feat: refactor components to utilize DataGridCard for improved UI consistency

Updated various components including AccessApiKeysCard, FirewallClientsGrid, FirewallRulesGrid, ModuleEntriesSection, and DirectoriesComponent to replace traditional card and table structures with the new DataGridCard component. This change enhances the user interface by providing a more consistent layout and improved loading states. Additionally, integrated QueryState for better handling of loading and error scenarios across these components, streamlining the overall user experience.

.codegraph/daemon.pid

@@ -1,6 +1,6 @@
 {
-  "pid": 44608,
+  "pid": 39884,
   "version": "0.9.9",
   "socketPath": "\\\\.\\pipe\\codegraph-97b92efdcc5351da",
-  "startedAt": 1781240018712
+  "startedAt": 1783489774882
 }

.cursor/rules/context7-stack.mdc

@@ -82,7 +82,7 @@ UI-правила репозитория: `.cursor/rules/web-shadcn.mdc` (MCP +
 1. **Контракт HTTP** — `docs/openapi.yaml` (не Context7).
 2. **Context7** — синтаксис и API библиотек из таблицы.
 3. **Локальные docs** — `docs/`, `web/README.md`, `AGENTS.md`.
-4. **Официальный сайт** — BIRD: https://bird.network.cz/?get_doc (если Context7 не покрыл кейс).
+4. **Официальный сайт** — BIRD: https://bird.nic.cz/?get_doc (если Context7 не покрыл кейс).
 
 ## Примеры запросов
 

.cursor/rules/engineering.mdc

@@ -207,7 +207,7 @@ alwaysApply: true
 | OpenAPI / problem+json | `docs/openapi.yaml`, RFC 9457 |
 | Svelte / Kit | https://svelte.dev/docs , https://kit.svelte.dev/docs |
 | shadcn-svelte | https://shadcn-svelte.com/docs |
-| BIRD 2 | https://bird.network.cz/?get_doc |
+| BIRD 2 | https://bird.nic.cz/?get_doc |
 | Prometheus Go | https://pkg.go.dev/github.com/prometheus/client_golang |
 
 **DOC-SYNC-01** | MUST | Новый API библиотеки — сверка версии в `go.mod`/`package.json` с официальной документацией.

.cursor/rules/networking-bird.mdc

@@ -23,7 +23,7 @@ alwaysApply: false
 | Параметры BIRD tenant | Global settings: `bird_router_id`, `bird_local_asn`, … (`docs/manual.md`) |
 | BGP peers | `BGPPeer` + `ParsePeerNeighbor` |
 
-**BIRD2 docs:** https://bird.network.cz/?get_doc
+**BIRD2 docs:** https://bird.nic.cz/?get_doc
 
 ---
 
@@ -199,7 +199,7 @@ alwaysApply: false
 
 ## Documentation Sync
 
-**DOC-SYNC-05** | MUST | BIRD — https://bird.network.cz/?get_doc
+**DOC-SYNC-05** | MUST | BIRD — https://bird.nic.cz/?get_doc
 **DOC-SYNC-08** | MUST | BGP policy — RFC 4271, 4760, 7454 + BIRD docs + `birdfmt`
 **DOC-SYNC-09** | MUST | CIDR — https://pkg.go.dev/net/netip ; примеры — RFC 5737, 3849
 

.gitea/workflows/ci.yaml

@@ -167,14 +167,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-        with:
-          version: 10
       - uses: actions/setup-node@v4
         with:
           node-version: "22"
-          cache: pnpm
-          cache-dependency-path: pnpm-lock.yaml
+      - name: Enable pnpm via corepack
+        run: corepack enable
       - name: pnpm install, typecheck, lint, build
         run: |
           set -euxo pipefail

apps/web/src/components/access/access-api-keys-card.tsx

@@ -0,0 +1,103 @@
+import { useState } from 'react'
+import { Plus, RefreshCw } from 'lucide-react'
+
+import { Button } from '@evobgp/ui/components/button'
+
+import { AccessApiKeysGrid } from '@/components/access/access-api-keys-grid'
+import { DataGridCard } from '@/components/data-grid-shell'
+import { ApiKeyCreateDialog } from '@/components/access/api-key-create-dialog'
+import { ApiKeyTokenDialog } from '@/components/access/api-key-token-dialog'
+import { QueryState } from '@/components/query-state'
+import { TableSkeleton } from '@/components/skeletons'
+import { useRevokeApiKeyMutation, useRotateApiKeyMutation } from '@/queries/api-keys'
+import type { ApiKey, ApiKeyCreated } from '@/types/api'
+
+interface AccessApiKeysCardProps {
+  items: ApiKey[]
+  isLoading: boolean
+  isError: boolean
+  error: unknown
+  onRetry: () => void
+}
+
+export function AccessApiKeysCard({
+  items,
+  isLoading,
+  isError,
+  error,
+  onRetry,
+}: AccessApiKeysCardProps) {
+  const [createOpen, setCreateOpen] = useState(false)
+  const [tokenDialogOpen, setTokenDialogOpen] = useState(false)
+  const [revealedToken, setRevealedToken] = useState('')
+
+  const revoke = useRevokeApiKeyMutation()
+  const rotate = useRotateApiKeyMutation()
+
+  function showToken(created: ApiKeyCreated) {
+    setRevealedToken(created.token)
+    setTokenDialogOpen(true)
+  }
+
+  function handleRotated(id: string) {
+    rotate.mutate(id, {
+      onSuccess: (created) => showToken(created),
+    })
+  }
+
+  return (
+    <>
+      <DataGridCard
+        title="API-ключи"
+        description="Управление ключами tenant. Полный токен показывается только при создании и ротации."
+        actions={
+          <>
+            <Button size="sm" variant="outline" type="button" onClick={onRetry} disabled={isLoading}>
+              <RefreshCw className={isLoading ? 'animate-spin' : ''} />
+              Обновить
+            </Button>
+            <Button size="sm" type="button" onClick={() => setCreateOpen(true)}>
+              <Plus />
+              Создать
+            </Button>
+          </>
+        }
+      >
+        <QueryState
+          data={items}
+          isLoading={isLoading}
+          isError={isError}
+          error={error}
+          empty={items.length === 0}
+          emptyTitle="Нет ключей"
+          emptyDescription="Создайте API-ключ для автоматизации или отдельного доступа."
+          skeleton={<TableSkeleton rows={4} cols={6} />}
+          onRetry={onRetry}
+        >
+          {(data) => (
+            <AccessApiKeysGrid
+              items={data}
+              isLoading={isLoading}
+              onRotate={handleRotated}
+              onRevoke={(id) => revoke.mutate(id)}
+              rotatePending={rotate.isPending}
+              revokePending={revoke.isPending}
+            />
+          )}
+        </QueryState>
+      </DataGridCard>
+
+      <ApiKeyCreateDialog
+        open={createOpen}
+        onOpenChange={setCreateOpen}
+        onCreated={showToken}
+      />
+
+      <ApiKeyTokenDialog
+        open={tokenDialogOpen}
+        token={revealedToken}
+        onOpenChange={setTokenDialogOpen}
+      />
+    </>
+  )
+}

