. -->
-    <!--
-    <http_server_default_response><![CDATA[Greetings from ClickHouse!]]></http_server_default_response>
-    -->
-
-    <!-- The maximum number of query processing threads, excluding threads for retrieving data from remote servers, allowed to run all queries.
-         This is not a hard limit. In case if the limit is reached the query will still get at least one thread to run.
-         Query can upscale to desired number of threads during execution if more threads become available.
-    -->
-    <concurrent_threads_soft_limit_num>0</concurrent_threads_soft_limit_num>
-    <concurrent_threads_soft_limit_ratio_to_cores>2</concurrent_threads_soft_limit_ratio_to_cores>
-    <concurrent_threads_scheduler>fair_round_robin</concurrent_threads_scheduler>
-
-    <!-- Maximum number of concurrent queries. -->
-    <max_concurrent_queries>1000</max_concurrent_queries>
-
-    <!-- Maximum memory usage (resident set size) for server process.
-         Zero value or unset means default. Default is "max_server_memory_usage_to_ram_ratio" of available physical RAM.
-         If the value is larger than "max_server_memory_usage_to_ram_ratio" of available physical RAM, it will be cut down.
-
-         The constraint is checked on query execution time.
-         If a query tries to allocate memory and the current memory usage plus allocation is greater
-          than specified threshold, exception will be thrown.
-
-         It is not practical to set this constraint to small values like just a few gigabytes,
-          because memory allocator will keep this amount of memory in caches and the server will deny service of queries.
-        <max_server_memory_usage>0</max_server_memory_usage>
-      -->
-    <max_server_memory_usage>1500000000</max_server_memory_usage>
-
-    <!-- Maximum number of threads in the Global thread pool.
-    This will default to a maximum of 10000 threads if not specified.
-    This setting will be useful in scenarios where there are a large number
-    of distributed queries that are running concurrently but are idling most
-    of the time, in which case a higher number of threads might be required.
-    -->
-
-    <max_thread_pool_size>10000</max_thread_pool_size>
-
-    <!-- Configure other thread pools: -->
-    <!--
-    <background_buffer_flush_schedule_pool_size>16</background_buffer_flush_schedule_pool_size>
-    <background_pool_size>16</background_pool_size>
-    <background_merges_mutations_concurrency_ratio>2</background_merges_mutations_concurrency_ratio>
-    <background_merges_mutations_scheduling_policy>round_robin</background_merges_mutations_scheduling_policy>
-    <background_move_pool_size>8</background_move_pool_size>
-    <background_fetches_pool_size>8</background_fetches_pool_size>
-    <background_common_pool_size>8</background_common_pool_size>
-    <background_schedule_pool_size>128</background_schedule_pool_size>
-    <background_message_broker_schedule_pool_size>16</background_message_broker_schedule_pool_size>
-    <background_distributed_schedule_pool_size>16</background_distributed_schedule_pool_size>
-    <tables_loader_foreground_pool_size>0</tables_loader_foreground_pool_size>
-    <tables_loader_background_pool_size>0</tables_loader_background_pool_size>
-    -->
-
-    <!-- Enables asynchronous loading of databases and tables to speedup server startup.
-         Queries to not yet loaded entity will be blocked until load is finished.
-      -->
-    <async_load_databases>true</async_load_databases>
-
-    <!-- On memory constrained environments you may have to set this to value larger than 1.
-      -->
-    <max_server_memory_usage_to_ram_ratio>0.9</max_server_memory_usage_to_ram_ratio>
-
-    <!-- Simple server-wide memory profiler. Collect a stack trace at every peak allocation step (in bytes).
-         Data will be stored in system.trace_log table with query_id = empty string.
-         Zero means disabled.
-      -->
-    <total_memory_profiler_step>4194304</total_memory_profiler_step>
-
-    <!-- Collect random allocations and deallocations and write them into system.trace_log with 'MemorySample' trace_type.
-         The probability is for every alloc/free regardless to the size of the allocation.
-         Note that sampling happens only when the amount of untracked memory exceeds the untracked memory limit,
-          which is 4 MiB by default but can be lowered if 'total_memory_profiler_step' is lowered.
-         You may want to set 'total_memory_profiler_step' to 1 for extra fine grained sampling.
-      -->
-    <total_memory_tracker_sample_probability>0</total_memory_tracker_sample_probability>
-
-    <!-- Set limit on number of open files (default: maximum). This setting makes sense on Mac OS X because getrlimit() fails to retrieve
-         correct maximum value. -->
-    <!-- <max_open_files>262144</max_open_files> -->
-
-    <!-- Size of cache of uncompressed blocks of data, used in tables of MergeTree family.
-         In bytes. Cache is single for server. Memory is allocated only on demand.
-         Cache is used when 'use_uncompressed_cache' user setting turned on (off by default).
-         Uncompressed cache is advantageous only for very short queries and in rare cases.
-
-         Note: uncompressed cache can be pointless for lz4, because memory bandwidth
-         is slower than multi-core decompression on some server configurations.
-         Enabling it can sometimes paradoxically make queries slower.
-      <uncompressed_cache_size>8589934592</uncompressed_cache_size>
-      -->
-    <uncompressed_cache_size>100000000</uncompressed_cache_size>
-
-    <!-- Approximate size of mark cache, used in tables of MergeTree family.
-         In bytes. Cache is single for server. Memory is allocated only on demand.
-         You should not lower this value. -->
-    <!-- <mark_cache_size>5368709120</mark_cache_size> -->
-
-   <mark_cache_size>100000000</mark_cache_size>
-
-    <!-- For marks of secondary indices. -->
-    <!-- <index_mark_cache_size>5368709120</index_mark_cache_size> -->
-
-    <!-- If you enable the `min_bytes_to_use_mmap_io` setting,
-         the data in MergeTree tables can be read with mmap to avoid copying from kernel to userspace.
-         It makes sense only for large files and helps only if data reside in page cache.
-         To avoid frequent open/mmap/munmap/close calls (which are very expensive due to consequent page faults)
-         and to reuse mappings from several threads and queries,
-         the cache of mapped files is maintained. Its size is the number of mapped regions (usually equal to the number of mapped files).
-         The amount of data in mapped files can be monitored
-         in system.metrics, system.metric_log by the MMappedFiles, MMappedFileBytes metrics
-         and in system.asynchronous_metrics, system.asynchronous_metrics_log by the MMapCacheCells metric,
-         and also in system.events, system.processes, system.query_log, system.query_thread_log, system.query_views_log by the
-         CreatedReadBufferMMap, CreatedReadBufferMMapFailed, MMappedFileCacheHits, MMappedFileCacheMisses events.
-         Note that the amount of data in mapped files does not consume memory directly and is not accounted
-         in query or server memory usage - because this memory can be discarded similar to OS page cache.
-         The cache is dropped (the files are closed) automatically on removal of old parts in MergeTree,
-         also it can be dropped manually by the SYSTEM DROP MMAP CACHE query.
-      -->
-    <!-- <mmap_cache_size>1024</mmap_cache_size> -->
-
-    <!-- Cache size in bytes for compiled expressions.-->
-    <!-- <compiled_expression_cache_size>134217728</compiled_expression_cache_size> -->
-
-    <!-- Cache size in elements for compiled expressions.-->
-    <!-- <compiled_expression_cache_elements_size>10000</compiled_expression_cache_elements_size> -->
-
-    <!-- Size of the query condition cache in bytes. -->
-    <query_condition_cache_size>106700800</query_condition_cache_size>
-
-    <!-- Configuration for the query cache -->
-    <!--
-    <query_cache>
-        <max_size_in_bytes>1073741824</max_size_in_bytes>
-        <max_entries>1024</max_entries>
-        <max_entry_size_in_bytes>1048576</max_entry_size_in_bytes>
-        <max_entry_size_in_rows>30000000</max_entry_size_in_rows>
-    </query_cache>
-    -->
-
-    <!-- Cache path for custom (created from SQL) cached disks -->
-    <custom_cached_disks_base_directory>/var/lib/clickhouse/caches/</custom_cached_disks_base_directory>
-
-    <validate_tcp_client_information>false</validate_tcp_client_information>
-
-    <!-- Path to data directory, with trailing slash. -->
-    <path>/var/lib/clickhouse/</path>
-
-    <!-- Multi-disk configuration example: -->
-    <!--
-    <storage_configuration>
-        <disks>
-            <default>
-                <keep_free_space_bytes>0</keep_free_space_bytes>
-            </default>
-            <data>
-                <path>/data/</path>
-                <keep_free_space_bytes>0</keep_free_space_bytes>
-            </data>
-            <s3>
-                <type>s3</type>
-                <endpoint>http://path/to/endpoint</endpoint>
-                <access_key_id>your_access_key_id</access_key_id>
-                <secret_access_key>your_secret_access_key</secret_access_key>
-            </s3>
-            <blob_storage_disk>
-                <type>azure_blob_storage</type>
-                <storage_account_url>http://account.blob.core.windows.net</storage_account_url>
-                <container_name>container</container_name>
-                <account_name>account</account_name>
-                <account_key>pass123</account_key>
-                <metadata_path>/var/lib/clickhouse/disks/blob_storage_disk/</metadata_path>
-                <skip_access_check>false</skip_access_check>
-            </blob_storage_disk>
-        </disks>
-
-        <policies>
-            <all>
-                <volumes>
-                    <main>
-                        <disk>default</disk>
-                        <disk>data</disk>
-                        <disk>s3</disk>
-                        <disk>blob_storage_disk</disk>
-
-                        <max_data_part_size_bytes></max_data_part_size_bytes>
-                        <max_data_part_size_ratio></max_data_part_size_ratio>
-                        <perform_ttl_move_on_insert>true</perform_ttl_move_on_insert>
-                        <load_balancing>round_robin</load_balancing>
-                    </main>
-                </volumes>
-                <move_factor>0.2</move_factor>
-            </all>
-        </policies>
-    </storage_configuration>
-    -->
-
-    <!-- Default database disk storing metadata files: -->
-    <!--
-    <database_disk>
-        <disk>default</disk>
-    </database_disk>
-    -->
-
-    <!-- Path to temporary data for processing heavy queries. -->
-    <!-- NOTE: all files with `tmp` prefix will be removed at server startup -->
-    <tmp_path>/var/lib/clickhouse/tmp/</tmp_path>
-
-    <!-- Enable AuthType plaintext_password and no_password for ACL (1 = allow, 0 = forbid). -->
-    <allow_plaintext_password>1</allow_plaintext_password>
-    <allow_no_password>1</allow_no_password>
-    <allow_implicit_no_password>1</allow_implicit_no_password>
-
-    <!-- When a user does not specify a password type in the CREATE USER query, the default password type is used.
