From 18bf17fe14141d581e52b7b59ad38d6cbeebf9b2 Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Mon, 26 Aug 2024 18:08:01 +0800
Subject: [PATCH 1/2] Refine cover image display for attachment list

---
 api-docs/openapi/v3_0/aggregated.json         | 843 +++++++++++++++++-
 .../v3_0/apis_console.api_v1alpha1.json       |   6 +
 .../v3_0/apis_extension.api_v1alpha1.json     | 801 ++++++++++++++++-
 .../openapi/v3_0/apis_uc.api_v1alpha1.json    |   6 +
 .../contents/attachments/AttachmentList.vue   |   5 +-
 .../components/AttachmentDetailModal.vue      |   5 +-
 .../CoreSelectorProvider.vue                  |  11 +-
 .../api-client/src/.openapi-generator/FILES   |  10 +
 ui/packages/api-client/src/api.ts             |   3 +
 .../src/api/local-thumbnail-v1alpha1-api.ts   | 665 ++++++++++++++
 .../src/api/thumbnail-v1alpha1-api.ts         | 665 ++++++++++++++
 .../src/api/thumbnail-v1alpha1-public-api.ts  | 165 ++++
 .../src/models/attachment-status.ts           |   6 +
 ui/packages/api-client/src/models/index.ts    |   7 +
 .../src/models/local-thumbnail-list.ts        |  81 ++
 .../src/models/local-thumbnail-spec.ts        |  70 ++
 .../src/models/local-thumbnail-status.ts      |  39 +
 .../api-client/src/models/local-thumbnail.ts  |  63 ++
 .../api-client/src/models/thumbnail-list.ts   |  81 ++
 .../api-client/src/models/thumbnail-spec.ts   |  58 ++
 .../api-client/src/models/thumbnail.ts        |  54 ++
 21 files changed, 3570 insertions(+), 74 deletions(-)
 create mode 100644 ui/packages/api-client/src/api/local-thumbnail-v1alpha1-api.ts
 create mode 100644 ui/packages/api-client/src/api/thumbnail-v1alpha1-api.ts
 create mode 100644 ui/packages/api-client/src/api/thumbnail-v1alpha1-public-api.ts
 create mode 100644 ui/packages/api-client/src/models/local-thumbnail-list.ts
 create mode 100644 ui/packages/api-client/src/models/local-thumbnail-spec.ts
 create mode 100644 ui/packages/api-client/src/models/local-thumbnail-status.ts
 create mode 100644 ui/packages/api-client/src/models/local-thumbnail.ts
 create mode 100644 ui/packages/api-client/src/models/thumbnail-list.ts
 create mode 100644 ui/packages/api-client/src/models/thumbnail-spec.ts
 create mode 100644 ui/packages/api-client/src/models/thumbnail.ts

diff --git a/api-docs/openapi/v3_0/aggregated.json b/api-docs/openapi/v3_0/aggregated.json
index 5a6dd3ca99..b491544c22 100644
--- a/api-docs/openapi/v3_0/aggregated.json
+++ b/api-docs/openapi/v3_0/aggregated.json
@@ -6918,6 +6918,48 @@
         ]
       }
     },
+    "/apis/api.storage.halo.run/v1alpha1/thumbnails/-/via-uri": {
+      "get": {
+        "description": "Get thumbnail by URI",
+        "operationId": "GetThumbnailByUri",
+        "parameters": [
+          {
+            "description": "The URI of the image",
+            "in": "query",
+            "name": "uri",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "description": "The width of the thumbnail",
+            "in": "query",
+            "name": "width",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "default": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "type": "string",
+                  "format": "binary"
+                }
+              }
+            },
+            "description": "default response"
+          }
+        },
+        "tags": [
+          "ThumbnailV1alpha1Public"
+        ]
+      }
+    },
     "/apis/auth.halo.run/v1alpha1/authproviders": {
       "get": {
         "description": "List AuthProvider",
@@ -13415,6 +13457,243 @@
         ]
       }
     },
+    "/apis/storage.halo.run/v1alpha1/localthumbnails": {
+      "get": {
+        "description": "List LocalThumbnail",
+        "operationId": "listLocalThumbnail",
+        "parameters": [
+          {
+            "description": "Page number. Default is 0.",
+            "in": "query",
+            "name": "page",
+            "schema": {
+              "type": "integer",
+              "format": "int32"
+            }
+          },
+          {
+            "description": "Size number. Default is 0.",
+            "in": "query",
+            "name": "size",
+            "schema": {
+              "type": "integer",
+              "format": "int32"
+            }
+          },
+          {
+            "description": "Label selector. e.g.: hidden!\u003dtrue",
+            "in": "query",
+            "name": "labelSelector",
+            "schema": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          },
+          {
+            "description": "Field selector. e.g.: metadata.name\u003d\u003dhalo",
+            "in": "query",
+            "name": "fieldSelector",
+            "schema": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          },
+          {
+            "description": "Sorting criteria in the format: property,(asc|desc). Default sort order is ascending. Multiple sort criteria are supported.",
+            "in": "query",
+            "name": "sort",
+            "schema": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/LocalThumbnailList"
+                }
+              }
+            },
+            "description": "Response localthumbnails"
+          }
+        },
+        "tags": [
+          "LocalThumbnailV1alpha1"
+        ]
+      },
+      "post": {
+        "description": "Create LocalThumbnail",
+        "operationId": "createLocalThumbnail",
+        "requestBody": {
+          "content": {
+            "*/*": {
+              "schema": {
+                "$ref": "#/components/schemas/LocalThumbnail"
+              }
+            }
+          },
+          "description": "Fresh localthumbnail"
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/LocalThumbnail"
+                }
+              }
+            },
+            "description": "Response localthumbnails created just now"
+          }
+        },
+        "tags": [
+          "LocalThumbnailV1alpha1"
+        ]
+      }
+    },
+    "/apis/storage.halo.run/v1alpha1/localthumbnails/{name}": {
+      "delete": {
+        "description": "Delete LocalThumbnail",
+        "operationId": "deleteLocalThumbnail",
+        "parameters": [
+          {
+            "description": "Name of localthumbnail",
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Response localthumbnail deleted just now"
+          }
+        },
+        "tags": [
+          "LocalThumbnailV1alpha1"
+        ]
+      },
+      "get": {
+        "description": "Get LocalThumbnail",
+        "operationId": "getLocalThumbnail",
+        "parameters": [
+          {
+            "description": "Name of localthumbnail",
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/LocalThumbnail"
+                }
+              }
+            },
+            "description": "Response single localthumbnail"
+          }
+        },
+        "tags": [
+          "LocalThumbnailV1alpha1"
+        ]
+      },
+      "patch": {
+        "description": "Patch LocalThumbnail",
+        "operationId": "patchLocalThumbnail",
+        "parameters": [
+          {
+            "description": "Name of localthumbnail",
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json-patch+json": {
+              "schema": {
+                "$ref": "#/components/schemas/JsonPatch"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/LocalThumbnail"
+                }
+              }
+            },
+            "description": "Response localthumbnail patched just now"
+          }
+        },
+        "tags": [
+          "LocalThumbnailV1alpha1"
+        ]
+      },
+      "put": {
+        "description": "Update LocalThumbnail",
+        "operationId": "updateLocalThumbnail",
+        "parameters": [
+          {
+            "description": "Name of localthumbnail",
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "*/*": {
+              "schema": {
+                "$ref": "#/components/schemas/LocalThumbnail"
+              }
+            }
+          },
+          "description": "Updated localthumbnail"
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/LocalThumbnail"
+                }
+              }
+            },
+            "description": "Response localthumbnails updated just now"
+          }
+        },
+        "tags": [
+          "LocalThumbnailV1alpha1"
+        ]
+      }
+    },
     "/apis/storage.halo.run/v1alpha1/policies": {
       "get": {
         "description": "List Policy",
@@ -13722,46 +14001,283 @@
           }
         },
         "tags": [
-          "PolicyTemplateV1alpha1"
+          "PolicyTemplateV1alpha1"
+        ]
+      },
+      "post": {
+        "description": "Create PolicyTemplate",
+        "operationId": "createPolicyTemplate",
+        "requestBody": {
+          "content": {
+            "*/*": {
+              "schema": {
+                "$ref": "#/components/schemas/PolicyTemplate"
+              }
+            }
+          },
+          "description": "Fresh policytemplate"
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/PolicyTemplate"
+                }
+              }
+            },
+            "description": "Response policytemplates created just now"
+          }
+        },
+        "tags": [
+          "PolicyTemplateV1alpha1"
+        ]
+      }
+    },
+    "/apis/storage.halo.run/v1alpha1/policytemplates/{name}": {
+      "delete": {
+        "description": "Delete PolicyTemplate",
+        "operationId": "deletePolicyTemplate",
+        "parameters": [
+          {
+            "description": "Name of policytemplate",
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Response policytemplate deleted just now"
+          }
+        },
+        "tags": [
+          "PolicyTemplateV1alpha1"
+        ]
+      },
+      "get": {
+        "description": "Get PolicyTemplate",
+        "operationId": "getPolicyTemplate",
+        "parameters": [
+          {
+            "description": "Name of policytemplate",
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/PolicyTemplate"
+                }
+              }
+            },
+            "description": "Response single policytemplate"
+          }
+        },
+        "tags": [
+          "PolicyTemplateV1alpha1"
+        ]
+      },
+      "patch": {
+        "description": "Patch PolicyTemplate",
+        "operationId": "patchPolicyTemplate",
+        "parameters": [
+          {
+            "description": "Name of policytemplate",
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json-patch+json": {
+              "schema": {
+                "$ref": "#/components/schemas/JsonPatch"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/PolicyTemplate"
+                }
+              }
+            },
+            "description": "Response policytemplate patched just now"
+          }
+        },
+        "tags": [
+          "PolicyTemplateV1alpha1"
+        ]
+      },
+      "put": {
+        "description": "Update PolicyTemplate",
+        "operationId": "updatePolicyTemplate",
+        "parameters": [
+          {
+            "description": "Name of policytemplate",
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "*/*": {
+              "schema": {
+                "$ref": "#/components/schemas/PolicyTemplate"
+              }
+            }
+          },
+          "description": "Updated policytemplate"
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/PolicyTemplate"
+                }
+              }
+            },
+            "description": "Response policytemplates updated just now"
+          }
+        },
+        "tags": [
+          "PolicyTemplateV1alpha1"
+        ]
+      }
+    },
+    "/apis/storage.halo.run/v1alpha1/thumbnails": {
+      "get": {
+        "description": "List Thumbnail",
+        "operationId": "listThumbnail",
+        "parameters": [
+          {
+            "description": "Page number. Default is 0.",
+            "in": "query",
+            "name": "page",
+            "schema": {
+              "type": "integer",
+              "format": "int32"
+            }
+          },
+          {
+            "description": "Size number. Default is 0.",
+            "in": "query",
+            "name": "size",
+            "schema": {
+              "type": "integer",
+              "format": "int32"
+            }
+          },
+          {
+            "description": "Label selector. e.g.: hidden!\u003dtrue",
+            "in": "query",
+            "name": "labelSelector",
+            "schema": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          },
+          {
+            "description": "Field selector. e.g.: metadata.name\u003d\u003dhalo",
+            "in": "query",
+            "name": "fieldSelector",
+            "schema": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          },
+          {
+            "description": "Sorting criteria in the format: property,(asc|desc). Default sort order is ascending. Multiple sort criteria are supported.",
+            "in": "query",
+            "name": "sort",
+            "schema": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/ThumbnailList"
+                }
+              }
+            },
+            "description": "Response thumbnails"
+          }
+        },
+        "tags": [
+          "ThumbnailV1alpha1"
         ]
       },
       "post": {
-        "description": "Create PolicyTemplate",
-        "operationId": "createPolicyTemplate",
+        "description": "Create Thumbnail",
+        "operationId": "createThumbnail",
         "requestBody": {
           "content": {
             "*/*": {
               "schema": {
-                "$ref": "#/components/schemas/PolicyTemplate"
+                "$ref": "#/components/schemas/Thumbnail"
               }
             }
           },
-          "description": "Fresh policytemplate"
+          "description": "Fresh thumbnail"
         },
         "responses": {
           "200": {
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/PolicyTemplate"
+                  "$ref": "#/components/schemas/Thumbnail"
                 }
               }
             },
-            "description": "Response policytemplates created just now"
+            "description": "Response thumbnails created just now"
           }
         },
         "tags": [
-          "PolicyTemplateV1alpha1"
+          "ThumbnailV1alpha1"
         ]
       }
     },
-    "/apis/storage.halo.run/v1alpha1/policytemplates/{name}": {
+    "/apis/storage.halo.run/v1alpha1/thumbnails/{name}": {
       "delete": {
-        "description": "Delete PolicyTemplate",
-        "operationId": "deletePolicyTemplate",
+        "description": "Delete Thumbnail",
+        "operationId": "deleteThumbnail",
         "parameters": [
           {
-            "description": "Name of policytemplate",
+            "description": "Name of thumbnail",
             "in": "path",
             "name": "name",
             "required": true,
@@ -13772,19 +14288,19 @@
         ],
         "responses": {
           "200": {
-            "description": "Response policytemplate deleted just now"
+            "description": "Response thumbnail deleted just now"
           }
         },
         "tags": [
-          "PolicyTemplateV1alpha1"
+          "ThumbnailV1alpha1"
         ]
       },
       "get": {
-        "description": "Get PolicyTemplate",
-        "operationId": "getPolicyTemplate",
+        "description": "Get Thumbnail",
+        "operationId": "getThumbnail",
         "parameters": [
           {
-            "description": "Name of policytemplate",
+            "description": "Name of thumbnail",
             "in": "path",
             "name": "name",
             "required": true,
@@ -13798,23 +14314,23 @@
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/PolicyTemplate"
+                  "$ref": "#/components/schemas/Thumbnail"
                 }
               }
             },
-            "description": "Response single policytemplate"
+            "description": "Response single thumbnail"
           }
         },
         "tags": [
-          "PolicyTemplateV1alpha1"
+          "ThumbnailV1alpha1"
         ]
       },
       "patch": {
-        "description": "Patch PolicyTemplate",
-        "operationId": "patchPolicyTemplate",
+        "description": "Patch Thumbnail",
+        "operationId": "patchThumbnail",
         "parameters": [
           {
-            "description": "Name of policytemplate",
+            "description": "Name of thumbnail",
             "in": "path",
             "name": "name",
             "required": true,
@@ -13837,23 +14353,23 @@
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/PolicyTemplate"
+                  "$ref": "#/components/schemas/Thumbnail"
                 }
               }
             },
-            "description": "Response policytemplate patched just now"
+            "description": "Response thumbnail patched just now"
           }
         },
         "tags": [
-          "PolicyTemplateV1alpha1"
+          "ThumbnailV1alpha1"
         ]
       },
       "put": {
-        "description": "Update PolicyTemplate",
-        "operationId": "updatePolicyTemplate",
+        "description": "Update Thumbnail",
+        "operationId": "updateThumbnail",
         "parameters": [
           {
-            "description": "Name of policytemplate",
+            "description": "Name of thumbnail",
             "in": "path",
             "name": "name",
             "required": true,
@@ -13866,26 +14382,26 @@
           "content": {
             "*/*": {
               "schema": {
-                "$ref": "#/components/schemas/PolicyTemplate"
+                "$ref": "#/components/schemas/Thumbnail"
               }
             }
           },
-          "description": "Updated policytemplate"
+          "description": "Updated thumbnail"
         },
         "responses": {
           "200": {
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/PolicyTemplate"
+                  "$ref": "#/components/schemas/Thumbnail"
                 }
               }
             },
-            "description": "Response policytemplates updated just now"
+            "description": "Response thumbnails updated just now"
           }
         },
         "tags": [
-          "PolicyTemplateV1alpha1"
+          "ThumbnailV1alpha1"
         ]
       }
     },
@@ -15225,6 +15741,12 @@
           "permalink": {
             "type": "string",
             "description": "Permalink of attachment.\nIf it is in local storage, the public URL will be set.\nIf it is in s3 storage, the Object URL will be set.\n"
+          },
+          "thumbnails": {
+            "type": "object",
+            "additionalProperties": {
+              "type": "string"
+            }
           }
         }
       },
@@ -18188,6 +18710,145 @@
         },
         "description": "A chunk of items."
       },
+      "LocalThumbnail": {
+        "required": [
+          "apiVersion",
+          "kind",
+          "metadata",
+          "spec"
+        ],
+        "type": "object",
+        "properties": {
+          "apiVersion": {
+            "type": "string"
+          },
+          "kind": {
+            "type": "string"
+          },
+          "metadata": {
+            "$ref": "#/components/schemas/Metadata"
+          },
+          "spec": {
+            "$ref": "#/components/schemas/LocalThumbnailSpec"
+          },
+          "status": {
+            "$ref": "#/components/schemas/LocalThumbnailStatus"
+          }
+        }
+      },
+      "LocalThumbnailList": {
+        "required": [
+          "first",
+          "hasNext",
+          "hasPrevious",
+          "items",
+          "last",
+          "page",
+          "size",
+          "total",
+          "totalPages"
+        ],
+        "type": "object",
+        "properties": {
+          "first": {
+            "type": "boolean",
+            "description": "Indicates whether current page is the first page."
+          },
+          "hasNext": {
+            "type": "boolean",
+            "description": "Indicates whether current page has previous page."
+          },
+          "hasPrevious": {
+            "type": "boolean",
+            "description": "Indicates whether current page has previous page."
+          },
+          "items": {
+            "type": "array",
+            "description": "A chunk of items.",
+            "items": {
+              "$ref": "#/components/schemas/LocalThumbnail"
+            }
+          },
+          "last": {
+            "type": "boolean",
+            "description": "Indicates whether current page is the last page."
+          },
+          "page": {
+            "type": "integer",
+            "description": "Page number, starts from 1. If not set or equal to 0, it means no pagination.",
+            "format": "int32"
+          },
+          "size": {
+            "type": "integer",
+            "description": "Size of each page. If not set or equal to 0, it means no pagination.",
+            "format": "int32"
+          },
+          "total": {
+            "type": "integer",
+            "description": "Total elements.",
+            "format": "int64"
+          },
+          "totalPages": {
+            "type": "integer",
+            "description": "Indicates total pages.",
+            "format": "int64"
+          }
+        }
+      },
+      "LocalThumbnailSpec": {
+        "required": [
+          "filePath",
+          "imageSignature",
+          "imageUri",
+          "size",
+          "thumbSignature",
+          "thumbnailUri"
+        ],
+        "type": "object",
+        "properties": {
+          "filePath": {
+            "type": "string"
+          },
+          "imageSignature": {
+            "minLength": 1,
+            "type": "string"
+          },
+          "imageUri": {
+            "minLength": 1,
+            "type": "string"
+          },
+          "size": {
+            "type": "string",
+            "enum": [
+              "S",
+              "M",
+              "L",
+              "XL"
+            ]
+          },
+          "thumbSignature": {
+            "minLength": 1,
+            "type": "string"
+          },
+          "thumbnailUri": {
+            "minLength": 1,
+            "type": "string"
+          }
+        }
+      },
+      "LocalThumbnailStatus": {
+        "type": "object",
+        "properties": {
+          "phase": {
+            "type": "string",
+            "enum": [
+              "PENDING",
+              "SUCCEEDED",
+              "FAILED"
+            ]
+          }
+        }
+      },
       "LoginHistory": {
         "required": [
           "loginAt",
@@ -22620,6 +23281,120 @@
           }
         }
       },
+      "Thumbnail": {
+        "required": [
+          "apiVersion",
+          "kind",
+          "metadata",
+          "spec"
+        ],
+        "type": "object",
+        "properties": {
+          "apiVersion": {
+            "type": "string"
+          },
+          "kind": {
+            "type": "string"
+          },
+          "metadata": {
+            "$ref": "#/components/schemas/Metadata"
+          },
+          "spec": {
+            "$ref": "#/components/schemas/ThumbnailSpec"
+          }
+        }
+      },
+      "ThumbnailList": {
+        "required": [
+          "first",
+          "hasNext",
+          "hasPrevious",
+          "items",
+          "last",
+          "page",
+          "size",
+          "total",
+          "totalPages"
+        ],
+        "type": "object",
+        "properties": {
+          "first": {
+            "type": "boolean",
+            "description": "Indicates whether current page is the first page."
+          },
+          "hasNext": {
+            "type": "boolean",
+            "description": "Indicates whether current page has previous page."
+          },
+          "hasPrevious": {
+            "type": "boolean",
+            "description": "Indicates whether current page has previous page."
+          },
+          "items": {
+            "type": "array",
+            "description": "A chunk of items.",
+            "items": {
+              "$ref": "#/components/schemas/Thumbnail"
+            }
+          },
+          "last": {
+            "type": "boolean",
+            "description": "Indicates whether current page is the last page."
+          },
+          "page": {
+            "type": "integer",
+            "description": "Page number, starts from 1. If not set or equal to 0, it means no pagination.",
+            "format": "int32"
+          },
+          "size": {
+            "type": "integer",
+            "description": "Size of each page. If not set or equal to 0, it means no pagination.",
+            "format": "int32"
+          },
+          "total": {
+            "type": "integer",
+            "description": "Total elements.",
+            "format": "int64"
+          },
+          "totalPages": {
+            "type": "integer",
+            "description": "Indicates total pages.",
+            "format": "int64"
+          }
+        }
+      },
+      "ThumbnailSpec": {
+        "required": [
+          "imageSignature",
+          "imageUri",
+          "size",
+          "thumbnailUri"
+        ],
+        "type": "object",
+        "properties": {
+          "imageSignature": {
+            "minLength": 1,
+            "type": "string"
+          },
+          "imageUri": {
+            "minLength": 1,
+            "type": "string"
+          },
+          "size": {
+            "type": "string",
+            "enum": [
+              "S",
+              "M",
+              "L",
+              "XL"
+            ]
+          },
+          "thumbnailUri": {
+            "minLength": 1,
+            "type": "string"
+          }
+        }
+      },
       "TotpAuthLinkResponse": {
         "type": "object",
         "properties": {
diff --git a/api-docs/openapi/v3_0/apis_console.api_v1alpha1.json b/api-docs/openapi/v3_0/apis_console.api_v1alpha1.json
index f763704278..8483de34f7 100644
--- a/api-docs/openapi/v3_0/apis_console.api_v1alpha1.json
+++ b/api-docs/openapi/v3_0/apis_console.api_v1alpha1.json
@@ -3393,6 +3393,12 @@
           "permalink": {
             "type": "string",
             "description": "Permalink of attachment.\nIf it is in local storage, the public URL will be set.\nIf it is in s3 storage, the Object URL will be set.\n"
+          },
+          "thumbnails": {
+            "type": "object",
+            "additionalProperties": {
+              "type": "string"
+            }
           }
         }
       },
diff --git a/api-docs/openapi/v3_0/apis_extension.api_v1alpha1.json b/api-docs/openapi/v3_0/apis_extension.api_v1alpha1.json
index 8015200160..92018c3729 100644
--- a/api-docs/openapi/v3_0/apis_extension.api_v1alpha1.json
+++ b/api-docs/openapi/v3_0/apis_extension.api_v1alpha1.json
@@ -7127,6 +7127,243 @@
         ]
       }
     },
+    "/apis/storage.halo.run/v1alpha1/localthumbnails": {
+      "get": {
+        "description": "List LocalThumbnail",
+        "operationId": "listLocalThumbnail",
+        "parameters": [
+          {
+            "description": "Page number. Default is 0.",
+            "in": "query",
+            "name": "page",
+            "schema": {
+              "type": "integer",
+              "format": "int32"
+            }
+          },
+          {
+            "description": "Size number. Default is 0.",
+            "in": "query",
+            "name": "size",
+            "schema": {
+              "type": "integer",
+              "format": "int32"
+            }
+          },
+          {
+            "description": "Label selector. e.g.: hidden!\u003dtrue",
+            "in": "query",
+            "name": "labelSelector",
+            "schema": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          },
+          {
+            "description": "Field selector. e.g.: metadata.name\u003d\u003dhalo",
+            "in": "query",
+            "name": "fieldSelector",
+            "schema": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          },
+          {
+            "description": "Sorting criteria in the format: property,(asc|desc). Default sort order is ascending. Multiple sort criteria are supported.",
+            "in": "query",
+            "name": "sort",
+            "schema": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/LocalThumbnailList"
+                }
+              }
+            },
+            "description": "Response localthumbnails"
+          }
+        },
+        "tags": [
+          "LocalThumbnailV1alpha1"
+        ]
+      },
+      "post": {
+        "description": "Create LocalThumbnail",
+        "operationId": "createLocalThumbnail",
+        "requestBody": {
+          "content": {
+            "*/*": {
+              "schema": {
+                "$ref": "#/components/schemas/LocalThumbnail"
+              }
+            }
+          },
+          "description": "Fresh localthumbnail"
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/LocalThumbnail"
+                }
+              }
+            },
+            "description": "Response localthumbnails created just now"
+          }
+        },
+        "tags": [
+          "LocalThumbnailV1alpha1"
+        ]
+      }
+    },
+    "/apis/storage.halo.run/v1alpha1/localthumbnails/{name}": {
+      "delete": {
+        "description": "Delete LocalThumbnail",
+        "operationId": "deleteLocalThumbnail",
+        "parameters": [
+          {
+            "description": "Name of localthumbnail",
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Response localthumbnail deleted just now"
+          }
+        },
+        "tags": [
+          "LocalThumbnailV1alpha1"
+        ]
+      },
+      "get": {
+        "description": "Get LocalThumbnail",
+        "operationId": "getLocalThumbnail",
+        "parameters": [
+          {
+            "description": "Name of localthumbnail",
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/LocalThumbnail"
+                }
+              }
+            },
+            "description": "Response single localthumbnail"
+          }
+        },
+        "tags": [
+          "LocalThumbnailV1alpha1"
+        ]
+      },
+      "patch": {
+        "description": "Patch LocalThumbnail",
+        "operationId": "patchLocalThumbnail",
+        "parameters": [
+          {
+            "description": "Name of localthumbnail",
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json-patch+json": {
+              "schema": {
+                "$ref": "#/components/schemas/JsonPatch"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/LocalThumbnail"
+                }
+              }
+            },
+            "description": "Response localthumbnail patched just now"
+          }
+        },
+        "tags": [
+          "LocalThumbnailV1alpha1"
+        ]
+      },
+      "put": {
+        "description": "Update LocalThumbnail",
+        "operationId": "updateLocalThumbnail",
+        "parameters": [
+          {
+            "description": "Name of localthumbnail",
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "*/*": {
+              "schema": {
+                "$ref": "#/components/schemas/LocalThumbnail"
+              }
+            }
+          },
+          "description": "Updated localthumbnail"
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/LocalThumbnail"
+                }
+              }
+            },
+            "description": "Response localthumbnails updated just now"
+          }
+        },
+        "tags": [
+          "LocalThumbnailV1alpha1"
+        ]
+      }
+    },
     "/apis/storage.halo.run/v1alpha1/policies": {
       "get": {
         "description": "List Policy",
@@ -7434,46 +7671,283 @@
           }
         },
         "tags": [
-          "PolicyTemplateV1alpha1"
+          "PolicyTemplateV1alpha1"
+        ]
+      },
+      "post": {
+        "description": "Create PolicyTemplate",
+        "operationId": "createPolicyTemplate",
+        "requestBody": {
+          "content": {
+            "*/*": {
+              "schema": {
+                "$ref": "#/components/schemas/PolicyTemplate"
+              }
+            }
+          },
+          "description": "Fresh policytemplate"
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/PolicyTemplate"
+                }
+              }
+            },
+            "description": "Response policytemplates created just now"
+          }
+        },
+        "tags": [
+          "PolicyTemplateV1alpha1"
+        ]
+      }
+    },
+    "/apis/storage.halo.run/v1alpha1/policytemplates/{name}": {
+      "delete": {
+        "description": "Delete PolicyTemplate",
+        "operationId": "deletePolicyTemplate",
+        "parameters": [
+          {
+            "description": "Name of policytemplate",
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Response policytemplate deleted just now"
+          }
+        },
+        "tags": [
+          "PolicyTemplateV1alpha1"
+        ]
+      },
+      "get": {
+        "description": "Get PolicyTemplate",
+        "operationId": "getPolicyTemplate",
+        "parameters": [
+          {
+            "description": "Name of policytemplate",
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/PolicyTemplate"
+                }
+              }
+            },
+            "description": "Response single policytemplate"
+          }
+        },
+        "tags": [
+          "PolicyTemplateV1alpha1"
+        ]
+      },
+      "patch": {
+        "description": "Patch PolicyTemplate",
+        "operationId": "patchPolicyTemplate",
+        "parameters": [
+          {
+            "description": "Name of policytemplate",
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json-patch+json": {
+              "schema": {
+                "$ref": "#/components/schemas/JsonPatch"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/PolicyTemplate"
+                }
+              }
+            },
+            "description": "Response policytemplate patched just now"
+          }
+        },
+        "tags": [
+          "PolicyTemplateV1alpha1"
+        ]
+      },
+      "put": {
+        "description": "Update PolicyTemplate",
+        "operationId": "updatePolicyTemplate",
+        "parameters": [
+          {
+            "description": "Name of policytemplate",
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "*/*": {
+              "schema": {
+                "$ref": "#/components/schemas/PolicyTemplate"
+              }
+            }
+          },
+          "description": "Updated policytemplate"
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/PolicyTemplate"
+                }
+              }
+            },
+            "description": "Response policytemplates updated just now"
+          }
+        },
+        "tags": [
+          "PolicyTemplateV1alpha1"
+        ]
+      }
+    },
+    "/apis/storage.halo.run/v1alpha1/thumbnails": {
+      "get": {
+        "description": "List Thumbnail",
+        "operationId": "listThumbnail",
+        "parameters": [
+          {
+            "description": "Page number. Default is 0.",
+            "in": "query",
+            "name": "page",
+            "schema": {
+              "type": "integer",
+              "format": "int32"
+            }
+          },
+          {
+            "description": "Size number. Default is 0.",
+            "in": "query",
+            "name": "size",
+            "schema": {
+              "type": "integer",
+              "format": "int32"
+            }
+          },
+          {
+            "description": "Label selector. e.g.: hidden!\u003dtrue",
+            "in": "query",
+            "name": "labelSelector",
+            "schema": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          },
+          {
+            "description": "Field selector. e.g.: metadata.name\u003d\u003dhalo",
+            "in": "query",
+            "name": "fieldSelector",
+            "schema": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          },
+          {
+            "description": "Sorting criteria in the format: property,(asc|desc). Default sort order is ascending. Multiple sort criteria are supported.",
+            "in": "query",
+            "name": "sort",
+            "schema": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/ThumbnailList"
+                }
+              }
+            },
+            "description": "Response thumbnails"
+          }
+        },
+        "tags": [
+          "ThumbnailV1alpha1"
         ]
       },
       "post": {
-        "description": "Create PolicyTemplate",
-        "operationId": "createPolicyTemplate",
+        "description": "Create Thumbnail",
+        "operationId": "createThumbnail",
         "requestBody": {
           "content": {
             "*/*": {
               "schema": {
-                "$ref": "#/components/schemas/PolicyTemplate"
+                "$ref": "#/components/schemas/Thumbnail"
               }
             }
           },
-          "description": "Fresh policytemplate"
+          "description": "Fresh thumbnail"
         },
         "responses": {
           "200": {
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/PolicyTemplate"
+                  "$ref": "#/components/schemas/Thumbnail"
                 }
               }
             },
-            "description": "Response policytemplates created just now"
+            "description": "Response thumbnails created just now"
           }
         },
         "tags": [
-          "PolicyTemplateV1alpha1"
+          "ThumbnailV1alpha1"
         ]
       }
     },
-    "/apis/storage.halo.run/v1alpha1/policytemplates/{name}": {
+    "/apis/storage.halo.run/v1alpha1/thumbnails/{name}": {
       "delete": {
-        "description": "Delete PolicyTemplate",
-        "operationId": "deletePolicyTemplate",
+        "description": "Delete Thumbnail",
+        "operationId": "deleteThumbnail",
         "parameters": [
           {
-            "description": "Name of policytemplate",
+            "description": "Name of thumbnail",
             "in": "path",
             "name": "name",
             "required": true,
@@ -7484,19 +7958,19 @@
         ],
         "responses": {
           "200": {
-            "description": "Response policytemplate deleted just now"
+            "description": "Response thumbnail deleted just now"
           }
         },
         "tags": [
-          "PolicyTemplateV1alpha1"
+          "ThumbnailV1alpha1"
         ]
       },
       "get": {
-        "description": "Get PolicyTemplate",
-        "operationId": "getPolicyTemplate",
+        "description": "Get Thumbnail",
+        "operationId": "getThumbnail",
         "parameters": [
           {
-            "description": "Name of policytemplate",
+            "description": "Name of thumbnail",
             "in": "path",
             "name": "name",
             "required": true,
@@ -7510,23 +7984,23 @@
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/PolicyTemplate"
+                  "$ref": "#/components/schemas/Thumbnail"
                 }
               }
             },
-            "description": "Response single policytemplate"
+            "description": "Response single thumbnail"
           }
         },
         "tags": [
-          "PolicyTemplateV1alpha1"
+          "ThumbnailV1alpha1"
         ]
       },
       "patch": {
-        "description": "Patch PolicyTemplate",
-        "operationId": "patchPolicyTemplate",
+        "description": "Patch Thumbnail",
+        "operationId": "patchThumbnail",
         "parameters": [
           {
-            "description": "Name of policytemplate",
+            "description": "Name of thumbnail",
             "in": "path",
             "name": "name",
             "required": true,
@@ -7549,23 +8023,23 @@
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/PolicyTemplate"
+                  "$ref": "#/components/schemas/Thumbnail"
                 }
               }
             },
-            "description": "Response policytemplate patched just now"
+            "description": "Response thumbnail patched just now"
           }
         },
         "tags": [
-          "PolicyTemplateV1alpha1"
+          "ThumbnailV1alpha1"
         ]
       },
       "put": {
-        "description": "Update PolicyTemplate",
-        "operationId": "updatePolicyTemplate",
+        "description": "Update Thumbnail",
+        "operationId": "updateThumbnail",
         "parameters": [
           {
-            "description": "Name of policytemplate",
+            "description": "Name of thumbnail",
             "in": "path",
             "name": "name",
             "required": true,
@@ -7578,26 +8052,26 @@
           "content": {
             "*/*": {
               "schema": {
-                "$ref": "#/components/schemas/PolicyTemplate"
+                "$ref": "#/components/schemas/Thumbnail"
               }
             }
           },
-          "description": "Updated policytemplate"
+          "description": "Updated thumbnail"
         },
         "responses": {
           "200": {
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/PolicyTemplate"
+                  "$ref": "#/components/schemas/Thumbnail"
                 }
               }
             },
-            "description": "Response policytemplates updated just now"
+            "description": "Response thumbnails updated just now"
           }
         },
         "tags": [
-          "PolicyTemplateV1alpha1"
+          "ThumbnailV1alpha1"
         ]
       }
     },
@@ -8099,6 +8573,12 @@
           "permalink": {
             "type": "string",
             "description": "Permalink of attachment.\nIf it is in local storage, the public URL will be set.\nIf it is in s3 storage, the Object URL will be set.\n"
+          },
+          "thumbnails": {
+            "type": "object",
+            "additionalProperties": {
+              "type": "string"
+            }
           }
         }
       },
@@ -9556,6 +10036,145 @@
           }
         }
       },
+      "LocalThumbnail": {
+        "required": [
+          "apiVersion",
+          "kind",
+          "metadata",
+          "spec"
+        ],
+        "type": "object",
+        "properties": {
+          "apiVersion": {
+            "type": "string"
+          },
+          "kind": {
+            "type": "string"
+          },
+          "metadata": {
+            "$ref": "#/components/schemas/Metadata"
+          },
+          "spec": {
+            "$ref": "#/components/schemas/LocalThumbnailSpec"
+          },
+          "status": {
+            "$ref": "#/components/schemas/LocalThumbnailStatus"
+          }
+        }
+      },
+      "LocalThumbnailList": {
+        "required": [
+          "first",
+          "hasNext",
+          "hasPrevious",
+          "items",
+          "last",
+          "page",
+          "size",
+          "total",
+          "totalPages"
+        ],
+        "type": "object",
+        "properties": {
+          "first": {
+            "type": "boolean",
+            "description": "Indicates whether current page is the first page."
+          },
+          "hasNext": {
+            "type": "boolean",
+            "description": "Indicates whether current page has previous page."
+          },
+          "hasPrevious": {
+            "type": "boolean",
+            "description": "Indicates whether current page has previous page."
+          },
+          "items": {
+            "type": "array",
+            "description": "A chunk of items.",
+            "items": {
+              "$ref": "#/components/schemas/LocalThumbnail"
+            }
+          },
+          "last": {
+            "type": "boolean",
+            "description": "Indicates whether current page is the last page."
+          },
+          "page": {
+            "type": "integer",
+            "description": "Page number, starts from 1. If not set or equal to 0, it means no pagination.",
+            "format": "int32"
+          },
+          "size": {
+            "type": "integer",
+            "description": "Size of each page. If not set or equal to 0, it means no pagination.",
+            "format": "int32"
+          },
+          "total": {
+            "type": "integer",
+            "description": "Total elements.",
+            "format": "int64"
+          },
+          "totalPages": {
+            "type": "integer",
+            "description": "Indicates total pages.",
+            "format": "int64"
+          }
+        }
+      },
+      "LocalThumbnailSpec": {
+        "required": [
+          "filePath",
+          "imageSignature",
+          "imageUri",
+          "size",
+          "thumbSignature",
+          "thumbnailUri"
+        ],
+        "type": "object",
+        "properties": {
+          "filePath": {
+            "type": "string"
+          },
+          "imageSignature": {
+            "minLength": 1,
+            "type": "string"
+          },
+          "imageUri": {
+            "minLength": 1,
+            "type": "string"
+          },
+          "size": {
+            "type": "string",
+            "enum": [
+              "S",
+              "M",
+              "L",
+              "XL"
+            ]
+          },
+          "thumbSignature": {
+            "minLength": 1,
+            "type": "string"
+          },
+          "thumbnailUri": {
+            "minLength": 1,
+            "type": "string"
+          }
+        }
+      },
+      "LocalThumbnailStatus": {
+        "type": "object",
+        "properties": {
+          "phase": {
+            "type": "string",
+            "enum": [
+              "PENDING",
+              "SUCCEEDED",
+              "FAILED"
+            ]
+          }
+        }
+      },
       "LoginHistory": {
         "required": [
           "loginAt",
@@ -12405,6 +13024,120 @@
           }
         }
       },
+      "Thumbnail": {
+        "required": [
+          "apiVersion",
+          "kind",
+          "metadata",
+          "spec"
+        ],
+        "type": "object",
+        "properties": {
+          "apiVersion": {
+            "type": "string"
+          },
+          "kind": {
+            "type": "string"
+          },
+          "metadata": {
+            "$ref": "#/components/schemas/Metadata"
+          },
+          "spec": {
+            "$ref": "#/components/schemas/ThumbnailSpec"
+          }
+        }
+      },
+      "ThumbnailList": {
+        "required": [
+          "first",
+          "hasNext",
+          "hasPrevious",
+          "items",
+          "last",
+          "page",
+          "size",
+          "total",
+          "totalPages"
+        ],
+        "type": "object",
+        "properties": {
+          "first": {
+            "type": "boolean",
+            "description": "Indicates whether current page is the first page."
+          },
+          "hasNext": {
+            "type": "boolean",
+            "description": "Indicates whether current page has previous page."
+          },
+          "hasPrevious": {
+            "type": "boolean",
+            "description": "Indicates whether current page has previous page."
+          },
+          "items": {
+            "type": "array",
+            "description": "A chunk of items.",
+            "items": {
+              "$ref": "#/components/schemas/Thumbnail"
+            }
+          },
+          "last": {
+            "type": "boolean",
+            "description": "Indicates whether current page is the last page."
+          },
+          "page": {
+            "type": "integer",
+            "description": "Page number, starts from 1. If not set or equal to 0, it means no pagination.",
+            "format": "int32"
+          },
+          "size": {
+            "type": "integer",
+            "description": "Size of each page. If not set or equal to 0, it means no pagination.",
+            "format": "int32"
+          },
+          "total": {
+            "type": "integer",
+            "description": "Total elements.",
+            "format": "int64"
+          },
+          "totalPages": {
+            "type": "integer",
+            "description": "Indicates total pages.",
+            "format": "int64"
+          }
+        }
+      },
+      "ThumbnailSpec": {
+        "required": [
+          "imageSignature",
+          "imageUri",
+          "size",
+          "thumbnailUri"
+        ],
+        "type": "object",
+        "properties": {
+          "imageSignature": {
+            "minLength": 1,
+            "type": "string"
+          },
+          "imageUri": {
+            "minLength": 1,
+            "type": "string"
+          },
+          "size": {
+            "type": "string",
+            "enum": [
+              "S",
+              "M",
+              "L",
+              "XL"
+            ]
+          },
+          "thumbnailUri": {
+            "minLength": 1,
+            "type": "string"
+          }
+        }
+      },
       "User": {
         "required": [
           "apiVersion",
diff --git a/api-docs/openapi/v3_0/apis_uc.api_v1alpha1.json b/api-docs/openapi/v3_0/apis_uc.api_v1alpha1.json
index 61b7a8896b..7b39276dac 100644
--- a/api-docs/openapi/v3_0/apis_uc.api_v1alpha1.json
+++ b/api-docs/openapi/v3_0/apis_uc.api_v1alpha1.json
@@ -934,6 +934,12 @@
           "permalink": {
             "type": "string",
             "description": "Permalink of attachment.\nIf it is in local storage, the public URL will be set.\nIf it is in s3 storage, the Object URL will be set.\n"
+          },
+          "thumbnails": {
+            "type": "object",
+            "additionalProperties": {
+              "type": "string"
+            }
           }
         }
       },
diff --git a/ui/console-src/modules/contents/attachments/AttachmentList.vue b/ui/console-src/modules/contents/attachments/AttachmentList.vue
index 17fe87a414..bb601a7f55 100644
--- a/ui/console-src/modules/contents/attachments/AttachmentList.vue
+++ b/ui/console-src/modules/contents/attachments/AttachmentList.vue
@@ -509,7 +509,10 @@ watch(
                         v-if="isImage(attachment.spec.mediaType)"
                         :key="attachment.metadata.name"
                         :alt="attachment.spec.displayName"
-                        :src="attachment.status?.permalink"
+                        :src="
+                          attachment.status?.thumbnails?.S ||
+                          attachment.status?.permalink
+                        "
                         classes="pointer-events-none object-cover group-hover:opacity-75 transform-gpu"
                       >
                         <template #loading>
diff --git a/ui/console-src/modules/contents/attachments/components/AttachmentDetailModal.vue b/ui/console-src/modules/contents/attachments/components/AttachmentDetailModal.vue
index 2e4e33e543..2111013cb7 100644
--- a/ui/console-src/modules/contents/attachments/components/AttachmentDetailModal.vue
+++ b/ui/console-src/modules/contents/attachments/components/AttachmentDetailModal.vue
@@ -135,7 +135,10 @@ const showDisplayNameForm = ref(false);
               >
                 <LazyImage
                   :alt="attachment?.spec.displayName"
-                  :src="attachment?.status?.permalink"
+                  :src="
+                    attachment?.status?.thumbnails?.M ||
+                    attachment?.status?.permalink
+                  "
                   classes="max-w-full cursor-pointer rounded sm:max-w-[50%]"
                 >
                   <template #loading>
diff --git a/ui/console-src/modules/contents/attachments/components/selector-providers/CoreSelectorProvider.vue b/ui/console-src/modules/contents/attachments/components/selector-providers/CoreSelectorProvider.vue
index 71d05d27c3..aa39d787d3 100644
--- a/ui/console-src/modules/contents/attachments/components/selector-providers/CoreSelectorProvider.vue
+++ b/ui/console-src/modules/contents/attachments/components/selector-providers/CoreSelectorProvider.vue
@@ -60,7 +60,7 @@ const selectedGroup = ref();
 const selectedPolicy = ref();
 const selectedSort = ref();
 const page = ref(1);
-const size = ref(20);
+const size = ref(60);
 