apps/web/src/components/access/access-api-keys-grid.tsx

@@ -0,0 +1,158 @@
+import { ColumnDef, useReactTable } from '@tanstack/react-table'
+import { RefreshCw, Trash2 } from 'lucide-react'
+import { useMemo } from 'react'
+
+import { Button } from '@evobgp/ui/components/button'
+
+import { DataGridShell } from '@/components/data-grid-shell'
+import { Badge } from '@/components/reui/badge'
+import { ConfirmDialog } from '@/components/confirm-dialog'
+import { StatusBadge } from '@/components/status-badge'
+import { DataGridColumnHeader } from '@/components/reui/data-grid/data-grid-column-header'
+import { formatApiKeyDate } from '@/lib/access/api-key-labels'
+import { createClientDataGridOptions } from '@/lib/data-grid-defaults'
+import type { ApiKey } from '@/types/api'
+
+export function AccessApiKeysGrid({
+  items,
+  isLoading = false,
+  onRotate,
+  onRevoke,
+  rotatePending = false,
+  revokePending = false,
+}: {
+  items: ApiKey[]
+  isLoading?: boolean
+  onRotate: (id: string) => void
+  onRevoke: (id: string) => void
+  rotatePending?: boolean
+  revokePending?: boolean
+}) {
+  const columns = useMemo<ColumnDef<ApiKey>[]>(
+    () => [
+      {
+        accessorKey: 'name',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Имя" />,
+        cell: ({ row }) => <span className="font-medium">{row.original.name}</span>,
+        meta: { headerTitle: 'Имя' },
+      },
+      {
+        accessorKey: 'role',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Роль" />,
+        cell: ({ row }) => (
+          <Badge variant="outline" className="font-mono text-xs">
+            {row.original.role}
+          </Badge>
+        ),
+        meta: { headerTitle: 'Роль' },
+      },
+      {
+        accessorKey: 'prefix',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Префикс" />,
+        cell: ({ row }) => (
+          <span className="font-mono text-xs text-muted-foreground">{row.original.prefix}…</span>
+        ),
+        meta: { headerTitle: 'Префикс' },
+      },
+      {
+        id: 'status',
+        enableSorting: false,
+        header: 'Статус',
+        cell: ({ row }) =>
+          row.original.revoked_at ? (
+            <StatusBadge status="error" label="отозван" />
+          ) : (
+            <StatusBadge status="active" label="активен" />
+          ),
+        meta: { headerTitle: 'Статус' },
+      },
+      {
+        id: 'expires_at',
+        accessorFn: (row) => row.expires_at ?? '',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Истекает" />,
+        cell: ({ row }) => (
+          <span className="text-sm text-muted-foreground">
+            {formatApiKeyDate(row.original.expires_at)}
+          </span>
+        ),
+        meta: { headerTitle: 'Истекает' },
+      },
+      {
+        id: 'last_used_at',
+        accessorFn: (row) => row.last_used_at ?? '',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Последнее использование" />,
+        cell: ({ row }) => (
+          <span className="text-sm text-muted-foreground">
+            {formatApiKeyDate(row.original.last_used_at)}
+          </span>
+        ),
+        meta: { headerTitle: 'Последнее использование' },
+      },
+      {
+        id: 'actions',
+        enableSorting: false,
+        header: () => null,
+        cell: ({ row }) => {
+          const k = row.original
+          return (
+            <div className="flex gap-1">
+              <ConfirmDialog
+                trigger={
+                  <Button
+                    variant="ghost"
+                    size="icon-sm"
+                    type="button"
+                    title="Ротировать"
+                    disabled={!!k.revoked_at || rotatePending}
+                  >
+                    <RefreshCw className="size-3.5" />
+                  </Button>
+                }
+                title="Ротировать ключ?"
+                description="Старый токен перестанет работать сразу."
+                confirmLabel="Ротировать"
+                onConfirm={() => onRotate(k.id)}
+              />
+              <ConfirmDialog
+                trigger={
+                  <Button
+                    variant="ghost"
+                    size="icon-sm"
+                    type="button"
+                    className="text-destructive"
+                    disabled={!!k.revoked_at || revokePending}
+                    title="Отозвать"
+                  >
+                    <Trash2 className="size-3.5" />
+                  </Button>
+                }
+                title="Отозвать API-ключ?"
+                description={`${k.name} (${k.prefix}…)`}
+                confirmLabel="Отозвать"
+                destructive
+                onConfirm={() => onRevoke(k.id)}
+              />
+            </div>
+          )
+        },
+      },
+    ],
+    [onRevoke, onRotate, revokePending, rotatePending],
+  )
+
+  const table = useReactTable({
+    data: items,
+    columns,
+    ...createClientDataGridOptions<ApiKey>(),
+    getRowId: (row) => row.id,
+  })
+
+  return (
+    <DataGridShell
+      table={table}
+      recordCount={items.length}
+      isLoading={isLoading}
+      emptyMessage="Нет ключей"
+    />
+  )
+}

apps/web/src/components/access/api-key-create-dialog.tsx

@@ -0,0 +1,132 @@
+import { useEffect, useState } from 'react'
+import { toast } from 'sonner'
+
+import { Button } from '@evobgp/ui/components/button'
+import {
+  Dialog,
+  DialogContent,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+} from '@evobgp/ui/components/dialog'
+import { Input } from '@evobgp/ui/components/input'
+import { Label } from '@evobgp/ui/components/label'
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from '@evobgp/ui/components/select'
+
+import { LoadingButton } from '@/components/loading-button'
+import { API_KEY_ROLE_ITEMS } from '@/lib/access/api-key-labels'
+import { useCreateApiKeyMutation } from '@/queries/api-keys'
+import type { ApiKeyCreate, ApiKeyCreated, ApiKeyRole } from '@/types/api'
+
+interface ApiKeyCreateDialogProps {
+  open: boolean
+  onOpenChange: (open: boolean) => void
+  onCreated: (created: ApiKeyCreated) => void
+}
+
+export function ApiKeyCreateDialog({ open, onOpenChange, onCreated }: ApiKeyCreateDialogProps) {
+  const createMutation = useCreateApiKeyMutation()
+  const [name, setName] = useState('')
+  const [role, setRole] = useState<ApiKeyRole>('editor')
+  const [expiresLocal, setExpiresLocal] = useState('')
+
+  useEffect(() => {
+    if (!open) return
+    setName('')
+    setRole('editor')
+    setExpiresLocal('')
+  }, [open])
+
+  function handleOpenChange(next: boolean) {
+    onOpenChange(next)
+  }
+
+  async function save() {
+    if (!name.trim()) {
+      toast.error('Укажите имя')
+      return
+    }
+    const body: ApiKeyCreate = {
+      name: name.trim(),
+      role,
+    }
+    if (expiresLocal.trim()) {
+      const d = new Date(expiresLocal)
+      if (Number.isNaN(d.getTime())) {
+        toast.error('Некорректная дата истечения')
+        return
+      }
+      body.expires_at = d.toISOString()
+    }
+    try {
+      const created = await createMutation.mutateAsync(body)
+      onOpenChange(false)
+      onCreated(created)
+    } catch {
+      // toast handled in mutation
+    }
+  }
+
+  return (
+    <Dialog open={open} onOpenChange={handleOpenChange}>
+      <DialogContent className="sm:max-w-sm">
+        <DialogHeader>
+          <DialogTitle>Новый API-ключ</DialogTitle>
+        </DialogHeader>
+        <div className="flex flex-col gap-4 py-2">
+          <div className="flex flex-col gap-2">
+            <Label htmlFor="key-name">Имя</Label>
+            <Input
+              id="key-name"
+              value={name}
+              onChange={(e) => setName(e.target.value)}
+              placeholder="CI / оператор UI"
+            />
+          </div>
+          <div className="flex flex-col gap-2">
+            <Label htmlFor="key-role">Роль</Label>
+            <Select
+              items={[...API_KEY_ROLE_ITEMS]}
+              value={role}
+              onValueChange={(v) => v && setRole(v as ApiKeyRole)}
+            >
+              <SelectTrigger id="key-role" className="w-full">
+                <SelectValue placeholder="Выберите роль" />
+              </SelectTrigger>
+              <SelectContent>
+                {API_KEY_ROLE_ITEMS.map((opt) => (
+                  <SelectItem key={opt.value} value={opt.value}>
+                    {opt.label}
+                  </SelectItem>
+                ))}
+              </SelectContent>
+            </Select>
+          </div>
+          <div className="flex flex-col gap-2">
+            <Label htmlFor="key-expires">Истекает (опционально)</Label>
+            <Input
+              id="key-expires"
+              type="datetime-local"
+              value={expiresLocal}
+              onChange={(e) => setExpiresLocal(e.target.value)}
+            />
+          </div>
+        </div>
+        <DialogFooter>
+          <Button variant="outline" onClick={() => handleOpenChange(false)}>
+            Отмена
+          </Button>
+          <LoadingButton onClick={save} loading={createMutation.isPending}>
+            Создать
+          </LoadingButton>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  )
+}