-         Accepted values are: 'plaintext_password', 'sha256_password', 'double_sha1_password', 'bcrypt_password'.
-      -->
-    <default_password_type>sha256_password</default_password_type>
-
-    <!-- Work factor for bcrypt_password authentication type -->
-    <bcrypt_workfactor>12</bcrypt_workfactor>
-
-    <!-- Complexity requirements for user passwords.
-         Note: ClickHouse Cloud https://clickhouse.com/cloud is always configured for strong passwords.
-      -->
-    <!-- <password_complexity>
-        <rule>
-            <pattern>.{12}</pattern>
-            <message>be at least 12 characters long</message>
-        </rule>
-        <rule>
-            <pattern>\p{N}</pattern>
-            <message>contain at least 1 numeric character</message>
-        </rule>
-        <rule>
-            <pattern>\p{Ll}</pattern>
-            <message>contain at least 1 lowercase character</message>
-        </rule>
-        <rule>
-            <pattern>\p{Lu}</pattern>
-            <message>contain at least 1 uppercase character</message>
-        </rule>
-        <rule>
-            <pattern>[^\p{L}\p{N}]</pattern>
-            <message>contain at least 1 special character</message>
-        </rule>
-    </password_complexity> -->
-
-    <!-- Policy from the <storage_configuration> for the temporary files.
-         If not set <tmp_path> is used, otherwise <tmp_path> is ignored.
-
-         Notes:
-         - move_factor              is ignored
-         - keep_free_space_bytes    is ignored
-         - max_data_part_size_bytes is ignored
-         - you must have exactly one volume in that policy
-
-         NOTE: all files with `tmp` prefix will be removed at server startup
-    -->
-    <!-- <tmp_policy>tmp</tmp_policy> -->
-
-    <!-- Directory with user provided files that are accessible by 'file' table function. -->
-    <user_files_path>/var/lib/clickhouse/user_files/</user_files_path>
-
-    <!-- LDAP server definitions. -->
-    <ldap_servers>
-        <!-- List LDAP servers with their connection parameters here to later 1) use them as authenticators for dedicated local users,
-              who have 'ldap' authentication mechanism specified instead of 'password', or to 2) use them as remote user directories.
-             Parameters:
-                host - LDAP server hostname or IP, this parameter is mandatory and cannot be empty.
-                port - LDAP server port, default is 636 if enable_tls is set to true, 389 otherwise.
-                bind_dn - template used to construct the DN to bind to.
-                        The resulting DN will be constructed by replacing all '{user_name}' substrings of the template with the actual
-                         user name during each authentication attempt.
-                user_dn_detection - section with LDAP search parameters for detecting the actual user DN of the bound user.
-                        This is mainly used in search filters for further role mapping when the server is Active Directory. The
-                         resulting user DN will be used when replacing '{user_dn}' substrings wherever they are allowed. By default,
-                         user DN is set equal to bind DN, but once search is performed, it will be updated with to the actual detected
-                         user DN value.
-                    base_dn - template used to construct the base DN for the LDAP search.
-                            The resulting DN will be constructed by replacing all '{user_name}' and '{bind_dn}' substrings
-                             of the template with the actual user name and bind DN during the LDAP search.
-                    scope - scope of the LDAP search.
-                            Accepted values are: 'base', 'one_level', 'children', 'subtree' (the default).
-                    search_filter - template used to construct the search filter for the LDAP search.
-                            The resulting filter will be constructed by replacing all '{user_name}', '{bind_dn}', and '{base_dn}'
-                             substrings of the template with the actual user name, bind DN, and base DN during the LDAP search.
-                            Note, that the special characters must be escaped properly in XML.
-                verification_cooldown - a period of time, in seconds, after a successful bind attempt, during which a user will be assumed
-                         to be successfully authenticated for all consecutive requests without contacting the LDAP server.
-                        Specify 0 (the default) to disable caching and force contacting the LDAP server for each authentication request.
-                enable_tls - flag to trigger use of secure connection to the LDAP server.
-                        Specify 'no' for plain text (ldap://) protocol (not recommended).
-                        Specify 'yes' for LDAP over SSL/TLS (ldaps://) protocol (recommended, the default).
-                        Specify 'starttls' for legacy StartTLS protocol (plain text (ldap://) protocol, upgraded to TLS).
-                tls_minimum_protocol_version - the minimum protocol version of SSL/TLS.
-                        Accepted values are: 'ssl2', 'ssl3', 'tls1.0', 'tls1.1', 'tls1.2' (the default).
-                tls_require_cert - SSL/TLS peer certificate verification behavior.
-                        Accepted values are: 'never', 'allow', 'try', 'demand' (the default).
-                tls_cert_file - path to certificate file.
-                tls_key_file - path to certificate key file.
-                tls_ca_cert_file - path to CA certificate file.
-                tls_ca_cert_dir - path to the directory containing CA certificates.
-                tls_cipher_suite - allowed cipher suite (in OpenSSL notation).
-             Example:
-                <my_ldap_server>
-                    <host>localhost</host>
-                    <port>636</port>
-                    <bind_dn>uid={user_name},ou=users,dc=example,dc=com</bind_dn>
-                    <verification_cooldown>300</verification_cooldown>
-                    <enable_tls>yes</enable_tls>
-                    <tls_minimum_protocol_version>tls1.2</tls_minimum_protocol_version>
-                    <tls_require_cert>demand</tls_require_cert>
-                    <tls_cert_file>/path/to/tls_cert_file</tls_cert_file>
-                    <tls_key_file>/path/to/tls_key_file</tls_key_file>
-                    <tls_ca_cert_file>/path/to/tls_ca_cert_file</tls_ca_cert_file>
-                    <tls_ca_cert_dir>/path/to/tls_ca_cert_dir</tls_ca_cert_dir>
-                    <tls_cipher_suite>ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:AES256-GCM-SHA384</tls_cipher_suite>
-                </my_ldap_server>
-             Example (typical Active Directory with configured user DN detection for further role mapping):
-                <my_ad_server>
-                    <host>localhost</host>
-                    <port>389</port>
-                    <bind_dn>EXAMPLE\{user_name}</bind_dn>
-                    <user_dn_detection>
-                        <base_dn>CN=Users,DC=example,DC=com</base_dn>
-                        <search_filter>(&amp;(objectClass=user)(sAMAccountName={user_name}))</search_filter>
-                    </user_dn_detection>
-                    <enable_tls>no</enable_tls>
-                </my_ad_server>
-        -->
-    </ldap_servers>
-
-    <!-- To enable Kerberos authentication support for HTTP requests (GSS-SPNEGO), for those users who are explicitly configured
-          to authenticate via Kerberos, define a single 'kerberos' section here.
-         Parameters:
-            principal - canonical service principal name, that will be acquired and used when accepting security contexts.
-                    This parameter is optional, if omitted, the default principal will be used.
-                    This parameter cannot be specified together with 'realm' parameter.
-            realm - a realm, that will be used to restrict authentication to only those requests whose initiator's realm matches it.
-                    This parameter is optional, if omitted, no additional filtering by realm will be applied.
-                    This parameter cannot be specified together with 'principal' parameter.
-         Example:
-            <kerberos />
-         Example:
-            <kerberos>
-                <principal>HTTP/clickhouse.example.com@EXAMPLE.COM</principal>
-            </kerberos>
-         Example:
-            <kerberos>
-                <realm>EXAMPLE.COM</realm>
-            </kerberos>
-    -->
-
-    <!-- Sources to read users, roles, access rights, profiles of settings, quotas. -->
-    <user_directories>
-        <users_xml>
-            <!-- Path to configuration file with predefined users. -->
-            <path>users.xml</path>
-        </users_xml>
-        <local_directory>
-            <!-- Path to folder where users created by SQL commands are stored. -->
-            <path>/var/lib/clickhouse/access/</path>
-        </local_directory>
-
-        <!-- To add an LDAP server as a remote user directory of users that are not defined locally, define a single 'ldap' section
-              with the following parameters:
-                server - one of LDAP server names defined in 'ldap_servers' config section above.
-                        This parameter is mandatory and cannot be empty.
-                roles - section with a list of locally defined roles that will be assigned to each user retrieved from the LDAP server.
-                        If no roles are specified here or assigned during role mapping (below), user will not be able to perform any
-                         actions after authentication.
-                role_mapping - section with LDAP search parameters and mapping rules.
-                        When a user authenticates, while still bound to LDAP, an LDAP search is performed using search_filter and the
-                         name of the logged in user. For each entry found during that search, the value of the specified attribute is
-                         extracted. For each attribute value that has the specified prefix, the prefix is removed, and the rest of the
-                         value becomes the name of a local role defined in ClickHouse, which is expected to be created beforehand by
-                         CREATE ROLE command.
-                        There can be multiple 'role_mapping' sections defined inside the same 'ldap' section. All of them will be
-                         applied.
-                    base_dn - template used to construct the base DN for the LDAP search.
-                            The resulting DN will be constructed by replacing all '{user_name}', '{bind_dn}', and '{user_dn}'
-                             substrings of the template with the actual user name, bind DN, and user DN during each LDAP search.
-                    scope - scope of the LDAP search.