 const {
   attachments,
@@ -293,7 +293,7 @@ const viewType = useLocalStorage("attachment-selector-view-type", "grid");
   <div v-else>
     <Transition v-if="viewType === 'grid'" appear name="fade">
       <div
-        class="mt-2 grid grid-cols-3 gap-x-2 gap-y-3 sm:grid-cols-3 md:grid-cols-5"
+        class="mt-2 grid grid-cols-3 gap-x-2 gap-y-3 sm:grid-cols-3 md:grid-cols-6 xl:grid-cols-8 2xl:grid-cols-10"
         role="list"
       >
         <VCard
@@ -316,7 +316,10 @@ const viewType = useLocalStorage("attachment-selector-view-type", "grid");
                 v-if="isImage(attachment.spec.mediaType)"
                 :key="attachment.metadata.name"
                 :alt="attachment.spec.displayName"
-                :src="attachment.status?.permalink"
+                :src="
+                  attachment.status?.thumbnails?.S ||
+                  attachment.status?.permalink
+                "
                 classes="pointer-events-none object-cover group-hover:opacity-75 transform-gpu"
               >
                 <template #loading>
@@ -404,7 +407,7 @@ const viewType = useLocalStorage("attachment-selector-view-type", "grid");
         $t('core.components.pagination.total_label', { total: total })
       "
       :total="total"
-      :size-options="[20, 50, 100]"
+      :size-options="[60, 120, 200]"
     />
   </div>
   <AttachmentUploadModal v-if="uploadVisible" @close="onUploadModalClose" />
diff --git a/ui/packages/api-client/src/.openapi-generator/FILES b/ui/packages/api-client/src/.openapi-generator/FILES
index 33560cd3d0..0a78264347 100644
--- a/ui/packages/api-client/src/.openapi-generator/FILES
+++ b/ui/packages/api-client/src/.openapi-generator/FILES
@@ -24,6 +24,7 @@ api/extension-point-definition-v1alpha1-api.ts
 api/group-v1alpha1-api.ts
 api/index-v1alpha1-public-api.ts
 api/indices-v1alpha1-console-api.ts
+api/local-thumbnail-v1alpha1-api.ts
 api/login-api.ts
 api/menu-item-v1alpha1-api.ts
 api/menu-v1alpha1-api.ts
@@ -71,6 +72,8 @@ api/tag-v1alpha1-console-api.ts
 api/tag-v1alpha1-public-api.ts
 api/theme-v1alpha1-api.ts
 api/theme-v1alpha1-console-api.ts
+api/thumbnail-v1alpha1-api.ts
+api/thumbnail-v1alpha1-public-api.ts
 api/two-factor-auth-v1alpha1-uc-api.ts
 api/user-connection-v1alpha1-api.ts
 api/user-v1alpha1-api.ts
@@ -182,6 +185,10 @@ models/listed-single-page.ts
 models/listed-snapshot-dto.ts
 models/listed-snapshot-spec.ts
 models/listed-user.ts
+models/local-thumbnail-list.ts
+models/local-thumbnail-spec.ts
+models/local-thumbnail-status.ts
+models/local-thumbnail.ts
 models/login-history.ts
 models/mark-specified-request.ts
 models/menu-item-list.ts
@@ -316,6 +323,9 @@ models/theme-list.ts
 models/theme-spec.ts
 models/theme-status.ts
 models/theme.ts
+models/thumbnail-list.ts
+models/thumbnail-spec.ts
+models/thumbnail.ts
 models/totp-auth-link-response.ts
 models/totp-request.ts
 models/two-factor-auth-settings.ts
diff --git a/ui/packages/api-client/src/api.ts b/ui/packages/api-client/src/api.ts
index 14eef95131..677cc9efd8 100644
--- a/ui/packages/api-client/src/api.ts
+++ b/ui/packages/api-client/src/api.ts
@@ -36,6 +36,7 @@ export * from './api/extension-point-definition-v1alpha1-api';
 export * from './api/group-v1alpha1-api';
 export * from './api/index-v1alpha1-public-api';
 export * from './api/indices-v1alpha1-console-api';
+export * from './api/local-thumbnail-v1alpha1-api';
 export * from './api/login-api';
 export * from './api/menu-item-v1alpha1-api';
 export * from './api/menu-v1alpha1-api';
@@ -83,6 +84,8 @@ export * from './api/tag-v1alpha1-console-api';
 export * from './api/tag-v1alpha1-public-api';
 export * from './api/theme-v1alpha1-api';
 export * from './api/theme-v1alpha1-console-api';
+export * from './api/thumbnail-v1alpha1-api';
+export * from './api/thumbnail-v1alpha1-public-api';
 export * from './api/two-factor-auth-v1alpha1-uc-api';
 export * from './api/user-connection-v1alpha1-api';
 export * from './api/user-v1alpha1-api';
diff --git a/ui/packages/api-client/src/api/local-thumbnail-v1alpha1-api.ts b/ui/packages/api-client/src/api/local-thumbnail-v1alpha1-api.ts
new file mode 100644
index 0000000000..46291201f7
--- /dev/null
+++ b/ui/packages/api-client/src/api/local-thumbnail-v1alpha1-api.ts
@@ -0,0 +1,665 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * Halo
+ * No description provided (generated by Openapi Generator https://github.com/openapitools/openapi-generator)
+ *
+ * The version of the OpenAPI document: 2.19.0-SNAPSHOT
+ * 
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+
+import type { Configuration } from '../configuration';
+import type { AxiosPromise, AxiosInstance, RawAxiosRequestConfig } from 'axios';
+import globalAxios from 'axios';
+// Some imports not used depending on template conditions
+// @ts-ignore
+import { DUMMY_BASE_URL, assertParamExists, setApiKeyToObject, setBasicAuthToObject, setBearerAuthToObject, setOAuthToObject, setSearchParams, serializeDataIfNeeded, toPathString, createRequestFunction } from '../common';
+// @ts-ignore
+import { BASE_PATH, COLLECTION_FORMATS, RequestArgs, BaseAPI, RequiredError, operationServerMap } from '../base';
+// @ts-ignore
+import { JsonPatchInner } from '../models';
+// @ts-ignore
+import { LocalThumbnail } from '../models';
+// @ts-ignore
+import { LocalThumbnailList } from '../models';
+/**
+ * LocalThumbnailV1alpha1Api - axios parameter creator
+ * @export
+ */
+export const LocalThumbnailV1alpha1ApiAxiosParamCreator = function (configuration?: Configuration) {
+    return {
+        /**
+         * Create LocalThumbnail
+         * @param {LocalThumbnail} [localThumbnail] Fresh localthumbnail
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        createLocalThumbnail: async (localThumbnail?: LocalThumbnail, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            const localVarPath = `/apis/storage.halo.run/v1alpha1/localthumbnails`;
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'POST', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            // authentication basicAuth required
+            // http basic authentication required
+            setBasicAuthToObject(localVarRequestOptions, configuration)
+
+            // authentication bearerAuth required
+            // http bearer authentication required
+            await setBearerAuthToObject(localVarHeaderParameter, configuration)
+
+
+    
+            localVarHeaderParameter['Content-Type'] = 'application/json';
+
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+            localVarRequestOptions.data = serializeDataIfNeeded(localThumbnail, localVarRequestOptions, configuration)
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+        /**
+         * Delete LocalThumbnail
+         * @param {string} name Name of localthumbnail
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        deleteLocalThumbnail: async (name: string, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            // verify required parameter 'name' is not null or undefined
+            assertParamExists('deleteLocalThumbnail', 'name', name)
+            const localVarPath = `/apis/storage.halo.run/v1alpha1/localthumbnails/{name}`
+                .replace(`{${"name"}}`, encodeURIComponent(String(name)));
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'DELETE', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            // authentication basicAuth required
+            // http basic authentication required
+            setBasicAuthToObject(localVarRequestOptions, configuration)
+
+            // authentication bearerAuth required
+            // http bearer authentication required
+            await setBearerAuthToObject(localVarHeaderParameter, configuration)
+
+
+    
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+        /**
+         * Get LocalThumbnail
+         * @param {string} name Name of localthumbnail
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        getLocalThumbnail: async (name: string, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            // verify required parameter 'name' is not null or undefined
+            assertParamExists('getLocalThumbnail', 'name', name)
+            const localVarPath = `/apis/storage.halo.run/v1alpha1/localthumbnails/{name}`
+                .replace(`{${"name"}}`, encodeURIComponent(String(name)));
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'GET', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            // authentication basicAuth required
+            // http basic authentication required
+            setBasicAuthToObject(localVarRequestOptions, configuration)
+
+            // authentication bearerAuth required
+            // http bearer authentication required
+            await setBearerAuthToObject(localVarHeaderParameter, configuration)
+
+
+    
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+        /**
+         * List LocalThumbnail
+         * @param {number} [page] Page number. Default is 0.
+         * @param {number} [size] Size number. Default is 0.
+         * @param {Array<string>} [labelSelector] Label selector. e.g.: hidden!&#x3D;true
+         * @param {Array<string>} [fieldSelector] Field selector. e.g.: metadata.name&#x3D;&#x3D;halo
+         * @param {Array<string>} [sort] Sorting criteria in the format: property,(asc|desc). Default sort order is ascending. Multiple sort criteria are supported.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        listLocalThumbnail: async (page?: number, size?: number, labelSelector?: Array<string>, fieldSelector?: Array<string>, sort?: Array<string>, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            const localVarPath = `/apis/storage.halo.run/v1alpha1/localthumbnails`;
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'GET', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            // authentication basicAuth required
+            // http basic authentication required
+            setBasicAuthToObject(localVarRequestOptions, configuration)
+
+            // authentication bearerAuth required
+            // http bearer authentication required
+            await setBearerAuthToObject(localVarHeaderParameter, configuration)
+
+            if (page !== undefined) {
+                localVarQueryParameter['page'] = page;
+            }
+
+            if (size !== undefined) {
+                localVarQueryParameter['size'] = size;
+            }
+
+            if (labelSelector) {
+                localVarQueryParameter['labelSelector'] = labelSelector;
+            }
+
+            if (fieldSelector) {
+                localVarQueryParameter['fieldSelector'] = fieldSelector;
+            }
+
+            if (sort) {
+                localVarQueryParameter['sort'] = sort;
+            }
+
+
+    
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+        /**
+         * Patch LocalThumbnail
+         * @param {string} name Name of localthumbnail
+         * @param {Array<JsonPatchInner>} [jsonPatchInner] 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        patchLocalThumbnail: async (name: string, jsonPatchInner?: Array<JsonPatchInner>, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            // verify required parameter 'name' is not null or undefined
+            assertParamExists('patchLocalThumbnail', 'name', name)
+            const localVarPath = `/apis/storage.halo.run/v1alpha1/localthumbnails/{name}`
+                .replace(`{${"name"}}`, encodeURIComponent(String(name)));
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'PATCH', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            // authentication basicAuth required
+            // http basic authentication required
+            setBasicAuthToObject(localVarRequestOptions, configuration)
+
+            // authentication bearerAuth required
+            // http bearer authentication required
+            await setBearerAuthToObject(localVarHeaderParameter, configuration)
+
+
+    
+            localVarHeaderParameter['Content-Type'] = 'application/json-patch+json';
+
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+            localVarRequestOptions.data = serializeDataIfNeeded(jsonPatchInner, localVarRequestOptions, configuration)
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+        /**
+         * Update LocalThumbnail
+         * @param {string} name Name of localthumbnail
+         * @param {LocalThumbnail} [localThumbnail] Updated localthumbnail
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        updateLocalThumbnail: async (name: string, localThumbnail?: LocalThumbnail, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            // verify required parameter 'name' is not null or undefined
+            assertParamExists('updateLocalThumbnail', 'name', name)
+            const localVarPath = `/apis/storage.halo.run/v1alpha1/localthumbnails/{name}`
+                .replace(`{${"name"}}`, encodeURIComponent(String(name)));
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'PUT', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            // authentication basicAuth required
+            // http basic authentication required
+            setBasicAuthToObject(localVarRequestOptions, configuration)
+
+            // authentication bearerAuth required
+            // http bearer authentication required
+            await setBearerAuthToObject(localVarHeaderParameter, configuration)
+
+
+    
+            localVarHeaderParameter['Content-Type'] = 'application/json';
+
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+            localVarRequestOptions.data = serializeDataIfNeeded(localThumbnail, localVarRequestOptions, configuration)
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+    }
+};
+
+/**
+ * LocalThumbnailV1alpha1Api - functional programming interface
+ * @export
+ */
+export const LocalThumbnailV1alpha1ApiFp = function(configuration?: Configuration) {
+    const localVarAxiosParamCreator = LocalThumbnailV1alpha1ApiAxiosParamCreator(configuration)
+    return {
+        /**
+         * Create LocalThumbnail
+         * @param {LocalThumbnail} [localThumbnail] Fresh localthumbnail
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async createLocalThumbnail(localThumbnail?: LocalThumbnail, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<LocalThumbnail>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.createLocalThumbnail(localThumbnail, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['LocalThumbnailV1alpha1Api.createLocalThumbnail']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+        /**
+         * Delete LocalThumbnail
+         * @param {string} name Name of localthumbnail
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async deleteLocalThumbnail(name: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<void>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.deleteLocalThumbnail(name, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['LocalThumbnailV1alpha1Api.deleteLocalThumbnail']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+        /**
+         * Get LocalThumbnail
+         * @param {string} name Name of localthumbnail
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async getLocalThumbnail(name: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<LocalThumbnail>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.getLocalThumbnail(name, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['LocalThumbnailV1alpha1Api.getLocalThumbnail']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+        /**
+         * List LocalThumbnail
+         * @param {number} [page] Page number. Default is 0.
+         * @param {number} [size] Size number. Default is 0.
+         * @param {Array<string>} [labelSelector] Label selector. e.g.: hidden!&#x3D;true
+         * @param {Array<string>} [fieldSelector] Field selector. e.g.: metadata.name&#x3D;&#x3D;halo
+         * @param {Array<string>} [sort] Sorting criteria in the format: property,(asc|desc). Default sort order is ascending. Multiple sort criteria are supported.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async listLocalThumbnail(page?: number, size?: number, labelSelector?: Array<string>, fieldSelector?: Array<string>, sort?: Array<string>, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<LocalThumbnailList>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.listLocalThumbnail(page, size, labelSelector, fieldSelector, sort, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['LocalThumbnailV1alpha1Api.listLocalThumbnail']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+        /**
+         * Patch LocalThumbnail
+         * @param {string} name Name of localthumbnail
+         * @param {Array<JsonPatchInner>} [jsonPatchInner] 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async patchLocalThumbnail(name: string, jsonPatchInner?: Array<JsonPatchInner>, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<LocalThumbnail>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.patchLocalThumbnail(name, jsonPatchInner, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['LocalThumbnailV1alpha1Api.patchLocalThumbnail']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+        /**
+         * Update LocalThumbnail
+         * @param {string} name Name of localthumbnail
+         * @param {LocalThumbnail} [localThumbnail] Updated localthumbnail
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async updateLocalThumbnail(name: string, localThumbnail?: LocalThumbnail, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<LocalThumbnail>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.updateLocalThumbnail(name, localThumbnail, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['LocalThumbnailV1alpha1Api.updateLocalThumbnail']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+    }
+};
+
+/**
+ * LocalThumbnailV1alpha1Api - factory interface
+ * @export
+ */
+export const LocalThumbnailV1alpha1ApiFactory = function (configuration?: Configuration, basePath?: string, axios?: AxiosInstance) {
+    const localVarFp = LocalThumbnailV1alpha1ApiFp(configuration)
+    return {
+        /**
+         * Create LocalThumbnail
+         * @param {LocalThumbnailV1alpha1ApiCreateLocalThumbnailRequest} requestParameters Request parameters.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        createLocalThumbnail(requestParameters: LocalThumbnailV1alpha1ApiCreateLocalThumbnailRequest = {}, options?: RawAxiosRequestConfig): AxiosPromise<LocalThumbnail> {
+            return localVarFp.createLocalThumbnail(requestParameters.localThumbnail, options).then((request) => request(axios, basePath));
+        },
+        /**
+         * Delete LocalThumbnail
+         * @param {LocalThumbnailV1alpha1ApiDeleteLocalThumbnailRequest} requestParameters Request parameters.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        deleteLocalThumbnail(requestParameters: LocalThumbnailV1alpha1ApiDeleteLocalThumbnailRequest, options?: RawAxiosRequestConfig): AxiosPromise<void> {
+            return localVarFp.deleteLocalThumbnail(requestParameters.name, options).then((request) => request(axios, basePath));
+        },
+        /**
+         * Get LocalThumbnail
+         * @param {LocalThumbnailV1alpha1ApiGetLocalThumbnailRequest} requestParameters Request parameters.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        getLocalThumbnail(requestParameters: LocalThumbnailV1alpha1ApiGetLocalThumbnailRequest, options?: RawAxiosRequestConfig): AxiosPromise<LocalThumbnail> {
+            return localVarFp.getLocalThumbnail(requestParameters.name, options).then((request) => request(axios, basePath));
+        },
+        /**
+         * List LocalThumbnail
+         * @param {LocalThumbnailV1alpha1ApiListLocalThumbnailRequest} requestParameters Request parameters.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        listLocalThumbnail(requestParameters: LocalThumbnailV1alpha1ApiListLocalThumbnailRequest = {}, options?: RawAxiosRequestConfig): AxiosPromise<LocalThumbnailList> {
+            return localVarFp.listLocalThumbnail(requestParameters.page, requestParameters.size, requestParameters.labelSelector, requestParameters.fieldSelector, requestParameters.sort, options).then((request) => request(axios, basePath));
+        },
+        /**
+         * Patch LocalThumbnail
+         * @param {LocalThumbnailV1alpha1ApiPatchLocalThumbnailRequest} requestParameters Request parameters.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        patchLocalThumbnail(requestParameters: LocalThumbnailV1alpha1ApiPatchLocalThumbnailRequest, options?: RawAxiosRequestConfig): AxiosPromise<LocalThumbnail> {
+            return localVarFp.patchLocalThumbnail(requestParameters.name, requestParameters.jsonPatchInner, options).then((request) => request(axios, basePath));
+        },
+        /**
+         * Update LocalThumbnail
+         * @param {LocalThumbnailV1alpha1ApiUpdateLocalThumbnailRequest} requestParameters Request parameters.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        updateLocalThumbnail(requestParameters: LocalThumbnailV1alpha1ApiUpdateLocalThumbnailRequest, options?: RawAxiosRequestConfig): AxiosPromise<LocalThumbnail> {
+            return localVarFp.updateLocalThumbnail(requestParameters.name, requestParameters.localThumbnail, options).then((request) => request(axios, basePath));
+        },
+    };
+};
+
+/**
+ * Request parameters for createLocalThumbnail operation in LocalThumbnailV1alpha1Api.
+ * @export
+ * @interface LocalThumbnailV1alpha1ApiCreateLocalThumbnailRequest
+ */
+export interface LocalThumbnailV1alpha1ApiCreateLocalThumbnailRequest {
+    /**
+     * Fresh localthumbnail
+     * @type {LocalThumbnail}
+     * @memberof LocalThumbnailV1alpha1ApiCreateLocalThumbnail
+     */
+    readonly localThumbnail?: LocalThumbnail
+}
+
+/**
+ * Request parameters for deleteLocalThumbnail operation in LocalThumbnailV1alpha1Api.
+ * @export
+ * @interface LocalThumbnailV1alpha1ApiDeleteLocalThumbnailRequest
+ */
+export interface LocalThumbnailV1alpha1ApiDeleteLocalThumbnailRequest {
+    /**
+     * Name of localthumbnail
+     * @type {string}
+     * @memberof LocalThumbnailV1alpha1ApiDeleteLocalThumbnail
+     */
+    readonly name: string
+}
+
+/**
+ * Request parameters for getLocalThumbnail operation in LocalThumbnailV1alpha1Api.
+ * @export
+ * @interface LocalThumbnailV1alpha1ApiGetLocalThumbnailRequest
+ */
+export interface LocalThumbnailV1alpha1ApiGetLocalThumbnailRequest {
+    /**
+     * Name of localthumbnail
+     * @type {string}
+     * @memberof LocalThumbnailV1alpha1ApiGetLocalThumbnail
+     */
+    readonly name: string
+}
+
+/**
+ * Request parameters for listLocalThumbnail operation in LocalThumbnailV1alpha1Api.
+ * @export
+ * @interface LocalThumbnailV1alpha1ApiListLocalThumbnailRequest
+ */
+export interface LocalThumbnailV1alpha1ApiListLocalThumbnailRequest {
+    /**
+     * Page number. Default is 0.
+     * @type {number}
+     * @memberof LocalThumbnailV1alpha1ApiListLocalThumbnail
+     */
+    readonly page?: number
+
+    /**
+     * Size number. Default is 0.
+     * @type {number}
+     * @memberof LocalThumbnailV1alpha1ApiListLocalThumbnail
+     */
+    readonly size?: number
+
+    /**
+     * Label selector. e.g.: hidden!&#x3D;true
+     * @type {Array<string>}
+     * @memberof LocalThumbnailV1alpha1ApiListLocalThumbnail
+     */
+    readonly labelSelector?: Array<string>
+
+    /**
+     * Field selector. e.g.: metadata.name&#x3D;&#x3D;halo
+     * @type {Array<string>}
+     * @memberof LocalThumbnailV1alpha1ApiListLocalThumbnail
+     */
+    readonly fieldSelector?: Array<string>
+
+    /**
+     * Sorting criteria in the format: property,(asc|desc). Default sort order is ascending. Multiple sort criteria are supported.
+     * @type {Array<string>}
+     * @memberof LocalThumbnailV1alpha1ApiListLocalThumbnail
+     */
+    readonly sort?: Array<string>
+}
+
+/**
+ * Request parameters for patchLocalThumbnail operation in LocalThumbnailV1alpha1Api.
+ * @export
+ * @interface LocalThumbnailV1alpha1ApiPatchLocalThumbnailRequest
+ */
+export interface LocalThumbnailV1alpha1ApiPatchLocalThumbnailRequest {
+    /**
+     * Name of localthumbnail
+     * @type {string}
+     * @memberof LocalThumbnailV1alpha1ApiPatchLocalThumbnail
+     */
+    readonly name: string
+
+    /**
+     * 
+     * @type {Array<JsonPatchInner>}
+     * @memberof LocalThumbnailV1alpha1ApiPatchLocalThumbnail
+     */
+    readonly jsonPatchInner?: Array<JsonPatchInner>
+}
+
+/**
+ * Request parameters for updateLocalThumbnail operation in LocalThumbnailV1alpha1Api.
+ * @export
+ * @interface LocalThumbnailV1alpha1ApiUpdateLocalThumbnailRequest
+ */
+export interface LocalThumbnailV1alpha1ApiUpdateLocalThumbnailRequest {
+    /**
+     * Name of localthumbnail
+     * @type {string}
+     * @memberof LocalThumbnailV1alpha1ApiUpdateLocalThumbnail
+     */
+    readonly name: string
+
+    /**
+     * Updated localthumbnail
+     * @type {LocalThumbnail}
+     * @memberof LocalThumbnailV1alpha1ApiUpdateLocalThumbnail
+     */
+    readonly localThumbnail?: LocalThumbnail
+}
+
+/**
+ * LocalThumbnailV1alpha1Api - object-oriented interface
+ * @export
+ * @class LocalThumbnailV1alpha1Api
+ * @extends {BaseAPI}
+ */
+export class LocalThumbnailV1alpha1Api extends BaseAPI {
+    /**
+     * Create LocalThumbnail
+     * @param {LocalThumbnailV1alpha1ApiCreateLocalThumbnailRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof LocalThumbnailV1alpha1Api
+     */
+    public createLocalThumbnail(requestParameters: LocalThumbnailV1alpha1ApiCreateLocalThumbnailRequest = {}, options?: RawAxiosRequestConfig) {
+        return LocalThumbnailV1alpha1ApiFp(this.configuration).createLocalThumbnail(requestParameters.localThumbnail, options).then((request) => request(this.axios, this.basePath));
+    }
+
+    /**
+     * Delete LocalThumbnail
+     * @param {LocalThumbnailV1alpha1ApiDeleteLocalThumbnailRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof LocalThumbnailV1alpha1Api
+     */
+    public deleteLocalThumbnail(requestParameters: LocalThumbnailV1alpha1ApiDeleteLocalThumbnailRequest, options?: RawAxiosRequestConfig) {
+        return LocalThumbnailV1alpha1ApiFp(this.configuration).deleteLocalThumbnail(requestParameters.name, options).then((request) => request(this.axios, this.basePath));
+    }
+
+    /**
+     * Get LocalThumbnail
+     * @param {LocalThumbnailV1alpha1ApiGetLocalThumbnailRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof LocalThumbnailV1alpha1Api
+     */
+    public getLocalThumbnail(requestParameters: LocalThumbnailV1alpha1ApiGetLocalThumbnailRequest, options?: RawAxiosRequestConfig) {
+        return LocalThumbnailV1alpha1ApiFp(this.configuration).getLocalThumbnail(requestParameters.name, options).then((request) => request(this.axios, this.basePath));
+    }
+
+    /**
+     * List LocalThumbnail
+     * @param {LocalThumbnailV1alpha1ApiListLocalThumbnailRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof LocalThumbnailV1alpha1Api
+     */
+    public listLocalThumbnail(requestParameters: LocalThumbnailV1alpha1ApiListLocalThumbnailRequest = {}, options?: RawAxiosRequestConfig) {
+        return LocalThumbnailV1alpha1ApiFp(this.configuration).listLocalThumbnail(requestParameters.page, requestParameters.size, requestParameters.labelSelector, requestParameters.fieldSelector, requestParameters.sort, options).then((request) => request(this.axios, this.basePath));
+    }
+
+    /**
+     * Patch LocalThumbnail
+     * @param {LocalThumbnailV1alpha1ApiPatchLocalThumbnailRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof LocalThumbnailV1alpha1Api
+     */
+    public patchLocalThumbnail(requestParameters: LocalThumbnailV1alpha1ApiPatchLocalThumbnailRequest, options?: RawAxiosRequestConfig) {
+        return LocalThumbnailV1alpha1ApiFp(this.configuration).patchLocalThumbnail(requestParameters.name, requestParameters.jsonPatchInner, options).then((request) => request(this.axios, this.basePath));
+    }
+
+    /**
+     * Update LocalThumbnail
+     * @param {LocalThumbnailV1alpha1ApiUpdateLocalThumbnailRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof LocalThumbnailV1alpha1Api
+     */
+    public updateLocalThumbnail(requestParameters: LocalThumbnailV1alpha1ApiUpdateLocalThumbnailRequest, options?: RawAxiosRequestConfig) {
+        return LocalThumbnailV1alpha1ApiFp(this.configuration).updateLocalThumbnail(requestParameters.name, requestParameters.localThumbnail, options).then((request) => request(this.axios, this.basePath));
+    }
+}
+
diff --git a/ui/packages/api-client/src/api/thumbnail-v1alpha1-api.ts b/ui/packages/api-client/src/api/thumbnail-v1alpha1-api.ts
new file mode 100644
index 0000000000..0407b9442a
--- /dev/null
+++ b/ui/packages/api-client/src/api/thumbnail-v1alpha1-api.ts
@@ -0,0 +1,665 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * Halo
+ * No description provided (generated by Openapi Generator https://github.com/openapitools/openapi-generator)
+ *
+ * The version of the OpenAPI document: 2.19.0-SNAPSHOT
+ * 