apps/web/src/components/access/api-key-token-dialog.tsx

@@ -0,0 +1,51 @@
+import { Copy } from 'lucide-react'
+import { toast } from 'sonner'
+
+import { Button } from '@evobgp/ui/components/button'
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+} from '@evobgp/ui/components/dialog'
+
+interface ApiKeyTokenDialogProps {
+  open: boolean
+  token: string
+  onOpenChange: (open: boolean) => void
+}
+
+export function ApiKeyTokenDialog({ open, token, onOpenChange }: ApiKeyTokenDialogProps) {
+  async function copyToken() {
+    if (!token) return
+    try {
+      await navigator.clipboard.writeText(token)
+      toast.success('Скопировано')
+    } catch {
+      toast.error('Не удалось скопировать')
+    }
+  }
+
+  return (
+    <Dialog open={open} onOpenChange={onOpenChange}>
+      <DialogContent className="sm:max-w-md">
+        <DialogHeader>
+          <DialogTitle>Сохраните токен</DialogTitle>
+          <DialogDescription>
+            Он больше не будет показан. Скопируйте в безопасное хранилище.
+          </DialogDescription>
+        </DialogHeader>
+        <div className="break-all rounded-md border bg-muted/40 p-3 font-mono text-xs">{token}</div>
+        <DialogFooter>
+          <Button variant="outline" onClick={copyToken}>
+            <Copy />
+            Копировать
+          </Button>
+          <Button onClick={() => onOpenChange(false)}>Готово</Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  )
+}

apps/web/src/components/dashboard/dashboard-network-panel.tsx

@@ -0,0 +1,38 @@
+import { aggregateNetworkMetrics } from '@/queries/overview'
+import type { PeerRow, SpeakerRow } from '@/types/api'
+
+function Row({ label, value, variant = 'default' }: { label: string; value: string; variant?: 'default' | 'warning' }) {
+  return (
+    <div className="flex items-center justify-between gap-2 px-1 text-sm">
+      <span className="text-muted-foreground">{label}</span>
+      <span
+        className={
+          variant === 'warning'
+            ? 'font-medium text-warning-foreground tabular-nums'
+            : 'font-medium tabular-nums'
+        }
+      >
+        {value}
+      </span>
+    </div>
+  )
+}
+
+export function DashboardNetworkPanel({
+  peers,
+  speakers,
+}: {
+  peers: PeerRow[]
+  speakers: SpeakerRow[]
+}) {
+  const m = aggregateNetworkMetrics(peers, speakers)
+  return (
+    <div className="flex flex-col gap-2 p-3">
+      <Row label="Пиры Established" value={`${m.peersEstablished} / ${m.peersEnabled}`} />
+      <Row label="Спикеры online" value={`${m.speakersOnline} / ${m.speakersTotal}`} />
+      {m.peersMismatch > 0 ? (
+        <Row label="Mismatches" value={String(m.peersMismatch)} variant="warning" />
+      ) : null}
+    </div>
+  )
+}

apps/web/src/components/dashboard/dashboard-quick-actions.tsx

@@ -0,0 +1,41 @@
+import { Link } from '@tanstack/react-router'
+import { Gauge, Network, Play, Plus, Share2, Tags } from 'lucide-react'
+
+import { Button } from '@evobgp/ui/components/button'
+import { FrameFooter } from '@/components/reui/frame'
+
+export function DashboardQuickActions() {
+  return (
+    <FrameFooter className="flex flex-wrap gap-2">
+      <Button variant="outline" size="sm" type="button" render={<Link to="/modules" />}>
+        <Plus className="size-4" />
+        Создать модуль
+      </Button>
+      <Button variant="outline" size="sm" type="button" render={<Link to="/directories" />}>
+        <Tags className="size-4" />
+        Добавить community
+      </Button>
+      <Button variant="outline" size="sm" type="button" render={<Link to="/network" search={{ tab: 'overview' }} />}>
+        <Network className="size-4" />
+        Сеть
+      </Button>
+      <Button variant="outline" size="sm" type="button" render={<Link to="/network" search={{ tab: 'peers' }} />}>
+        <Share2 className="size-4" />
+        Добавить пира
+      </Button>
+      <Button
+        variant="outline"
+        size="sm"
+        type="button"
+        render={<Link to="/operations" search={{ tab: 'revisions' }} />}
+      >
+        <Play className="size-4" />
+        Деплой (Apply)
+      </Button>
+      <Button variant="outline" size="sm" type="button" render={<Link to="/monitoring" search={{ tab: 'system' }} />}>
+        <Gauge className="size-4" />
+        Мониторинг
+      </Button>
+    </FrameFooter>
+  )
+}

apps/web/src/components/dashboard/dashboard-recent-jobs-grid.tsx

@@ -0,0 +1,74 @@
+import { ColumnDef, getCoreRowModel, useReactTable } from '@tanstack/react-table'
+import { useMemo } from 'react'
+
+import { DataGridShell } from '@/components/data-grid-shell'
+import { DataGridColumnHeader } from '@/components/reui/data-grid/data-grid-column-header'
+import { DATA_GRID_DENSE_LAYOUT } from '@/lib/data-grid-defaults'
+import type { JobRow } from '@/types/api'
+
+function StatusText({ status }: { status: string }) {
+  const cls =
+    status === 'succeeded'
+      ? 'text-success'
+      : status === 'failed' || status === 'cancelled'
+        ? 'text-destructive'
+        : 'text-muted-foreground'
+  return <span className={`text-xs font-medium ${cls}`}>{status}</span>
+}
+
+export function DashboardRecentJobsGrid({
+  jobs,
+  nameById,
+  isLoading = false,
+}: {
+  jobs: JobRow[]
+  nameById: Map<string, string>
+  isLoading?: boolean
+}) {
+  const data = useMemo(() => jobs.slice(0, 8), [jobs])
+
+  const columns = useMemo<ColumnDef<JobRow>[]>(
+    () => [
+      {
+        accessorKey: 'kind',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Вид" />,
+        cell: ({ row }) => (
+          <div className="min-w-0">
+            <div className="truncate font-mono text-xs text-muted-foreground">{row.original.kind}</div>
+            {row.original.meta?.module_id ? (
+              <div className="truncate text-xs">
+                {nameById.get(String(row.original.meta.module_id)) ?? ''}
+              </div>
+            ) : null}
+          </div>
+        ),
+        meta: { headerTitle: 'Вид' },
+      },
+      {
+        accessorKey: 'status',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Статус" />,
+        cell: ({ row }) => <StatusText status={row.original.status} />,
+        meta: { headerTitle: 'Статус' },
+      },
+    ],
+    [nameById],
+  )
+
+  const table = useReactTable({
+    data,
+    columns,
+    getCoreRowModel: getCoreRowModel(),
+    getRowId: (row) => row.job_id,
+  })
+
+  return (
+    <DataGridShell
+      table={table}
+      recordCount={data.length}
+      isLoading={isLoading}
+      emptyMessage="Нет задач"
+      showPagination={false}
+      tableLayout={DATA_GRID_DENSE_LAYOUT}
+    />
+  )
+}

apps/web/src/components/dashboard/dashboard-recent-revisions-grid.tsx

@@ -0,0 +1,62 @@
+import { ColumnDef, getCoreRowModel, useReactTable } from '@tanstack/react-table'
+import { useMemo } from 'react'
+
+import { DataGridShell } from '@/components/data-grid-shell'
+import { DataGridColumnHeader } from '@/components/reui/data-grid/data-grid-column-header'
+import { DATA_GRID_DENSE_LAYOUT } from '@/lib/data-grid-defaults'
+import type { RevisionRow } from '@/types/api'
+
+export function DashboardRecentRevisionsGrid({
+  revisions,
+  isLoading = false,
+}: {
+  revisions: RevisionRow[]
+  isLoading?: boolean
+}) {
+  const data = useMemo(() => revisions.slice(0, 8), [revisions])
+
+  const columns = useMemo<ColumnDef<RevisionRow>[]>(
+    () => [
+      {
+        id: 'id',
+        accessorFn: (row) => row.id,
+        header: ({ column }) => <DataGridColumnHeader column={column} title="ID" />,
+        cell: ({ row }) => (
+          <span className="truncate font-mono text-xs text-muted-foreground">
+            {row.original.id.slice(0, 10)}…
+          </span>
+        ),
+        meta: { headerTitle: 'ID' },
+      },
+      {
+        accessorKey: 'created_at',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Создана" />,
+        cell: ({ row }) => (
+          <span className="text-xs text-muted-foreground">
+            {new Date(row.original.created_at).toLocaleString('ru-RU')}
+          </span>
+        ),
+        meta: { headerTitle: 'Создана' },
+      },
+    ],
+    [],
+  )
+
+  const table = useReactTable({
+    data,
+    columns,
+    getCoreRowModel: getCoreRowModel(),
+    getRowId: (row) => row.id,
+  })
+
+  return (
+    <DataGridShell
+      table={table}
+      recordCount={data.length}
+      isLoading={isLoading}
+      emptyMessage="Нет ревизий"
+      showPagination={false}
+      tableLayout={DATA_GRID_DENSE_LAYOUT}
+    />
+  )
+}