-                            Accepted values are: 'base', 'one_level', 'children', 'subtree' (the default).
-                    search_filter - template used to construct the search filter for the LDAP search.
-                            The resulting filter will be constructed by replacing all '{user_name}', '{bind_dn}', '{user_dn}', and
-                             '{base_dn}' substrings of the template with the actual user name, bind DN, user DN, and base DN during
-                             each LDAP search.
-                            Note, that the special characters must be escaped properly in XML.
-                    attribute - attribute name whose values will be returned by the LDAP search. 'cn', by default.
-                    prefix - prefix, that will be expected to be in front of each string in the original list of strings returned by
-                             the LDAP search. Prefix will be removed from the original strings and resulting strings will be treated
-                             as local role names. Empty, by default.
-             Example:
-                <ldap>
-                    <server>my_ldap_server</server>
-                    <roles>
-                        <my_local_role1 />
-                        <my_local_role2 />
-                    </roles>
-                    <role_mapping>
-                        <base_dn>ou=groups,dc=example,dc=com</base_dn>
-                        <scope>subtree</scope>
-                        <search_filter>(&amp;(objectClass=groupOfNames)(member={bind_dn}))</search_filter>
-                        <attribute>cn</attribute>
-                        <prefix>clickhouse_</prefix>
-                    </role_mapping>
-                </ldap>
-             Example (typical Active Directory with role mapping that relies on the detected user DN):
-                <ldap>
-                    <server>my_ad_server</server>
-                    <role_mapping>
-                        <base_dn>CN=Users,DC=example,DC=com</base_dn>
-                        <attribute>CN</attribute>
-                        <scope>subtree</scope>
-                        <search_filter>(&amp;(objectClass=group)(member={user_dn}))</search_filter>
-                        <prefix>clickhouse_</prefix>
-                    </role_mapping>
-                </ldap>
-        -->
-    </user_directories>
-
-    <access_control_improvements>
-        <!-- Enables logic that users without permissive row policies can still read rows using a SELECT query.
-             For example, if there two users A, B and a row policy is defined only for A, then
-             if this setting is true the user B will see all rows, and if this setting is false the user B will see no rows.
-             By default this setting is true. -->
-        <users_without_row_policies_can_read_rows>true</users_without_row_policies_can_read_rows>
-
-        <!-- By default, for backward compatibility ON CLUSTER queries ignore CLUSTER grant,
-             however you can change this behaviour by setting this to true -->
-        <on_cluster_queries_require_cluster_grant>true</on_cluster_queries_require_cluster_grant>
-
-        <!-- By default, for backward compatibility "SELECT * FROM system.<table>" doesn't require any grants and can be executed
-             by any user. You can change this behaviour by setting this to true.
-             If it's set to true then this query requires "GRANT SELECT ON system.<table>" just like as for non-system tables.
-             Exceptions: a few system tables ("tables", "columns", "databases", and some constant tables like "one", "contributors")
-             are still accessible for everyone; and if there is a SHOW privilege (e.g. "SHOW USERS") granted the corresponding system
-             table (i.e. "system.users") will be accessible. -->
-        <select_from_system_db_requires_grant>true</select_from_system_db_requires_grant>
-
-        <!-- By default, for backward compatibility "SELECT * FROM information_schema.<table>" doesn't require any grants and can be
-             executed by any user. You can change this behaviour by setting this to true.
-             If it's set to true then this query requires "GRANT SELECT ON information_schema.<table>" just like as for ordinary tables. -->
-        <select_from_information_schema_requires_grant>true</select_from_information_schema_requires_grant>
-
-        <!-- By default, for backward compatibility a settings profile constraint for a specific setting inherit every not set field from
-             previous profile. You can change this behaviour by setting this to true.
-             If it's set to true then if settings profile has a constraint for a specific setting, then this constraint completely cancels all
-             actions of previous constraint (defined in other profiles) for the same specific setting, including fields that are not set by new constraint.
-             It also enables 'changeable_in_readonly' constraint type -->
-        <settings_constraints_replace_previous>true</settings_constraints_replace_previous>
-
-        <!-- By default, for backward compatibility creating table with a specific table engine ignores grant,
-             however you can change this behaviour by setting this to true -->
-        <table_engines_require_grant>false</table_engines_require_grant>
-
-        <!-- Number of seconds since last access a role is stored in the Role Cache -->
-        <role_cache_expiration_time_seconds>600</role_cache_expiration_time_seconds>
-    </access_control_improvements>
-
-    <!-- Default profile of settings. -->
-    <default_profile>default</default_profile>
-
-    <!-- Comma-separated list of prefixes for user-defined settings.
-         The server will allow to set these settings, and retrieve them with the getSetting function.
-         They are also logged in the query_log, similarly to other settings, but have no special effect.
-         The "SQL_" prefix is introduced for compatibility with MySQL - these settings are being set by Tableau.
-    -->
-    <custom_settings_prefixes>SQL_</custom_settings_prefixes>
-
-    <!-- System profile of settings. This settings are used by internal processes (Distributed DDL worker and so on). -->
-    <!-- <system_profile>default</system_profile> -->
-
-    <!-- Buffer profile of settings.
-         This settings are used by Buffer storage to flush data to the underlying table.
-         Default: used from system_profile directive.
-    -->
-    <!-- <buffer_profile>default</buffer_profile> -->
-
-    <!-- Default database. -->
-    <default_database>default</default_database>
-
-    <!-- Server time zone could be set here.
-
-         Time zone is used when converting between String and DateTime types,
-          when printing DateTime in text formats and parsing DateTime from text,
-          it is used in date and time related functions, if specific time zone was not passed as an argument.
-
-         Time zone is specified as identifier from IANA time zone database, like UTC or Africa/Abidjan.
-         If not specified, system time zone at server startup is used.
-
-         Please note, that server could display time zone alias instead of specified name.
-         Example: Zulu is an alias for UTC.
-    -->
-    <!-- <timezone>UTC</timezone> -->
-
-    <!-- You can specify umask here (see "man umask"). Server will apply it on startup.
-         Number is always parsed as octal. Default umask is 027 (other users cannot read logs, data files, etc; group can only read).
-    -->
-    <!-- <umask>022</umask> -->
-
-    <!-- Perform mlockall after startup to lower first queries latency
-          and to prevent clickhouse executable from being paged out under high IO load.
-         Enabling this option is recommended but will lead to increased startup time for up to a few seconds.
-    -->
-    <mlock_executable>true</mlock_executable>
-    <!-- But skip it if the memory is low -->
-    <mlock_executable_min_total_memory_amount_bytes>5000000000</mlock_executable_min_total_memory_amount_bytes>
-
-    <!-- Reallocate memory for machine code ("text") using huge pages. Highly experimental. -->
-    <remap_executable>false</remap_executable>
-
-    <![CDATA[
-         Uncomment below in order to use JDBC table engine and function.
-
-         To install and run JDBC bridge in background:
-         * [Debian/Ubuntu]
-           export MVN_URL=https://repo1.maven.org/maven2/com/clickhouse/clickhouse-jdbc-bridge/
-           export PKG_VER=$(curl -sL $MVN_URL/maven-metadata.xml | grep '<release>' | sed -e 's|.*>\(.*\)<.*|\1|')
-           wget https://github.com/ClickHouse/clickhouse-jdbc-bridge/releases/download/v$PKG_VER/clickhouse-jdbc-bridge_$PKG_VER-1_all.deb
-           apt install --no-install-recommends -f ./clickhouse-jdbc-bridge_$PKG_VER-1_all.deb
-           clickhouse-jdbc-bridge &
-
-         * [CentOS/RHEL]
-           export MVN_URL=https://repo1.maven.org/maven2/com/clickhouse/clickhouse-jdbc-bridge/
-           export PKG_VER=$(curl -sL $MVN_URL/maven-metadata.xml | grep '<release>' | sed -e 's|.*>\(.*\)<.*|\1|')
-           wget https://github.com/ClickHouse/clickhouse-jdbc-bridge/releases/download/v$PKG_VER/clickhouse-jdbc-bridge-$PKG_VER-1.noarch.rpm
-           yum localinstall -y clickhouse-jdbc-bridge-$PKG_VER-1.noarch.rpm
-           clickhouse-jdbc-bridge &
-
-         Please refer to https://github.com/ClickHouse/clickhouse-jdbc-bridge#usage for more information.
-    ]]>
-    <!--
-    <jdbc_bridge>
-        <host>127.0.0.1</host>
-        <port>9019</port>
-    </jdbc_bridge>
-    -->
-
-    <!-- Configuration of clusters that could be used in Distributed tables.
-         https://clickhouse.com/docs/en/operations/table_engines/distributed/
-         Note: ClickHouse Cloud https://clickhouse.com/cloud has the cluster preconfigured and dynamically scalable.
-      -->
-    <remote_servers>
-        <!-- Test only shard config for testing distributed storage -->
-        <default>
-            <!-- Inter-server per-cluster secret for Distributed queries
-                 default: no secret (no authentication will be performed)
-
-                 If set, then Distributed queries will be validated on shards, so at least:
-                 - such cluster should exist on the shard,
-                 - such cluster should have the same secret.
-
-                 And also (and which is more important), the initial_user will
-                 be used as current user for the query.
-
-                 Right now the protocol is pretty simple, and it only takes into account:
-                 - cluster name
-                 - query
-
-                 Also, it will be nice if the following will be implemented:
-                 - source hostname (see interserver_http_host), but then it will depend on DNS,
-                   it can use IP address instead, but then you need to get correct on the initiator node.