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+
+import type { Configuration } from '../configuration';
+import type { AxiosPromise, AxiosInstance, RawAxiosRequestConfig } from 'axios';
+import globalAxios from 'axios';
+// Some imports not used depending on template conditions
+// @ts-ignore
+import { DUMMY_BASE_URL, assertParamExists, setApiKeyToObject, setBasicAuthToObject, setBearerAuthToObject, setOAuthToObject, setSearchParams, serializeDataIfNeeded, toPathString, createRequestFunction } from '../common';
+// @ts-ignore
+import { BASE_PATH, COLLECTION_FORMATS, RequestArgs, BaseAPI, RequiredError, operationServerMap } from '../base';
+// @ts-ignore
+import { JsonPatchInner } from '../models';
+// @ts-ignore
+import { Thumbnail } from '../models';
+// @ts-ignore
+import { ThumbnailList } from '../models';
+/**
+ * ThumbnailV1alpha1Api - axios parameter creator
+ * @export
+ */
+export const ThumbnailV1alpha1ApiAxiosParamCreator = function (configuration?: Configuration) {
+    return {
+        /**
+         * Create Thumbnail
+         * @param {Thumbnail} [thumbnail] Fresh thumbnail
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        createThumbnail: async (thumbnail?: Thumbnail, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            const localVarPath = `/apis/storage.halo.run/v1alpha1/thumbnails`;
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'POST', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            // authentication basicAuth required
+            // http basic authentication required
+            setBasicAuthToObject(localVarRequestOptions, configuration)
+
+            // authentication bearerAuth required
+            // http bearer authentication required
+            await setBearerAuthToObject(localVarHeaderParameter, configuration)
+
+
+    
+            localVarHeaderParameter['Content-Type'] = 'application/json';
+
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+            localVarRequestOptions.data = serializeDataIfNeeded(thumbnail, localVarRequestOptions, configuration)
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+        /**
+         * Delete Thumbnail
+         * @param {string} name Name of thumbnail
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        deleteThumbnail: async (name: string, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            // verify required parameter 'name' is not null or undefined
+            assertParamExists('deleteThumbnail', 'name', name)
+            const localVarPath = `/apis/storage.halo.run/v1alpha1/thumbnails/{name}`
+                .replace(`{${"name"}}`, encodeURIComponent(String(name)));
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'DELETE', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            // authentication basicAuth required
+            // http basic authentication required
+            setBasicAuthToObject(localVarRequestOptions, configuration)
+
+            // authentication bearerAuth required
+            // http bearer authentication required
+            await setBearerAuthToObject(localVarHeaderParameter, configuration)
+
+
+    
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+        /**
+         * Get Thumbnail
+         * @param {string} name Name of thumbnail
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        getThumbnail: async (name: string, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            // verify required parameter 'name' is not null or undefined
+            assertParamExists('getThumbnail', 'name', name)
+            const localVarPath = `/apis/storage.halo.run/v1alpha1/thumbnails/{name}`
+                .replace(`{${"name"}}`, encodeURIComponent(String(name)));
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'GET', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            // authentication basicAuth required
+            // http basic authentication required
+            setBasicAuthToObject(localVarRequestOptions, configuration)
+
+            // authentication bearerAuth required
+            // http bearer authentication required
+            await setBearerAuthToObject(localVarHeaderParameter, configuration)
+
+
+    
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+        /**
+         * List Thumbnail
+         * @param {number} [page] Page number. Default is 0.
+         * @param {number} [size] Size number. Default is 0.
+         * @param {Array<string>} [labelSelector] Label selector. e.g.: hidden!&#x3D;true
+         * @param {Array<string>} [fieldSelector] Field selector. e.g.: metadata.name&#x3D;&#x3D;halo
+         * @param {Array<string>} [sort] Sorting criteria in the format: property,(asc|desc). Default sort order is ascending. Multiple sort criteria are supported.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        listThumbnail: async (page?: number, size?: number, labelSelector?: Array<string>, fieldSelector?: Array<string>, sort?: Array<string>, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            const localVarPath = `/apis/storage.halo.run/v1alpha1/thumbnails`;
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'GET', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            // authentication basicAuth required
+            // http basic authentication required
+            setBasicAuthToObject(localVarRequestOptions, configuration)
+
+            // authentication bearerAuth required
+            // http bearer authentication required
+            await setBearerAuthToObject(localVarHeaderParameter, configuration)
+
+            if (page !== undefined) {
+                localVarQueryParameter['page'] = page;
+            }
+
+            if (size !== undefined) {
+                localVarQueryParameter['size'] = size;
+            }
+
+            if (labelSelector) {
+                localVarQueryParameter['labelSelector'] = labelSelector;
+            }
+
+            if (fieldSelector) {
+                localVarQueryParameter['fieldSelector'] = fieldSelector;
+            }
+
+            if (sort) {
+                localVarQueryParameter['sort'] = sort;
+            }
+
+
+    
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+        /**
+         * Patch Thumbnail
+         * @param {string} name Name of thumbnail
+         * @param {Array<JsonPatchInner>} [jsonPatchInner] 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        patchThumbnail: async (name: string, jsonPatchInner?: Array<JsonPatchInner>, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            // verify required parameter 'name' is not null or undefined
+            assertParamExists('patchThumbnail', 'name', name)
+            const localVarPath = `/apis/storage.halo.run/v1alpha1/thumbnails/{name}`
+                .replace(`{${"name"}}`, encodeURIComponent(String(name)));
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'PATCH', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            // authentication basicAuth required
+            // http basic authentication required
+            setBasicAuthToObject(localVarRequestOptions, configuration)
+
+            // authentication bearerAuth required
+            // http bearer authentication required
+            await setBearerAuthToObject(localVarHeaderParameter, configuration)
+
+
+    
+            localVarHeaderParameter['Content-Type'] = 'application/json-patch+json';
+
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+            localVarRequestOptions.data = serializeDataIfNeeded(jsonPatchInner, localVarRequestOptions, configuration)
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+        /**
+         * Update Thumbnail
+         * @param {string} name Name of thumbnail
+         * @param {Thumbnail} [thumbnail] Updated thumbnail
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        updateThumbnail: async (name: string, thumbnail?: Thumbnail, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            // verify required parameter 'name' is not null or undefined
+            assertParamExists('updateThumbnail', 'name', name)
+            const localVarPath = `/apis/storage.halo.run/v1alpha1/thumbnails/{name}`
+                .replace(`{${"name"}}`, encodeURIComponent(String(name)));
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'PUT', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            // authentication basicAuth required
+            // http basic authentication required
+            setBasicAuthToObject(localVarRequestOptions, configuration)
+
+            // authentication bearerAuth required
+            // http bearer authentication required
+            await setBearerAuthToObject(localVarHeaderParameter, configuration)
+
+
+    
+            localVarHeaderParameter['Content-Type'] = 'application/json';
+
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+            localVarRequestOptions.data = serializeDataIfNeeded(thumbnail, localVarRequestOptions, configuration)
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+    }
+};
+
+/**
+ * ThumbnailV1alpha1Api - functional programming interface
+ * @export
+ */
+export const ThumbnailV1alpha1ApiFp = function(configuration?: Configuration) {
+    const localVarAxiosParamCreator = ThumbnailV1alpha1ApiAxiosParamCreator(configuration)
+    return {
+        /**
+         * Create Thumbnail
+         * @param {Thumbnail} [thumbnail] Fresh thumbnail
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async createThumbnail(thumbnail?: Thumbnail, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<Thumbnail>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.createThumbnail(thumbnail, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['ThumbnailV1alpha1Api.createThumbnail']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+        /**
+         * Delete Thumbnail
+         * @param {string} name Name of thumbnail
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async deleteThumbnail(name: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<void>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.deleteThumbnail(name, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['ThumbnailV1alpha1Api.deleteThumbnail']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+        /**
+         * Get Thumbnail
+         * @param {string} name Name of thumbnail
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async getThumbnail(name: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<Thumbnail>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.getThumbnail(name, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['ThumbnailV1alpha1Api.getThumbnail']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+        /**
+         * List Thumbnail
+         * @param {number} [page] Page number. Default is 0.
+         * @param {number} [size] Size number. Default is 0.
+         * @param {Array<string>} [labelSelector] Label selector. e.g.: hidden!&#x3D;true
+         * @param {Array<string>} [fieldSelector] Field selector. e.g.: metadata.name&#x3D;&#x3D;halo
+         * @param {Array<string>} [sort] Sorting criteria in the format: property,(asc|desc). Default sort order is ascending. Multiple sort criteria are supported.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async listThumbnail(page?: number, size?: number, labelSelector?: Array<string>, fieldSelector?: Array<string>, sort?: Array<string>, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<ThumbnailList>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.listThumbnail(page, size, labelSelector, fieldSelector, sort, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['ThumbnailV1alpha1Api.listThumbnail']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+        /**
+         * Patch Thumbnail
+         * @param {string} name Name of thumbnail
+         * @param {Array<JsonPatchInner>} [jsonPatchInner] 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async patchThumbnail(name: string, jsonPatchInner?: Array<JsonPatchInner>, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<Thumbnail>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.patchThumbnail(name, jsonPatchInner, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['ThumbnailV1alpha1Api.patchThumbnail']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+        /**
+         * Update Thumbnail
+         * @param {string} name Name of thumbnail
+         * @param {Thumbnail} [thumbnail] Updated thumbnail
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async updateThumbnail(name: string, thumbnail?: Thumbnail, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<Thumbnail>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.updateThumbnail(name, thumbnail, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['ThumbnailV1alpha1Api.updateThumbnail']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+    }
+};
+
+/**
+ * ThumbnailV1alpha1Api - factory interface
+ * @export
+ */
+export const ThumbnailV1alpha1ApiFactory = function (configuration?: Configuration, basePath?: string, axios?: AxiosInstance) {
+    const localVarFp = ThumbnailV1alpha1ApiFp(configuration)
+    return {
+        /**
+         * Create Thumbnail
+         * @param {ThumbnailV1alpha1ApiCreateThumbnailRequest} requestParameters Request parameters.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        createThumbnail(requestParameters: ThumbnailV1alpha1ApiCreateThumbnailRequest = {}, options?: RawAxiosRequestConfig): AxiosPromise<Thumbnail> {
+            return localVarFp.createThumbnail(requestParameters.thumbnail, options).then((request) => request(axios, basePath));
+        },
+        /**
+         * Delete Thumbnail
+         * @param {ThumbnailV1alpha1ApiDeleteThumbnailRequest} requestParameters Request parameters.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        deleteThumbnail(requestParameters: ThumbnailV1alpha1ApiDeleteThumbnailRequest, options?: RawAxiosRequestConfig): AxiosPromise<void> {
+            return localVarFp.deleteThumbnail(requestParameters.name, options).then((request) => request(axios, basePath));
+        },
+        /**
+         * Get Thumbnail
+         * @param {ThumbnailV1alpha1ApiGetThumbnailRequest} requestParameters Request parameters.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        getThumbnail(requestParameters: ThumbnailV1alpha1ApiGetThumbnailRequest, options?: RawAxiosRequestConfig): AxiosPromise<Thumbnail> {
+            return localVarFp.getThumbnail(requestParameters.name, options).then((request) => request(axios, basePath));
+        },
+        /**
+         * List Thumbnail
+         * @param {ThumbnailV1alpha1ApiListThumbnailRequest} requestParameters Request parameters.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        listThumbnail(requestParameters: ThumbnailV1alpha1ApiListThumbnailRequest = {}, options?: RawAxiosRequestConfig): AxiosPromise<ThumbnailList> {
+            return localVarFp.listThumbnail(requestParameters.page, requestParameters.size, requestParameters.labelSelector, requestParameters.fieldSelector, requestParameters.sort, options).then((request) => request(axios, basePath));
+        },
+        /**
+         * Patch Thumbnail
+         * @param {ThumbnailV1alpha1ApiPatchThumbnailRequest} requestParameters Request parameters.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        patchThumbnail(requestParameters: ThumbnailV1alpha1ApiPatchThumbnailRequest, options?: RawAxiosRequestConfig): AxiosPromise<Thumbnail> {
+            return localVarFp.patchThumbnail(requestParameters.name, requestParameters.jsonPatchInner, options).then((request) => request(axios, basePath));
+        },
+        /**
+         * Update Thumbnail
+         * @param {ThumbnailV1alpha1ApiUpdateThumbnailRequest} requestParameters Request parameters.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        updateThumbnail(requestParameters: ThumbnailV1alpha1ApiUpdateThumbnailRequest, options?: RawAxiosRequestConfig): AxiosPromise<Thumbnail> {
+            return localVarFp.updateThumbnail(requestParameters.name, requestParameters.thumbnail, options).then((request) => request(axios, basePath));
+        },
+    };
+};
+
+/**
+ * Request parameters for createThumbnail operation in ThumbnailV1alpha1Api.
+ * @export
+ * @interface ThumbnailV1alpha1ApiCreateThumbnailRequest
+ */
+export interface ThumbnailV1alpha1ApiCreateThumbnailRequest {
+    /**
+     * Fresh thumbnail
+     * @type {Thumbnail}
+     * @memberof ThumbnailV1alpha1ApiCreateThumbnail
+     */
+    readonly thumbnail?: Thumbnail
+}
+
+/**
+ * Request parameters for deleteThumbnail operation in ThumbnailV1alpha1Api.
+ * @export
+ * @interface ThumbnailV1alpha1ApiDeleteThumbnailRequest
+ */
+export interface ThumbnailV1alpha1ApiDeleteThumbnailRequest {
+    /**
+     * Name of thumbnail
+     * @type {string}
+     * @memberof ThumbnailV1alpha1ApiDeleteThumbnail
+     */
+    readonly name: string
+}
+
+/**
+ * Request parameters for getThumbnail operation in ThumbnailV1alpha1Api.
+ * @export
+ * @interface ThumbnailV1alpha1ApiGetThumbnailRequest
+ */
+export interface ThumbnailV1alpha1ApiGetThumbnailRequest {
+    /**
+     * Name of thumbnail
+     * @type {string}
+     * @memberof ThumbnailV1alpha1ApiGetThumbnail
+     */
+    readonly name: string
+}
+
+/**
+ * Request parameters for listThumbnail operation in ThumbnailV1alpha1Api.
+ * @export
+ * @interface ThumbnailV1alpha1ApiListThumbnailRequest
+ */
+export interface ThumbnailV1alpha1ApiListThumbnailRequest {
+    /**
+     * Page number. Default is 0.
+     * @type {number}
+     * @memberof ThumbnailV1alpha1ApiListThumbnail
+     */
+    readonly page?: number
+
+    /**
+     * Size number. Default is 0.
+     * @type {number}
+     * @memberof ThumbnailV1alpha1ApiListThumbnail
+     */
+    readonly size?: number
+
+    /**
+     * Label selector. e.g.: hidden!&#x3D;true
+     * @type {Array<string>}
+     * @memberof ThumbnailV1alpha1ApiListThumbnail
+     */
+    readonly labelSelector?: Array<string>
+
+    /**
+     * Field selector. e.g.: metadata.name&#x3D;&#x3D;halo
+     * @type {Array<string>}
+     * @memberof ThumbnailV1alpha1ApiListThumbnail
+     */
+    readonly fieldSelector?: Array<string>
+
+    /**
+     * Sorting criteria in the format: property,(asc|desc). Default sort order is ascending. Multiple sort criteria are supported.
+     * @type {Array<string>}
+     * @memberof ThumbnailV1alpha1ApiListThumbnail
+     */
+    readonly sort?: Array<string>
+}
+
+/**
+ * Request parameters for patchThumbnail operation in ThumbnailV1alpha1Api.
+ * @export
+ * @interface ThumbnailV1alpha1ApiPatchThumbnailRequest
+ */
+export interface ThumbnailV1alpha1ApiPatchThumbnailRequest {
+    /**
+     * Name of thumbnail
+     * @type {string}
+     * @memberof ThumbnailV1alpha1ApiPatchThumbnail
+     */
+    readonly name: string
+
+    /**
+     * 
+     * @type {Array<JsonPatchInner>}
+     * @memberof ThumbnailV1alpha1ApiPatchThumbnail
+     */
+    readonly jsonPatchInner?: Array<JsonPatchInner>
+}
+
+/**
+ * Request parameters for updateThumbnail operation in ThumbnailV1alpha1Api.
+ * @export
+ * @interface ThumbnailV1alpha1ApiUpdateThumbnailRequest
+ */
+export interface ThumbnailV1alpha1ApiUpdateThumbnailRequest {
+    /**
+     * Name of thumbnail
+     * @type {string}
+     * @memberof ThumbnailV1alpha1ApiUpdateThumbnail
+     */
+    readonly name: string
+
+    /**
+     * Updated thumbnail
+     * @type {Thumbnail}
+     * @memberof ThumbnailV1alpha1ApiUpdateThumbnail
+     */
+    readonly thumbnail?: Thumbnail
+}
+
+/**
+ * ThumbnailV1alpha1Api - object-oriented interface
+ * @export
+ * @class ThumbnailV1alpha1Api
+ * @extends {BaseAPI}
+ */
+export class ThumbnailV1alpha1Api extends BaseAPI {
+    /**
+     * Create Thumbnail
+     * @param {ThumbnailV1alpha1ApiCreateThumbnailRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof ThumbnailV1alpha1Api
+     */
+    public createThumbnail(requestParameters: ThumbnailV1alpha1ApiCreateThumbnailRequest = {}, options?: RawAxiosRequestConfig) {
+        return ThumbnailV1alpha1ApiFp(this.configuration).createThumbnail(requestParameters.thumbnail, options).then((request) => request(this.axios, this.basePath));
+    }
+
+    /**
+     * Delete Thumbnail
+     * @param {ThumbnailV1alpha1ApiDeleteThumbnailRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof ThumbnailV1alpha1Api
+     */
+    public deleteThumbnail(requestParameters: ThumbnailV1alpha1ApiDeleteThumbnailRequest, options?: RawAxiosRequestConfig) {
+        return ThumbnailV1alpha1ApiFp(this.configuration).deleteThumbnail(requestParameters.name, options).then((request) => request(this.axios, this.basePath));
+    }
+
+    /**
+     * Get Thumbnail
+     * @param {ThumbnailV1alpha1ApiGetThumbnailRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof ThumbnailV1alpha1Api
+     */
+    public getThumbnail(requestParameters: ThumbnailV1alpha1ApiGetThumbnailRequest, options?: RawAxiosRequestConfig) {
+        return ThumbnailV1alpha1ApiFp(this.configuration).getThumbnail(requestParameters.name, options).then((request) => request(this.axios, this.basePath));
+    }
+
+    /**
+     * List Thumbnail
+     * @param {ThumbnailV1alpha1ApiListThumbnailRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof ThumbnailV1alpha1Api
+     */
+    public listThumbnail(requestParameters: ThumbnailV1alpha1ApiListThumbnailRequest = {}, options?: RawAxiosRequestConfig) {
+        return ThumbnailV1alpha1ApiFp(this.configuration).listThumbnail(requestParameters.page, requestParameters.size, requestParameters.labelSelector, requestParameters.fieldSelector, requestParameters.sort, options).then((request) => request(this.axios, this.basePath));
+    }
+
+    /**
+     * Patch Thumbnail
+     * @param {ThumbnailV1alpha1ApiPatchThumbnailRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof ThumbnailV1alpha1Api
+     */
+    public patchThumbnail(requestParameters: ThumbnailV1alpha1ApiPatchThumbnailRequest, options?: RawAxiosRequestConfig) {
+        return ThumbnailV1alpha1ApiFp(this.configuration).patchThumbnail(requestParameters.name, requestParameters.jsonPatchInner, options).then((request) => request(this.axios, this.basePath));
+    }
+
+    /**
+     * Update Thumbnail
+     * @param {ThumbnailV1alpha1ApiUpdateThumbnailRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof ThumbnailV1alpha1Api
+     */
+    public updateThumbnail(requestParameters: ThumbnailV1alpha1ApiUpdateThumbnailRequest, options?: RawAxiosRequestConfig) {
+        return ThumbnailV1alpha1ApiFp(this.configuration).updateThumbnail(requestParameters.name, requestParameters.thumbnail, options).then((request) => request(this.axios, this.basePath));
+    }
+}
+
diff --git a/ui/packages/api-client/src/api/thumbnail-v1alpha1-public-api.ts b/ui/packages/api-client/src/api/thumbnail-v1alpha1-public-api.ts
new file mode 100644
index 0000000000..abe31e623d
--- /dev/null
+++ b/ui/packages/api-client/src/api/thumbnail-v1alpha1-public-api.ts
@@ -0,0 +1,165 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * Halo
+ * No description provided (generated by Openapi Generator https://github.com/openapitools/openapi-generator)
+ *
+ * The version of the OpenAPI document: 2.19.0-SNAPSHOT
+ * 
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+
+import type { Configuration } from '../configuration';
+import type { AxiosPromise, AxiosInstance, RawAxiosRequestConfig } from 'axios';
+import globalAxios from 'axios';
+// Some imports not used depending on template conditions
+// @ts-ignore
+import { DUMMY_BASE_URL, assertParamExists, setApiKeyToObject, setBasicAuthToObject, setBearerAuthToObject, setOAuthToObject, setSearchParams, serializeDataIfNeeded, toPathString, createRequestFunction } from '../common';
+// @ts-ignore
+import { BASE_PATH, COLLECTION_FORMATS, RequestArgs, BaseAPI, RequiredError, operationServerMap } from '../base';
+/**
+ * ThumbnailV1alpha1PublicApi - axios parameter creator
+ * @export
+ */
+export const ThumbnailV1alpha1PublicApiAxiosParamCreator = function (configuration?: Configuration) {
+    return {
+        /**
+         * Get thumbnail by URI
+         * @param {string} uri The URI of the image
+         * @param {string} width The width of the thumbnail
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        getThumbnailByUri: async (uri: string, width: string, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            // verify required parameter 'uri' is not null or undefined
+            assertParamExists('getThumbnailByUri', 'uri', uri)
+            // verify required parameter 'width' is not null or undefined
+            assertParamExists('getThumbnailByUri', 'width', width)
+            const localVarPath = `/apis/api.storage.halo.run/v1alpha1/thumbnails/-/via-uri`;
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'GET', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            // authentication basicAuth required
+            // http basic authentication required
+            setBasicAuthToObject(localVarRequestOptions, configuration)
+
+            // authentication bearerAuth required
+            // http bearer authentication required
+            await setBearerAuthToObject(localVarHeaderParameter, configuration)
+
+            if (uri !== undefined) {
+                localVarQueryParameter['uri'] = uri;
+            }
+
+            if (width !== undefined) {
+                localVarQueryParameter['width'] = width;
+            }
+
+
+    
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+    }
+};
+
+/**
+ * ThumbnailV1alpha1PublicApi - functional programming interface
+ * @export
+ */
+export const ThumbnailV1alpha1PublicApiFp = function(configuration?: Configuration) {
+    const localVarAxiosParamCreator = ThumbnailV1alpha1PublicApiAxiosParamCreator(configuration)
+    return {
+        /**
+         * Get thumbnail by URI
+         * @param {string} uri The URI of the image
+         * @param {string} width The width of the thumbnail
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async getThumbnailByUri(uri: string, width: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<File>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.getThumbnailByUri(uri, width, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['ThumbnailV1alpha1PublicApi.getThumbnailByUri']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+    }
+};
+
+/**
+ * ThumbnailV1alpha1PublicApi - factory interface
+ * @export
+ */
+export const ThumbnailV1alpha1PublicApiFactory = function (configuration?: Configuration, basePath?: string, axios?: AxiosInstance) {
+    const localVarFp = ThumbnailV1alpha1PublicApiFp(configuration)
+    return {
+        /**
+         * Get thumbnail by URI
+         * @param {ThumbnailV1alpha1PublicApiGetThumbnailByUriRequest} requestParameters Request parameters.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        getThumbnailByUri(requestParameters: ThumbnailV1alpha1PublicApiGetThumbnailByUriRequest, options?: RawAxiosRequestConfig): AxiosPromise<File> {
+            return localVarFp.getThumbnailByUri(requestParameters.uri, requestParameters.width, options).then((request) => request(axios, basePath));
+        },
+    };
+};
+
+/**
+ * Request parameters for getThumbnailByUri operation in ThumbnailV1alpha1PublicApi.
+ * @export
+ * @interface ThumbnailV1alpha1PublicApiGetThumbnailByUriRequest
+ */
+export interface ThumbnailV1alpha1PublicApiGetThumbnailByUriRequest {
+    /**
+     * The URI of the image
+     * @type {string}
+     * @memberof ThumbnailV1alpha1PublicApiGetThumbnailByUri
+     */
+    readonly uri: string
+
+    /**
+     * The width of the thumbnail
+     * @type {string}
+     * @memberof ThumbnailV1alpha1PublicApiGetThumbnailByUri
+     */
+    readonly width: string
+}
+
+/**
+ * ThumbnailV1alpha1PublicApi - object-oriented interface
+ * @export
+ * @class ThumbnailV1alpha1PublicApi
+ * @extends {BaseAPI}
+ */
+export class ThumbnailV1alpha1PublicApi extends BaseAPI {
+    /**
+     * Get thumbnail by URI
+     * @param {ThumbnailV1alpha1PublicApiGetThumbnailByUriRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof ThumbnailV1alpha1PublicApi
+     */
+    public getThumbnailByUri(requestParameters: ThumbnailV1alpha1PublicApiGetThumbnailByUriRequest, options?: RawAxiosRequestConfig) {
+        return ThumbnailV1alpha1PublicApiFp(this.configuration).getThumbnailByUri(requestParameters.uri, requestParameters.width, options).then((request) => request(this.axios, this.basePath));
+    }
+}
+
diff --git a/ui/packages/api-client/src/models/attachment-status.ts b/ui/packages/api-client/src/models/attachment-status.ts
index 2d16a1dcba..ae31ac837f 100644
--- a/ui/packages/api-client/src/models/attachment-status.ts
+++ b/ui/packages/api-client/src/models/attachment-status.ts
@@ -26,5 +26,11 @@ export interface AttachmentStatus {
      * @memberof AttachmentStatus
      */
     'permalink'?: string;
+    /**
+     * 
+     * @type {{ [key: string]: string; }}
+     * @memberof AttachmentStatus
+     */
+    'thumbnails'?: { [key: string]: string; };
 }
 