apps/web/src/components/data-grid-shell.tsx

@@ -0,0 +1,77 @@
+import type { ReactNode } from 'react'
+import type { Table } from '@tanstack/react-table'
+
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '@evobgp/ui/components/card'
+
+import { DataGridPagination } from '@/components/reui/data-grid/data-grid-pagination'
+import { DataGrid, DataGridContainer } from '@/components/reui/data-grid/data-grid'
+import { DataGridTable } from '@/components/reui/data-grid/data-grid-table'
+import {
+  DATA_GRID_PAGINATION_RU,
+  DATA_GRID_TABLE_LAYOUT,
+} from '@/lib/data-grid-defaults'
+
+interface DataGridShellProps<TData extends object> {
+  table: Table<TData>
+  recordCount: number
+  isLoading?: boolean
+  emptyMessage?: ReactNode
+  showPagination?: boolean
+  tableLayout?: typeof DATA_GRID_TABLE_LAYOUT
+  className?: string
+  onRowClick?: (row: TData) => void
+}
+
+export function DataGridShell<TData extends object>({
+  table,
+  recordCount,
+  isLoading = false,
+  emptyMessage,
+  showPagination = true,
+  tableLayout = DATA_GRID_TABLE_LAYOUT,
+  className,
+  onRowClick,
+}: DataGridShellProps<TData>) {
+  return (
+    <DataGrid
+      table={table}
+      recordCount={recordCount}
+      isLoading={isLoading}
+      emptyMessage={emptyMessage}
+      tableLayout={tableLayout}
+      className={className}
+      onRowClick={onRowClick}
+    >
+      <DataGridContainer>
+        <DataGridTable />
+      </DataGridContainer>
+      {showPagination ? <DataGridPagination {...DATA_GRID_PAGINATION_RU} /> : null}
+    </DataGrid>
+  )
+}
+
+interface DataGridCardProps {
+  title?: string
+  description?: string
+  actions?: ReactNode
+  children: ReactNode
+  className?: string
+}
+
+export function DataGridCard({ title, description, actions, children, className }: DataGridCardProps) {
+  const hasHeader = Boolean(title || description || actions)
+  return (
+    <Card className={className ?? 'gap-0'}>
+      {hasHeader ? (
+        <CardHeader className="flex flex-row items-center justify-between border-b py-3">
+          <div className="flex flex-col gap-0.5">
+            {title ? <CardTitle className="text-base">{title}</CardTitle> : null}
+            {description ? <CardDescription>{description}</CardDescription> : null}
+          </div>
+          {actions ? <div className="flex shrink-0 items-center gap-2">{actions}</div> : null}
+        </CardHeader>
+      ) : null}
+      <CardContent className="p-0">{children}</CardContent>
+    </Card>
+  )
+}

apps/web/src/components/directories/directories-communities-grid.tsx

@@ -0,0 +1,58 @@
+import { ColumnDef, useReactTable } from '@tanstack/react-table'
+import { useMemo } from 'react'
+
+import { Badge } from '@evobgp/ui/components/badge'
+
+import { DataGridShell } from '@/components/data-grid-shell'
+import { DataGridColumnHeader } from '@/components/reui/data-grid/data-grid-column-header'
+import { createClientDataGridOptions } from '@/lib/data-grid-defaults'
+import type { BgpCommunity } from '@/types/api'
+
+export function DirectoriesCommunitiesGrid({
+  items,
+  isLoading = false,
+}: {
+  items: BgpCommunity[]
+  isLoading?: boolean
+}) {
+  const columns = useMemo<ColumnDef<BgpCommunity>[]>(
+    () => [
+      {
+        accessorKey: 'title',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Название" />,
+        cell: ({ row }) => <span className="font-medium">{row.original.title}</span>,
+        meta: { headerTitle: 'Название' },
+      },
+      {
+        accessorKey: 'community',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Значение" />,
+        cell: ({ row }) => <span className="font-mono text-xs">{row.original.community}</span>,
+        meta: { headerTitle: 'Значение' },
+      },
+      {
+        id: 'type',
+        enableSorting: false,
+        header: 'Тип',
+        cell: () => <Badge variant="outline">community</Badge>,
+        meta: { headerTitle: 'Тип' },
+      },
+    ],
+    [],
+  )
+
+  const table = useReactTable({
+    data: items,
+    columns,
+    ...createClientDataGridOptions<BgpCommunity>(),
+    getRowId: (row) => row.id,
+  })
+
+  return (
+    <DataGridShell
+      table={table}
+      recordCount={items.length}
+      isLoading={isLoading}
+      emptyMessage="Нет сообществ"
+    />
+  )
+}

apps/web/src/components/directories/directories-doh-grid.tsx

@@ -0,0 +1,59 @@
+import { ColumnDef, useReactTable } from '@tanstack/react-table'
+import { useMemo } from 'react'
+
+import { Badge } from '@evobgp/ui/components/badge'
+
+import { DataGridShell } from '@/components/data-grid-shell'
+import { DataGridColumnHeader } from '@/components/reui/data-grid/data-grid-column-header'
+import { createClientDataGridOptions } from '@/lib/data-grid-defaults'
+import type { DohProfile } from '@/types/api'
+
+export function DirectoriesDohGrid({
+  items,
+  isLoading = false,
+}: {
+  items: DohProfile[]
+  isLoading?: boolean
+}) {
+  const columns = useMemo<ColumnDef<DohProfile>[]>(
+    () => [
+      {
+        id: 'name',
+        accessorFn: (row) => row.name ?? row.url,
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Название" />,
+        cell: ({ row }) => <span className="font-medium">{row.original.name ?? row.original.url}</span>,
+        meta: { headerTitle: 'Название' },
+      },
+      {
+        accessorKey: 'url',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="URL" />,
+        cell: ({ row }) => <span className="font-mono text-xs">{row.original.url}</span>,
+        meta: { headerTitle: 'URL' },
+      },
+      {
+        id: 'default',
+        enableSorting: false,
+        header: 'По умолчанию',
+        cell: () => <Badge variant="outline">—</Badge>,
+        meta: { headerTitle: 'По умолчанию' },
+      },
+    ],
+    [],
+  )
+
+  const table = useReactTable({
+    data: items,
+    columns,
+    ...createClientDataGridOptions<DohProfile>(),
+    getRowId: (row) => row.id,
+  })
+
+  return (
+    <DataGridShell
+      table={table}
+      recordCount={items.length}
+      isLoading={isLoading}
+      emptyMessage="Нет DoH профилей"
+    />
+  )
+}