-                 - target hostname / ip address (same notes as for source hostname)
-                 - time-based security tokens
-            -->
-            <!-- <secret></secret> -->
-
-            <shard>
-                <!-- Optional. Whether to write data to just one of the replicas. Default: false (write data to all replicas). -->
-                <!-- <internal_replication>false</internal_replication> -->
-                <!-- Optional. Shard weight when writing data. Default: 1. -->
-                <!-- <weight>1</weight> -->
-                <replica>
-                    <host>localhost</host>
-                    <port>9000</port>
-                    <!-- Optional. Priority of the replica for load_balancing. Default: 1 (less value has more priority). -->
-                    <!-- <priority>1</priority> -->
-                    <!-- Use SSL? Default: no -->
-                    <!-- <secure>0</secure> -->
-                    <!-- Optional. Bind to specific host before connecting to use a specific network. -->
-                    <!-- <bind_host>10.0.0.1</bind_host> -->
-                </replica>
-            </shard>
-        </default>
-    </remote_servers>
-
-    <!-- The list of hosts allowed to use in URL-related storage engines and table functions.
-        If this section is not present in configuration, all hosts are allowed.
-    -->
-    <!--<remote_url_allow_hosts>-->
-        <!-- Host should be specified exactly as in URL. The name is checked before DNS resolution.
-            Example: "clickhouse.com", "clickhouse.com." and "www.clickhouse.com" are different hosts.
-                    If port is explicitly specified in URL, the host:port is checked as a whole.
-                    If host specified here without port, any port with this host allowed.
-                    "clickhouse.com" -> "clickhouse.com:443", "clickhouse.com:80" etc. is allowed, but "clickhouse.com:80" -> only "clickhouse.com:80" is allowed.
-            If the host is specified as IP address, it is checked as specified in URL. Example: "[2a02:6b8:a::a]".
-            If there are redirects and support for redirects is enabled, every redirect (the Location field) is checked.
-            Host should be specified using the host xml tag:
-                    <host>clickhouse.com</host>
-        -->
-
-        <!-- Regular expression can be specified. RE2 engine is used for regexps.
-            Regexps are not aligned: don't forget to add ^ and $. Also don't forget to escape dot (.) metacharacter
-            (forgetting to do so is a common source of error).
-        -->
-    <!--</remote_url_allow_hosts>-->
-
-    <!-- The list of HTTP headers forbidden to use in HTTP-related storage engines and table functions.
-        If this section is not present in configuration, all headers are allowed.
-    -->
-    <!-- <http_forbid_headers>
-        <header>exact_header</header>
-        <header_regexp>(?i)(case_insensitive_header)</header_regexp>
-    </http_forbid_headers> -->
-
-    <!-- If element has 'incl' attribute, then for it's value will be used corresponding substitution from another file.
-         By default, path to file with substitutions is /etc/metrika.xml. It could be changed in config in 'include_from' element.
-         Values for substitutions are specified in /clickhouse/name_of_substitution elements in that file.
-      -->
-
-    <!-- ZooKeeper is used to store metadata about replicas, when using Replicated tables.
-         Optional. If you don't use replicated tables, you could omit that.
-
-         See https://clickhouse.com/docs/en/engines/table-engines/mergetree-family/replication/
-
-         Note: ClickHouse Cloud https://clickhouse.com/cloud has ClickHouse Keeper automatically configured for every service.
-      -->
-
-    <!--
-    <zookeeper>
-        <node>
-            <host>example1</host>
-            <port>2181</port>
-        </node>
-        <node>
-            <host>example2</host>
-            <port>2181</port>
-        </node>
-        <node>
-            <host>example3</host>
-            <port>2181</port>
-        </node>
-    </zookeeper>
-    -->
-
-    <!-- Substitutions for parameters of replicated tables.
-          Optional. If you don't use replicated tables, you could omit that.
-
-         See https://clickhouse.com/docs/en/engines/table-engines/mergetree-family/replication/#creating-replicated-tables
-      -->
-    <!--
-    <macros>
-        <shard>01</shard>
-        <replica>example01-01-1</replica>
-    </macros>
-    -->
-
-    <!--
-    <default_replica_path>/clickhouse/tables/{database}/{table}</default_replica_path>
-    <default_replica_name>{replica}</default_replica_name>
-    -->
-
-    <!-- Replica group name for database Replicated.
-          The cluster created by Replicated database will consist of replicas in the same group.
-          DDL queries will only wail for the replicas in the same group.
-          Empty by default.
-    -->
-    <!--
-    <replica_group_name><replica_group_name>
-    -->
-
-
-    <!-- Reloading interval for embedded dictionaries, in seconds. Default: 3600. -->
-    <builtin_dictionaries_reload_interval>3600</builtin_dictionaries_reload_interval>
-
-
-    <!-- Maximum session timeout, in seconds. Default: 3600. -->
-    <max_session_timeout>3600</max_session_timeout>
-
-    <!-- Default session timeout, in seconds. Default: 60. -->
-    <default_session_timeout>60</default_session_timeout>
-
-    <!-- Sending data to Graphite for monitoring. Several sections can be defined. -->
-    <!--
-        interval - send every X second
-        root_path - prefix for keys
-        hostname_in_path - append hostname to root_path (default = true)
-        metrics - send data from table system.metrics
-        events - send data from table system.events
-        asynchronous_metrics - send data from table system.asynchronous_metrics
-    -->
-    <!--
-    <graphite>
-        <host>localhost</host>
-        <port>42000</port>
-        <timeout>0.1</timeout>
-        <interval>60</interval>
-        <root_path>one_min</root_path>
-        <hostname_in_path>true</hostname_in_path>
-
-        <metrics>true</metrics>
-        <events>true</events>
-        <events_cumulative>false</events_cumulative>
-        <asynchronous_metrics>true</asynchronous_metrics>
-    </graphite>
-    <graphite>
-        <host>localhost</host>
-        <port>42000</port>
-        <timeout>0.1</timeout>
-        <interval>1</interval>
-        <root_path>one_sec</root_path>
-
-        <metrics>true</metrics>
-        <events>true</events>
-        <events_cumulative>false</events_cumulative>
-        <asynchronous_metrics>false</asynchronous_metrics>
-    </graphite>
-    -->
-
-    <!-- Serve endpoint for Prometheus monitoring. -->
-    <!--
-        endpoint - mertics path (relative to root, statring with "/")
-        port - port to setup server. If not defined or 0 than http_port used
-        metrics - send data from table system.metrics
-        events - send data from table system.events
-        asynchronous_metrics - send data from table system.asynchronous_metrics
-    -->
-    <!--
-    <prometheus>
-        <endpoint>/metrics</endpoint>
-        <port>9363</port>
-
-        <metrics>true</metrics>
-        <events>true</events>
-        <asynchronous_metrics>true</asynchronous_metrics>
-    </prometheus>
-    -->
-
-    <!-- Query log. Used only for queries with setting log_queries = 1. -->
-    <query_log>
-        <!-- What table to insert data. If table is not exist, it will be created.
-             When query log structure is changed after system update,
-              then old table will be renamed and new table will be created automatically.
-        -->
-        <database>system</database>
-        <table>query_log</table>
-        <!--
-            PARTITION BY expr: https://clickhouse.com/docs/en/table_engines/mergetree-family/custom_partitioning_key/
-            Example:
-                event_date
-                toMonday(event_date)
-                toYYYYMM(event_date)
-                toStartOfHour(event_time)
-        -->
-        <partition_by>toYYYYMM(event_date)</partition_by>
-        <!--
-            Table TTL specification: https://clickhouse.com/docs/en/engines/table-engines/mergetree-family/mergetree/#mergetree-table-ttl
-            Example:
-                event_date + INTERVAL 1 WEEK
-                event_date + INTERVAL 7 DAY DELETE
-                event_date + INTERVAL 2 WEEK TO DISK 'bbb'
-
-        <ttl>event_date + INTERVAL 30 DAY DELETE</ttl>
-        -->
-
-        <!--
-            ORDER BY expr: https://clickhouse.com/docs/en/engines/table-engines/mergetree-family/mergetree#order_by
-            Example:
-                event_date, event_time
-                event_date, type, query_id
-                event_date, event_time, initial_query_id
-
-        <order_by>event_date, event_time, initial_query_id</order_by>
-        -->
-
-        <!-- Instead of partition_by, you can provide full engine expression (starting with ENGINE = ) with parameters,
-             Example: <engine>ENGINE = MergeTree PARTITION BY toYYYYMM(event_date) ORDER BY (event_date, event_time) SETTINGS index_granularity = 1024</engine>
-          -->
-
-        <!-- Interval of flushing data. -->
-        <flush_interval_milliseconds>7500</flush_interval_milliseconds>
-        <!-- Maximum size in lines for the logs. When non-flushed logs amount reaches max_size, logs dumped to the disk. -->
-        <max_size_rows>1048576</max_size_rows>
-        <!-- Pre-allocated size in lines for the logs. -->
-        <reserved_size_rows>8192</reserved_size_rows>
-        <!-- Lines amount threshold, reaching it launches flushing logs to the disk in background. -->
-        <buffer_size_rows_flush_threshold>524288</buffer_size_rows_flush_threshold>
-        <!-- Indication whether logs should be dumped to the disk in case of a crash -->
-        <flush_on_crash>false</flush_on_crash>
-
-        <!-- example of using a different storage policy for a system table -->
-        <!-- storage_policy>local_ssd</storage_policy -->
-    </query_log>
-
-    <!-- Trace log. Stores stack traces collected by query profilers.
-         See query_profiler_real_time_period_ns and query_profiler_cpu_time_period_ns settings. -->
-    <trace_log>
-        <enabled>false</enabled>
-        <database>system</database>
-        <table>trace_log</table>
-
-        <partition_by>toYYYYMM(event_date)</partition_by>
-        <flush_interval_milliseconds>7500</flush_interval_milliseconds>
-        <max_size_rows>1048576</max_size_rows>
-        <reserved_size_rows>8192</reserved_size_rows>
-        <buffer_size_rows_flush_threshold>524288</buffer_size_rows_flush_threshold>
-        <!-- Indication whether logs should be dumped to the disk in case of a crash -->
-        <flush_on_crash>false</flush_on_crash>
-        <symbolize>true</symbolize>
-    </trace_log>
-
-    <!-- Query thread log. Has information about all threads participated in query execution.