diff --git a/ui/packages/api-client/src/models/index.ts b/ui/packages/api-client/src/models/index.ts
index 4944755262..d6c4372ece 100644
--- a/ui/packages/api-client/src/models/index.ts
+++ b/ui/packages/api-client/src/models/index.ts
@@ -98,6 +98,10 @@ export * from './listed-single-page-vo-list';
 export * from './listed-snapshot-dto';
 export * from './listed-snapshot-spec';
 export * from './listed-user';
+export * from './local-thumbnail';
+export * from './local-thumbnail-list';
+export * from './local-thumbnail-spec';
+export * from './local-thumbnail-status';
 export * from './login-history';
 export * from './mark-specified-request';
 export * from './menu';
@@ -232,6 +236,9 @@ export * from './theme';
 export * from './theme-list';
 export * from './theme-spec';
 export * from './theme-status';
+export * from './thumbnail';
+export * from './thumbnail-list';
+export * from './thumbnail-spec';
 export * from './totp-auth-link-response';
 export * from './totp-request';
 export * from './two-factor-auth-settings';
diff --git a/ui/packages/api-client/src/models/local-thumbnail-list.ts b/ui/packages/api-client/src/models/local-thumbnail-list.ts
new file mode 100644
index 0000000000..e944a646a1
--- /dev/null
+++ b/ui/packages/api-client/src/models/local-thumbnail-list.ts
@@ -0,0 +1,81 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * Halo
+ * No description provided (generated by Openapi Generator https://github.com/openapitools/openapi-generator)
+ *
+ * The version of the OpenAPI document: 2.19.0-SNAPSHOT
+ * 
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+
+// May contain unused imports in some cases
+// @ts-ignore
+import { LocalThumbnail } from './local-thumbnail';
+
+/**
+ * 
+ * @export
+ * @interface LocalThumbnailList
+ */
+export interface LocalThumbnailList {
+    /**
+     * Indicates whether current page is the first page.
+     * @type {boolean}
+     * @memberof LocalThumbnailList
+     */
+    'first': boolean;
+    /**
+     * Indicates whether current page has previous page.
+     * @type {boolean}
+     * @memberof LocalThumbnailList
+     */
+    'hasNext': boolean;
+    /**
+     * Indicates whether current page has previous page.
+     * @type {boolean}
+     * @memberof LocalThumbnailList
+     */
+    'hasPrevious': boolean;
+    /**
+     * A chunk of items.
+     * @type {Array<LocalThumbnail>}
+     * @memberof LocalThumbnailList
+     */
+    'items': Array<LocalThumbnail>;
+    /**
+     * Indicates whether current page is the last page.
+     * @type {boolean}
+     * @memberof LocalThumbnailList
+     */
+    'last': boolean;
+    /**
+     * Page number, starts from 1. If not set or equal to 0, it means no pagination.
+     * @type {number}
+     * @memberof LocalThumbnailList
+     */
+    'page': number;
+    /**
+     * Size of each page. If not set or equal to 0, it means no pagination.
+     * @type {number}
+     * @memberof LocalThumbnailList
+     */
+    'size': number;
+    /**
+     * Total elements.
+     * @type {number}
+     * @memberof LocalThumbnailList
+     */
+    'total': number;
+    /**
+     * Indicates total pages.
+     * @type {number}
+     * @memberof LocalThumbnailList
+     */
+    'totalPages': number;
+}
+
diff --git a/ui/packages/api-client/src/models/local-thumbnail-spec.ts b/ui/packages/api-client/src/models/local-thumbnail-spec.ts
new file mode 100644
index 0000000000..59bc5157ef
--- /dev/null
+++ b/ui/packages/api-client/src/models/local-thumbnail-spec.ts
@@ -0,0 +1,70 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * Halo
+ * No description provided (generated by Openapi Generator https://github.com/openapitools/openapi-generator)
+ *
+ * The version of the OpenAPI document: 2.19.0-SNAPSHOT
+ * 
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+
+
+/**
+ * 
+ * @export
+ * @interface LocalThumbnailSpec
+ */
+export interface LocalThumbnailSpec {
+    /**
+     * 
+     * @type {string}
+     * @memberof LocalThumbnailSpec
+     */
+    'filePath': string;
+    /**
+     * 
+     * @type {string}
+     * @memberof LocalThumbnailSpec
+     */
+    'imageSignature': string;
+    /**
+     * 
+     * @type {string}
+     * @memberof LocalThumbnailSpec
+     */
+    'imageUri': string;
+    /**
+     * 
+     * @type {string}
+     * @memberof LocalThumbnailSpec
+     */
+    'size': LocalThumbnailSpecSizeEnum;
+    /**
+     * 
+     * @type {string}
+     * @memberof LocalThumbnailSpec
+     */
+    'thumbSignature': string;
+    /**
+     * 
+     * @type {string}
+     * @memberof LocalThumbnailSpec
+     */
+    'thumbnailUri': string;
+}
+
+export const LocalThumbnailSpecSizeEnum = {
+    S: 'S',
+    M: 'M',
+    L: 'L',
+    Xl: 'XL'
+} as const;
+
+export type LocalThumbnailSpecSizeEnum = typeof LocalThumbnailSpecSizeEnum[keyof typeof LocalThumbnailSpecSizeEnum];
+
+
diff --git a/ui/packages/api-client/src/models/local-thumbnail-status.ts b/ui/packages/api-client/src/models/local-thumbnail-status.ts
new file mode 100644
index 0000000000..ba2cac0c11
--- /dev/null
+++ b/ui/packages/api-client/src/models/local-thumbnail-status.ts
@@ -0,0 +1,39 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * Halo
+ * No description provided (generated by Openapi Generator https://github.com/openapitools/openapi-generator)
+ *
+ * The version of the OpenAPI document: 2.19.0-SNAPSHOT
+ * 
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+
+
+/**
+ * 
+ * @export
+ * @interface LocalThumbnailStatus
+ */
+export interface LocalThumbnailStatus {
+    /**
+     * 
+     * @type {string}
+     * @memberof LocalThumbnailStatus
+     */
+    'phase'?: LocalThumbnailStatusPhaseEnum;
+}
+
+export const LocalThumbnailStatusPhaseEnum = {
+    Pending: 'PENDING',
+    Succeeded: 'SUCCEEDED',
+    Failed: 'FAILED'
+} as const;
+
+export type LocalThumbnailStatusPhaseEnum = typeof LocalThumbnailStatusPhaseEnum[keyof typeof LocalThumbnailStatusPhaseEnum];
+
+
diff --git a/ui/packages/api-client/src/models/local-thumbnail.ts b/ui/packages/api-client/src/models/local-thumbnail.ts
new file mode 100644
index 0000000000..49eec71290
--- /dev/null
+++ b/ui/packages/api-client/src/models/local-thumbnail.ts
@@ -0,0 +1,63 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * Halo
+ * No description provided (generated by Openapi Generator https://github.com/openapitools/openapi-generator)
+ *
+ * The version of the OpenAPI document: 2.19.0-SNAPSHOT
+ * 
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+
+// May contain unused imports in some cases
+// @ts-ignore
+import { LocalThumbnailSpec } from './local-thumbnail-spec';
+// May contain unused imports in some cases
+// @ts-ignore
+import { LocalThumbnailStatus } from './local-thumbnail-status';
+// May contain unused imports in some cases
+// @ts-ignore
+import { Metadata } from './metadata';
+
+/**
+ * 
+ * @export
+ * @interface LocalThumbnail
+ */
+export interface LocalThumbnail {
+    /**
+     * 
+     * @type {string}
+     * @memberof LocalThumbnail
+     */
+    'apiVersion': string;
+    /**
+     * 
+     * @type {string}
+     * @memberof LocalThumbnail
+     */
+    'kind': string;
+    /**
+     * 
+     * @type {Metadata}
+     * @memberof LocalThumbnail
+     */
+    'metadata': Metadata;
+    /**
+     * 
+     * @type {LocalThumbnailSpec}
+     * @memberof LocalThumbnail
+     */
+    'spec': LocalThumbnailSpec;
+    /**
+     * 
+     * @type {LocalThumbnailStatus}
+     * @memberof LocalThumbnail
+     */
+    'status'?: LocalThumbnailStatus;
+}
+
diff --git a/ui/packages/api-client/src/models/thumbnail-list.ts b/ui/packages/api-client/src/models/thumbnail-list.ts
new file mode 100644
index 0000000000..f789d3aa15
--- /dev/null
+++ b/ui/packages/api-client/src/models/thumbnail-list.ts
@@ -0,0 +1,81 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * Halo
+ * No description provided (generated by Openapi Generator https://github.com/openapitools/openapi-generator)
+ *
+ * The version of the OpenAPI document: 2.19.0-SNAPSHOT
+ * 
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+
+// May contain unused imports in some cases
+// @ts-ignore
+import { Thumbnail } from './thumbnail';
+
+/**
+ * 
+ * @export
+ * @interface ThumbnailList
+ */
+export interface ThumbnailList {
+    /**
+     * Indicates whether current page is the first page.
+     * @type {boolean}
+     * @memberof ThumbnailList
+     */
+    'first': boolean;
+    /**
+     * Indicates whether current page has previous page.
+     * @type {boolean}
+     * @memberof ThumbnailList
+     */
+    'hasNext': boolean;
+    /**
+     * Indicates whether current page has previous page.
+     * @type {boolean}
+     * @memberof ThumbnailList
+     */
+    'hasPrevious': boolean;
+    /**
+     * A chunk of items.
+     * @type {Array<Thumbnail>}
+     * @memberof ThumbnailList
+     */
+    'items': Array<Thumbnail>;
+    /**
+     * Indicates whether current page is the last page.
+     * @type {boolean}
+     * @memberof ThumbnailList
+     */
+    'last': boolean;
+    /**
+     * Page number, starts from 1. If not set or equal to 0, it means no pagination.
+     * @type {number}
+     * @memberof ThumbnailList
+     */
+    'page': number;
+    /**
+     * Size of each page. If not set or equal to 0, it means no pagination.
+     * @type {number}
+     * @memberof ThumbnailList
+     */
+    'size': number;
+    /**
+     * Total elements.
+     * @type {number}
+     * @memberof ThumbnailList
+     */
+    'total': number;
+    /**
+     * Indicates total pages.
+     * @type {number}
+     * @memberof ThumbnailList
+     */
+    'totalPages': number;
+}
+
diff --git a/ui/packages/api-client/src/models/thumbnail-spec.ts b/ui/packages/api-client/src/models/thumbnail-spec.ts
new file mode 100644
index 0000000000..df7f6dcb38
--- /dev/null
+++ b/ui/packages/api-client/src/models/thumbnail-spec.ts
@@ -0,0 +1,58 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * Halo
+ * No description provided (generated by Openapi Generator https://github.com/openapitools/openapi-generator)
+ *
+ * The version of the OpenAPI document: 2.19.0-SNAPSHOT
+ * 
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+
+
+/**
+ * 
+ * @export
+ * @interface ThumbnailSpec
+ */
+export interface ThumbnailSpec {
+    /**
+     * 
+     * @type {string}
+     * @memberof ThumbnailSpec
+     */
+    'imageSignature': string;
+    /**
+     * 
+     * @type {string}
+     * @memberof ThumbnailSpec
+     */
+    'imageUri': string;
+    /**
+     * 
+     * @type {string}
+     * @memberof ThumbnailSpec
+     */
+    'size': ThumbnailSpecSizeEnum;
+    /**
+     * 
+     * @type {string}
+     * @memberof ThumbnailSpec
+     */
+    'thumbnailUri': string;
+}
+
+export const ThumbnailSpecSizeEnum = {
+    S: 'S',
+    M: 'M',
+    L: 'L',
+    Xl: 'XL'
+} as const;
+
+export type ThumbnailSpecSizeEnum = typeof ThumbnailSpecSizeEnum[keyof typeof ThumbnailSpecSizeEnum];
+
+
diff --git a/ui/packages/api-client/src/models/thumbnail.ts b/ui/packages/api-client/src/models/thumbnail.ts
new file mode 100644
index 0000000000..909c29ca88
--- /dev/null
+++ b/ui/packages/api-client/src/models/thumbnail.ts
@@ -0,0 +1,54 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * Halo
+ * No description provided (generated by Openapi Generator https://github.com/openapitools/openapi-generator)
+ *
+ * The version of the OpenAPI document: 2.19.0-SNAPSHOT
+ * 
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+
+// May contain unused imports in some cases
+// @ts-ignore
+import { Metadata } from './metadata';
+// May contain unused imports in some cases
+// @ts-ignore
+import { ThumbnailSpec } from './thumbnail-spec';
+
+/**
+ * 
+ * @export
+ * @interface Thumbnail
+ */
+export interface Thumbnail {
+    /**
+     * 
+     * @type {string}
+     * @memberof Thumbnail
+     */
+    'apiVersion': string;
+    /**
+     * 
+     * @type {string}
+     * @memberof Thumbnail
+     */
+    'kind': string;
+    /**
+     * 
+     * @type {Metadata}
+     * @memberof Thumbnail
+     */
+    'metadata': Metadata;
+    /**
+     * 
+     * @type {ThumbnailSpec}
+     * @memberof Thumbnail
+     */
+    'spec': ThumbnailSpec;
+}
+