apps/web/src/components/firewall/firewall-clients-grid.tsx

@@ -0,0 +1,191 @@
+import { ColumnDef, useReactTable } from '@tanstack/react-table'
+import { useMemo } from 'react'
+
+import { Button } from '@evobgp/ui/components/button'
+
+import { DataGridShell } from '@/components/data-grid-shell'
+import { ConfirmDialog } from '@/components/confirm-dialog'
+import { StatusBadge } from '@/components/status-badge'
+import { DataGridColumnHeader } from '@/components/reui/data-grid/data-grid-column-header'
+import { createClientDataGridOptions } from '@/lib/data-grid-defaults'
+import type { FirewallClient } from '@/types/api'
+
+function formatPacketCount(value?: number | null): string | null {
+  if (value == null || value <= 0) return null
+  if (value >= 1_000_000) return `${(value / 1_000_000).toFixed(1)}M`
+  if (value >= 1_000) return `${(value / 1_000).toFixed(1)}k`
+  return String(value)
+}
+
+export interface FirewallClientsGridProps {
+  clients: FirewallClient[]
+  isLoading?: boolean
+  onApprove: (id: string) => void
+  onReject: (id: string) => void
+  approvePending?: boolean
+  rejectPending?: boolean
+  emptyTitle?: string
+}
+
+export function FirewallClientsGrid({
+  clients,
+  isLoading = false,
+  onApprove,
+  onReject,
+  approvePending = false,
+  rejectPending = false,
+  emptyTitle = 'Нет клиентов',
+}: FirewallClientsGridProps) {
+  const columns = useMemo<ColumnDef<FirewallClient>[]>(
+    () => [
+      {
+        accessorKey: 'name',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Имя" />,
+        cell: ({ row }) => (
+          <div>
+            <div className="font-medium">{row.original.name}</div>
+            <div className="text-muted-foreground text-xs">
+              {row.original.hostname || row.original.token_prefix}
+            </div>
+          </div>
+        ),
+        meta: { headerTitle: 'Имя' },
+      },
+      {
+        accessorKey: 'status',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Статус" />,
+        cell: ({ row }) => <StatusBadge status={row.original.status} />,
+        meta: { headerTitle: 'Статус' },
+      },
+      {
+        id: 'last_seen_at',
+        accessorFn: (row) => row.last_seen_at ?? '',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Last seen" />,
+        cell: ({ row }) => (
+          <span className="text-xs">{row.original.last_seen_at?.slice(0, 19) ?? '—'}</span>
+        ),
+        sortingFn: (a, b) => {
+          const av = a.original.last_seen_at ?? ''
+          const bv = b.original.last_seen_at ?? ''
+          return av.localeCompare(bv)
+        },
+        meta: { headerTitle: 'Last seen' },
+      },
+      {
+        id: 'apply',
+        enableSorting: false,
+        header: 'Apply',
+        cell: ({ row }) => {
+          const c = row.original
+          return (
+            <span className="text-xs">
+              {c.last_apply_status ?? '—'}
+              {c.last_apply_prefix_count != null ? ` (${c.last_apply_prefix_count})` : ''}
+            </span>
+          )
+        },
+        meta: { headerTitle: 'Apply' },
+      },
+      {
+        id: 'packets',
+        enableSorting: false,
+        header: 'Пакеты',
+        cell: ({ row }) => {
+          const dropped = formatPacketCount(row.original.last_apply_packets_dropped)
+          const accepted = formatPacketCount(row.original.last_apply_packets_accepted)
+          if (!dropped && !accepted) {
+            return <span className="text-muted-foreground text-xs">—</span>
+          }
+          return (
+            <span className="text-muted-foreground text-xs">
+              {dropped ? <span className="text-destructive">↓{dropped}</span> : null}
+              {dropped && accepted ? ' · ' : null}
+              {accepted ? <span className="text-success">↑{accepted}</span> : null}
+            </span>
+          )
+        },
+        meta: { headerTitle: 'Пакеты' },
+      },
+      {
+        id: 'actions',
+        enableSorting: false,
+        header: () => null,
+        cell: ({ row }) => {
+          const c = row.original
+          return (
+            <div className="flex justify-end gap-2">
+              {c.status === 'pending' ? (
+                <>
+                  <Button
+                    size="sm"
+                    variant="outline"
+                    type="button"
+                    disabled={approvePending}
+                    onClick={() => onApprove(c.id)}
+                  >
+                    Одобрить
+                  </Button>
+                  <ConfirmDialog
+                    trigger={
+                      <Button
+                        size="sm"
+                        variant="outline"
+                        type="button"
+                        className="text-destructive"
+                        disabled={rejectPending}
+                      >
+                        Отклонить
+                      </Button>
+                    }
+                    title="Отклонить запрос?"
+                    description={`${c.name}${c.hostname ? ` (${c.hostname})` : ''} — запись будет удалена, токен перестанет работать.`}
+                    confirmLabel="Отклонить"
+                    destructive
+                    onConfirm={() => onReject(c.id)}
+                  />
+                </>
+              ) : null}
+              {c.status === 'approved' ? (
+                <ConfirmDialog
+                  trigger={
+                    <Button
+                      size="sm"
+                      variant="ghost"
+                      type="button"
+                      className="text-destructive"
+                      disabled={rejectPending}
+                    >
+                      Удалить
+                    </Button>
+                  }
+                  title="Удалить клиент?"
+                  description={`${c.name} — запись будет удалена, blocklist и токен перестанут работать.`}
+                  confirmLabel="Удалить"
+                  destructive
+                  onConfirm={() => onReject(c.id)}
+                />
+              ) : null}
+            </div>
+          )
+        },
+      },
+    ],
+    [approvePending, onApprove, onReject, rejectPending],
+  )
+
+  const table = useReactTable({
+    data: clients,
+    columns,
+    ...createClientDataGridOptions<FirewallClient>(),
+    getRowId: (row) => row.id,
+  })
+
+  return (
+    <DataGridShell
+      table={table}
+      recordCount={clients.length}
+      isLoading={isLoading}
+      emptyMessage={emptyTitle}
+    />
+  )
+}

apps/web/src/components/firewall/firewall-rules-grid.tsx

@@ -0,0 +1,118 @@
+import { ColumnDef, useReactTable } from '@tanstack/react-table'
+import { useMemo } from 'react'
+
+import { Button } from '@evobgp/ui/components/button'
+
+import { DataGridShell } from '@/components/data-grid-shell'
+import { ConfirmDialog } from '@/components/confirm-dialog'
+import { StatusBadge } from '@/components/status-badge'
+import { DataGridColumnHeader } from '@/components/reui/data-grid/data-grid-column-header'
+import { createClientDataGridOptions } from '@/lib/data-grid-defaults'
+import { communityLabel } from '@/lib/modules/helpers'
+import type { BgpCommunity, FirewallRule } from '@/types/api'
+
+export interface FirewallRulesGridProps {
+  rules: FirewallRule[]
+  communities: BgpCommunity[]
+  isLoading?: boolean
+  onDelete: (id: string) => void
+  deletePending?: boolean
+  emptyTitle?: string
+}
+
+export function FirewallRulesGrid({
+  rules,
+  communities,
+  isLoading = false,
+  onDelete,
+  deletePending = false,
+  emptyTitle = 'Нет правил — blocklist пуст (default accept).',
+}: FirewallRulesGridProps) {
+  const columns = useMemo<ColumnDef<FirewallRule>[]>(
+    () => [
+      {
+        accessorKey: 'priority',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="#" />,
+        cell: ({ row }) => row.original.priority,
+        meta: { headerTitle: '#' },
+      },
+      {
+        accessorKey: 'action',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Действие" />,
+        cell: ({ row }) => (
+          <StatusBadge status={row.original.action} label={row.original.action} />
+        ),
+        meta: { headerTitle: 'Действие' },
+      },
+      {
+        id: 'community',
+        enableSorting: false,
+        header: 'Community',
+        cell: ({ row }) => (
+          <span className="text-sm">
+            {row.original.community_id
+              ? communityLabel(row.original.community_id, communities)
+              : 'Все'}
+          </span>
+        ),
+        meta: { headerTitle: 'Community' },
+      },
+      {
+        accessorKey: 'comment',
+        enableSorting: false,
+        header: 'Комментарий',
+        cell: ({ row }) => row.original.comment || '—',
+        meta: { headerTitle: 'Комментарий' },
+      },
+      {
+        id: 'actions',
+        enableSorting: false,
+        header: () => null,
+        cell: ({ row }) => {
+          const r = row.original
+          return (
+            <ConfirmDialog
+              trigger={
+                <Button
+                  size="sm"
+                  variant="ghost"
+                  type="button"
+                  className="text-destructive"
+                  disabled={deletePending}
+                >
+                  Удалить
+                </Button>
+              }
+              title="Удалить правило?"
+              description={
+                r.comment
+                  ? `Правило #${r.priority} (${r.action}): ${r.comment}`
+                  : `Правило #${r.priority} (${r.action}) будет удалено.`
+              }
+              confirmLabel="Удалить"
+              destructive
+              onConfirm={() => onDelete(r.id)}
+            />
+          )
+        },
+      },
+    ],
+    [communities, deletePending, onDelete],
+  )
+
+  const table = useReactTable({
+    data: rules,
+    columns,
+    ...createClientDataGridOptions<FirewallRule>(),
+    getRowId: (row) => row.id,
+  })
+
+  return (
+    <DataGridShell
+      table={table}
+      recordCount={rules.length}
+      isLoading={isLoading}
+      emptyMessage={emptyTitle}
+    />
+  )
+}

apps/web/src/components/layout/app-shell.tsx

@@ -9,6 +9,7 @@ import {
   BookText,
   KeyRound,
   ServerCog,
+  Shield,
 } from 'lucide-react'
 