-         Used only for queries with setting log_query_threads = 1. -->
-     <!-- <query_thread_log>
-        <database>system</database>
-        <table>query_thread_log</table>
-        <partition_by>toYYYYMM(event_date)</partition_by>
-        <flush_interval_milliseconds>7500</flush_interval_milliseconds>
-        <max_size_rows>1048576</max_size_rows>
-        <reserved_size_rows>8192</reserved_size_rows>
-        <buffer_size_rows_flush_threshold>524288</buffer_size_rows_flush_threshold>
-        <flush_on_crash>false</flush_on_crash>
-    </query_thread_log>-->
-
-    <!-- Query views log. Has information about all dependent views associated with a query.
-         Used only for queries with setting log_query_views = 1. -->
-    <query_views_log>
-        <database>system</database>
-        <table>query_views_log</table>
-        <partition_by>toYYYYMM(event_date)</partition_by>
-        <flush_interval_milliseconds>7500</flush_interval_milliseconds>
-    </query_views_log>
-
-    <!-- Part log contains information about all actions with parts in MergeTree tables (creation, deletion, merges, downloads). -->
-     <!-- <part_log>
-        <database>system</database>
-        <table>part_log</table>
-        <partition_by>toYYYYMM(event_date)</partition_by>
-        <flush_interval_milliseconds>7500</flush_interval_milliseconds>
-        <max_size_rows>1048576</max_size_rows>
-        <reserved_size_rows>8192</reserved_size_rows>
-        <buffer_size_rows_flush_threshold>524288</buffer_size_rows_flush_threshold>
-        <flush_on_crash>false</flush_on_crash>
-    </part_log>-->
-
-    <!-- Contains information about all background tasks that are executed via various background pools.
-         See also:
-         - background_schedule_pool_size
-         - background_buffer_flush_schedule_pool_size
-         - background_message_broker_schedule_pool_size
-         - background_distributed_schedule_pool_size
-    -->
-    <background_schedule_pool_log>
-        <database>system</database>
-        <table>background_schedule_pool_log</table>
-        <partition_by>toYYYYMM(event_date)</partition_by>
-        <flush_interval_milliseconds>7500</flush_interval_milliseconds>
-        <max_size_rows>1048576</max_size_rows>
-        <reserved_size_rows>8192</reserved_size_rows>
-        <buffer_size_rows_flush_threshold>524288</buffer_size_rows_flush_threshold>
-        <flush_on_crash>false</flush_on_crash>
-        <!-- Only tasks longer then duration_threshold_milliseconds will be logged. Zero means log everything -->
-        <!-- Default value is 30ms (averge tasks execution time) -->
-        <duration_threshold_milliseconds>30</duration_threshold_milliseconds>
-    </background_schedule_pool_log>
-
-    <!-- Text log contains all information from usual server log but stores it in structured and efficient way.
-         The level of the messages that goes to the table can be limited (<level>), if not specified all messages will go to the table.
-    -->
-      <!--<text_log>
-        <database>system</database>
-        <table>text_log</table>
-        <flush_interval_milliseconds>7500</flush_interval_milliseconds>
-        <max_size_rows>1048576</max_size_rows>
-        <reserved_size_rows>8192</reserved_size_rows>
-        <buffer_size_rows_flush_threshold>524288</buffer_size_rows_flush_threshold>
-        <flush_on_crash>false</flush_on_crash>
-        <level>warning</level>
-    </text_log> -->
-
-    <!-- Metric log contains rows with current values of ProfileEvents, CurrentMetrics collected with "collect_interval_milliseconds" interval. -->
-    <!--<metric_log>
-        <database>system</database>
-        <table>metric_log</table>
-        <flush_interval_milliseconds>7500</flush_interval_milliseconds>
-        <max_size_rows>1048576</max_size_rows>
-        <reserved_size_rows>8192</reserved_size_rows>
-        <buffer_size_rows_flush_threshold>524288</buffer_size_rows_flush_threshold>
-        <collect_interval_milliseconds>1000</collect_interval_milliseconds>
-        <flush_on_crash>false</flush_on_crash>
-    </metric_log> -->
-
-    <!-- Error log contains rows with current values of errors collected with "collect_interval_milliseconds" interval. -->
-    <error_log>
-        <database>system</database>
-        <table>error_log</table>
-        <flush_interval_milliseconds>7500</flush_interval_milliseconds>
-        <max_size_rows>1048576</max_size_rows>
-        <reserved_size_rows>8192</reserved_size_rows>
-        <buffer_size_rows_flush_threshold>524288</buffer_size_rows_flush_threshold>
-        <collect_interval_milliseconds>1000</collect_interval_milliseconds>
-        <flush_on_crash>false</flush_on_crash>
-    </error_log>
-
-    <!-- Instrumentation trace log contains rows with profile information of functions produced using XRay that we can export to Chrome trace format. -->
-    <instrumentation_trace_log>
-        <database>system</database>
-        <table>instrumentation_trace_log</table>
-        <flush_interval_milliseconds>7500</flush_interval_milliseconds>
-        <max_size_rows>1048576</max_size_rows>
-        <reserved_size_rows>8192</reserved_size_rows>
-        <buffer_size_rows_flush_threshold>524288</buffer_size_rows_flush_threshold>
-        <collect_interval_milliseconds>1000</collect_interval_milliseconds>
-        <flush_on_crash>false</flush_on_crash>
-    </instrumentation_trace_log>
-
-    <!-- Query metric log contains history of memory and metric values from table system.events for individual queries, periodically flushed to disk
-    every "collect_interval_milliseconds" interval-->
-    <query_metric_log>
-        <database>system</database>
-        <table>query_metric_log</table>
-        <flush_interval_milliseconds>7500</flush_interval_milliseconds>
-        <max_size_rows>1048576</max_size_rows>
-        <reserved_size_rows>8192</reserved_size_rows>
-        <buffer_size_rows_flush_threshold>524288</buffer_size_rows_flush_threshold>
-        <collect_interval_milliseconds>1000</collect_interval_milliseconds>
-        <flush_on_crash>false</flush_on_crash>
-    </query_metric_log>
-
-    <!--
-        Asynchronous metric log contains values of metrics from
-        system.asynchronous_metrics.
-    -->
-    <!--<asynchronous_metric_log>
-        <database>system</database>
-        <table>asynchronous_metric_log</table>
-        <flush_interval_milliseconds>7000</flush_interval_milliseconds>
-        <max_size_rows>1048576</max_size_rows>
-        <reserved_size_rows>8192</reserved_size_rows>
-        <buffer_size_rows_flush_threshold>524288</buffer_size_rows_flush_threshold>
-        <flush_on_crash>false</flush_on_crash>
-    </asynchronous_metric_log> -->
-
-    <iceberg_metadata_log>
-        <database>system</database>
-        <table>iceberg_metadata_log</table>
-        <flush_interval_milliseconds>2000</flush_interval_milliseconds>
-        <max_size_rows>1048576</max_size_rows>
-        <reserved_size_rows>8192</reserved_size_rows>
-        <buffer_size_rows_flush_threshold>524288</buffer_size_rows_flush_threshold>
-        <flush_on_crash>false</flush_on_crash>
-    </iceberg_metadata_log>
-
-    <delta_lake_metadata_log>
-        <database>system</database>
-        <table>delta_lake_metadata_log</table>
-        <flush_interval_milliseconds>2000</flush_interval_milliseconds>
-        <max_size_rows>1048576</max_size_rows>
-        <reserved_size_rows>8192</reserved_size_rows>
-        <buffer_size_rows_flush_threshold>524288</buffer_size_rows_flush_threshold>
-        <flush_on_crash>false</flush_on_crash>
-    </delta_lake_metadata_log>
-    <!--
-        OpenTelemetry log contains OpenTelemetry trace spans.
-
-        NOTE: this table does not use standard schema with event_date and event_time!
-    -->
-    <opentelemetry_span_log>
-        <!--
-            The default table creation code is insufficient, this <engine> spec
-            is a workaround. There is no 'event_time' for this log, but two times,
-            start and finish. It is sorted by finish time, to avoid inserting
-            data too far away in the past (probably we can sometimes insert a span
-            that is seconds earlier than the last span in the table, due to a race
-            between several spans inserted in parallel). This gives the spans a
-            global order that we can use to e.g. retry insertion into some external
-            system.
-        -->
-        <engine>
-            engine MergeTree
-            partition by toYYYYMM(finish_date)
-            order by (finish_date, finish_time_us)
-        </engine>
-        <database>system</database>
-        <table>opentelemetry_span_log</table>
-        <flush_interval_milliseconds>7500</flush_interval_milliseconds>
-        <max_size_rows>1048576</max_size_rows>
-        <reserved_size_rows>8192</reserved_size_rows>
-        <buffer_size_rows_flush_threshold>524288</buffer_size_rows_flush_threshold>
-        <flush_on_crash>false</flush_on_crash>
-    </opentelemetry_span_log>
-
-
-    <!-- Crash log. Stores stack traces for fatal errors.
-         This table is normally empty. -->
-    <crash_log>
-        <database>system</database>
-        <table>crash_log</table>
-
-        <partition_by />
-        <flush_interval_milliseconds>1000</flush_interval_milliseconds>
-        <max_size_rows>1024</max_size_rows>
-        <reserved_size_rows>1024</reserved_size_rows>
-        <buffer_size_rows_flush_threshold>512</buffer_size_rows_flush_threshold>
-        <flush_on_crash>true</flush_on_crash>
-    </crash_log>
-
-    <!-- Session log. Stores user log in (successful or not) and log out events. -->
-    <!-- <session_log>
-        <database>system</database>
-        <table>session_log</table>
-
-        <partition_by>toYYYYMM(event_date)</partition_by>
-        <flush_interval_milliseconds>7500</flush_interval_milliseconds>
-        <max_size_rows>1048576</max_size_rows>
-        <reserved_size_rows>8192</reserved_size_rows>
-        <buffer_size_rows_flush_threshold>524288</buffer_size_rows_flush_threshold>
-        <flush_on_crash>false</flush_on_crash>
-    </session_log> -->
-
-    <!-- Profiling on Processors level. -->
-    <processors_profile_log>
-        <database>system</database>
-        <table>processors_profile_log</table>
-
-        <partition_by>toYYYYMM(event_date)</partition_by>
-        <flush_interval_milliseconds>7500</flush_interval_milliseconds>
-        <max_size_rows>1048576</max_size_rows>
-        <reserved_size_rows>8192</reserved_size_rows>
-        <buffer_size_rows_flush_threshold>524288</buffer_size_rows_flush_threshold>
-        <flush_on_crash>false</flush_on_crash>
-        <ttl>event_date + INTERVAL 30 DAY DELETE</ttl>
-    </processors_profile_log>
-
-    <!-- Log of asynchronous inserts. It allows to check status
-         of insert query in fire-and-forget mode.