From fa528a007f6827707ee3f35730bc564ccab279d1 Mon Sep 17 00:00:00 2001
From: guqing <i@guqing.email>
Date: Mon, 26 Aug 2024 18:08:33 +0800
Subject: [PATCH 2/2] feat: implement new mechanisms for generating and
 managing attachment thumbnails

---
 api/build.gradle                              |   1 +
 .../core/attachment/ThumbnailProvider.java    |  40 +++
 .../app/core/attachment/ThumbnailSize.java    |  43 +++
 .../core/extension/attachment/Attachment.java |   2 +
 .../content/HtmlThumbnailSrcsetInjector.java  |  92 ++++++
 .../content/PostContentThumbnailHandler.java  |  40 +++
 .../core/attachment/AttachmentRootGetter.java |  10 +
 .../app/core/attachment/AttachmentUtils.java  |  56 ++++
 .../attachment/LocalThumbnailProvider.java    |  43 +++
 .../attachment/LocalThumbnailService.java     |  81 +++++
 .../core/attachment/ThumbnailGenerator.java   | 173 +++++++++++
 .../app/core/attachment/ThumbnailService.java |  22 ++
 .../app/core/attachment/ThumbnailSigner.java  |  37 +++
 .../impl/AttachmentRootGetterImpl.java        |  18 ++
 .../impl/LocalThumbnailServiceImpl.java       | 284 ++++++++++++++++++
 .../attachment/impl/ThumbnailServiceImpl.java | 133 ++++++++
 .../reconciler}/AttachmentReconciler.java     | 112 +++----
 .../reconciler/LocalThumbnailsReconciler.java | 184 ++++++++++++
 .../extension/attachment/LocalThumbnail.java  |  88 ++++++
 .../core/extension/attachment/Thumbnail.java  |  49 +++
 .../endpoint/AttachmentEndpoint.java          |  10 +-
 .../LocalAttachmentUploadHandler.java         |  50 ++-
 .../infra/DefaultExternalLinkProcessor.java   |  24 +-
 .../run/halo/app/infra/SchemeInitializer.java |  28 ++
 .../app/theme/endpoint/ThumbnailEndpoint.java | 169 +++++++++++
 .../app/theme/finders/ThumbnailFinder.java    |  20 ++
 .../finders/impl/ThumbnailFinderImpl.java     |  22 ++
 .../extensions/extension-definitions.yaml     |  10 +
 .../extensionpoint-definitions.yaml           |  10 +
 .../extensions/role-template-anonymous.yaml   |   3 +
 .../HtmlThumbnailSrcsetInjectorTest.java      |  46 +++
 .../core/attachment/AttachmentUtilsTest.java  |  27 ++
 .../attachment/ThumbnailGeneratorTest.java    |  91 ++++++
 .../core/attachment/ThumbnailSignerTest.java  |  21 ++
 .../impl/AttachmentRootGetterImplTest.java    |  35 +++
 .../impl/LocalThumbnailServiceImplTest.java   | 141 +++++++++
 .../impl/ThumbnailServiceImplTest.java        | 172 +++++++++++
 .../DefaultExternalLinkProcessorTest.java     |   4 +-
 platform/application/build.gradle             |   2 +
 39 files changed, 2280 insertions(+), 113 deletions(-)
 create mode 100644 api/src/main/java/run/halo/app/core/attachment/ThumbnailProvider.java
 create mode 100644 api/src/main/java/run/halo/app/core/attachment/ThumbnailSize.java
 create mode 100644 application/src/main/java/run/halo/app/content/HtmlThumbnailSrcsetInjector.java
 create mode 100644 application/src/main/java/run/halo/app/content/PostContentThumbnailHandler.java
 create mode 100644 application/src/main/java/run/halo/app/core/attachment/AttachmentRootGetter.java
 create mode 100644 application/src/main/java/run/halo/app/core/attachment/AttachmentUtils.java
 create mode 100644 application/src/main/java/run/halo/app/core/attachment/LocalThumbnailProvider.java
 create mode 100644 application/src/main/java/run/halo/app/core/attachment/LocalThumbnailService.java
 create mode 100644 application/src/main/java/run/halo/app/core/attachment/ThumbnailGenerator.java
 create mode 100644 application/src/main/java/run/halo/app/core/attachment/ThumbnailService.java
 create mode 100644 application/src/main/java/run/halo/app/core/attachment/ThumbnailSigner.java
 create mode 100644 application/src/main/java/run/halo/app/core/attachment/impl/AttachmentRootGetterImpl.java
 create mode 100644 application/src/main/java/run/halo/app/core/attachment/impl/LocalThumbnailServiceImpl.java
 create mode 100644 application/src/main/java/run/halo/app/core/attachment/impl/ThumbnailServiceImpl.java
 rename application/src/main/java/run/halo/app/core/{extension/reconciler/attachment => attachment/reconciler}/AttachmentReconciler.java (51%)
 create mode 100644 application/src/main/java/run/halo/app/core/attachment/reconciler/LocalThumbnailsReconciler.java
 create mode 100644 application/src/main/java/run/halo/app/core/extension/attachment/LocalThumbnail.java
 create mode 100644 application/src/main/java/run/halo/app/core/extension/attachment/Thumbnail.java
 create mode 100644 application/src/main/java/run/halo/app/theme/endpoint/ThumbnailEndpoint.java
 create mode 100644 application/src/main/java/run/halo/app/theme/finders/ThumbnailFinder.java
 create mode 100644 application/src/main/java/run/halo/app/theme/finders/impl/ThumbnailFinderImpl.java
 create mode 100644 application/src/test/java/run/halo/app/content/HtmlThumbnailSrcsetInjectorTest.java
 create mode 100644 application/src/test/java/run/halo/app/core/attachment/AttachmentUtilsTest.java
 create mode 100644 application/src/test/java/run/halo/app/core/attachment/ThumbnailGeneratorTest.java
 create mode 100644 application/src/test/java/run/halo/app/core/attachment/ThumbnailSignerTest.java
 create mode 100644 application/src/test/java/run/halo/app/core/attachment/impl/AttachmentRootGetterImplTest.java
 create mode 100644 application/src/test/java/run/halo/app/core/attachment/impl/LocalThumbnailServiceImplTest.java
 create mode 100644 application/src/test/java/run/halo/app/core/attachment/impl/ThumbnailServiceImplTest.java

diff --git a/api/build.gradle b/api/build.gradle
index 717b853d1a..752acc961a 100644
--- a/api/build.gradle
+++ b/api/build.gradle
@@ -66,6 +66,7 @@ dependencies {
     api "com.github.java-json-tools:json-patch"
     api "org.thymeleaf.extras:thymeleaf-extras-springsecurity6"
     api 'org.apache.tika:tika-core'
+    api "org.imgscalr:imgscalr-lib"
 
     api "io.github.resilience4j:resilience4j-spring-boot3"
     api "io.github.resilience4j:resilience4j-reactor"
diff --git a/api/src/main/java/run/halo/app/core/attachment/ThumbnailProvider.java b/api/src/main/java/run/halo/app/core/attachment/ThumbnailProvider.java
new file mode 100644
index 0000000000..d28a20c669
--- /dev/null
+++ b/api/src/main/java/run/halo/app/core/attachment/ThumbnailProvider.java
@@ -0,0 +1,40 @@
+package run.halo.app.core.attachment;
+
+import java.net.URI;
+import java.net.URL;
+import lombok.Builder;
+import lombok.Data;
+import org.pf4j.ExtensionPoint;
+import reactor.core.publisher.Mono;
+
+public interface ThumbnailProvider extends ExtensionPoint {
+
+    /**
+     * Generate thumbnail URI for given image URL and size.
+     *
+     * @param context Thumbnail context including image URI and size
+     * @return Generated thumbnail URI
+     */
+    Mono<URI> generate(ThumbnailContext context);
+
+    /**
+     * Delete thumbnail file for given image URL.
+     *
+     * @param imageUrl original image URL
+     */
+    Mono<Void> delete(URL imageUrl);
+
+    /**
+     * Whether the provider supports the given image URI.
+     *
+     * @return {@code true} if supports, {@code false} otherwise
+     */
+    Mono<Boolean> supports(ThumbnailContext context);
+
+    @Data
+    @Builder
+    class ThumbnailContext {
+        private final URL imageUrl;
+        private final ThumbnailSize size;
+    }
+}
diff --git a/api/src/main/java/run/halo/app/core/attachment/ThumbnailSize.java b/api/src/main/java/run/halo/app/core/attachment/ThumbnailSize.java
new file mode 100644
index 0000000000..bdc7035c19
--- /dev/null
+++ b/api/src/main/java/run/halo/app/core/attachment/ThumbnailSize.java
@@ -0,0 +1,43 @@
+package run.halo.app.core.attachment;
+
+import lombok.Getter;
+
+@Getter
+public enum ThumbnailSize {
+    S(400),
+    M(800),
+    L(1200),
+    XL(1600);
+
+    private final int width;
+
+    ThumbnailSize(int width) {
+        this.width = width;
+    }
+
+    /**
+     * Convert width string to {@link ThumbnailSize}.
+     *
+     * @param width width string
+     */
+    public static ThumbnailSize fromWidth(String width) {
+        for (ThumbnailSize value : values()) {
+            if (String.valueOf(value.getWidth()).equals(width)) {
+                return value;
+            }
+        }
+        return ThumbnailSize.M;
+    }
+
+    /**
+     * Convert name to {@link ThumbnailSize}.
+     */
+    public static ThumbnailSize fromName(String name) {
+        for (ThumbnailSize value : values()) {
+            if (value.name().equalsIgnoreCase(name)) {
+                return value;
+            }
+        }
+        throw new IllegalArgumentException("No such thumbnail size: " + name);
+    }
+}
diff --git a/api/src/main/java/run/halo/app/core/extension/attachment/Attachment.java b/api/src/main/java/run/halo/app/core/extension/attachment/Attachment.java
index 974c97763f..8b37861c9e 100644
--- a/api/src/main/java/run/halo/app/core/extension/attachment/Attachment.java
+++ b/api/src/main/java/run/halo/app/core/extension/attachment/Attachment.java
@@ -5,6 +5,7 @@
 
 import io.swagger.v3.oas.annotations.media.ArraySchema;
 import io.swagger.v3.oas.annotations.media.Schema;
+import java.util.Map;
 import java.util.Set;
 import lombok.Data;
 import lombok.EqualsAndHashCode;
@@ -64,5 +65,6 @@ public static class AttachmentStatus {
             """)
         private String permalink;
 
+        private Map<String, String> thumbnails;
     }
 }
diff --git a/application/src/main/java/run/halo/app/content/HtmlThumbnailSrcsetInjector.java b/application/src/main/java/run/halo/app/content/HtmlThumbnailSrcsetInjector.java
new file mode 100644
index 0000000000..39f6cedab8
--- /dev/null
+++ b/application/src/main/java/run/halo/app/content/HtmlThumbnailSrcsetInjector.java
@@ -0,0 +1,92 @@
+package run.halo.app.content;
+
+import java.net.URI;
+import java.util.function.Function;
+import lombok.experimental.UtilityClass;
+import org.apache.commons.lang3.StringUtils;
+import org.jsoup.Jsoup;
+import org.jsoup.nodes.Document;
+import org.jsoup.select.Elements;
+import reactor.core.publisher.Flux;
+import reactor.core.publisher.Mono;
+import run.halo.app.core.attachment.ThumbnailService;
+import run.halo.app.core.attachment.ThumbnailSize;
+
+@UtilityClass
+public class HtmlThumbnailSrcsetInjector {
+    static final String SRC = "src";
+    static final String SRCSET = "srcset";
+
+    /**
+     * Inject srcset attribute to img tags in the given html.
+     */
+    public static Mono<String> injectSrcset(String html,
+        Function<String, Mono<String>> srcSetValueGenerator) {
+        Document document = Jsoup.parseBodyFragment(html);
+        document.outputSettings(new Document.OutputSettings().prettyPrint(false));
+
+        Elements imgTags = document.select("img[src]");
+        return Flux.fromIterable(imgTags)
+            .filter(element -> {
+                String src = element.attr(SRC);
+                return !element.hasAttr(SRCSET) && isValidSrc(src);
+            })
+            .flatMap(img -> {
+                String src = img.attr(SRC);
+                return srcSetValueGenerator.apply(src)
+                    .filter(StringUtils::isNotBlank)
+                    .doOnNext(srcsetValue -> {
+                        img.attr(SRCSET, srcsetValue);
+                        img.attr("sizes", buildSizesAttr());
+                    });
+            })
+            .then(Mono.fromSupplier(() -> document.body().html()));
+    }
+
+    static String buildSizesAttr() {
+        var sb = new StringBuilder();
+        var delimiter = ", ";
+        var sizes = ThumbnailSize.values();
+        for (int i = 0; i < sizes.length; i++) {
+            var size = sizes[i];
+            sb.append("(max-width: ").append(size.getWidth()).append("px)")
+                .append(" ")
+                .append(size.getWidth())
+                .append("px");
+            if (i < sizes.length - 1) {
+                sb.append(delimiter);
+            }
+        }
+        return sb.toString();
+    }
+
+    /**
+     * Generate srcset attribute value for the given src.
+     */
+    public static Mono<String> generateSrcset(URI src, ThumbnailService thumbnailService) {
+        return Flux.fromArray(ThumbnailSize.values())
+            .flatMap(size -> thumbnailService.generate(src, size)
+                .map(thumbnail -> thumbnail.toString() + " " + size.getWidth() + "w")
+            )
+            .collect(StringBuilder::new, (builder, srcsetValue) -> {
+                if (!builder.isEmpty()) {
+                    builder.append(", ");
+                }
+                builder.append(srcsetValue);
+            })
+            .map(StringBuilder::toString);
+    }
+
+    private static boolean isValidSrc(String src) {
+        if (StringUtils.isBlank(src)) {
+            return false;
+        }
+        try {
+            URI.create(src);
+            return true;
+        } catch (IllegalArgumentException e) {
+            // ignore
+        }
+        return false;
+    }
+}
diff --git a/application/src/main/java/run/halo/app/content/PostContentThumbnailHandler.java b/application/src/main/java/run/halo/app/content/PostContentThumbnailHandler.java
new file mode 100644
index 0000000000..9a94e4ed46
--- /dev/null
+++ b/application/src/main/java/run/halo/app/content/PostContentThumbnailHandler.java
@@ -0,0 +1,40 @@
+package run.halo.app.content;
+
+import static run.halo.app.content.HtmlThumbnailSrcsetInjector.generateSrcset;
+
+import java.net.URI;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.lang.NonNull;
+import org.springframework.stereotype.Component;
+import reactor.core.publisher.Mono;
+import run.halo.app.core.attachment.ThumbnailService;
+import run.halo.app.theme.ReactivePostContentHandler;
+
+/**
+ * A post content handler to handle post html content and generate thumbnail by the img tag.
+ *
+ * @author guqing
+ * @since 2.19.0
+ */
+@Slf4j
+@Component
+@RequiredArgsConstructor
+public class PostContentThumbnailHandler implements ReactivePostContentHandler {
+    private final ThumbnailService thumbnailService;
+
+    @Override
+    public Mono<PostContentContext> handle(@NonNull PostContentContext postContent) {
+        var html = postContent.getContent();
+        return HtmlThumbnailSrcsetInjector.injectSrcset(html,
+                src -> generateSrcset(URI.create(src), thumbnailService)
+            )
+            .onErrorResume(throwable -> {
+                log.debug("Failed to inject srcset to post content, fallback to original content",
+                    throwable);
+                return Mono.just(html);
+            })
+            .doOnNext(postContent::setContent)
+            .thenReturn(postContent);
+    }
+}
diff --git a/application/src/main/java/run/halo/app/core/attachment/AttachmentRootGetter.java b/application/src/main/java/run/halo/app/core/attachment/AttachmentRootGetter.java
new file mode 100644
index 0000000000..3f2e6809f6
--- /dev/null
+++ b/application/src/main/java/run/halo/app/core/attachment/AttachmentRootGetter.java
@@ -0,0 +1,10 @@
+package run.halo.app.core.attachment;
+
+import java.nio.file.Path;
+import java.util.function.Supplier;
+
+/**
+ * Gets the root path(work dir) of the local attachment.
+ */
+public interface AttachmentRootGetter extends Supplier<Path> {
+}
diff --git a/application/src/main/java/run/halo/app/core/attachment/AttachmentUtils.java b/application/src/main/java/run/halo/app/core/attachment/AttachmentUtils.java
new file mode 100644
index 0000000000..8f95800ed6
--- /dev/null
+++ b/application/src/main/java/run/halo/app/core/attachment/AttachmentUtils.java
@@ -0,0 +1,56 @@
+package run.halo.app.core.attachment;
+
+import static run.halo.app.infra.FileCategoryMatcher.IMAGE;
+
+import java.net.MalformedURLException;
+import java.net.URI;
+import java.net.URL;
+import java.nio.charset.StandardCharsets;
+import lombok.experimental.UtilityClass;
+import org.springframework.lang.NonNull;
+import org.springframework.util.Assert;
+import org.springframework.web.util.UriComponentsBuilder;
+import org.springframework.web.util.UriUtils;
+import run.halo.app.core.extension.attachment.Attachment;
+
+@UtilityClass
+public class AttachmentUtils {
+    /**
+     * Check whether the attachment is an image.
+     *
+     * @param attachment Attachment must not be null
+     * @return true if the attachment is an image, false otherwise
+     */
+    public static boolean isImage(Attachment attachment) {
+        Assert.notNull(attachment, "Attachment must not be null");
+        var mediaType = attachment.getSpec().getMediaType();
+        return mediaType != null && IMAGE.match(mediaType);
+    }
+
+    /**
+     * Convert URI to URL.
+     *
+     * @param uri URI must not be null
+     * @return URL
+     * @throws IllegalArgumentException if the URL is malformed
+     */
+    public static URL toUrl(@NonNull URI uri) {
+        try {
+            return uri.toURL();
+        } catch (MalformedURLException e) {
+            throw new IllegalArgumentException(e);
+        }
+    }
+
+    /**
+     * Encode uri string to URI.
+     * This method will decode the uri string first and then encode it.
+     */
+    public static URI encodeUri(String uriStr) {
+        var decodedUriStr = UriUtils.decode(uriStr, StandardCharsets.UTF_8);
+        return UriComponentsBuilder.fromUriString(decodedUriStr)
+            .encode(StandardCharsets.UTF_8)
+            .build()
+            .toUri();
+    }
+}
diff --git a/application/src/main/java/run/halo/app/core/attachment/LocalThumbnailProvider.java b/application/src/main/java/run/halo/app/core/attachment/LocalThumbnailProvider.java
new file mode 100644
index 0000000000..5cd976a971
--- /dev/null
+++ b/application/src/main/java/run/halo/app/core/attachment/LocalThumbnailProvider.java
@@ -0,0 +1,43 @@
+package run.halo.app.core.attachment;
+
+import java.net.URI;
+import java.net.URL;
+import lombok.RequiredArgsConstructor;
+import org.apache.commons.lang3.StringUtils;
+import org.springframework.stereotype.Component;
+import org.springframework.util.Assert;
+import reactor.core.publisher.Mono;
+import run.halo.app.infra.ExternalUrlSupplier;
+
+@Component
+@RequiredArgsConstructor
+public class LocalThumbnailProvider implements ThumbnailProvider {
+    private final ExternalUrlSupplier externalUrlSupplier;
+    private final LocalThumbnailService localThumbnailService;
+
+    @Override
+    public Mono<URI> generate(ThumbnailContext context) {
+        return localThumbnailService.create(context.getImageUrl(), context.getSize())
+            .map(localThumbnail -> localThumbnail.getSpec().getThumbnailUri())
+            .map(URI::create);
+    }
+
+    @Override
+    public Mono<Void> delete(URL imageUrl) {
+        Assert.notNull(imageUrl, "Image URL must not be null");
+        return localThumbnailService.delete(URI.create(imageUrl.toString()));
+    }
+
+    @Override
+    public Mono<Boolean> supports(ThumbnailContext context) {
+        var imageUrl = context.getImageUrl();
+        var externalUrl = externalUrlSupplier.getRaw();
+        return Mono.fromSupplier(() -> externalUrl != null
+            && isSameOrigin(imageUrl, externalUrl));
+    }
+
+    private boolean isSameOrigin(URL imageUrl, URL externalUrl) {
+        return StringUtils.equals(imageUrl.getHost(), externalUrl.getHost())
+            && imageUrl.getPort() == externalUrl.getPort();
+    }
+}
diff --git a/application/src/main/java/run/halo/app/core/attachment/LocalThumbnailService.java b/application/src/main/java/run/halo/app/core/attachment/LocalThumbnailService.java
new file mode 100644
index 0000000000..0e2f81e085
--- /dev/null
+++ b/application/src/main/java/run/halo/app/core/attachment/LocalThumbnailService.java
@@ -0,0 +1,81 @@
+package run.halo.app.core.attachment;
+
+import java.net.URI;
+import java.net.URL;
+import java.nio.file.Path;
+import org.springframework.core.io.Resource;
+import org.springframework.lang.NonNull;
+import reactor.core.publisher.Mono;
+import run.halo.app.core.extension.attachment.LocalThumbnail;
+import run.halo.app.infra.ExternalLinkProcessor;
+import run.halo.app.infra.exception.NotFoundException;
+
+public interface LocalThumbnailService {
+
+    /**
+     * Gets original image URI for the given thumbnail URI.
+     *
+     * @param thumbnailUri The thumbnail URI string
+     * @return The original image URI, {@link NotFoundException} will be thrown if the thumbnail
+     * record does not exist by the given thumbnail URI
+     */
+    Mono<URI> getOriginalImageUri(String thumbnailUri);
+
+    /**
+     * <p>Gets thumbnail file resource for the given year, size and filename.</p>
+     * {@link Mono#empty()} will be returned if the thumbnail file does not generate yet or the
+     * thumbnail record does not exist.
+     *
+     * @param thumbnailUri The thumbnail URI string
+     * @return The thumbnail file resource
+     */
+    Mono<Resource> getThumbnail(String thumbnailUri);
+
+    /**
+     * <p>Gets thumbnail file resource for the given URI and size.</p>
+     * {@link Mono#empty()} will be returned if the thumbnail file does not generate yet.
+     *
+     * @param originalImageUri original image URI to get thumbnail
+     * @param size thumbnail size
+     */
+    Mono<Resource> getThumbnail(URI originalImageUri, ThumbnailSize size);
+
+    /**
+     * Generate thumbnail file for the given thumbnail.
+     * Do nothing if the thumbnail file already exists.
+     *
+     * @param thumbnail The thumbnail to generate.
+     * @return The generated thumbnail file resource.
+     */
+    Mono<Resource> generate(LocalThumbnail thumbnail);
+
+    /**
+     * Creates a {@link LocalThumbnail} record for the given image URL and size.
+     * The thumbnail file will be generated asynchronously according to the thumbnail record.
+     *
+     * @param imageUrl original image URL
+     * @param size thumbnail size to generate
+     * @return The created thumbnail record.
+     */
+    Mono<LocalThumbnail> create(URL imageUrl, ThumbnailSize size);
+
+    /**
+     * Deletes the all size thumbnail files for the given image URI.
+     * If the image URI is not absolute, it will be processed by {@link ExternalLinkProcessor}.
+     *
+     * @param imageUri original image URI to delete thumbnails
+     * @return A {@link Mono} indicates the completion of the deletion.
+     */
+    Mono<Void> delete(URI imageUri);
+
+    /**
+     * Ensures the image URI is an url path if it's an in-site image.
+     * If it's not an in-site image, it will return directly.
+     */
+    @NonNull
+    URI ensureInSiteUriIsRelative(URI imageUri);
+
+    Path toFilePath(String thumbRelativeUnixPath);
+
+    String buildThumbnailUri(String year, ThumbnailSize size, String filename);
+}
diff --git a/application/src/main/java/run/halo/app/core/attachment/ThumbnailGenerator.java b/application/src/main/java/run/halo/app/core/attachment/ThumbnailGenerator.java
new file mode 100644
index 0000000000..dc2ec2f021
--- /dev/null
+++ b/application/src/main/java/run/halo/app/core/attachment/ThumbnailGenerator.java
@@ -0,0 +1,173 @@
+package run.halo.app.core.attachment;
+
+import java.io.File;
+import java.io.FileOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.net.URL;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.Iterator;
+import java.util.Optional;
+import javax.imageio.ImageIO;
+import javax.imageio.ImageReader;
+import javax.imageio.stream.ImageInputStream;
+import lombok.AllArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.imgscalr.Scalr;
+
+@Slf4j
+@AllArgsConstructor
+public class ThumbnailGenerator {
+    /**
+     * Max file size in bytes for downloading.
+     * 30MB
+     */
+    static final int MAX_FILE_SIZE = 30 * 1024 * 1024;
+
+    private final ImageDownloader imageDownloader = new ImageDownloader();
+    private final ThumbnailSize size;
+    private final Path storePath;
+
+    /**
+     * Generate thumbnail and save it to store path.
+     */
+    public void generate(URL imageUrl) {
+        Path tempImagePath = null;
+        try {
+            tempImagePath = imageDownloader.downloadFile(imageUrl);
+            generateThumbnail(tempImagePath);
+        } catch (IOException e) {
+            throw new IllegalStateException(e);
+        } finally {
+            if (tempImagePath != null) {
+                try {
+                    Files.deleteIfExists(tempImagePath);
+                } catch (IOException e) {
+                    // Ignore
+                }
+            }
+        }
+    }
+
+    /**
+     * Generate thumbnail by image file path.
+     */
+    public void generate(Path imageFilePath) {
+        try {
+            generateThumbnail(imageFilePath);
+        } catch (IOException e) {
+            throw new IllegalStateException(e);
+        }
+    }
+
+    private void generateThumbnail(Path tempImagePath) throws IOException {
+        var file = tempImagePath.toFile();
+        if (file.length() > MAX_FILE_SIZE) {
+            throw new IOException("File size exceeds the limit: " + MAX_FILE_SIZE);
+        }
+        var formatNameOpt = getFormatName(file);
+        var img = ImageIO.read(file);
+        if (img == null) {
+            throw new UnsupportedOperationException(
+                "Unsupported image format for: " + formatNameOpt.orElse("unknown"));
+        }
+        var thumbnail = Scalr.resize(img, Scalr.Method.SPEED, Scalr.Mode.FIT_TO_WIDTH,
+            size.getWidth());
+        var formatName = formatNameOpt.orElse("jpg");
+        var thumbnailFile = getThumbnailFile(formatName);
+        ImageIO.write(thumbnail, formatName, thumbnailFile);
+    }
+
+    private File getThumbnailFile(String formatName) {
+        return Optional.of(storePath)
+            .map(path -> {
+                if (storePath.endsWith(formatName)) {
+                    return storePath.resolve("." + formatName);
+                }
+                return storePath;
+            })
+            .map(path -> {
+                if (!Files.exists(path.getParent())) {
+                    try {
+                        Files.createDirectories(path.getParent());
+                    } catch (IOException e) {
+                        throw new RuntimeException(e);
+                    }
+                }
+                return path;
+            })
+            .map(Path::toFile)
+            .orElseThrow();
+    }
+
+    /**
+     * Sanitize file name.
+     *
+     * @param fileName file name to sanitize
+     */
+    public static String sanitizeFileName(String fileName) {
+        String sanitizedFileName = fileName.replaceAll("[^a-zA-Z0-9\\.\\-]", "");
+
+        if (sanitizedFileName.length() > 255) {
+            sanitizedFileName = sanitizedFileName.substring(0, 255);
+        }
+
+        return sanitizedFileName;
+    }
+
+    private static Optional<String> getFormatName(File file) {
+        try {
+            return Optional.of(doGetFormatName(file));
+        } catch (IOException e) {
+            // Ignore
+        }
+        return Optional.empty();
+    }
+
+    private static String doGetFormatName(File file) throws IOException {
+        try (ImageInputStream imageStream = ImageIO.createImageInputStream(file)) {
+            Iterator<ImageReader> readers = ImageIO.getImageReaders(imageStream);
+            if (!readers.hasNext()) {
+                throw new IOException("No ImageReader found for the image.");
+            }
+            ImageReader reader = readers.next();
+            return reader.getFormatName().toLowerCase();
+        }
+    }
+
+    static class ImageDownloader {
+        public Path downloadFile(URL url) throws IOException {
+            var encodedUri = AttachmentUtils.encodeUri(url.toString());
+            return downloadFileInternal(encodedUri.toURL());
+        }
+
+        Path downloadFileInternal(URL url) throws IOException {
+            File tempFile = File.createTempFile("halo-image-thumb-", ".tmp");
+            long totalBytesDownloaded = 0;
+            var tempFilePath = tempFile.toPath();
+            try (InputStream inputStream = url.openStream();
+                 FileOutputStream outputStream = new FileOutputStream(tempFile)) {
+
+                byte[] buffer = new byte[4096];
+                int bytesRead;
+
+                while ((bytesRead = inputStream.read(buffer)) != -1) {
+                    totalBytesDownloaded += bytesRead;
+
+                    if (totalBytesDownloaded > MAX_FILE_SIZE) {
+                        outputStream.close();
+                        Files.deleteIfExists(tempFilePath);
+                        throw new IOException("File size exceeds the limit: " + MAX_FILE_SIZE);
+                    }
+
+                    outputStream.write(buffer, 0, bytesRead);
+                }
+            } catch (IOException e) {
+                Files.deleteIfExists(tempFilePath);
+                throw e;
+            }
+            return tempFile.toPath();
+        }
+    }
+}
diff --git a/application/src/main/java/run/halo/app/core/attachment/ThumbnailService.java b/application/src/main/java/run/halo/app/core/attachment/ThumbnailService.java
new file mode 100644
index 0000000000..dfa1680008
--- /dev/null
+++ b/application/src/main/java/run/halo/app/core/attachment/ThumbnailService.java
@@ -0,0 +1,22 @@
+package run.halo.app.core.attachment;
+
+import java.net.URI;
+import reactor.core.publisher.Mono;
+import run.halo.app.infra.ExternalLinkProcessor;
+
+public interface ThumbnailService {
+
+    /**
+     * Generate thumbnail by the given image uri and size.
+     * <p>if the imageUri is not absolute, it will be processed by {@link ExternalLinkProcessor}
+     * .</p>
+     * <p>if externalUrl is not configured, it will return empty.</p>
+     *
+     * @param imageUri image uri to generate thumbnail
+     * @param size thumbnail size to generate
+     * @return generated thumbnail uri if success, otherwise empty.
+     */
+    Mono<URI> generate(URI imageUri, ThumbnailSize size);
+
+    Mono<Void> delete(URI imageUri);
+}
diff --git a/application/src/main/java/run/halo/app/core/attachment/ThumbnailSigner.java b/application/src/main/java/run/halo/app/core/attachment/ThumbnailSigner.java
new file mode 100644
index 0000000000..c9d335e8e9
--- /dev/null
+++ b/application/src/main/java/run/halo/app/core/attachment/ThumbnailSigner.java
@@ -0,0 +1,37 @@
+package run.halo.app.core.attachment;
+
+import java.math.BigInteger;
+import java.nio.charset.StandardCharsets;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import lombok.experimental.UtilityClass;
+
+@UtilityClass
+public class ThumbnailSigner {
+    private static final String ALGORITHM = "SHA-256";
+
+    /**
+     * Generate signature for the given input.
+     *
+     * @param input generally the uri of the thumbnail
+     */
+    public static String generateSignature(String input) {
+        try {
+            MessageDigest digest = MessageDigest.getInstance(ALGORITHM);
+
+            byte[] hashBytes = digest.digest(input.getBytes(StandardCharsets.UTF_8));
+
+            BigInteger number = new BigInteger(1, hashBytes);
+            StringBuilder hexString = new StringBuilder(number.toString(16));
+
+            // Complete the string to ensure a length of 64 characters
+            while (hexString.length() < 64) {
+                hexString.insert(0, '0');
+            }
+
+            return hexString.toString();
+        } catch (NoSuchAlgorithmException e) {
+            throw new RuntimeException(ALGORITHM + " algorithm not found", e);
+        }
+    }
+}
diff --git a/application/src/main/java/run/halo/app/core/attachment/impl/AttachmentRootGetterImpl.java b/application/src/main/java/run/halo/app/core/attachment/impl/AttachmentRootGetterImpl.java
new file mode 100644
index 0000000000..6acda4bcdc
--- /dev/null
+++ b/application/src/main/java/run/halo/app/core/attachment/impl/AttachmentRootGetterImpl.java
@@ -0,0 +1,18 @@
+package run.halo.app.core.attachment.impl;
+
+import java.nio.file.Path;
+import lombok.RequiredArgsConstructor;
+import org.springframework.stereotype.Component;
+import run.halo.app.core.attachment.AttachmentRootGetter;
+import run.halo.app.infra.properties.HaloProperties;
+
+@Component
+@RequiredArgsConstructor
+public class AttachmentRootGetterImpl implements AttachmentRootGetter {
+    private final HaloProperties haloProp;
+
+    @Override
+    public Path get() {
+        return haloProp.getWorkDir().resolve("attachments");
+    }
+}
diff --git a/application/src/main/java/run/halo/app/core/attachment/impl/LocalThumbnailServiceImpl.java b/application/src/main/java/run/halo/app/core/attachment/impl/LocalThumbnailServiceImpl.java
new file mode 100644
index 0000000000..65b231a391
--- /dev/null
+++ b/application/src/main/java/run/halo/app/core/attachment/impl/LocalThumbnailServiceImpl.java
@@ -0,0 +1,284 @@
+package run.halo.app.core.attachment.impl;
+
+import static org.apache.commons.lang3.RandomStringUtils.randomAlphanumeric;
+import static org.apache.commons.lang3.StringUtils.defaultIfBlank;
+import static org.apache.commons.lang3.StringUtils.removeStart;
+import static org.apache.commons.lang3.StringUtils.substringAfterLast;
+import static run.halo.app.extension.MetadataUtil.nullSafeAnnotations;
+import static run.halo.app.extension.index.query.QueryFactory.and;
+import static run.halo.app.extension.index.query.QueryFactory.equal;
+import static run.halo.app.extension.index.query.QueryFactory.isNull;
+
+import java.net.URI;
+import java.net.URL;
+import java.nio.file.FileSystems;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.time.Duration;
+import java.time.LocalDateTime;
+import java.util.concurrent.Callable;
+import java.util.function.Consumer;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.apache.commons.lang3.StringUtils;
+import org.springframework.core.io.FileSystemResource;
+import org.springframework.core.io.Resource;
+import org.springframework.dao.OptimisticLockingFailureException;
+import org.springframework.data.domain.Sort;
+import org.springframework.lang.NonNull;
+import org.springframework.stereotype.Component;
+import org.springframework.util.Assert;
+import reactor.core.Exceptions;
+import reactor.core.publisher.Flux;
+import reactor.core.publisher.Mono;
+import reactor.core.scheduler.Schedulers;
+import reactor.util.retry.Retry;
+import run.halo.app.core.attachment.AttachmentRootGetter;
+import run.halo.app.core.attachment.LocalThumbnailService;
+import run.halo.app.core.attachment.ThumbnailGenerator;
+import run.halo.app.core.attachment.ThumbnailSigner;
+import run.halo.app.core.attachment.ThumbnailSize;
+import run.halo.app.core.extension.attachment.LocalThumbnail;
+import run.halo.app.extension.ListOptions;
+import run.halo.app.extension.ListResult;
+import run.halo.app.extension.Metadata;
+import run.halo.app.extension.PageRequestImpl;
+import run.halo.app.extension.ReactiveExtensionClient;
+import run.halo.app.infra.ExternalUrlSupplier;
+
+@Slf4j
+@Component
+@RequiredArgsConstructor
+public class LocalThumbnailServiceImpl implements LocalThumbnailService {
+    private final AttachmentRootGetter attachmentDirGetter;
+    private final ReactiveExtensionClient client;
+    private final ExternalUrlSupplier externalUrlSupplier;
+
+    private static Path buildThumbnailStorePath(Path rootPath, String fileName, String year,
+        ThumbnailSize size) {
+        return rootPath
+            .resolve("thumbnails")
+            .resolve(year)
+            .resolve("w" + size.getWidth())
+            .resolve(fileName);
+    }
+
+    static String geImageFileName(URL imageUrl) {
+        var fileName = substringAfterLast(imageUrl.getPath(), "/");
+        fileName = defaultIfBlank(fileName, randomAlphanumeric(10));
+        return ThumbnailGenerator.sanitizeFileName(fileName);
+    }
+
+    static String getYear() {
+        return String.valueOf(LocalDateTime.now().getYear());
+    }
+
+    @Override
+    public Mono<URI> getOriginalImageUri(String thumbnailUri) {
+        return fetchThumbnail(thumbnailUri)
+            .map(local -> URI.create(local.getSpec().getImageUri()));
+    }
+
+    @Override
+    public Mono<Resource> getThumbnail(String thumbnailUri) {
+        Assert.notNull(thumbnailUri, "Thumbnail URI must not be null.");
+        return fetchThumbnail(thumbnailUri)
+            .flatMap(thumbnail -> {
+                var filePath = toFilePath(thumbnail.getSpec().getFilePath());
+                if (Files.exists(filePath)) {
+                    return getResourceMono(() -> new FileSystemResource(filePath));
+                }
+                return generate(thumbnail)
+                    .then(Mono.empty());
+            });
+    }
+
+    @Override
+    public Mono<Resource> getThumbnail(URI originalImageUri, ThumbnailSize size) {
+        var imageHash = signatureForImageUri(originalImageUri);
+        return fetchByImageHashAndSize(imageHash, size)
+            .flatMap(this::generate);
+    }
+
+    private Mono<LocalThumbnail> fetchThumbnail(String thumbnailUri) {
+        Assert.notNull(thumbnailUri, "Thumbnail URI must not be null.");
+        var thumbSignature = ThumbnailSigner.generateSignature(thumbnailUri);
+        return client.listBy(LocalThumbnail.class, ListOptions.builder()
+                .fieldQuery(equal("spec.thumbSignature", thumbSignature))
+                .build(), PageRequestImpl.ofSize(1))
+            .flatMap(result -> Mono.justOrEmpty(ListResult.first(result)));
+    }
+
+    private Mono<LocalThumbnail> fetchByImageHashAndSize(String imageSignature,
+        ThumbnailSize size) {
+        return client.listBy(LocalThumbnail.class, ListOptions.builder()
+                .fieldQuery(equal("spec.imageSignature", imageSignature))
+                .build(), PageRequestImpl.ofSize(ThumbnailSize.values().length))
+            .flatMapMany(result -> Flux.fromIterable(result.getItems()))
+            .filter(thumbnail -> thumbnail.getSpec().getSize().equals(size))
+            .next();
+    }
+
+    @Override
+    public Mono<Resource> generate(LocalThumbnail thumbnail) {
+        Assert.notNull(thumbnail, "Thumbnail must not be null.");
+        var filePath = toFilePath(thumbnail.getSpec().getFilePath());
+        if (Files.exists(filePath)) {
+            return getResourceMono(() -> new FileSystemResource(filePath));
+        }
+        return updateWithRetry(thumbnail,
+            record -> nullSafeAnnotations(record)
+                .put(LocalThumbnail.REQUEST_TO_GENERATE_ANNO, "true"))
+            .then(Mono.empty());
+    }
+
+    private static Mono<Resource> getResourceMono(Callable<Resource> callable) {
+        return Mono.fromCallable(callable)
+            .subscribeOn(Schedulers.boundedElastic());
+    }
+
+    private Mono<Void> updateWithRetry(LocalThumbnail localThumbnail, Consumer<LocalThumbnail> op) {
+        op.accept(localThumbnail);
+        return client.update(localThumbnail)
+            .onErrorResume(OptimisticLockingFailureException.class,
+                e -> client.fetch(LocalThumbnail.class, localThumbnail.getMetadata().getName())
+                    .flatMap(latest -> {
+                        op.accept(latest);
+                        return client.update(latest);
+                    })
+                    .retryWhen(Retry.backoff(5, Duration.ofMillis(100))
+                        .filter(OptimisticLockingFailureException.class::isInstance))
+            )
+            .then();
+    }
+
+    @Override
+    public Mono<LocalThumbnail> create(URL imageUrl, ThumbnailSize size) {
+        Assert.notNull(imageUrl, "Image URL must not be null.");
+        Assert.notNull(size, "Thumbnail size must not be null.");
+        var year = getYear();
+        var originalFileName = geImageFileName(imageUrl);
+        var imageUri = URI.create(imageUrl.toString());
+        return generateUniqueThumbFileName(originalFileName, year, size)
+            .flatMap(thumbFileName -> {
+                var filePath =
+                    buildThumbnailStorePath(attachmentDirGetter.get(), thumbFileName, year, size);
+                var thumbnail = new LocalThumbnail();
+                thumbnail.setMetadata(new Metadata());
+                thumbnail.getMetadata().setGenerateName("thumbnail-");
+                var thumbnailUri = buildThumbnailUri(year, size, thumbFileName);
+                var thumbSignature = ThumbnailSigner.generateSignature(thumbnailUri);
+                thumbnail.setSpec(new LocalThumbnail.Spec()
+                    .setImageSignature(signatureForImageUri(imageUri))
+                    .setFilePath(toRelativeUnixPath(filePath))
+                    .setImageUri(ensureInSiteUriIsRelative(imageUri).toString())
+                    .setSize(size)
+                    .setThumbSignature(thumbSignature)
+                    .setThumbnailUri(thumbnailUri));
+                return client.create(thumbnail);
+            });
+    }
+
+    @Override
+    public Mono<Void> delete(URI imageUri) {
+        var signature = signatureForImageUri(imageUri);
+        return client.listAll(LocalThumbnail.class, ListOptions.builder()
+                .fieldQuery(and(
+                    equal("spec.imageSignature", signature),
+                    isNull("metadata.deletionTimestamp"))
+                )
+                .build(), Sort.unsorted())
+            .flatMap(thumbnail -> {
+                var filePath = toFilePath(thumbnail.getSpec().getFilePath());
+                return deleteFile(filePath)
+                    .then(client.delete(thumbnail));
+            })
+            .then();
+    }
+
+    @Override
+    @NonNull
+    public URI ensureInSiteUriIsRelative(URI imageUri) {
+        Assert.notNull(imageUri, "Image URI must not be null.");
+        var externalUrl = externalUrlSupplier.getRaw();
+        if (externalUrl == null || !isSameOrigin(imageUri, externalUrl)) {
+            return imageUri;
+        }
+        var uriStr = imageUri.toString().replaceFirst("^\\w+://", "");
+        uriStr = StringUtils.removeStart(uriStr, imageUri.getAuthority());
+        return URI.create(uriStr);
+    }
+
+    Mono<String> generateUniqueThumbFileName(String originalFileName, String year,
+        ThumbnailSize size) {
+        Assert.notNull(originalFileName, "Original file name must not be null.");
+        return generateUniqueThumbFileName(originalFileName, originalFileName, year, size);
+    }
+
+    private Mono<String> generateUniqueThumbFileName(String originalFileName, String tryFileName,
+        String year, ThumbnailSize size) {
+        var thumbnailUri = buildThumbnailUri(year, size, tryFileName);
+        return fetchThumbnail(thumbnailUri)
+            .flatMap(thumbnail -> {
+                // use the original file name to generate a new file name
+                var newTryFileName = appendRandomSuffix(originalFileName);
+                return generateUniqueThumbFileName(originalFileName, newTryFileName, year, size);
+            })
+            .switchIfEmpty(Mono.just(tryFileName));
+    }
+
+    @Override
+    public Path toFilePath(String relativeUnixPath) {
+        Assert.notNull(relativeUnixPath, "Relative path must not be null.");
+        var systemPath = removeStart(relativeUnixPath, "/")
+            .replace("/", FileSystems.getDefault().getSeparator());
+        return attachmentDirGetter.get().resolve(systemPath);
+    }
+
+    @Override
+    public String buildThumbnailUri(String year, ThumbnailSize size, String filename) {
+        return "/upload/thumbnails/%s/w%s/%s".formatted(year, size.getWidth(), filename);
+    }
+
+    private String toRelativeUnixPath(Path filePath) {
+        var dir = attachmentDirGetter.get().toString();
+        var relativePath = removeStart(filePath.toString(), dir);
+        return relativePath.replace("\\", "/");
+    }
+
+    private Mono<Void> deleteFile(Path path) {
+        return Mono.fromRunnable(
+                () -> {
+                    try {
+                        Files.deleteIfExists(path);
+                    } catch (Exception e) {
+                        throw Exceptions.propagate(e);
+                    }
+                })
+            .subscribeOn(Schedulers.boundedElastic())
+            .then();
+    }
+
+    /**
+     * Generate signature for the given image URI.
+     * <p>if externalUrl is not configured, it will return the signature generated by the image URI
+     * directly, otherwise, it will return the signature generated by the relative path of the
+     * image URL to the external URL.</p>
+     */
+    String signatureForImageUri(URI imageUri) {
+        var uriToSign = ensureInSiteUriIsRelative(imageUri).toString();
+        return ThumbnailSigner.generateSignature(uriToSign);
+    }
+
+    private boolean isSameOrigin(URI imageUri, URL externalUrl) {
+        return StringUtils.equals(imageUri.getHost(), externalUrl.getHost())
+            && imageUri.getPort() == externalUrl.getPort();
+    }
+
+    static String appendRandomSuffix(String fileName) {
+        var baseName = StringUtils.substringBeforeLast(fileName, ".");
+        var extension = substringAfterLast(fileName, ".");
+        var randomSuffix = randomAlphanumeric(6);
+        return String.format("%s_%s.%s", baseName, randomSuffix, extension);
+    }
+}
diff --git a/application/src/main/java/run/halo/app/core/attachment/impl/ThumbnailServiceImpl.java b/application/src/main/java/run/halo/app/core/attachment/impl/ThumbnailServiceImpl.java
new file mode 100644
index 0000000000..fb65d99ba1
--- /dev/null
+++ b/application/src/main/java/run/halo/app/core/attachment/impl/ThumbnailServiceImpl.java
@@ -0,0 +1,133 @@
+package run.halo.app.core.attachment.impl;
+
+import static run.halo.app.extension.index.query.QueryFactory.equal;
+import static run.halo.app.extension.index.query.QueryFactory.startsWith;
+
+import java.net.MalformedURLException;
+import java.net.URI;
+import java.net.URL;
+import java.util.Optional;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.data.domain.Sort;
+import org.springframework.stereotype.Component;
+import org.springframework.util.Assert;
+import reactor.core.publisher.Mono;
+import run.halo.app.core.attachment.AttachmentUtils;
+import run.halo.app.core.attachment.LocalThumbnailService;
+import run.halo.app.core.attachment.ThumbnailProvider;
+import run.halo.app.core.attachment.ThumbnailProvider.ThumbnailContext;
+import run.halo.app.core.attachment.ThumbnailService;
+import run.halo.app.core.attachment.ThumbnailSigner;
+import run.halo.app.core.attachment.ThumbnailSize;
+import run.halo.app.core.extension.attachment.Thumbnail;
+import run.halo.app.extension.ListOptions;
+import run.halo.app.extension.ListResult;
+import run.halo.app.extension.Metadata;
+import run.halo.app.extension.PageRequestImpl;
+import run.halo.app.extension.ReactiveExtensionClient;
+import run.halo.app.infra.ExternalLinkProcessor;
+import run.halo.app.plugin.extensionpoint.ExtensionGetter;
+
+@Slf4j
+@Component
+@RequiredArgsConstructor
+public class ThumbnailServiceImpl implements ThumbnailService {
+    private final ExtensionGetter extensionGetter;
+    private final ReactiveExtensionClient client;
+    private final ExternalLinkProcessor externalLinkProcessor;
+    private final ThumbnailProvider thumbnailProvider;
+    private final LocalThumbnailService localThumbnailService;
+
+    @Override
+    public Mono<URI> generate(URI imageUri, ThumbnailSize size) {
+        var imageUrlOpt = toImageUrl(imageUri);
+        if (imageUrlOpt.isEmpty()) {
+            return Mono.empty();
+        }
+        var imageUrl = imageUrlOpt.get();
+        return fetchThumbnail(imageUri, size)
+            .map(thumbnail -> URI.create(thumbnail.getSpec().getThumbnailUri()))
+            .switchIfEmpty(create(imageUrl, size))
+            .onErrorResume(Throwable.class, e -> {
+                log.warn("Failed to generate thumbnail for image: {}", imageUrl, e);
+                return Mono.just(URI.create(imageUrl.toString()));
+            });
+    }
+
+    @Override
+    public Mono<Void> delete(URI imageUri) {
+        Assert.notNull(imageUri, "Image uri must not be null");
+        Mono<Void> deleteMono;
+        if (imageUri.isAbsolute()) {
+            deleteMono = thumbnailProvider.delete(AttachmentUtils.toUrl(imageUri));
+        } else {
+            // Local thumbnails maybe a relative path, so we need to process it.
+            deleteMono = localThumbnailService.delete(imageUri);
+        }
+        return deleteMono.then(deleteThumbnailRecord(imageUri));
+    }
+
+    private Mono<Void> deleteThumbnailRecord(URI imageUri) {
+        var imageHash = signatureFor(imageUri);
+        var listOptions = ListOptions.builder()
+            .fieldQuery(startsWith(Thumbnail.ID_INDEX, Thumbnail.idIndexFunc(imageHash, "")))
+            .build();
+        return client.listAll(Thumbnail.class, listOptions, Sort.unsorted())
+            .flatMap(client::delete)
+            .then();
+    }
+
+    Optional<URL> toImageUrl(URI imageUri) {
+        try {
+            if (imageUri.isAbsolute()) {
+                return Optional.of(imageUri.toURL());
+            }
+            var url = new URL(externalLinkProcessor.processLink(imageUri.toString()));
+            return Optional.of(url);
+        } catch (MalformedURLException e) {
+            // Ignore
+        }
+        return Optional.empty();
+    }
+
+    Mono<URI> create(URL imageUrl, ThumbnailSize size) {
+        var context = ThumbnailContext.builder()
+            .imageUrl(imageUrl)
+            .size(size)
+            .build();
+        var imageUri =
+            localThumbnailService.ensureInSiteUriIsRelative(URI.create(imageUrl.toString()));
+        return extensionGetter.getEnabledExtensions(ThumbnailProvider.class)
+            .filterWhen(provider -> provider.supports(context))
+            .next()
+            .flatMap(provider -> provider.generate(context))
+            .flatMap(uri -> {
+                var thumb = new Thumbnail();
+                thumb.setMetadata(new Metadata());
+                thumb.getMetadata().setGenerateName("thumb-");
+                thumb.setSpec(new Thumbnail.Spec()
+                    .setSize(size)
+                    .setThumbnailUri(uri.toString())
+                    .setImageUri(imageUri.toString())
+                    .setImageSignature(signatureFor(imageUri))
+                );
+                return client.create(thumb)
+                    .thenReturn(uri);
+            });
+    }
+
+    private String signatureFor(URI imageUri) {
+        var uri = localThumbnailService.ensureInSiteUriIsRelative(imageUri);
+        return ThumbnailSigner.generateSignature(uri.toString());
+    }
+
+    Mono<Thumbnail> fetchThumbnail(URI imageUri, ThumbnailSize size) {
+        var imageHash = signatureFor(imageUri);
+        var id = Thumbnail.idIndexFunc(imageHash, size.name());
+        return client.listBy(Thumbnail.class, ListOptions.builder()
+                .fieldQuery(equal(Thumbnail.ID_INDEX, id))
+                .build(), PageRequestImpl.ofSize(1))
+            .flatMap(result -> Mono.justOrEmpty(ListResult.first(result)));
+    }
+}
diff --git a/application/src/main/java/run/halo/app/core/extension/reconciler/attachment/AttachmentReconciler.java b/application/src/main/java/run/halo/app/core/attachment/reconciler/AttachmentReconciler.java
similarity index 51%
rename from application/src/main/java/run/halo/app/core/extension/reconciler/attachment/AttachmentReconciler.java
rename to application/src/main/java/run/halo/app/core/attachment/reconciler/AttachmentReconciler.java
index d525e2ffa2..0441390cc5 100644
--- a/application/src/main/java/run/halo/app/core/extension/reconciler/attachment/AttachmentReconciler.java
+++ b/application/src/main/java/run/halo/app/core/attachment/reconciler/AttachmentReconciler.java
@@ -1,50 +1,60 @@
-package run.halo.app.core.extension.reconciler.attachment;
+package run.halo.app.core.attachment.reconciler;
+
+import static run.halo.app.extension.ExtensionUtil.addFinalizers;
+import static run.halo.app.extension.ExtensionUtil.removeFinalizers;
 