 import {
@@ -69,6 +70,7 @@ const NAV_GROUPS: NavGroup[] = [
     label: 'Операции',
     items: [
       { to: '/operations', label: 'Операции', icon: Cog },
+      { to: '/firewall', label: 'Firewall', icon: Shield },
       { to: '/schedule', label: 'Задачи', icon: ListChecks },
       { to: '/monitoring', label: 'Мониторинг', icon: Activity },
     ],

apps/web/src/components/modules/community-select.tsx

@@ -0,0 +1,76 @@
+import { useMemo } from 'react'
+
+import { Label } from '@evobgp/ui/components/label'
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from '@evobgp/ui/components/select'
+
+import {
+  NONE_OPTION,
+  communityOptionLabel,
+  fromNullableSelect,
+  nullableSelectValue,
+} from '@/lib/modules/helpers'
+import type { BgpCommunity } from '@/types/api'
+
+interface CommunitySelectProps {
+  id?: string
+  label?: string
+  value: string | null
+  onValueChange: (value: string | null) => void
+  communities: BgpCommunity[]
+  nullable?: boolean
+  placeholder?: string
+}
+
+export function CommunitySelect({
+  id,
+  label,
+  value,
+  onValueChange,
+  communities,
+  nullable = false,
+  placeholder = 'Выберите community',
+}: CommunitySelectProps) {
+  const items = useMemo(() => {
+    const communityItems = communities.map((c) => ({
+      value: c.id,
+      label: communityOptionLabel(c),
+    }))
+    if (nullable) {
+      return [{ value: NONE_OPTION, label: 'Не выбрано' }, ...communityItems]
+    }
+    return communityItems
+  }, [communities, nullable])
+
+  const selectValue = nullable ? nullableSelectValue(value) : (value ?? '')
+
+  return (
+    <div className="flex flex-col gap-1.5">
+      {label ? <Label htmlFor={id}>{label}</Label> : null}
+      <Select
+        items={items}
+        value={selectValue}
+        onValueChange={(v) => {
+          if (!v) return
+          onValueChange(nullable ? fromNullableSelect(v) : v)
+        }}
+      >
+        <SelectTrigger id={id} className="w-full">
+          <SelectValue placeholder={placeholder} />
+        </SelectTrigger>
+        <SelectContent>
+          {items.map((item) => (
+            <SelectItem key={item.value} value={item.value}>
+              {item.label}
+            </SelectItem>
+          ))}
+        </SelectContent>
+      </Select>
+    </div>
+  )
+}

apps/web/src/components/modules/module-as-entry-dialog.tsx

@@ -0,0 +1,116 @@
+import { useEffect, useState } from 'react'
+import { toast } from 'sonner'
+
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+} from '@evobgp/ui/components/dialog'
+import { Input } from '@evobgp/ui/components/input'
+import { Label } from '@evobgp/ui/components/label'
+
+import { LoadingButton } from '@/components/loading-button'
+import { CommunitySelect } from '@/components/modules/community-select'
+import { ApiError, apiMutate } from '@/lib/api-client'
+import type { AsEntry, AsEntryCreate, AsEntryPatch, BgpCommunity } from '@/types/api'
+
+interface ModuleAsEntryDialogProps {
+  open: boolean
+  moduleId: string
+  edit: AsEntry | null
+  communities: BgpCommunity[]
+  onOpenChange: (open: boolean) => void
+  onSaved: () => void | Promise<void>
+}
+
+export function ModuleAsEntryDialog({
+  open,
+  moduleId,
+  edit,
+  communities,
+  onOpenChange,
+  onSaved,
+}: ModuleAsEntryDialogProps) {
+  const [saving, setSaving] = useState(false)
+  const [form, setForm] = useState<AsEntryCreate>({ asn: 0, community_id: null })
+
+  useEffect(() => {
+    if (!open) return
+    setForm(
+      edit
+        ? { asn: edit.asn, community_id: edit.community_id }
+        : { asn: 0, community_id: null },
+    )
+  }, [open, edit])
+
+  async function save() {
+    const asn = Number(form.asn)
+    if (!Number.isFinite(asn) || asn < 1 || asn > 4294967295) {
+      toast.error('Укажите корректный ASN (1–4294967295)')
+      return
+    }
+    setSaving(true)
+    try {
+      const body: AsEntryCreate | AsEntryPatch = { asn, community_id: form.community_id }
+      if (edit) {
+        await apiMutate(`/v1/modules/${moduleId}/as-entries/${edit.id}`, 'PATCH', body)
+        toast.success('Запись обновлена')
+      } else {
+        await apiMutate(`/v1/modules/${moduleId}/as-entries`, 'POST', body as AsEntryCreate)
+        toast.success('Запись добавлена')
+      }
+      onOpenChange(false)
+      await onSaved()
+    } catch (e) {
+      toast.error(e instanceof ApiError ? e.message : String(e))
+    } finally {
+      setSaving(false)
+    }
+  }
+
+  return (
+    <Dialog open={open} onOpenChange={onOpenChange}>
+      <DialogContent className="sm:max-w-sm">
+        <DialogHeader>
+          <DialogTitle>{edit ? 'Редактировать запись' : 'Новая AS-запись'}</DialogTitle>
+          <DialogDescription>
+            Номер автономной системы и community для политики анонса.
+          </DialogDescription>
+        </DialogHeader>
+        <div className="space-y-4 py-2">
+          <div className="flex flex-col gap-1.5">
+            <Label htmlFor="as-asn">ASN</Label>
+            <Input
+              id="as-asn"
+              type="number"
+              placeholder="12345"
+              value={form.asn || ''}
+              min={1}
+              max={4294967295}
+              onChange={(e) => setForm((s) => ({ ...s, asn: Number(e.target.value) }))}
+            />
+          </div>
+          <CommunitySelect
+            id="as-comm"
+            label="Community"
+            value={form.community_id ?? null}
+            onValueChange={(v) => setForm((s) => ({ ...s, community_id: v }))}
+            communities={communities}
+            nullable
+          />
+        </div>
+        <DialogFooter>
+          <LoadingButton variant="outline" onClick={() => onOpenChange(false)}>
+            Отмена
+          </LoadingButton>
+          <LoadingButton loading={saving} onClick={() => void save()}>
+            {edit ? 'Сохранить' : 'Добавить'}
+          </LoadingButton>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  )
+}