-    -->
-    <asynchronous_insert_log>
-        <database>system</database>
-        <table>asynchronous_insert_log</table>
-
-        <flush_interval_milliseconds>7500</flush_interval_milliseconds>
-        <max_size_rows>1048576</max_size_rows>
-        <reserved_size_rows>8192</reserved_size_rows>
-        <buffer_size_rows_flush_threshold>524288</buffer_size_rows_flush_threshold>
-        <flush_on_crash>false</flush_on_crash>
-        <partition_by>event_date</partition_by>
-        <ttl>event_date + INTERVAL 3 DAY</ttl>
-    </asynchronous_insert_log>
-
-    <!-- Backup/restore log.
-    -->
-    <backup_log>
-        <database>system</database>
-        <table>backup_log</table>
-        <partition_by>toYYYYMM(event_date)</partition_by>
-        <flush_interval_milliseconds>7500</flush_interval_milliseconds>
-    </backup_log>
-
-    <!-- Storage S3Queue log.
-    -->
-    <s3queue_log>
-        <database>system</database>
-        <table>s3queue_log</table>
-        <partition_by>toYYYYMM(event_date)</partition_by>
-        <flush_interval_milliseconds>7500</flush_interval_milliseconds>
-    </s3queue_log>
-
-    <!-- Blob storage object operations log.
-    -->
-    <blob_storage_log>
-        <database>system</database>
-        <table>blob_storage_log</table>
-        <partition_by>toYYYYMM(event_date)</partition_by>
-        <flush_interval_milliseconds>7500</flush_interval_milliseconds>
-        <ttl>event_date + INTERVAL 30 DAY</ttl>
-    </blob_storage_log>
-
-    <!-- Aggregated ZooKeeper log.
-    -->
-    <aggregated_zookeeper_log>
-        <database>system</database>
-        <table>aggregated_zookeeper_log</table>
-        <partition_by>toYYYYMM(event_date)</partition_by>
-        <collect_interval_milliseconds>1000</collect_interval_milliseconds>
-        <ttl>event_date + INTERVAL 30 DAY</ttl>
-    </aggregated_zookeeper_log>
-
-    <!-- ZooKeeper connection log.
-    -->
-    <zookeeper_connection_log>
-        <database>system</database>
-        <table>zookeeper_connection_log</table>
-        <partition_by>toYYYYMM(event_date)</partition_by>
-        <ttl>event_date + INTERVAL 30 DAY</ttl>
-    </zookeeper_connection_log>
-
-    <!-- Configure system.dashboards for dashboard.html.
-
-         Could have any query parameters, for which there will be an input on the page.
-         For instance an example from comments have the following:
-         - seconds
-         - rounding
-
-         NOTE: All default dashboards will be overwritten if it was set here. -->
-    <!-- Here is an example without merge() function, to make it work with readonly user -->
-    <!--
-    <dashboards>
-        <dashboard>
-            <dashboard>Overview</dashboard>
-            <title>Queries/second</title>
-            <query>
-                SELECT toStartOfInterval(event_time, INTERVAL {rounding:UInt32} SECOND)::INT AS t, avg(ProfileEvent_Query)
-                FROM system.metric_log
-                WHERE event_date >= toDate(now() - {seconds:UInt32}) AND event_time >= now() - {seconds:UInt32}
-                GROUP BY t
-                ORDER BY t WITH FILL STEP {rounding:UInt32}
-            </query>
-        </dashboard>
-    </dashboards>
-    -->
-
-    <!-- <top_level_domains_path>/var/lib/clickhouse/top_level_domains/</top_level_domains_path> -->
-    <!-- Custom TLD lists.
-         Format: <name>/path/to/file</name>
-
-         Changes will not be applied w/o server restart.
-         Path to the list is under top_level_domains_path (see above).
-    -->
-    <top_level_domains_lists>
-        <!--
-        <public_suffix_list>/path/to/public_suffix_list.dat</public_suffix_list>
-        -->
-    </top_level_domains_lists>
-
-    <!-- Configuration of external dictionaries. See:
-         https://clickhouse.com/docs/en/sql-reference/dictionaries/external-dictionaries/external-dicts
-    -->
-    <dictionaries_config>*_dictionary.*ml</dictionaries_config>
-
-    <!-- Load dictionaries lazily, i.e. a dictionary will be loaded when it's used for the first time.
-         "false" means ClickHouse will start loading dictionaries immediately at startup.
-    -->
-    <dictionaries_lazy_load>true</dictionaries_lazy_load>
-
-    <!-- Wait at startup until all the dictionaries finish their loading (successfully or not)
-         before receiving any connections. Affects dictionaries only if "dictionaries_lazy_load" is false.
-         Setting this to false can make ClickHouse start faster, however some queries can be executed slower.
-    -->
-    <wait_dictionaries_load_at_startup>true</wait_dictionaries_load_at_startup>
-
-    <!-- Configuration of user defined executable functions -->
-    <user_defined_executable_functions_config>*_function.*ml</user_defined_executable_functions_config>
-
-    <!-- Path in ZooKeeper to store user-defined SQL functions created by the command CREATE FUNCTION.
-     If not specified they will be stored locally. -->
-    <!-- <user_defined_zookeeper_path>/clickhouse/user_defined</user_defined_zookeeper_path> -->
-
-    <!-- Path in ZooKeeper to store workload and resource created by the command CREATE WORKLOAD and CREATE RESOURCE.
-     If not specified they will be stored locally. -->
-    <!-- <workload_zookeeper_path>/clickhouse/workload/definitions.sql</workload_zookeeper_path> -->
-
-    <!-- Uncomment if you want data to be compressed 30-100% better.
-         Don't do that if you just started using ClickHouse.
-         Note: ClickHouse Cloud https://clickhouse.com/cloud has a stronger compression by default.
-      -->
-    <!--
-    <compression>
-        <!- - Set of variants. Checked in order. Last matching case wins. If nothing matches, lz4 will be used. - ->
-        <case>
-
-            <!- - Conditions. All must be satisfied. Some conditions may be omitted. - ->
-            <min_part_size>10000000000</min_part_size>        <!- - Min part size in bytes. - ->
-            <min_part_size_ratio>0.01</min_part_size_ratio>   <!- - Min size of part relative to whole table size. - ->
-
-            <!- - What compression method to use. - ->
-            <method>zstd</method>
-        </case>
-    </compression>
-    -->
-
-    <!-- Configuration of encryption. The server executes a command to
-         obtain an encryption key at startup if such a command is
-         defined, or encryption codecs will be disabled otherwise. The
-         command is executed through /bin/sh and is expected to write
-         a Base64-encoded key to the stdout.
-
-         Note: ClickHouse Cloud https://clickhouse.com/cloud supports encryption with customer-managed keys.
-    -->
-    <encryption_codecs>
-        <!-- aes_128_gcm_siv -->
-            <!-- Example of getting hex key from env -->
-            <!-- the code should use this key and throw an exception if its length is not 16 bytes -->
-            <!-- key_hex from_env="..."></key_hex -->
-
-            <!-- Example of multiple hex keys. They can be imported from env or be written down in config -->
-            <!-- the code should use these keys and throw an exception if their length is not 16 bytes -->
-            <!-- key_hex id="0">...</key_hex -->
-            <!-- key_hex id="1" from_env=".."></key_hex -->
-            <!-- key_hex id="2">...</key_hex -->
-            <!-- current_key_id>2</current_key_id -->
-
-            <!-- Example of getting hex key from config -->
-            <!-- the code should use this key and throw an exception if its length is not 16 bytes -->
-            <!-- key>...</key -->
-
-            <!-- example of adding nonce -->
-            <!-- nonce>...</nonce -->
-
-        <!-- /aes_128_gcm_siv -->
-    </encryption_codecs>
-
-    <!-- Allow to execute distributed DDL queries (CREATE, DROP, ALTER, RENAME) on cluster.
-         Works only if ZooKeeper is enabled. Comment it if such functionality isn't required.
-         Note: ClickHouse Cloud https://clickhouse.com/cloud always runs DDL queries on cluster.
-    -->
-    <distributed_ddl>
-        <!-- Path in ZooKeeper to queue with DDL queries -->
-        <path>/clickhouse/task_queue/ddl</path>
-        <!-- Path in ZooKeeper to store running DDL hosts -->
-        <replicas_path>/clickhouse/task_queue/replicas</replicas_path>
-
-        <!-- Settings from this profile will be used to execute DDL queries -->
-        <!-- <profile>default</profile> -->
-
-        <!-- Controls how many ON CLUSTER queries can be run simultaneously. -->
-        <!-- <pool_size>1</pool_size> -->
-
-        <!--
-             Cleanup settings (active tasks will not be removed)
-        -->
-
-        <!-- Controls task TTL (default 1 week) -->
-        <!-- <task_max_lifetime>604800</task_max_lifetime> -->
-
-        <!-- Controls how often cleanup should be performed (in seconds) -->
-        <!-- <cleanup_delay_period>60</cleanup_delay_period> -->
-
-        <!-- Controls how many tasks could be in the queue -->
-        <!-- <max_tasks_in_queue>1000</max_tasks_in_queue> -->
-
-        <!-- Host name of the current node. If specified, will only compare and not resolve hostnames inside the DDL tasks -->
-        <!-- <host_name>replica</host_name> -->
-    </distributed_ddl>
-
-    <!-- Workload scheduling: used to regulate how resources are utilized and shared between merges, mutations and other workloads.