 import java.net.URI;
-import java.util.HashSet;
+import java.time.Duration;
+import java.util.Map;
 import java.util.Objects;
+import java.util.Optional;
 import java.util.Set;
+import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
+import org.apache.commons.lang3.StringUtils;
 import org.springframework.stereotype.Component;
+import reactor.core.publisher.Flux;
 import reactor.core.publisher.Mono;
+import run.halo.app.core.attachment.AttachmentUtils;
+import run.halo.app.core.attachment.ThumbnailService;
+import run.halo.app.core.attachment.ThumbnailSize;
 import run.halo.app.core.extension.attachment.Attachment;
 import run.halo.app.core.extension.attachment.Attachment.AttachmentStatus;
 import run.halo.app.core.extension.attachment.Constant;
 import run.halo.app.core.extension.service.AttachmentService;
 import run.halo.app.extension.ExtensionClient;
+import run.halo.app.extension.ExtensionUtil;
 import run.halo.app.extension.controller.Controller;
 import run.halo.app.extension.controller.ControllerBuilder;
 import run.halo.app.extension.controller.Reconciler;
 import run.halo.app.extension.controller.Reconciler.Request;
-import run.halo.app.infra.ExternalUrlSupplier;
 
 @Slf4j
 @Component
+@RequiredArgsConstructor
 public class AttachmentReconciler implements Reconciler<Request> {
 
     private final ExtensionClient client;
 
-    private final ExternalUrlSupplier externalUrl;
-
     private final AttachmentService attachmentService;
 
-    public AttachmentReconciler(ExtensionClient client,
-        ExternalUrlSupplier externalUrl, AttachmentService attachmentService) {
-        this.client = client;
-        this.externalUrl = externalUrl;
-        this.attachmentService = attachmentService;
-    }
+    private final ThumbnailService thumbnailService;
 
     @Override
     public Result reconcile(Request request) {
         client.fetch(Attachment.class, request.name()).ifPresent(attachment -> {
-            // TODO Handle the finalizer
-            if (attachment.getMetadata().getDeletionTimestamp() != null) {
-                removeFinalizer(attachment);
+            if (ExtensionUtil.isDeleted(attachment)) {
+                if (removeFinalizers(attachment.getMetadata(), Set.of(Constant.FINALIZER_NAME))) {
+                    cleanUpResources(attachment);
+                    client.update(attachment);
+                }
                 return;
             }
             // add finalizer
-            addFinalizerIfNotSet(request.name(), attachment.getMetadata().getFinalizers());
+            if (addFinalizers(attachment.getMetadata(), Set.of(Constant.FINALIZER_NAME))) {
+                client.update(attachment);
+            }
+
             var annotations = attachment.getMetadata().getAnnotations();
             if (annotations != null) {
                 attachmentService.getPermalink(attachment)
@@ -55,20 +65,29 @@ public Result reconcile(Request request) {
                     }))
                     .doOnNext(permalink -> {
                         log.debug("Set permalink {} for attachment {}", permalink, request.name());
-                        var status = attachment.getStatus();
-                        if (status == null) {
-                            status = new AttachmentStatus();
-                            attachment.setStatus(status);
-                        }
+                        var status = nullSafeStatus(attachment);
                         status.setPermalink(permalink);
                     })
                     .blockOptional();
             }
+            var permalink = nullSafeStatus(attachment).getPermalink();
+            if (StringUtils.isNotBlank(permalink) && AttachmentUtils.isImage(attachment)) {
+                populateThumbnails(permalink, attachment.getStatus());
+            }
             updateStatus(request.name(), attachment.getStatus());
         });
         return null;
     }
 
+    private static AttachmentStatus nullSafeStatus(Attachment attachment) {
+        var status = attachment.getStatus();
+        if (status == null) {
+            status = new AttachmentStatus();
+            attachment.setStatus(status);
+        }
+        return status;
+    }
+
     @Override
     public Controller setupWith(ControllerBuilder builder) {
         return builder
@@ -76,6 +95,17 @@ public Controller setupWith(ControllerBuilder builder) {
             .build();
     }
 
+    void populateThumbnails(String permalink, AttachmentStatus status) {
+        var imageUri = URI.create(permalink);
+        Flux.fromArray(ThumbnailSize.values())
+            .flatMap(size -> thumbnailService.generate(imageUri, size)
+                .map(thumbUri -> Map.entry(size.name(), thumbUri.toString()))
+            )
+            .collectMap(Map.Entry::getKey, Map.Entry::getValue)
+            .doOnNext(status::setThumbnails)
+            .block();
+    }
+
     void updateStatus(String attachmentName, AttachmentStatus status) {
         client.fetch(Attachment.class, attachmentName)
             .filter(attachment -> !Objects.deepEquals(attachment.getStatus(), status))
@@ -85,41 +115,13 @@ void updateStatus(String attachmentName, AttachmentStatus status) {
             });
     }
 
-    void removeFinalizer(Attachment oldAttachment) {
-        if (!hasFinalizer(oldAttachment, Constant.FINALIZER_NAME)) {
-            return;
-        }
-        attachmentService.delete(oldAttachment).block();
-        client.fetch(Attachment.class, oldAttachment.getMetadata().getName())
-            .ifPresent(attachment -> {
-                var finalizers = attachment.getMetadata().getFinalizers();
-                if (hasFinalizer(attachment, Constant.FINALIZER_NAME)
-                    && finalizers.remove(Constant.FINALIZER_NAME)) {
-                    // update it
-                    client.update(attachment);
-                }
-            });
-    }
+    void cleanUpResources(Attachment attachment) {
+        var timeout = Duration.ofSeconds(20);
+        Optional.ofNullable(attachment.getStatus())
+            .map(AttachmentStatus::getPermalink)
+            .map(URI::create)
+            .ifPresent(uri -> thumbnailService.delete(uri).block(timeout));
 