apps/web/src/components/modules/module-cdn-source-dialog.tsx

@@ -0,0 +1,277 @@
+import { useEffect, useMemo, useState } from 'react'
+import { toast } from 'sonner'
+
+import {
+  Dialog,
+  DialogContent,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+} from '@evobgp/ui/components/dialog'
+import { Input } from '@evobgp/ui/components/input'
+import { Label } from '@evobgp/ui/components/label'
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from '@evobgp/ui/components/select'
+import { Button } from '@evobgp/ui/components/button'
+
+import { LoadingButton } from '@/components/loading-button'
+import { CommunitySelect } from '@/components/modules/community-select'
+import { ApiError, apiMutate } from '@/lib/api-client'
+import { normalizeCdnSourceKind } from '@/lib/modules/helpers'
+import type { BgpCommunity, CdnPreviewResponse, CdnSource, CdnSourceCreate } from '@/types/api'
+
+const CDN_KIND_ITEMS = [
+  { value: 'plaintext', label: 'plaintext' },
+  { value: 'json', label: 'json' },
+] as const
+
+interface ModuleCdnSourceDialogProps {
+  open: boolean
+  moduleId: string
+  edit: CdnSource | null
+  communities: BgpCommunity[]
+  onOpenChange: (open: boolean) => void
+  onSaved: () => void | Promise<void>
+}
+
+type CdnForm = CdnSourceCreate & { refresh_interval_sec?: number | null }
+
+export function ModuleCdnSourceDialog({
+  open,
+  moduleId,
+  edit,
+  communities,
+  onOpenChange,
+  onSaved,
+}: ModuleCdnSourceDialogProps) {
+  const [saving, setSaving] = useState(false)
+  const [previewLoading, setPreviewLoading] = useState(false)
+  const [previewItems, setPreviewItems] = useState<string[]>([])
+  const [previewTotal, setPreviewTotal] = useState(0)
+  const [previewTruncated, setPreviewTruncated] = useState(false)
+  const [previewError, setPreviewError] = useState<string | null>(null)
+  const [previewOk, setPreviewOk] = useState(false)
+  const [form, setForm] = useState<CdnForm>({
+    url: '',
+    source_kind: 'plaintext',
+    prefix_path: '',
+    community_id: null,
+  })
+
+  const kindItems = useMemo(() => [...CDN_KIND_ITEMS], [])
+
+  function clearPreview() {
+    setPreviewLoading(false)
+    setPreviewItems([])
+    setPreviewTotal(0)
+    setPreviewTruncated(false)
+    setPreviewError(null)
+    setPreviewOk(false)
+  }
+
+  useEffect(() => {
+    if (!open) {
+      clearPreview()
+      return
+    }
+    setForm(
+      edit
+        ? {
+            url: edit.url,
+            source_kind: normalizeCdnSourceKind(edit.source_kind),
+            prefix_path: edit.prefix_path ?? '',
+            community_id: edit.community_id,
+            refresh_interval_sec: edit.refresh_interval_sec,
+          }
+        : { url: '', source_kind: 'plaintext', prefix_path: '', community_id: null },
+    )
+    clearPreview()
+  }, [open, edit])
+
+  async function previewCdn() {
+    const urlTrim = form.url.trim()
+    if (!urlTrim) {
+      toast.error('Укажите URL')
+      return
+    }
+    setPreviewLoading(true)
+    setPreviewError(null)
+    setPreviewOk(false)
+    try {
+      const res = await apiMutate<CdnPreviewResponse>(
+        `/v1/modules/${moduleId}/cdn-sources/preview`,
+        'POST',
+        {
+          url: urlTrim,
+          source_kind: form.source_kind,
+          prefix_path: form.prefix_path?.trim() ?? '',
+        },
+      )
+      setPreviewItems(res.items)
+      setPreviewTotal(res.total)
+      setPreviewTruncated(res.truncated)
+      setPreviewOk(true)
+    } catch (e) {
+      setPreviewError(e instanceof ApiError ? e.message : String(e))
+      setPreviewItems([])
+      setPreviewTotal(0)
+      setPreviewTruncated(false)
+      setPreviewOk(false)
+    } finally {
+      setPreviewLoading(false)
+    }
+  }
+
+  async function save() {
+    const urlTrim = form.url.trim()
+    if (!urlTrim) {
+      toast.error('Укажите URL')
+      return
+    }
+    setSaving(true)
+    try {
+      const body = {
+        ...form,
+        url: urlTrim,
+        source_kind: form.source_kind,
+        prefix_path: form.prefix_path?.trim() ?? '',
+      }
+      if (edit) {
+        await apiMutate(`/v1/modules/${moduleId}/cdn-sources/${edit.id}`, 'PATCH', body)
+        toast.success('Источник обновлён')
+      } else {
+        await apiMutate(`/v1/modules/${moduleId}/cdn-sources`, 'POST', body)
+        toast.success('Источник добавлен')
+      }
+      clearPreview()
+      onOpenChange(false)
+      await onSaved()
+    } catch (e) {
+      toast.error(e instanceof ApiError ? e.message : String(e))
+    } finally {
+      setSaving(false)
+    }
+  }
+
+  return (
+    <Dialog open={open} onOpenChange={onOpenChange}>
+      <DialogContent className="sm:max-w-lg">
+        <DialogHeader>
+          <DialogTitle>{edit ? 'Редактировать источник' : 'Новый CDN-источник'}</DialogTitle>
+        </DialogHeader>
+        <div className="space-y-4 py-2">
+          <div className="flex flex-col gap-1.5">
+            <Label htmlFor="cdn-url">URL</Label>
+            <Input
+              id="cdn-url"
+              placeholder="https://example.com/list.txt"
+              value={form.url}
+              onChange={(e) => setForm((s) => ({ ...s, url: e.target.value }))}
+            />
+          </div>
+          <div className="flex flex-col gap-1.5">
+            <Label htmlFor="cdn-kind">Тип источника</Label>
+            <Select
+              items={kindItems}
+              value={form.source_kind}
+              onValueChange={(v) => v && setForm((s) => ({ ...s, source_kind: v }))}
+            >
+              <SelectTrigger id="cdn-kind" className="w-full">
+                <SelectValue />
+              </SelectTrigger>
+              <SelectContent>
+                {kindItems.map((item) => (
+                  <SelectItem key={item.value} value={item.value}>
+                    {item.label}
+                  </SelectItem>
+                ))}
+              </SelectContent>
+            </Select>
+          </div>
+          <div className="flex flex-col gap-1.5">
+            <Label htmlFor="cdn-prefix-path">JSON path (prefix_path)</Label>
+            <Input
+              id="cdn-prefix-path"
+              placeholder="напр. prefixes[] или data.items[].cidr"
+              value={form.prefix_path ?? ''}
+              onChange={(e) => setForm((s) => ({ ...s, prefix_path: e.target.value }))}
+            />
+            {form.source_kind === 'json' && !form.prefix_path?.trim() ? (
+              <p className="text-xs text-muted-foreground">
+                Для JSON укажите путь к полям с CIDR; пустой путь может не дать префиксов.
+              </p>
+            ) : null}
+          </div>
+          <CommunitySelect
+            id="cdn-comm"
+            label="Community"
+            value={form.community_id ?? null}
+            onValueChange={(v) => setForm((s) => ({ ...s, community_id: v }))}
+            communities={communities}
+            nullable
+          />
+          <div className="flex flex-col gap-1.5">
+            <Label htmlFor="cdn-interval">Интервал обновления (сек)</Label>
+            <Input
+              id="cdn-interval"
+              type="number"
+              placeholder="3600"
+              value={form.refresh_interval_sec ?? ''}
+              onChange={(e) =>
+                setForm((s) => ({
+                  ...s,
+                  refresh_interval_sec: e.target.value ? Number(e.target.value) : null,
+                }))
+              }
+            />
+          </div>
+          <div className="flex flex-col gap-2 rounded-lg border border-border p-3">
+            <div className="flex flex-wrap items-center gap-2">
+              <Button
+                type="button"
+                variant="secondary"
+                size="sm"
+                onClick={() => void previewCdn()}
+                disabled={previewLoading}
+              >
+                {previewLoading ? 'Загрузка…' : 'Предпросмотр'}
+              </Button>
+              {previewError ? (
+                <span className="text-sm text-destructive">{previewError}</span>
+              ) : previewOk ? (
+                <span className="text-sm text-muted-foreground">
+                  Всего: {previewTotal}
+                  {previewTruncated ? (
+                    <span className="text-amber-600 dark:text-amber-500"> (обрезано)</span>
+                  ) : null}
+                </span>
+              ) : null}
+            </div>
+            {previewItems.length > 0 ? (
+              <ul className="max-h-48 overflow-y-auto rounded-md border bg-muted/40 p-2 font-mono text-xs">
+                {previewItems.map((item, i) => (
+                  <li key={`${i}-${item}`} className="py-0.5">
+                    {item}
+                  </li>
+                ))}
+              </ul>
+            ) : null}
+          </div>
+        </div>
+        <DialogFooter>
+          <LoadingButton variant="outline" onClick={() => onOpenChange(false)}>
+            Отмена
+          </LoadingButton>
+          <LoadingButton loading={saving} onClick={() => void save()}>
+            {edit ? 'Сохранить' : 'Добавить'}
+          </LoadingButton>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  )
+}