-         Specified value is used as `workload` setting value for background merge or mutation.
-    -->
-    <!--
-    <merge_workload>merges_and_mutations</merge_workload>
-    <mutation_workload>merges_and_mutations</mutation_workload>
-    -->
-
-    <!-- Workload scheduling: throw or provide unlimited access to resource given unknown `workload` query setting -->
-    <!-- <throw_on_unknown_workload>true</throw_on_unknown_workload> -->
-
-    <!-- Workload scheduling: if enabled during CPU overloaded periods, long-running queries will downscale to lower number of threads dynamically.
-         Ensures more fair CPU resource distribution.
-    -->
-    <!--
-    <cpu_slot_preemption>true</cpu_slot_preemption>
-    <cpu_slot_quantum_ns>10000000</cpu_slot_quantum_ns>
-    <cpu_slot_preemption_timeout_ms>1000</cpu_slot_preemption_timeout_ms>
-    -->
-
-    <!-- Settings to tune cpu and memory overload warnings for system.warnings.
-    <resource_overload_warnings>
-        <cpu_overload_warn_ratio>0.9</cpu_overload_warn_ratio>
-        <cpu_overload_clear_ratio>0.8</cpu_overload_clear_ratio>
-        <cpu_overload_duration_seconds>600</cpu_overload_duration_seconds>
-        <memory_overload_warn_ratio>0.9</memory_overload_warn_ratio>
-        <memory_overload_clear_ratio>0.8</memory_overload_clear_ratio>
-        <memory_overload_duration_seconds>600</memory_overload_duration_seconds>
-    </resource_overload_warnings>
-    -->
-
-    <!-- Settings to fine-tune MergeTree tables. See documentation in source code, in MergeTreeSettings.h -->
-    <!--
-    <merge_tree>
-        <max_suspicious_broken_parts>5</max_suspicious_broken_parts>
-    </merge_tree>
-    -->
-
-    <!-- Settings to fine-tune ReplicatedMergeTree tables. See documentation in source code, in MergeTreeSettings.h
-         Note: ClickHouse Cloud https://clickhouse.com/cloud has a SharedMergeTree engine that does not require fine-tuning.
-    -->
-    <!--
-    <replicated_merge_tree>
-        <max_replicated_fetches_network_bandwidth>1000000000</max_replicated_fetches_network_bandwidth>
-    </replicated_merge_tree>
-    -->
-
-    <!-- Settings to fine-tune DatabaseReplicatedSettings. See documentation in source code, in DatabaseReplicatedSettings.h -->
-    <!--
-    <database_replicated>
-        <max_broken_tables_ratio>1</max_broken_tables_ratio>
-        <max_replication_lag_to_enqueue>50</max_replication_lag_to_enqueue>
-        <wait_entry_commited_timeout_sec>3600</wait_entry_commited_timeout_sec>
-        <collection_name>default_collection</collection_name>
-        <check_consistency>true</check_consistency>
-        <max_retries_before_automatic_recovery>10</max_retries_before_automatic_recovery>
-    </database_replicated>
-    -->
-
-    <!-- Settings to fine-tune Distributed tables. See documentation in source code, in DistributedSettings.h -->
-    <!--
-    <distributed>
-        <flush_on_detach>false</flush_on_detach>
-    </distributed>
-    -->
-
-    <!-- Protection from accidental DROP.
-         If size of a MergeTree table is greater than max_table_size_to_drop (in bytes) than table could not be dropped with any DROP query.
-         If you want do delete one table and don't want to change clickhouse-server config, you could create special file <clickhouse-path>/flags/force_drop_table and make DROP once.
-         By default max_table_size_to_drop is 50GB; max_table_size_to_drop=0 allows to DROP any tables.
-         The same for max_partition_size_to_drop.
-         Uncomment to disable protection.
-    -->
-    <!-- <max_table_size_to_drop>0</max_table_size_to_drop> -->
-    <!-- <max_partition_size_to_drop>0</max_partition_size_to_drop> -->
-
-    <!-- Example of parameters for GraphiteMergeTree table engine -->
-    <graphite_rollup_example>
-        <pattern>
-            <regexp>click_cost</regexp>
-            <function>any</function>
-            <retention>
-                <age>0</age>
-                <precision>3600</precision>
-            </retention>
-            <retention>
-                <age>86400</age>
-                <precision>60</precision>
-            </retention>
-        </pattern>
-        <default>
-            <function>max</function>
-            <retention>
-                <age>0</age>
-                <precision>60</precision>
-            </retention>
-            <retention>
-                <age>3600</age>
-                <precision>300</precision>
-            </retention>
-            <retention>
-                <age>86400</age>
-                <precision>3600</precision>
-            </retention>
-        </default>
-    </graphite_rollup_example>
-
-    <!-- Directory in <clickhouse-path> containing schema files for various input formats.
-         The directory will be created if it doesn't exist.
-      -->
-    <format_schema_path>/var/lib/clickhouse/format_schemas/</format_schema_path>
-
-    <!-- Directory containing the proto files for the well-known Protobuf types.
-      -->
-    <google_protos_path>/usr/share/clickhouse/protos/</google_protos_path>
-
-    <!-- Default query masking rules, matching lines would be replaced with something else in the logs
-        (both text logs and system.query_log).
-        name - name for the rule (optional)
-        regexp - RE2 compatible regular expression (mandatory)
-        replace - substitution string for sensitive data (optional, by default - six asterisks)
-    <query_masking_rules>
-        <rule>
-            <name>hide encrypt/decrypt arguments</name>
-            <regexp>((?:aes_)?(?:encrypt|decrypt)(?:_mysql)?)\s*\(\s*(?:'(?:\\'|.)+'|.*?)\s*\)</regexp>
-            <replace>\1(???)</replace>
-        </rule>
-    </query_masking_rules> -->
-
-    <!-- Uncomment to use custom http handlers.
-
-        rules are checked from top to bottom, first match runs the handler
-            url - to match request URL (path and query string only), you can use 'regex:' prefix to use regex match(optional)
-            full_url - to match request **full** URL (schema, host:port, path and query string), you can use 'regex:' prefix to use regex match(optional)
-                       note, ClickHouse does not support "virtual hosts" so "host" will contain IP address not the "Host" header.
-            empty_query_string - check that there is no query string in the URL
-            methods - to match request method, you can use commas to separate multiple method matches(optional)
-            headers - to match request headers, match each child element (child element name is header name), you can use 'regex:' prefix to use regex match(optional)
-
-        handler is request handler
-            type - supported types: static, dynamic_query_handler, predefined_query_handler, redirect
-            query - use with predefined_query_handler type, executes query when the handler is called
-            query_param_name - use with dynamic_query_handler type, extracts and executes the value corresponding to the <query_param_name> value in HTTP request params
-            status - use with static type, response status code
-            content_type - use with static type, response content-type
-            response_content - use with static type, response content sent to client, when using the prefix 'file://' or 'config://', find the content from the file or configuration send to client.
-            url - a location for redirect
-
-        Along with a list of rules, you can specify <defaults/> which means - enable all the default handlers.
-
-    <http_handlers>
-        <rule>
-            <url>/</url>
-            <methods>POST,GET</methods>
-            <headers><pragma>no-cache</pragma></headers>
-            <handler>
-                <type>dynamic_query_handler</type>
-                <query_param_name>query</query_param_name>
-            </handler>
-        </rule>
-
-        <rule>
-            <url>/predefined_query</url>
-            <methods>POST,GET</methods>
-            <handler>
-                <type>predefined_query_handler</type>
-                <query>SELECT * FROM system.settings</query>
-            </handler>
-        </rule>
-
-        <rule>
-            <url>/play</url>
-            <handler>
-                <type>redirect</type>
-                <location>/play?user=play</location>
-            </handler>
-        </rule>
-
-        <rule>
-            <full_url>regex:http?://[^/]/dashboard</full_url>
-            <handler>
-                <type>redirect</type>
-                <location>/dashboard?user=play</location>
-            </handler>
-        </rule>
-
-        <rule>
-            <handler>
-                <type>static</type>
-                <status>200</status>
-                <content_type>text/plain; charset=UTF-8</content_type>
-                <response_content>config://http_server_default_response</response_content>
-            </handler>
-        </rule>
-    </http_handlers>
-    -->
-
-    <send_crash_reports>
-        <!-- Setting <enabled> to true allows sending crash reports to -->
-        <!-- the ClickHouse core developers team. -->
-        <!-- Doing so at least in pre-production environments is highly appreciated -->
-        <!-- The reports are anonymized -->
-        <enabled>true</enabled>
-        <send_logical_errors>true</send_logical_errors>
-        <endpoint>https://crash.clickhouse.com/</endpoint>
-    </send_crash_reports>
-
-    <!-- Uncomment to disable ClickHouse internal DNS caching. -->
-    <!-- <disable_internal_dns_cache>1</disable_internal_dns_cache> -->
-
-    <!-- You can also configure rocksdb like this: -->
-    <!-- Full list of options:
-         - options:
-           - https://github.com/facebook/rocksdb/blob/4b013dcbed2df84fde3901d7655b9b91c557454d/include/rocksdb/options.h#L1452
-         - column_family_options:
-           - https://github.com/facebook/rocksdb/blob/4b013dcbed2df84fde3901d7655b9b91c557454d/include/rocksdb/options.h#L66
-         - block_based_table_options:
-           - https://github.com/facebook/rocksdb/blob/4b013dcbed2df84fde3901d7655b9b91c557454d/table/block_based/block_based_table_factory.cc#L228
-           - https://github.com/facebook/rocksdb/blob/4b013dcbed2df84fde3901d7655b9b91c557454d/include/rocksdb/table.h#L129
-    -->
-    <!--
-    <rocksdb>
-        <options>
-            <max_background_jobs>8</max_background_jobs>
-            <info_log_level>DEBUG_LEVEL</info_log_level>
-        </options>
-        <column_family_options>
-            <num_levels>2</num_levels>
-        </column_family_options>
-        <block_based_table_options>
-            <block_size>1024</block_size>
-        </block_based_table_options>
-        <tables>
-            <table>
-                <name>TABLE</name>
-                <options>
-                    <max_background_jobs>8</max_background_jobs>
-                </options>
-                <column_family_options>
-                    <num_levels>2</num_levels>
-                </column_family_options>
-                <block_based_table_options>
-                    <block_size>1024</block_size>
-                </block_based_table_options>
-            </table>
-        </tables>
-    </rocksdb>
-    -->
-
-    <!-- <kafka> -->
-        <!-- Global configuration properties -->
-        <!--
-        NOTE: statistics should be consumed, otherwise it creates too many
-              entries in the queue that leads to memory leak and slow shutdown.