-    boolean hasFinalizer(Attachment attachment, String finalizer) {
-        var finalizers = attachment.getMetadata().getFinalizers();
-        return finalizers != null && finalizers.contains(finalizer);
+        attachmentService.delete(attachment).block(timeout);
     }
-
-    void addFinalizerIfNotSet(String attachmentName, Set<String> existingFinalizers) {
-        if (existingFinalizers != null && existingFinalizers.contains(Constant.FINALIZER_NAME)) {
-            return;
-        }
-
-        client.fetch(Attachment.class, attachmentName).ifPresent(attachment -> {
-            var finalizers = attachment.getMetadata().getFinalizers();
-            if (finalizers == null) {
-                finalizers = new HashSet<>();
-                attachment.getMetadata().setFinalizers(finalizers);
-            }
-            finalizers.add(Constant.FINALIZER_NAME);
-            client.update(attachment);
-        });
-    }
-
 }
diff --git a/application/src/main/java/run/halo/app/core/attachment/reconciler/LocalThumbnailsReconciler.java b/application/src/main/java/run/halo/app/core/attachment/reconciler/LocalThumbnailsReconciler.java
new file mode 100644
index 0000000000..1f1eb7b38f
--- /dev/null
+++ b/application/src/main/java/run/halo/app/core/attachment/reconciler/LocalThumbnailsReconciler.java
@@ -0,0 +1,184 @@
+package run.halo.app.core.attachment.reconciler;
+
+import static org.springframework.data.domain.Sort.Order.desc;
+import static run.halo.app.core.extension.attachment.LocalThumbnail.REQUEST_TO_GENERATE_ANNO;
+import static run.halo.app.extension.MetadataUtil.nullSafeAnnotations;
+import static run.halo.app.extension.index.query.QueryFactory.and;
+import static run.halo.app.extension.index.query.QueryFactory.equal;
+import static run.halo.app.extension.index.query.QueryFactory.isNull;
+import static run.halo.app.infra.utils.FileUtils.checkDirectoryTraversal;
+
+import java.net.MalformedURLException;
+import java.net.URI;
+import java.net.URL;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.Optional;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.apache.commons.lang3.StringUtils;
+import org.springframework.data.domain.Sort;
+import org.springframework.stereotype.Component;
+import run.halo.app.core.attachment.AttachmentRootGetter;
+import run.halo.app.core.attachment.AttachmentUtils;
+import run.halo.app.core.attachment.LocalThumbnailService;
+import run.halo.app.core.attachment.ThumbnailGenerator;
+import run.halo.app.core.extension.attachment.Attachment;
+import run.halo.app.core.extension.attachment.Constant;
+import run.halo.app.core.extension.attachment.LocalThumbnail;
+import run.halo.app.extension.ExtensionClient;
+import run.halo.app.extension.ListOptions;
+import run.halo.app.extension.PageRequestImpl;
+import run.halo.app.extension.controller.Controller;
+import run.halo.app.extension.controller.ControllerBuilder;
+import run.halo.app.extension.controller.Reconciler;
+import run.halo.app.infra.ExternalLinkProcessor;
+
+@Slf4j
+@Component
+@RequiredArgsConstructor
+public class LocalThumbnailsReconciler implements Reconciler<Reconciler.Request> {
+    private final LocalThumbnailService localThumbnailService;
+    private final ExtensionClient client;
+    private final ExternalLinkProcessor externalLinkProcessor;
+    private final AttachmentRootGetter attachmentRootGetter;
+
+    @Override
+    public Result reconcile(Request request) {
+        client.fetch(LocalThumbnail.class, request.name())
+            .ifPresent(thumbnail -> {
+                if (shouldGenerate(thumbnail)) {
+                    requestGenerateThumbnail(thumbnail);
+                    nullSafeAnnotations(thumbnail).remove(REQUEST_TO_GENERATE_ANNO);
+                    client.update(thumbnail);
+                }
+            });
+        return Result.doNotRetry();
+    }
+
+    private boolean shouldGenerate(LocalThumbnail thumbnail) {
+        var annotations = nullSafeAnnotations(thumbnail);
+        return annotations.containsKey(REQUEST_TO_GENERATE_ANNO)
+            || thumbnailFileNotExists(thumbnail);
+    }
+
+    private boolean thumbnailFileNotExists(LocalThumbnail thumbnail) {
+        var filePath = localThumbnailService.toFilePath(thumbnail.getSpec().getFilePath());
+        return !Files.exists(filePath);
+    }
+
+    void requestGenerateThumbnail(LocalThumbnail thumbnail) {
+        // If the thumbnail generation has failed, we should not retry it
+        if (isGenerationFailed(thumbnail)) {
+            return;
+        }
+        var imageUri = thumbnail.getSpec().getImageUri();
+        var filePath = localThumbnailService.toFilePath(thumbnail.getSpec().getFilePath());
+        if (Files.exists(filePath)) {
+            return;
+        }
+        var generator = new ThumbnailGenerator(thumbnail.getSpec().getSize(), filePath);
+        var imageUrlOpt = toImageUrl(imageUri);
+        if (imageUrlOpt.isEmpty()) {
+            if (tryGenerateByAttachment(imageUri, generator)) {
+                thumbnail.getStatus().setPhase(LocalThumbnail.Phase.SUCCEEDED);
+            } else {
+                log.debug("Failed to parse image URL，please check external-url configuration for "
+                    + "record: {}", thumbnail.getMetadata().getName());
+                thumbnail.getStatus().setPhase(LocalThumbnail.Phase.FAILED);
+            }
+            return;
+        }
+        var imageUrl = imageUrlOpt.get();
+        if (generateThumbnail(thumbnail, imageUrl, generator)) {
+            thumbnail.getStatus().setPhase(LocalThumbnail.Phase.SUCCEEDED);
+        } else {
+            thumbnail.getStatus().setPhase(LocalThumbnail.Phase.FAILED);
+        }
+    }
+
+    private boolean isGenerationFailed(LocalThumbnail thumbnail) {
+        return LocalThumbnail.Phase.FAILED.equals(thumbnail.getStatus().getPhase());
+    }
+
+    private boolean generateThumbnail(LocalThumbnail thumbnail, URL imageUrl,
+        ThumbnailGenerator generator) {
+        return tryGenerateByAttachment(thumbnail.getSpec().getImageUri(), generator)
+            || tryGenerateByUrl(imageUrl, generator);
+    }
+
+    private boolean tryGenerate(String resourceIdentifier, Runnable generateAction) {
+        try {
+            generateAction.run();
+            return true;
+        } catch (Throwable e) {
+            log.debug("Failed to generate thumbnail for: {}", resourceIdentifier, e);
+            return false;
+        }
+    }
+
+    private boolean tryGenerateByUrl(URL imageUrl, ThumbnailGenerator generator) {
+        return tryGenerate(imageUrl.toString(), () -> {
+            log.debug("Generating thumbnail for image URL: {}", imageUrl);
+            generator.generate(imageUrl);
+        });
+    }
+
+    private boolean tryGenerateByAttachment(String imageUri, ThumbnailGenerator generator) {
+        return fetchAttachmentFilePath(imageUri)
+            .map(path -> tryGenerate(imageUri, () -> {
+                log.debug("Generating thumbnail for attachment file path: {}", path);
+                generator.generate(path);
+            }))
+            .orElse(false);
+    }
+
+    Optional<URL> toImageUrl(String imageUriStr) {
+        var imageUri = URI.create(imageUriStr);
+        try {
+            var url = new URL(externalLinkProcessor.processLink(imageUri.toString()));
+            return Optional.of(url);
+        } catch (MalformedURLException e) {
+            // Ignore
+        }
+        return Optional.empty();
+    }
+
+    Optional<Path> fetchAttachmentFilePath(String imageUri) {
+        return fetchAttachmentByPermalink(imageUri)
+            .filter(AttachmentUtils::isImage)
+            .map(attachment -> {
+                var annotations = nullSafeAnnotations(attachment);
+                var localRelativePath = annotations.get(Constant.LOCAL_REL_PATH_ANNO_KEY);
+                if (StringUtils.isBlank(localRelativePath)) {
+                    return null;
+                }
+                var attachmentsRoot = attachmentRootGetter.get();
+                var filePath = attachmentsRoot.resolve(localRelativePath);
+                checkDirectoryTraversal(attachmentsRoot, filePath);
+                return filePath;
+            });
+    }
+
+    Optional<Attachment> fetchAttachmentByPermalink(String permalink) {
+        var listOptions = ListOptions.builder()
+            .fieldQuery(and(
+                equal("status.permalink", permalink),
+                isNull("metadata.deletionTimestamp")
+            ))
+            .build();
+        var pageRequest = PageRequestImpl.ofSize(1)
+            .withSort(Sort.by(desc("metadata.creationTimestamp")));
+        return client.listBy(Attachment.class, listOptions, pageRequest)
+            .get()
+            .findFirst();
+    }
+
+    @Override
+    public Controller setupWith(ControllerBuilder builder) {
+        return builder
+            .extension(new LocalThumbnail())
+            .syncAllOnStart(true)
+            .build();
+    }
+}
diff --git a/application/src/main/java/run/halo/app/core/extension/attachment/LocalThumbnail.java b/application/src/main/java/run/halo/app/core/extension/attachment/LocalThumbnail.java
new file mode 100644
index 0000000000..652ffe2f99
--- /dev/null
+++ b/application/src/main/java/run/halo/app/core/extension/attachment/LocalThumbnail.java
@@ -0,0 +1,88 @@
+package run.halo.app.core.extension.attachment;
+
+import static io.swagger.v3.oas.annotations.media.Schema.RequiredMode.NOT_REQUIRED;
+import static io.swagger.v3.oas.annotations.media.Schema.RequiredMode.REQUIRED;
+
+import io.swagger.v3.oas.annotations.media.Schema;
+import lombok.Data;
+import lombok.EqualsAndHashCode;
+import lombok.Getter;
+import lombok.experimental.Accessors;
+import org.springframework.lang.NonNull;
+import run.halo.app.core.attachment.AttachmentRootGetter;
+import run.halo.app.core.attachment.ThumbnailSigner;
+import run.halo.app.core.attachment.ThumbnailSize;
+import run.halo.app.extension.AbstractExtension;
+import run.halo.app.extension.GVK;
+
+@Data
+@EqualsAndHashCode(callSuper = true)
+@GVK(group = "storage.halo.run", version = "v1alpha1", kind = "LocalThumbnail",
+    plural = "localthumbnails", singular = "localthumbnail")
+public class LocalThumbnail extends AbstractExtension {
+    public static final String REQUEST_TO_GENERATE_ANNO = "storage.halo.run/request-to-generate";
+
+    @Schema(requiredMode = REQUIRED)
+    private Spec spec;
+
+    @Getter(onMethod_ = @NonNull)
+    @Schema(requiredMode = NOT_REQUIRED)
+    private Status status = new Status();
+
+    public void setStatus(Status status) {
+        this.status = (status == null ? new Status() : status);
+    }
+
+    public static String signatureFor(String imageUri) {
+        return ThumbnailSigner.generateSignature(imageUri);
+    }
+
+    @Data
+    @Accessors(chain = true)
+    @Schema(name = "LocalThumbnailSpec")
+    public static class Spec {
+        /**
+         * A hash signature for the image uri.
+         *
+         * @see #getImageUri()
+         */
+        @Schema(requiredMode = REQUIRED, minLength = 1)
+        private String imageSignature;
+
+        @Schema(requiredMode = REQUIRED, minLength = 1)
+        private String imageUri;
+
+        @Schema(requiredMode = REQUIRED, minLength = 1)
+        private String thumbnailUri;
+
+        /**
+         * A hash signature for the thumbnail uri.
+         *
+         * @see #getThumbnailUri()
+         */
+        @Schema(requiredMode = REQUIRED, minLength = 1)
+        private String thumbSignature;
+
+        @Schema(requiredMode = REQUIRED)
+        private ThumbnailSize size;
+
+        /**
+         * Consider the compatibility of the system and migration, use unix-style relative paths
+         * here.
+         *
+         * @see AttachmentRootGetter
+         */
+        @Schema(requiredMode = REQUIRED)
+        private String filePath;
+    }
+
+    @Data
+    @Schema(name = "LocalThumbnailStatus")
+    public static class Status {
+        private Phase phase;
+    }
+
+    public enum Phase {
+        PENDING, SUCCEEDED, FAILED
+    }
+}
diff --git a/application/src/main/java/run/halo/app/core/extension/attachment/Thumbnail.java b/application/src/main/java/run/halo/app/core/extension/attachment/Thumbnail.java
new file mode 100644
index 0000000000..759a362f52
--- /dev/null
+++ b/application/src/main/java/run/halo/app/core/extension/attachment/Thumbnail.java
@@ -0,0 +1,49 @@
+package run.halo.app.core.extension.attachment;
+
+import static io.swagger.v3.oas.annotations.media.Schema.RequiredMode.REQUIRED;
+
+import io.swagger.v3.oas.annotations.media.Schema;
+import lombok.Data;
+import lombok.EqualsAndHashCode;
+import lombok.experimental.Accessors;
+import run.halo.app.core.attachment.ThumbnailSize;
+import run.halo.app.extension.AbstractExtension;
+import run.halo.app.extension.GVK;
+
+@Data
+@EqualsAndHashCode(callSuper = true)
+@GVK(group = "storage.halo.run", version = "v1alpha1", kind = "Thumbnail",
+    plural = "thumbnails", singular = "thumbnail")
+public class Thumbnail extends AbstractExtension {
+
+    public static final String ID_INDEX = "thumbnail-id";
+
+    @Schema(requiredMode = REQUIRED)
+    private Spec spec;
+
+    @Data
+    @Accessors(chain = true)
+    @Schema(name = "ThumbnailSpec")
+    public static class Spec {
+        @Schema(requiredMode = REQUIRED, minLength = 1)
+        private String imageSignature;
+
+        @Schema(requiredMode = REQUIRED, minLength = 1)
+        private String imageUri;
+
+        @Schema(requiredMode = REQUIRED)
+        private ThumbnailSize size;
+
+        @Schema(requiredMode = REQUIRED, minLength = 1)
+        private String thumbnailUri;
+    }
+
+    public static String idIndexFunc(Thumbnail thumbnail) {
+        return idIndexFunc(thumbnail.getSpec().getImageSignature(),
+            thumbnail.getSpec().getSize().name());
+    }
+
+    public static String idIndexFunc(String imageHash, String size) {
+        return imageHash + "-" + size;
+    }
+}
diff --git a/application/src/main/java/run/halo/app/core/extension/attachment/endpoint/AttachmentEndpoint.java b/application/src/main/java/run/halo/app/core/extension/attachment/endpoint/AttachmentEndpoint.java
index 792b942362..0d75c422a1 100644
--- a/application/src/main/java/run/halo/app/core/extension/attachment/endpoint/AttachmentEndpoint.java
+++ b/application/src/main/java/run/halo/app/core/extension/attachment/endpoint/AttachmentEndpoint.java
@@ -27,6 +27,7 @@
 import java.util.List;
 import java.util.Objects;
 import java.util.Optional;
+import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 import org.apache.commons.lang3.BooleanUtils;
 import org.springdoc.core.fn.builders.operation.Builder;
@@ -63,18 +64,13 @@
 
 @Slf4j
 @Component
+@RequiredArgsConstructor
 public class AttachmentEndpoint implements CustomEndpoint {
 
     private final AttachmentService attachmentService;
 
     private final ReactiveExtensionClient client;
 
-    public AttachmentEndpoint(AttachmentService attachmentService,
-        ReactiveExtensionClient client) {
-        this.attachmentService = attachmentService;
-        this.client = client;
-    }
-
     @Override
     public RouterFunction<ServerResponse> endpoint() {
         var tag = "AttachmentV1alpha1Console";
@@ -189,7 +185,7 @@ public interface ISearchRequest extends IListRequest {
                 example = "creationTimestamp,desc"))
         Sort getSort();
 
-        public static void buildParameters(Builder builder) {
+        static void buildParameters(Builder builder) {
             IListRequest.buildParameters(builder);
             builder.parameter(QueryParamBuildUtil.sortParameter())
                 .parameter(parameterBuilder()
diff --git a/application/src/main/java/run/halo/app/core/extension/attachment/endpoint/LocalAttachmentUploadHandler.java b/application/src/main/java/run/halo/app/core/extension/attachment/endpoint/LocalAttachmentUploadHandler.java
index 60ef6c9c50..b0db21fc81 100644
--- a/application/src/main/java/run/halo/app/core/extension/attachment/endpoint/LocalAttachmentUploadHandler.java
+++ b/application/src/main/java/run/halo/app/core/extension/attachment/endpoint/LocalAttachmentUploadHandler.java
@@ -36,6 +36,7 @@
 import reactor.core.publisher.Mono;
 import reactor.core.scheduler.Schedulers;
 import reactor.util.retry.Retry;
+import run.halo.app.core.attachment.AttachmentRootGetter;
 import run.halo.app.core.extension.attachment.Attachment;
 import run.halo.app.core.extension.attachment.Attachment.AttachmentSpec;
 import run.halo.app.core.extension.attachment.Constant;
@@ -47,7 +48,6 @@
 import run.halo.app.infra.exception.AttachmentAlreadyExistsException;
 import run.halo.app.infra.exception.FileSizeExceededException;
 import run.halo.app.infra.exception.FileTypeNotAllowedException;
-import run.halo.app.infra.properties.HaloProperties;
 import run.halo.app.infra.utils.FileTypeDetectUtils;
 import run.halo.app.infra.utils.JsonUtils;
 
@@ -55,20 +55,16 @@
 @Component
 class LocalAttachmentUploadHandler implements AttachmentHandler {
 
-    private final HaloProperties haloProp;
+    private final AttachmentRootGetter attachmentDirGetter;
 
     private final ExternalUrlSupplier externalUrl;
 
-    public LocalAttachmentUploadHandler(HaloProperties haloProp,
+    public LocalAttachmentUploadHandler(AttachmentRootGetter attachmentDirGetter,
         ExternalUrlSupplier externalUrl) {
-        this.haloProp = haloProp;
+        this.attachmentDirGetter = attachmentDirGetter;
         this.externalUrl = externalUrl;
     }
 
-    Path getAttachmentsRoot() {
-        return haloProp.getWorkDir().resolve("attachments");
-    }
-
     @Override
     public Mono<Attachment> upload(UploadContext uploadOption) {
         return Mono.just(uploadOption)
@@ -78,7 +74,7 @@ public Mono<Attachment> upload(UploadContext uploadOption) {
                 var settingJson = configMap.getData().getOrDefault("default", "{}");
                 var setting = JsonUtils.jsonToObject(settingJson, PolicySetting.class);
 
-                final var attachmentsRoot = getAttachmentsRoot();
+                final var attachmentsRoot = attachmentDirGetter.get();
                 final var uploadRoot = attachmentsRoot.resolve("upload");
                 final var file = option.file();
                 final Path attachmentPath;
@@ -195,7 +191,7 @@ public Mono<Attachment> delete(DeleteContext deleteContext) {
                 if (annotations != null) {
                     var localRelativePath = annotations.get(Constant.LOCAL_REL_PATH_ANNO_KEY);
                     if (StringUtils.hasText(localRelativePath)) {
-                        var attachmentsRoot = getAttachmentsRoot();
+                        var attachmentsRoot = attachmentDirGetter.get();
                         var attachmentPath = attachmentsRoot.resolve(localRelativePath);
                         checkDirectoryTraversal(attachmentsRoot, attachmentPath);
 
@@ -255,23 +251,6 @@ private boolean shouldHandle(Policy policy) {
         return "local".equals(policy.getSpec().getTemplateName());
     }
 
-    @Data
-    public static class PolicySetting {
-
-        private String location;
-
-        private DataSize maxFileSize;
-
-        private Set<String> allowedFileTypes;
-
-        public void setMaxFileSize(String maxFileSize) {
-            if (!StringUtils.hasText(maxFileSize)) {
-                return;
-            }
-            this.maxFileSize = DataSize.parse(maxFileSize);
-        }
-    }
-
     /**
      * Write content into file. We will detect duplicate filename and auto-rename it with 3 times
      * retry.
@@ -307,4 +286,21 @@ private Mono<Path> writeContent(Flux<DataBuffer> content,
                 .then(Mono.fromSupplier(pathRef::get));
         });
     }
+
+    @Data
+    public static class PolicySetting {
+
+        private String location;
+
+        private DataSize maxFileSize;
+
+        private Set<String> allowedFileTypes;
+
+        public void setMaxFileSize(String maxFileSize) {
+            if (!StringUtils.hasText(maxFileSize)) {
+                return;
+            }
+            this.maxFileSize = DataSize.parse(maxFileSize);
+        }
+    }
 }
diff --git a/application/src/main/java/run/halo/app/infra/DefaultExternalLinkProcessor.java b/application/src/main/java/run/halo/app/infra/DefaultExternalLinkProcessor.java
index f3b909181d..50f7bc7d0e 100644
--- a/application/src/main/java/run/halo/app/infra/DefaultExternalLinkProcessor.java
+++ b/application/src/main/java/run/halo/app/infra/DefaultExternalLinkProcessor.java
@@ -1,11 +1,7 @@
 package run.halo.app.infra;
 
-import java.net.URI;
-import java.net.URISyntaxException;
-import java.net.URL;
 import lombok.RequiredArgsConstructor;
 import org.apache.commons.lang3.StringUtils;
-import org.springframework.lang.NonNull;
 import org.springframework.stereotype.Component;
 import run.halo.app.infra.utils.PathUtils;
 
@@ -23,13 +19,9 @@ public class DefaultExternalLinkProcessor implements ExternalLinkProcessor {
     @Override
     public String processLink(String link) {
         var externalLink = externalUrlSupplier.getRaw();
-        if (StringUtils.isBlank(link)) {
+        if (StringUtils.isBlank(link) || externalLink == null || PathUtils.isAbsoluteUri(link)) {
             return link;
         }
-        if (externalLink == null || !linkInSite(externalLink, link)) {
-            return link;
-        }
-
         return append(externalLink.toString(), link);
     }
 
@@ -37,18 +29,4 @@ String append(String externalLink, String link) {
         return StringUtils.removeEnd(externalLink, "/")
             + StringUtils.prependIfMissing(link, "/");
     }
-
-    boolean linkInSite(@NonNull URL externalUrl, @NonNull String link) {
-        if (!PathUtils.isAbsoluteUri(link)) {
-            // relative uri is always in site
-            return true;
-        }
-        try {
-            URI requestUri = new URI(link);
-            return StringUtils.equals(externalUrl.getAuthority(), requestUri.getAuthority());
-        } catch (URISyntaxException e) {
-            // ignore this link
-        }
-        return false;
-    }
 }
diff --git a/application/src/main/java/run/halo/app/infra/SchemeInitializer.java b/application/src/main/java/run/halo/app/infra/SchemeInitializer.java
index 898627bff0..0825ce4470 100644
--- a/application/src/main/java/run/halo/app/infra/SchemeInitializer.java
+++ b/application/src/main/java/run/halo/app/infra/SchemeInitializer.java
@@ -36,8 +36,10 @@
 import run.halo.app.core.extension.UserConnection.UserConnectionSpec;
 import run.halo.app.core.extension.attachment.Attachment;
 import run.halo.app.core.extension.attachment.Group;
+import run.halo.app.core.extension.attachment.LocalThumbnail;
 import run.halo.app.core.extension.attachment.Policy;
 import run.halo.app.core.extension.attachment.PolicyTemplate;
+import run.halo.app.core.extension.attachment.Thumbnail;
 import run.halo.app.core.extension.content.Category;
 import run.halo.app.core.extension.content.Comment;
 import run.halo.app.core.extension.content.Post;
@@ -466,8 +468,34 @@ public void onApplicationEvent(@NonNull ApplicationContextInitializedEvent event
                         return size != null ? size.toString() : null;
                     }))
             );
+            indexSpecs.add(new IndexSpec()
+                .setName("status.permalink")
+                .setIndexFunc(simpleAttribute(Attachment.class, attachment -> {
+                    var status = attachment.getStatus();
+                    return status == null ? null : status.getPermalink();
+                }))
+            );
         });
         schemeManager.register(PolicyTemplate.class);
+        schemeManager.register(Thumbnail.class, indexSpec -> {
+            indexSpec.add(new IndexSpec()
+                .setName(Thumbnail.ID_INDEX)
+                .setIndexFunc(simpleAttribute(Thumbnail.class, Thumbnail::idIndexFunc))
+            );
+        });
+        schemeManager.register(LocalThumbnail.class, indexSpec -> {
+            indexSpec.add(new IndexSpec()
+                .setName("spec.imageSignature")
+                .setIndexFunc(simpleAttribute(LocalThumbnail.class,
+                    thumbnail -> thumbnail.getSpec().getImageSignature())
+                ));
+            indexSpec.add(new IndexSpec()
+                .setName("spec.thumbSignature")
+                .setUnique(true)
+                .setIndexFunc(simpleAttribute(LocalThumbnail.class,
+                    thumbnail -> thumbnail.getSpec().getThumbSignature())
+                ));
+        });
         // metrics.halo.run
         schemeManager.register(Counter.class);
         // auth.halo.run
diff --git a/application/src/main/java/run/halo/app/theme/endpoint/ThumbnailEndpoint.java b/application/src/main/java/run/halo/app/theme/endpoint/ThumbnailEndpoint.java
new file mode 100644
index 0000000000..fecde3c9db
--- /dev/null
+++ b/application/src/main/java/run/halo/app/theme/endpoint/ThumbnailEndpoint.java
@@ -0,0 +1,169 @@
+package run.halo.app.theme.endpoint;
+
+import static io.swagger.v3.oas.annotations.media.Schema.RequiredMode.REQUIRED;
+import static org.apache.commons.lang3.StringUtils.removeStart;
+import static org.springdoc.core.fn.builders.apiresponse.Builder.responseBuilder;
+import static org.springdoc.core.fn.builders.parameter.Builder.parameterBuilder;
+
+import io.swagger.v3.oas.annotations.enums.ParameterIn;
+import io.swagger.v3.oas.annotations.media.Schema;
+import java.io.IOException;
+import java.net.URI;
+import java.time.Instant;
+import lombok.RequiredArgsConstructor;
+import org.apache.commons.lang3.StringUtils;
+import org.springdoc.core.fn.builders.operation.Builder;
+import org.springdoc.webflux.core.fn.SpringdocRouteBuilder;
+import org.springframework.boot.autoconfigure.web.WebProperties;
+import org.springframework.context.annotation.Bean;
+import org.springframework.core.io.Resource;
+import org.springframework.http.CacheControl;
+import org.springframework.stereotype.Component;
+import org.springframework.util.MultiValueMap;
+import org.springframework.web.reactive.function.BodyInserters;
+import org.springframework.web.reactive.function.server.RouterFunction;
+import org.springframework.web.reactive.function.server.RouterFunctions;
+import org.springframework.web.reactive.function.server.ServerRequest;
+import org.springframework.web.reactive.function.server.ServerResponse;
+import org.springframework.web.server.ServerWebInputException;
+import reactor.core.publisher.Mono;
+import run.halo.app.core.attachment.AttachmentUtils;
+import run.halo.app.core.attachment.LocalThumbnailService;
+import run.halo.app.core.attachment.ThumbnailService;
+import run.halo.app.core.attachment.ThumbnailSize;
+import run.halo.app.core.extension.endpoint.CustomEndpoint;
+import run.halo.app.extension.GroupVersion;
+
+/**
+ * Thumbnail endpoint for thumbnail resource access.
+ *
+ * @author guqing
+ * @since 2.19.0
+ */
+@Component
+@RequiredArgsConstructor
+public class ThumbnailEndpoint implements CustomEndpoint {
+    private final LocalThumbnailService localThumbnailService;
+    private final WebProperties webProperties;
+    private final ThumbnailService thumbnailService;
+
+    @Override
+    public RouterFunction<ServerResponse> endpoint() {
+        var tag = "ThumbnailV1alpha1Public";
+        return SpringdocRouteBuilder.route()
+            .GET("/thumbnails/-/via-uri", this::getThumbnailByUri, builder -> {
+                builder.operationId("GetThumbnailByUri")
+                    .description("Get thumbnail by URI")
+                    .tag(tag)
+                    .response(responseBuilder()
+                        .implementation(Resource.class));
+                ThumbnailQuery.buildParameters(builder);
+            })
+            .build();
+    }
+
+    private Mono<ServerResponse> getThumbnailByUri(ServerRequest request) {
+        var query = new ThumbnailQuery(request.queryParams());
+        return thumbnailService.generate(query.getUri(), query.getWidth())
+            .defaultIfEmpty(query.getUri())
+            .flatMap(uri -> ServerResponse.permanentRedirect(uri).build());
+    }
+
+    static class ThumbnailQuery {
+        private final MultiValueMap<String, String> params;
+
+        public ThumbnailQuery(MultiValueMap<String, String> params) {
+            this.params = params;
+        }
+
+        @Schema(requiredMode = REQUIRED)
+        public URI getUri() {
+            var uriStr = params.getFirst("uri");
+            if (StringUtils.isBlank(uriStr)) {
+                throw new ServerWebInputException("Required parameter 'uri' is missing");
+            }
+            return AttachmentUtils.encodeUri(uriStr);
+        }
+
+        @Schema(requiredMode = REQUIRED)
+        public ThumbnailSize getWidth() {
+            var width = params.getFirst("width");
+            if (StringUtils.isBlank(width)) {
+                throw new ServerWebInputException("Required parameter 'width' is missing");
+            }
+            // Remove the 'w' prefix
+            return ThumbnailSize.fromWidth(removeStart(width, 'w'));
+        }
+
+        public static void buildParameters(Builder builder) {
+            builder.parameter(parameterBuilder()
+                    .in(ParameterIn.QUERY)
+                    .name("uri")
+                    .description("The URI of the image")
+                    .required(true))
+                .parameter(parameterBuilder()
+                    .in(ParameterIn.QUERY)
+                    .name("width")
+                    .description("The width of the thumbnail")
+                    .required(true));
+        }
+    }
+
+    @Bean
+    RouterFunction<ServerResponse> localThumbnailResourceRouter() {
+        return RouterFunctions.route()
+            .GET("/upload/thumbnails/{year}/w{width}/{fileName}", request -> {
+                var width = request.pathVariable("width");
+                var year = request.pathVariable("year");
+                var fileName = request.pathVariable("fileName");
+                var size = ThumbnailSize.fromWidth(width);
+                var thumbnailUri = localThumbnailService.buildThumbnailUri(year, size, fileName);
+                return localThumbnailService.getThumbnail(thumbnailUri)
+                    .flatMap(resource -> getResourceResponse(request, resource))
+                    .switchIfEmpty(Mono.defer(
+                        () -> localThumbnailService.getOriginalImageUri(thumbnailUri)
+                            .flatMap(this::fallback))
+                    );
+            })
+
+            .build();
+    }
+
+    @Override
+    public GroupVersion groupVersion() {
+        return new GroupVersion("api.storage.halo.run", "v1alpha1");
+    }
+
+    private Mono<ServerResponse> getResourceResponse(ServerRequest request, Resource resource) {
+        var resourceProperties = webProperties.getResources();
+        final var useLastModified = resourceProperties.getCache().isUseLastModified();
+        final var cacheControl = getCacheControl(resourceProperties);
+        var bodyBuilder = ServerResponse.ok().cacheControl(cacheControl);
+        try {
+            if (useLastModified) {
+                var lastModified = Instant.ofEpochMilli(resource.lastModified());
+                return request.checkNotModified(lastModified)
+                    .switchIfEmpty(Mono.defer(() -> bodyBuilder.lastModified(lastModified)
+                        .body(BodyInserters.fromResource(resource))
+                    ));
+            }
+            return bodyBuilder.body(BodyInserters.fromResource(resource));
+        } catch (IOException e) {
+            return Mono.error(e);
+        }
+    }
+
+    private Mono<ServerResponse> fallback(URI imageUri) {
+        return ServerResponse.temporaryRedirect(imageUri).build();
+    }
+
+    private static CacheControl getCacheControl(WebProperties.Resources resourceProperties) {
+        var cacheControl = resourceProperties.getCache()
+            .getCachecontrol()
+            .toHttpCacheControl();
+        if (cacheControl == null) {
+            cacheControl = CacheControl.empty();
+        }
+        return cacheControl;
+    }
+}
diff --git a/application/src/main/java/run/halo/app/theme/finders/ThumbnailFinder.java b/application/src/main/java/run/halo/app/theme/finders/ThumbnailFinder.java
new file mode 100644
index 0000000000..32bb407308
--- /dev/null
+++ b/application/src/main/java/run/halo/app/theme/finders/ThumbnailFinder.java
@@ -0,0 +1,20 @@
+package run.halo.app.theme.finders;
+
+import reactor.core.publisher.Mono;
+
+/**
+ * A dialect expression for image thumbnail.
+ *
+ * @author guqing
+ * @since 2.19.0
+ */
+public interface ThumbnailFinder {
+
+    /**
+     * Generate thumbnail url from given image url and size.
+     *
+     * @param size the size of thumbnail to generate
+     * @return the generated thumbnail url
+     */
+    Mono<String> gen(String url, String size);
+}
diff --git a/application/src/main/java/run/halo/app/theme/finders/impl/ThumbnailFinderImpl.java b/application/src/main/java/run/halo/app/theme/finders/impl/ThumbnailFinderImpl.java
new file mode 100644
index 0000000000..5ad7f4984a
--- /dev/null
+++ b/application/src/main/java/run/halo/app/theme/finders/impl/ThumbnailFinderImpl.java
@@ -0,0 +1,22 @@
+package run.halo.app.theme.finders.impl;
+
+import java.net.URI;
+import lombok.RequiredArgsConstructor;
+import reactor.core.publisher.Mono;
+import run.halo.app.core.attachment.ThumbnailService;
+import run.halo.app.core.attachment.ThumbnailSize;
+import run.halo.app.theme.finders.Finder;
+import run.halo.app.theme.finders.ThumbnailFinder;
+
+@Finder("thumbnail")
+@RequiredArgsConstructor
+public class ThumbnailFinderImpl implements ThumbnailFinder {
+    private final ThumbnailService thumbnailService;
+
+    @Override
+    public Mono<String> gen(String url, String size) {
+        return thumbnailService.generate(URI.create(url), ThumbnailSize.fromName(size))
+            .map(URI::toString)
+            .defaultIfEmpty(url);
+    }
+}
diff --git a/application/src/main/resources/extensions/extension-definitions.yaml b/application/src/main/resources/extensions/extension-definitions.yaml
index b654fd16e7..b8f871c4e8 100644
--- a/application/src/main/resources/extensions/extension-definitions.yaml
+++ b/application/src/main/resources/extensions/extension-definitions.yaml
@@ -47,3 +47,13 @@ spec:
   displayName: "Lucene 搜索引擎"
   description: "Halo 自带的本地搜索引擎"
   icon: /images/extension-points/lucene.png
+---
+apiVersion: plugin.halo.run/v1alpha1
+kind: ExtensionDefinition
+metadata:
+  name: post-content-thumbnail-handler
+spec:
+  className: run.halo.app.content.PostContentThumbnailHandler
+  extensionPointName: reactive-post-content-handler
+  displayName: "文章内容缩略图处理"
+  description: "处理文章的 HTML 内容为 img 标签追加缩略图"
diff --git a/application/src/main/resources/extensions/extensionpoint-definitions.yaml b/application/src/main/resources/extensions/extensionpoint-definitions.yaml
index 2e098119c2..7e06522fd6 100644
--- a/application/src/main/resources/extensions/extensionpoint-definitions.yaml
+++ b/application/src/main/resources/extensions/extensionpoint-definitions.yaml
@@ -97,3 +97,13 @@ spec:
   displayName: 摘要生成器
   type: SINGLETON
   description: "提供自动生成摘要的方式扩展，如使用算法提取或使用 AI 生成。"
+---
+apiVersion: plugin.halo.run/v1alpha1
+kind: ExtensionPointDefinition
+metadata:
+  name: thumbnail-provider
+spec:
+  className: run.halo.app.core.attachment.ThumbnailProvider
+  displayName: 图片缩略图生成
+  type: MULTI_INSTANCE
+  description: "提供生成图片缩略图的扩展方式"
diff --git a/application/src/main/resources/extensions/role-template-anonymous.yaml b/application/src/main/resources/extensions/role-template-anonymous.yaml
index 06e23a7a8e..8f2ffce10e 100644
--- a/application/src/main/resources/extensions/role-template-anonymous.yaml
+++ b/application/src/main/resources/extensions/role-template-anonymous.yaml
@@ -45,4 +45,7 @@ rules:
     verbs: [ "get", "list" ]
   - apiGroups: [ "api.notification.halo.run" ]
     resources: [ "subscriptions/unsubscribe" ]
+    verbs: [ "get", "list" ]
+  - apiGroups: [ "api.storage.halo.run" ]
+    resources: [ "thumbnails/via-uri" ]
     verbs: [ "get", "list" ]
\ No newline at end of file
diff --git a/application/src/test/java/run/halo/app/content/HtmlThumbnailSrcsetInjectorTest.java b/application/src/test/java/run/halo/app/content/HtmlThumbnailSrcsetInjectorTest.java
new file mode 100644
index 0000000000..5976457863
--- /dev/null
+++ b/application/src/test/java/run/halo/app/content/HtmlThumbnailSrcsetInjectorTest.java
@@ -0,0 +1,46 @@
+package run.halo.app.content;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static run.halo.app.content.HtmlThumbnailSrcsetInjector.buildSizesAttr;
+
+import org.junit.jupiter.api.Test;
+import reactor.core.publisher.Mono;
+
+/**
+ * Tests for {@link HtmlThumbnailSrcsetInjector}.
+ *
+ * @author guqing
+ * @since 2.19.0
+ */
+class HtmlThumbnailSrcsetInjectorTest {
+
+    @Test
+    void injectSrcset() {
+        String html = """
+            <div>
+              <img src='image1.jpg' alt="test">
+              <img src='image2.jpg' srcset='image2-small.jpg \
+            480w, image2-large.jpg 800w'>
+            </div>
+            """;
+        var result = HtmlThumbnailSrcsetInjector.injectSrcset(html,
+            src -> Mono.just(src + " 480w, " + src + " 800w")).block();
+        assertThat(result).isEqualToIgnoringWhitespace("""
+            <div>
+              <img src="image1.jpg" alt="test" srcset="image1.jpg 480w, image1.jpg 800w"\
+                sizes="(max-width: 400px) 400px, (max-width: 800px) 800px,\
+                 (max-width: 1200px) 1200px, (max-width: 1600px) 1600px">
+              <img src="image2.jpg" srcset="image2-small.jpg 480w, image2-large.jpg 800w">
+            </div>
+            """);
+    }
+
+    @Test
+    void buildSizesTest() {
+        var sizes = buildSizesAttr();
+        assertThat(sizes).isEqualToIgnoringWhitespace("""
+            (max-width: 400px) 400px, (max-width: 800px) 800px,
+            (max-width: 1200px) 1200px, (max-width: 1600px) 1600px
+            """);
+    }
+}
diff --git a/application/src/test/java/run/halo/app/core/attachment/AttachmentUtilsTest.java b/application/src/test/java/run/halo/app/core/attachment/AttachmentUtilsTest.java
new file mode 100644
index 0000000000..821679ffd0
--- /dev/null
+++ b/application/src/test/java/run/halo/app/core/attachment/AttachmentUtilsTest.java
@@ -0,0 +1,27 @@
+package run.halo.app.core.attachment;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+import org.junit.jupiter.api.Test;
+
+/**
+ * Tests for {@link AttachmentUtils}.
+ *
+ * @author guqing
+ * @since 2.19.0
+ */
+class AttachmentUtilsTest {
+
+    @Test
+    void encodeUriTest() {
+        String urlStr =
+            "http://localhost:8090/upload/2022/06/CleanShot 2022-06-12 at 23.30.22@2x.webp";
+        var result = AttachmentUtils.encodeUri(urlStr);
+        var targetUriStr =
+            "http://localhost:8090/upload/2022/06/CleanShot%202022-06-12%20at%2023.30.22@2x.webp";
+        assertThat(result.toString()).isEqualTo(targetUriStr);
+
+        result = AttachmentUtils.encodeUri(targetUriStr);
+        assertThat(result.toString()).isEqualTo(targetUriStr);
+    }
+}
diff --git a/application/src/test/java/run/halo/app/core/attachment/ThumbnailGeneratorTest.java b/application/src/test/java/run/halo/app/core/attachment/ThumbnailGeneratorTest.java
new file mode 100644
index 0000000000..e50da39ba9
--- /dev/null
+++ b/application/src/test/java/run/halo/app/core/attachment/ThumbnailGeneratorTest.java
@@ -0,0 +1,91 @@
+package run.halo.app.core.attachment;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+import static org.mockito.Mockito.doAnswer;
+import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.spy;
+
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.net.URL;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Nested;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.junit.jupiter.MockitoExtension;
+
+/**
+ * Tests for {@link ThumbnailGenerator}.
+ *
+ * @author guqing
+ * @since 2.19.0
+ */
+@ExtendWith(MockitoExtension.class)
+class ThumbnailGeneratorTest {
+
+    @Test
+    void sanitizeFileName() {
+        String sanitizedFileName = ThumbnailGenerator.sanitizeFileName("example.jpg");
+        assertThat(sanitizedFileName).isEqualTo("example.jpg");
+
+        sanitizedFileName = ThumbnailGenerator.sanitizeFileName("exampl./e$%^7*—=.jpg");
+        assertThat(sanitizedFileName).isEqualTo("exampl.e7.jpg");
+    }
+
+    @Nested
+    class ImageDownloaderTest {
+        private final ThumbnailGenerator.ImageDownloader imageDownloader =
+            new ThumbnailGenerator.ImageDownloader();
+
+        private Path tempFile;
+
+        @AfterEach
+        void tearDown() throws IOException {
+            if (tempFile != null && Files.exists(tempFile)) {
+                Files.delete(tempFile);
+            }
+        }
+
+        @Test
+        void testDownloadImage_Success() throws Exception {
+            var imageUrl = new URL("https://example.com/sample-image.jpg");
+            URL spyImageUrl = spy(imageUrl);
+            String mockImageData = "fakeImageData";
+            InputStream mockInputStream = new ByteArrayInputStream(mockImageData.getBytes());
+
+            doAnswer(invocation -> mockInputStream).when(spyImageUrl).openStream();
+
+            var path = imageDownloader.downloadFileInternal(spyImageUrl);
+            assertThat(path).isNotNull();
+            tempFile = path;
+            assertThat(Files.exists(path)).isTrue();
+            try {
+                assertThat(Files.size(path)).isEqualTo(mockImageData.length());
+            } catch (IOException e) {
+                throw new RuntimeException(e);
+            }
+            String fileName = path.getFileName().toString();
+            assertThat(fileName).endsWith(".tmp");
+        }
+
+        @Test
+        void downloadImage_FileSizeLimitExceeded() throws Exception {
+            String largeImageUrl = "https://example.com/large-image.jpg";
+            URL spyImageUrl = spy(new URL(largeImageUrl));
+
+            // larger than MAX_FILE_SIZE
+            var fileSizeByte = ThumbnailGenerator.MAX_FILE_SIZE + 10;
+            byte[] largeImageData = new byte[fileSizeByte];
+            InputStream mockInputStream = new ByteArrayInputStream(largeImageData);
+
+            doReturn(mockInputStream).when(spyImageUrl).openStream();
+            assertThatThrownBy(() -> imageDownloader.downloadFileInternal(spyImageUrl))
+                .isInstanceOf(IOException.class)
+                .hasMessageContaining("File size exceeds the limit");
+        }
+    }
+}
diff --git a/application/src/test/java/run/halo/app/core/attachment/ThumbnailSignerTest.java b/application/src/test/java/run/halo/app/core/attachment/ThumbnailSignerTest.java
new file mode 100644
index 0000000000..50603e6d2b
--- /dev/null
+++ b/application/src/test/java/run/halo/app/core/attachment/ThumbnailSignerTest.java
@@ -0,0 +1,21 @@
+package run.halo.app.core.attachment;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+import org.junit.jupiter.api.Test;
+
+/**
+ * Tests for {@link ThumbnailSigner}.
+ *
+ * @author guqing
+ * @since 2.19.0
+ */
+class ThumbnailSignerTest {
+
+    @Test
+    void generateSignature() {
+        var signature = ThumbnailSigner.generateSignature("example.jpg");
+        assertThat(signature).isEqualTo(
+            "ed2e575a1d298e08df19dca9733da3f46eab5b157b1b8f9ed02f31b2f907ec79");
+    }
+}
\ No newline at end of file
diff --git a/application/src/test/java/run/halo/app/core/attachment/impl/AttachmentRootGetterImplTest.java b/application/src/test/java/run/halo/app/core/attachment/impl/AttachmentRootGetterImplTest.java
new file mode 100644
index 0000000000..e14f7a33c4
--- /dev/null
+++ b/application/src/test/java/run/halo/app/core/attachment/impl/AttachmentRootGetterImplTest.java
@@ -0,0 +1,35 @@
+package run.halo.app.core.attachment.impl;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.Mockito.when;
+
+import java.nio.file.Path;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+import run.halo.app.infra.properties.HaloProperties;
+
+/**
+ * Tests for {@link AttachmentRootGetterImpl}.
+ *
+ * @author guqing
+ * @since 2.19.0
+ */
+@ExtendWith(MockitoExtension.class)
+class AttachmentRootGetterImplTest {
+    @Mock
+    private HaloProperties haloProperties;
+
+    @InjectMocks
+    private AttachmentRootGetterImpl localAttachmentDirGetter;
+
+    @Test
+    void get() {
+        var rootPath = Path.of("/tmp");
+        when(haloProperties.getWorkDir()).thenReturn(rootPath);
+        var dir = localAttachmentDirGetter.get();
+        assertThat(dir).isEqualTo(rootPath.resolve("attachments"));
+    }
+}
\ No newline at end of file
diff --git a/application/src/test/java/run/halo/app/core/attachment/impl/LocalThumbnailServiceImplTest.java b/application/src/test/java/run/halo/app/core/attachment/impl/LocalThumbnailServiceImplTest.java
new file mode 100644
index 0000000000..1cfedc2b31
--- /dev/null
+++ b/application/src/test/java/run/halo/app/core/attachment/impl/LocalThumbnailServiceImplTest.java
@@ -0,0 +1,141 @@
+package run.halo.app.core.attachment.impl;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.ArgumentMatchers.isA;
+import static org.mockito.Mockito.times;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import java.net.MalformedURLException;
+import java.net.URI;
+import java.net.URL;
+import java.nio.file.Path;
+import java.util.List;
+import java.util.concurrent.atomic.AtomicInteger;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+import reactor.core.publisher.Mono;
+import reactor.test.StepVerifier;
+import run.halo.app.core.attachment.AttachmentRootGetter;
+import run.halo.app.core.attachment.ThumbnailSize;
+import run.halo.app.core.extension.attachment.LocalThumbnail;
+import run.halo.app.extension.ListResult;
+import run.halo.app.extension.PageRequest;
+import run.halo.app.extension.ReactiveExtensionClient;
+import run.halo.app.infra.ExternalUrlSupplier;
+
+/**
+ * Tests for {@link LocalThumbnailServiceImpl}.
+ *
+ * @author guqing
+ * @since 2.19.0
+ */
+@ExtendWith(MockitoExtension.class)
+class LocalThumbnailServiceImplTest {
+
+    @Mock
+    private AttachmentRootGetter attachmentWorkDirGetter;
+
+    @Mock
+    private ExternalUrlSupplier externalUrlSupplier;
+
+    @Mock
+    private ReactiveExtensionClient client;
+
+    @InjectMocks
+    private LocalThumbnailServiceImpl localThumbnailService;
+
+    @Test
+    void endpointForTest() {
+        var endpoint =
+            localThumbnailService.buildThumbnailUri("2024", ThumbnailSize.L, "example.jpg");
+        assertThat(endpoint).isEqualTo("/upload/thumbnails/2024/w1200/example.jpg");
+    }
+
+    @Test
+    void geImageFileNameTest() throws MalformedURLException {
+        var fileName =
+            LocalThumbnailServiceImpl.geImageFileName(new URL("https://halo.run/example.jpg"));
+        assertThat(fileName).isEqualTo("example.jpg");
+
+        fileName = LocalThumbnailServiceImpl.geImageFileName(new URL("https://halo.run/"));
+        assertThat(fileName).isNotBlank();
+
+        fileName = LocalThumbnailServiceImpl.geImageFileName(
+            new URL("https://halo.run/.1fasfg(*&^%$.jpg"));
+        assertThat(fileName).isNotBlank();
+    }
+
+    @Test
+    void appendRandomSuffixTest() {
+        var result = LocalThumbnailServiceImpl.appendRandomSuffix("example.jpg");
+        assertThat(result).isNotEqualTo("example.jpg");
+        assertThat(result).endsWith(".jpg");
+        assertThat(result).startsWith("example_");
+    }
+
+    @Test
+    void toFilePathTest() {
+        when(attachmentWorkDirGetter.get()).thenReturn(Path.of("/tmp"));
+        var path = localThumbnailService.toFilePath("/thumbnails/2024/w1200/example.jpg");
+        assertThat(path).isEqualTo(Path.of("/tmp/thumbnails/2024/w1200/example.jpg"));
+    }
+
+    @Test
+    void signatureForImageUriTest() throws MalformedURLException {
+        when(externalUrlSupplier.getRaw()).thenReturn(new URL("http://localhost:8090"));
+        var signature = signatureForImageUriStr("http://localhost:8090/example.jpg");
+        assertThat(signature).isEqualTo(LocalThumbnail.signatureFor("/example.jpg"));
+
+        signature = signatureForImageUriStr("http://localhost:8090/example.jpg");
+        assertThat(signature).isEqualTo(LocalThumbnail.signatureFor("/example.jpg"));
+
+        signature = signatureForImageUriStr("http://localhost:8091/example.jpg");
+        assertThat(signature).isEqualTo(
+            LocalThumbnail.signatureFor("http://localhost:8091/example.jpg"));
+
+        signature = signatureForImageUriStr("localhost:8090/example.jpg");
+        assertThat(signature).isEqualTo(
+            LocalThumbnail.signatureFor("localhost:8090/example.jpg"));
+
+        when(externalUrlSupplier.getRaw()).thenReturn(null);
+        signature = signatureForImageUriStr("http://localhost:8090/example.jpg");
+        assertThat(signature).isEqualTo(
+            LocalThumbnail.signatureFor("http://localhost:8090/example.jpg"));
+    }
+
+    String signatureForImageUriStr(String uriStr) {
+        return localThumbnailService.signatureForImageUri(URI.create(uriStr));
+    }
+
+    @Test
+    void generateUniqueThumbFileNameTest() {
+        var count = new AtomicInteger(0);
+        when(client.listBy(eq(LocalThumbnail.class), any(), isA(PageRequest.class)))
+            .thenAnswer(invocation -> {
+                if (count.get() > 2) {
+                    return Mono.just(ListResult.emptyResult());
+                }
+                count.incrementAndGet();
+                var result = new ListResult<>(List.of(new LocalThumbnail()));
+                return Mono.just(result);
+            });
+
+        localThumbnailService.generateUniqueThumbFileName("example.jpg", "2024", ThumbnailSize.L)
+            .as(StepVerifier::create)
+            .consumeNextWith(fileName -> {
+                assertThat(fileName).startsWith("example_");
+                assertThat(fileName).endsWith(".jpg");
+                // 6 is the length of the random suffix
+                assertThat(fileName.length()).isEqualTo("example_.jpg".length() + 6);
+            })
+            .verifyComplete();
+
+        verify(client, times(4)).listBy(eq(LocalThumbnail.class), any(), isA(PageRequest.class));
+    }
+}
diff --git a/application/src/test/java/run/halo/app/core/attachment/impl/ThumbnailServiceImplTest.java b/application/src/test/java/run/halo/app/core/attachment/impl/ThumbnailServiceImplTest.java
new file mode 100644
index 0000000000..7a22f73d4a
--- /dev/null
+++ b/application/src/test/java/run/halo/app/core/attachment/impl/ThumbnailServiceImplTest.java
@@ -0,0 +1,172 @@
+package run.halo.app.core.attachment.impl;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.assertArg;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.ArgumentMatchers.isA;
+import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.spy;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+import static run.halo.app.extension.index.query.QueryFactory.equal;
+
+import java.net.MalformedURLException;
+import java.net.URI;
+import java.net.URISyntaxException;
+import java.net.URL;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+import org.skyscreamer.jsonassert.JSONAssert;
+import reactor.core.publisher.Flux;
+import reactor.core.publisher.Mono;
+import reactor.test.StepVerifier;
+import run.halo.app.core.attachment.LocalThumbnailProvider;
+import run.halo.app.core.attachment.LocalThumbnailService;
+import run.halo.app.core.attachment.ThumbnailProvider;
+import run.halo.app.core.attachment.ThumbnailSigner;
+import run.halo.app.core.attachment.ThumbnailSize;
+import run.halo.app.core.extension.attachment.Thumbnail;
+import run.halo.app.extension.ListOptions;
+import run.halo.app.extension.PageRequest;
+import run.halo.app.extension.ReactiveExtensionClient;
+import run.halo.app.infra.ExternalLinkProcessor;
+import run.halo.app.infra.utils.JsonUtils;
+import run.halo.app.plugin.extensionpoint.ExtensionGetter;
+
+/**
+ * Tests for {@link ThumbnailServiceImpl}.
+ *
+ * @author guqing
+ * @since 2.19.0
+ */
+@ExtendWith(MockitoExtension.class)
+class ThumbnailServiceImplTest {
+    @Mock
+    private ExternalLinkProcessor externalLinkProcessor;
+
+    @Mock
+    private ExtensionGetter extensionGetter;
+
+    @Mock
+    private LocalThumbnailProvider localThumbnailProvider;
+
+    @Mock
+    private LocalThumbnailService localThumbnailService;
+
+    @Mock
+    private ReactiveExtensionClient client;
+
+    @InjectMocks
+    private ThumbnailServiceImpl thumbnailService;
+
+    @Test
+    void toImageUrl() {
+        var link = "/test.jpg";
+        when(externalLinkProcessor.processLink(link)).thenReturn("http://localhost:8090/test.jpg");
+        var imageUrl = thumbnailService.toImageUrl(URI.create(link));
+        assertThat(imageUrl).isPresent();
+        assertThat(imageUrl.get().toString()).isEqualTo("http://localhost:8090/test.jpg");
+
+        var absoluteLink = "https://halo.run/test.jpg";
+        imageUrl = thumbnailService.toImageUrl(URI.create(absoluteLink));
+        assertThat(imageUrl).isPresent();
+        assertThat(imageUrl.get().toString()).isEqualTo(absoluteLink);
+    }
+
+    @Test
+    void generateTest() {
+        var uri = URI.create("http://localhost:8090/test.jpg");
+        var size = ThumbnailSize.L;
+        when(localThumbnailService.ensureInSiteUriIsRelative(eq(uri)))
+            .thenReturn(uri);
+        var imageHash = ThumbnailSigner.generateSignature(uri.toString());
+        var id = Thumbnail.idIndexFunc(imageHash, size.name());
+        var listOptions = ListOptions.builder()
+            .fieldQuery(equal(Thumbnail.ID_INDEX, id))
+            .build();
+        when(client.listBy(eq(Thumbnail.class), any(), any())).thenReturn(Mono.empty());
+
+        var spyThumbnailService = spy(thumbnailService);
+        doReturn(Mono.empty()).when(spyThumbnailService).create(any(), any());
+
+        spyThumbnailService.generate(uri, size)
+            .as(StepVerifier::create)
+            .verifyComplete();
+
+        verify(client).listBy(eq(Thumbnail.class), assertArg(options -> {
+            assertThat(options.toString()).isEqualTo(listOptions.toString());
+        }), isA(PageRequest.class));
+    }
+
+    @Test
+    void createTest() throws MalformedURLException, URISyntaxException {
+        var url = new URL("http://localhost:8090/test.jpg");
+        when(extensionGetter.getEnabledExtensions(eq(ThumbnailProvider.class)))
+            .thenReturn(Flux.just(localThumbnailProvider));
+        var thumbUri = URI.create("/test-thumb.jpg");
+        when(localThumbnailProvider.generate(any())).thenReturn(Mono.just(thumbUri));
+        when(localThumbnailProvider.supports(any())).thenReturn(Mono.just(true));
+
+        var insiteUri = URI.create("/test.jpg");
+        when(localThumbnailService.ensureInSiteUriIsRelative(any()))
+            .thenReturn(insiteUri);
+        when(client.create(any())).thenReturn(Mono.empty());
+
+        thumbnailService.create(url, ThumbnailSize.M)
+            .as(StepVerifier::create)
+            .expectNext(thumbUri)
+            .verifyComplete();
+
+        when(client.listBy(eq(Thumbnail.class), any(), isA(PageRequest.class)))
+            .thenReturn(Mono.empty());
+        thumbnailService.fetchThumbnail(url.toURI(), ThumbnailSize.M)
+            .as(StepVerifier::create)
+            .verifyComplete();
+        var hash = ThumbnailSigner.generateSignature(insiteUri.toString());
+
+        verify(client).listBy(eq(Thumbnail.class), assertArg(options -> {
+            var exceptOptions = ListOptions.builder()
+                .fieldQuery(equal(Thumbnail.ID_INDEX,
+                    Thumbnail.idIndexFunc(hash, ThumbnailSize.M.name())
+                ))
+                .build();
+            assertThat(options.toString()).isEqualTo(exceptOptions.toString());
+        }), isA(PageRequest.class));
+
+        verify(localThumbnailProvider).generate(any());
+
+        verify(client).create(assertArg(thumb -> {
+            JSONAssert.assertEquals("""
+                {
+                    "spec": {
+                        "imageSignature": "%s",
+                        "imageUri": "/test.jpg",
+                        "size": "M",
+                        "thumbnailUri": "/test-thumb.jpg"
+                    },
+                    "apiVersion": "storage.halo.run/v1alpha1",
+                    "kind": "Thumbnail",
+                    "metadata": {
+                        "generateName": "thumb-"
+                    }
+                }
+                """.formatted(hash), JsonUtils.objectToJson(thumb), true);
+        }));
+    }
+
+    @Test
+    void createTest2() throws MalformedURLException {
+        when(extensionGetter.getEnabledExtensions(eq(ThumbnailProvider.class)))
+            .thenReturn(Flux.empty());
+
+        // no thumbnail provider will do nothing
+        var url = new URL("http://localhost:8090/test.jpg");
+        thumbnailService.create(url, ThumbnailSize.M)
+            .as(StepVerifier::create)
+            .verifyComplete();
+    }
+}
\ No newline at end of file
diff --git a/application/src/test/java/run/halo/app/infra/DefaultExternalLinkProcessorTest.java b/application/src/test/java/run/halo/app/infra/DefaultExternalLinkProcessorTest.java
index 257dbb2eea..98b09cf0ed 100644
--- a/application/src/test/java/run/halo/app/infra/DefaultExternalLinkProcessorTest.java
+++ b/application/src/test/java/run/halo/app/infra/DefaultExternalLinkProcessorTest.java
@@ -45,5 +45,7 @@ void process() throws MalformedURLException {
 
         when(externalUrlSupplier.getRaw()).thenReturn(URI.create("https://halo.run/").toURL());
         assertThat(externalLinkProcessor.processLink("/test")).isEqualTo("https://halo.run/test");
+        assertThat(externalLinkProcessor.processLink("https://halo.run/test"))
+            .isEqualTo("https://halo.run/test");
     }
-}
\ No newline at end of file
+}
diff --git a/platform/application/build.gradle b/platform/application/build.gradle
index 18f3715181..13bb84bdd1 100644
--- a/platform/application/build.gradle
+++ b/platform/application/build.gradle
@@ -23,6 +23,7 @@ ext {
     resilience4jVersion = "2.2.0"
     twoFactorAuth = "1.3"
     tika = "2.9.2"
+    imgscalr = '4.2'
 }
 
 javaPlatform {
@@ -56,6 +57,7 @@ dependencies {
         api "io.github.resilience4j:resilience4j-reactor:$resilience4jVersion"
         api "com.j256.two-factor-auth:two-factor-auth:$twoFactorAuth"
         api "org.apache.tika:tika-core:$tika"
+        api "org.imgscalr:imgscalr-lib:$imgscalr"
     }
 
 }