-        default value: 0
-        <statistics_interval_ms>3000</statistics_interval_ms>
-        -->
-
-        <!-- Topic configuration properties -->
-        <!--
-        <kafka_topic>
-              <name>football</name>
-              <request_timeout_ms>6000</request_timeout_ms>
-        </kafka_topic>
-        -->
-
-        <!-- Producer configuration -->
-        <!--
-        <producer>
-            <compression_codec>gzip</compression_codec>
-            <kafka_topic>
-                <name>football</name>
-                <request_timeout_ms>6000</request_timeout_ms>
-            </kafka_topic>
-        </producer>
-        -->
-
-        <!-- Consumer configuration -->
-        <!--
-        <consumer>
-            <enable_auto_commit>true</enable_auto_commit>
-        </consumer>
-        -->
-    <!-- </kafka> -->
-
-    <!-- Note: ClickHouse Cloud https://clickhouse.com/cloud provides automatic backups to object storage. -->
-    <backups>
-        <allowed_path>backups</allowed_path>
-
-        <!-- If the BACKUP command fails and this setting is true then the files
-             copied before the failure will be removed automatically.
-        -->
-        <remove_backup_files_after_failure>true</remove_backup_files_after_failure>
-    </backups>
-
-    <!-- This allows to disable exposing addresses in stack traces for security reasons.
-         Please be aware that it does not improve security much, but makes debugging much harder.
-         The addresses that are small offsets from zero will be displayed nevertheless to show nullptr dereferences.
-         Regardless of this configuration, the addresses are visible in the system.stack_trace and system.trace_log tables
-         if the user has access to these tables.
-         I don't recommend to change this setting.
-    <show_addresses_in_stack_traces>false</show_addresses_in_stack_traces>
-    -->
-
-    <!-- On Linux systems this can control the behavior of OOM killer.
-    <oom_score>-1000</oom_score>
-    -->
-
-    <!-- Delay (in seconds) to wait for unfinished queries before force exit -->
-    <!-- <shutdown_wait_unfinished>5</shutdown_wait_unfinished> -->
-
-    <!-- If set true ClickHouse will wait for running queries finish before shutdown. -->
-    <!-- <shutdown_wait_unfinished_queries>false</shutdown_wait_unfinished_queries> -->
-
-    <!-- Disables the checksum of the clickhouse-server binary when performing integrity checks.
-        Not recommended in production environments, but there may be legitimate use-cases, such as
-        when instrumenting ClickHouse via eBPF probes.
-
-    <skip_binary_checksum_checks>false</skip_binary_checksum_checks>
-    -->
-
-    <!-- Tune maximum core file size (RLIMIT_CORE) -->
-    <!--
-    <core_dump>
-        <size_limit></size_limit>
-    </core_dump>
-    -->
-
-    <!-- Tune maximum number of pending signals
-         (You may want to increase it if you see CANNOT_CREATE_TIMER exceptions) -->
-    <!--
-    <pending_signals></pending_signals>
-    -->
-</clickhouse>
diff --git a/deploy.sh b/deploy/deploy.sh
similarity index 100%
rename from deploy.sh
rename to deploy/deploy.sh
diff --git a/deploy/升级部署手册.md b/deploy/升级部署手册.md
new file mode 100644
index 0000000..5484b66
--- /dev/null
+++ b/deploy/升级部署手册.md
@@ -0,0 +1,141 @@
+# CloudWAF 升级部署手册
+
+## I. 管理端 (EdgeAdmin) 升级
+
+本文档介绍如何使用 `deploy.sh` 自动化脚本对 EdgeAdmin 服务进行升级部署。
+
+### 1. 准备工作
+
+在开始升级之前，请确保已满足以下条件：
+
+1.  **文件准备**
+    -   `deploy.sh`: 部署脚本
+    -   `edge-admin-linux-amd64-plus-vX.X.X.zip`: 对应版本的 EdgeAdmin 更新包
+
+2.  **上传文件**
+    将上述两个文件上传到服务器的同一目录下（例如 `/root` 或 `/tmp`）。
+
+3.  **赋予脚本执行权限**
+    在终端中执行命令：
+    ```bash
+    chmod +x deploy.sh
+    ```
+
+### 2. 确认安装路径
+
+脚本默认的安装路径为 `/usr/local/goedge`。如果您的服务安装在其他位置，请按以下方法修改：
+
+**方法 A：修改脚本（推荐）**
+使用文本编辑器（如 vi/nano）打开 `deploy.sh`，修改第 10 行：
+```bash
+# 将默认路径修改为您的实际安装路径
+INSTALL_BASE_DIR="/您实际的/安装路径"
+```
+
+**方法 B：使用环境变量（临时）**
+在执行脚本时指定环境变量：
+```bash
+export BRAND_INSTALL_PATH="/您实际的/安装路径"
+```
+
+### 3. 执行升级
+
+使用 root 用户或 sudo 执行脚本，参数为更新包的路径。
+
+#### 3.1 运行命令
+```bash
+# 示例：更新当前目录下的 zip 包
+sudo ./deploy.sh ./edge-admin-linux-amd64-plus-v1.3.8.zip
+```
+
+#### 3.2 确认升级
+脚本运行后会显示升级信息预览，请检查路径是否正确：
+```text
+CloudWAF 部署脚本 - Gname DNS 提供商更新
+==========================================
+
+部署配置:
+  ZIP 文件: ...
+  目标目录: /usr/local/goedge/edge-admin
+  备份目录: /usr/local/goedge/backup_20240215_120000
+
+确认开始部署? (y/N): 
+```
+输入 `y` 并回车确认。
+
+### 4. 升级过程说明
+
+脚本会自动执行以下步骤：
+1.  **备份**：将当前的配置 (`configs/`) 和数据备份到 `backup_YYYYMMDD_HHMMSS` 目录。
+2.  **停止服务**：停止正在运行的 `edge-admin` 进程。
+3.  **解压**：解压新的安装包到临时目录。
+4.  **替换**：
+    -   覆盖 `bin/edge-admin` 可执行文件。
+    -   覆盖 `web/` 前端文件（保留 `web/tmp`）。
+    -   覆盖 `edge-api/` 相关文件（如果存在）。
+5.  **恢复配置**：将备份的 `configs/api_admin.yaml` 等配置文件恢复到新目录，**确保原有配置不丢**。
+6.  **启动服务**：重新启动 `edge-admin` 服务。
+
+### 5. 验证与故障排查
+
+升级完成后，请进行以下检查：
+-   **检查进程**：`ps aux | grep edge-admin`
+-   **查看日志**：`tail -f /安装路径/edge-admin/logs/run.log`
+-   **登录验证**：使用浏览器访问管理后台，确认升级成功。
+
+---
+
+## II. 用户端 (EdgeUser) 升级
+
+EdgeUser (用户控制台) 尚未提供自动化脚本，请按照以下步骤手动升级。
+
+### ⚠️ 重要提示：关于自定义样式
+如果您修改过 `web/` 目录下的 HTML/CSS (例如登录页)，请务必在升级前**手动备份这些文件**。
+升级过程中的 `web` 目录覆盖会导致您的自定义修改丢失。
+
+### 1. 备份 (Backup)
+```bash
+# 假设安装目录在 /opt/edge-user
+cp -r /opt/edge-user /opt/edge-user-backup-$(date +%Y%m%d)
+```
+*关键文件是 `configs/api_user.yaml`，这是连接 API 的凭证，**千万不要丢失**。*
+
+### 2. 上传与准备 (Prepare)
+将 `edge-user-linux-amd64-plus-vX.X.X.zip` 上传到服务器并解压到临时目录。
+```bash
+unzip edge-user-linux-amd64-plus-v1.3.8.zip -d /tmp/edge-user-update
+```
+
+### 3. 停止服务 (Stop)
+```bash
+/opt/edge-user/bin/edge-user stop
+```
+
+### 4. 替换文件 (Replace)
+
+执行以下命令替换程序文件：
+
+```bash
+# 1. 替换二进制文件
+cp -f /tmp/edge-user-update/edge-user/bin/edge-user /opt/edge-user/bin/
+
+# 2. 替换前端资源 (Web)
+# [警告] 此操作会重置所有页面样式
+cp -rf /tmp/edge-user-update/edge-user/web /opt/edge-user/
+
+# 3. 恢复自定义样式 (如果有备份)
+# cp /备份路径/login/index.html /opt/edge-user/web/views/@default/login/
+```
+
+**注意：不要覆盖 `configs` 目录，以保留您的 `api_user.yaml` 配置。**
+
+### 5. 重启服务 (Start)
+```bash
+/opt/edge-user/bin/edge-user start
+```
+
+### 6. 验证 (Verify)
+查看日志确定启动成功，并访问用户平台页面。
+```bash
+tail -f /opt/edge-user/logs/run.log
+```