apps/web/src/components/modules/module-domain-entry-dialog.tsx

@@ -0,0 +1,108 @@
+import { useEffect, useState } from 'react'
+import { toast } from 'sonner'
+
+import {
+  Dialog,
+  DialogContent,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+} from '@evobgp/ui/components/dialog'
+import { Input } from '@evobgp/ui/components/input'
+import { Label } from '@evobgp/ui/components/label'
+
+import { LoadingButton } from '@/components/loading-button'
+import { CommunitySelect } from '@/components/modules/community-select'
+import { ApiError, apiMutate } from '@/lib/api-client'
+import type { BgpCommunity, DomainEntry, DomainEntryCreate } from '@/types/api'
+
+interface ModuleDomainEntryDialogProps {
+  open: boolean
+  moduleId: string
+  edit: DomainEntry | null
+  communities: BgpCommunity[]
+  onOpenChange: (open: boolean) => void
+  onSaved: () => void | Promise<void>
+}
+
+export function ModuleDomainEntryDialog({
+  open,
+  moduleId,
+  edit,
+  communities,
+  onOpenChange,
+  onSaved,
+}: ModuleDomainEntryDialogProps) {
+  const [saving, setSaving] = useState(false)
+  const [form, setForm] = useState<DomainEntryCreate>({ fqdn: '', community_id: null })
+
+  useEffect(() => {
+    if (!open) return
+    setForm(
+      edit
+        ? { fqdn: edit.fqdn, community_id: edit.community_id }
+        : { fqdn: '', community_id: null },
+    )
+  }, [open, edit])
+
+  async function save() {
+    if (!form.fqdn.trim()) {
+      toast.error('Укажите FQDN')
+      return
+    }
+    setSaving(true)
+    try {
+      const body = { fqdn: form.fqdn.trim(), community_id: form.community_id }
+      if (edit) {
+        await apiMutate(`/v1/modules/${moduleId}/domain-entries/${edit.id}`, 'PATCH', body)
+        toast.success('Домен обновлён')
+      } else {
+        await apiMutate(`/v1/modules/${moduleId}/domain-entries`, 'POST', body)
+        toast.success('Домен добавлен')
+      }
+      onOpenChange(false)
+      await onSaved()
+    } catch (e) {
+      toast.error(e instanceof ApiError ? e.message : String(e))
+    } finally {
+      setSaving(false)
+    }
+  }
+
+  return (
+    <Dialog open={open} onOpenChange={onOpenChange}>
+      <DialogContent className="sm:max-w-sm">
+        <DialogHeader>
+          <DialogTitle>{edit ? 'Редактировать домен' : 'Новый домен'}</DialogTitle>
+        </DialogHeader>
+        <div className="space-y-4 py-2">
+          <div className="flex flex-col gap-1.5">
+            <Label htmlFor="dom-fqdn">FQDN</Label>
+            <Input
+              id="dom-fqdn"
+              placeholder="example.com"
+              value={form.fqdn}
+              onChange={(e) => setForm((s) => ({ ...s, fqdn: e.target.value }))}
+            />
+          </div>
+          <CommunitySelect
+            id="dom-comm"
+            label="Community"
+            value={form.community_id ?? null}
+            onValueChange={(v) => setForm((s) => ({ ...s, community_id: v }))}
+            communities={communities}
+            nullable
+          />
+        </div>
+        <DialogFooter>
+          <LoadingButton variant="outline" onClick={() => onOpenChange(false)}>
+            Отмена
+          </LoadingButton>
+          <LoadingButton loading={saving} onClick={() => void save()}>
+            {edit ? 'Сохранить' : 'Добавить'}
+          </LoadingButton>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  )
+}

apps/web/src/components/modules/module-entries-grid.tsx

@@ -0,0 +1,251 @@
+import { ColumnDef, useReactTable } from '@tanstack/react-table'
+import { Pencil, Trash2 } from 'lucide-react'
+import { useMemo } from 'react'
+
+import { Button } from '@evobgp/ui/components/button'
+
+import { DataGridShell } from '@/components/data-grid-shell'
+import { DataGridColumnHeader } from '@/components/reui/data-grid/data-grid-column-header'
+import { formatDateTime } from '@/lib/modules/display'
+import { communityLabel } from '@/lib/modules/helpers'
+import { createClientDataGridOptions } from '@/lib/data-grid-defaults'
+import type {
+  AsEntry,
+  BgpCommunity,
+  CdnSource,
+  DomainEntry,
+  IpRangeEntry,
+  ModuleRow,
+} from '@/types/api'
+
+type DeleteTarget =
+  | { kind: 'domain'; entry: DomainEntry }
+  | { kind: 'ip-range'; entry: IpRangeEntry }
+  | { kind: 'cdn'; entry: CdnSource }
+  | { kind: 'as'; entry: AsEntry }
+
+function RowActions({ onEdit, onDelete }: { onEdit: () => void; onDelete: () => void }) {
+  return (
+    <div className="flex justify-end gap-1">
+      <Button variant="ghost" size="icon-sm" type="button" onClick={onEdit} aria-label="Редактировать">
+        <Pencil className="size-3.5" />
+      </Button>
+      <Button
+        variant="ghost"
+        size="icon-sm"
+        type="button"
+        className="text-destructive"
+        onClick={onDelete}
+        aria-label="Удалить"
+      >
+        <Trash2 className="size-3.5" />
+      </Button>
+    </div>
+  )
+}
+
+export function ModuleEntriesGrid({
+  mod,
+  rows,
+  communities,
+  onEdit,
+  onDelete,
+  isLoading = false,
+}: {
+  mod: ModuleRow
+  rows: Record<string, unknown>[]
+  communities: BgpCommunity[]
+  onEdit: (target: DeleteTarget) => void
+  onDelete: (target: DeleteTarget) => void
+  isLoading?: boolean
+}) {
+  const columns = useMemo(() => {
+    if (mod.type === 'DOMAINS') {
+      return [
+        {
+          accessorKey: 'fqdn',
+          header: ({ column }: { column: { id: string } }) => (
+            <DataGridColumnHeader column={column as never} title="FQDN" />
+          ),
+          cell: ({ row }: { row: { original: DomainEntry } }) => (
+            <span className="font-mono text-sm">{row.original.fqdn}</span>
+          ),
+        },
+        {
+          id: 'community',
+          header: 'Community',
+          cell: ({ row }: { row: { original: DomainEntry } }) => (
+            <span className="text-sm text-muted-foreground">
+              {communityLabel(row.original.community_id, communities)}
+            </span>
+          ),
+        },
+        {
+          id: 'actions',
+          enableSorting: false,
+          header: () => null,
+          cell: ({ row }: { row: { original: DomainEntry } }) => (
+            <RowActions
+              onEdit={() => onEdit({ kind: 'domain', entry: row.original })}
+              onDelete={() => onDelete({ kind: 'domain', entry: row.original })}
+            />
+          ),
+        },
+      ] as ColumnDef<DomainEntry>[]
+    }
+
+    if (mod.type === 'IP_RANGES') {
+      return [
+        {
+          accessorKey: 'prefix',
+          header: ({ column }: { column: { id: string } }) => (
+            <DataGridColumnHeader column={column as never} title="Префикс (CIDR)" />
+          ),
+          cell: ({ row }: { row: { original: IpRangeEntry } }) => (
+            <span className="font-mono text-sm">{row.original.prefix}</span>
+          ),
+        },
+        {
+          id: 'community',
+          header: 'Community',
+          cell: ({ row }: { row: { original: IpRangeEntry } }) => (
+            <span className="text-sm text-muted-foreground">
+              {communityLabel(row.original.community_id, communities)}
+            </span>
+          ),
+        },
+        {
+          id: 'actions',
+          enableSorting: false,
+          header: () => null,
+          cell: ({ row }: { row: { original: IpRangeEntry } }) => (
+            <RowActions
+              onEdit={() => onEdit({ kind: 'ip-range', entry: row.original })}
+              onDelete={() => onDelete({ kind: 'ip-range', entry: row.original })}
+            />
+          ),
+        },
+      ] as ColumnDef<IpRangeEntry>[]
+    }
+
+    if (mod.type === 'CDN_CIDRS') {
+      return [
+        {
+          accessorKey: 'url',
+          header: ({ column }: { column: { id: string } }) => (
+            <DataGridColumnHeader column={column as never} title="URL" />
+          ),
+          cell: ({ row }: { row: { original: CdnSource } }) => (
+            <span className="max-w-xs truncate font-mono text-xs">{row.original.url}</span>
+          ),
+        },
+        {
+          accessorKey: 'source_kind',
+          header: 'Тип',
+          cell: ({ row }: { row: { original: CdnSource } }) => (
+            <span className="text-sm">{row.original.source_kind}</span>
+          ),
+        },
+        {
+          id: 'community',
+          header: 'Community',
+          cell: ({ row }: { row: { original: CdnSource } }) => (
+            <span className="text-sm text-muted-foreground">
+              {communityLabel(row.original.community_id, communities)}
+            </span>
+          ),
+        },
+        {
+          id: 'last_refreshed_at',
+          accessorFn: (row: CdnSource) => row.last_refreshed_at ?? '',
+          header: ({ column }: { column: { id: string } }) => (
+            <DataGridColumnHeader column={column as never} title="Обновлено" />
+          ),
+          cell: ({ row }: { row: { original: CdnSource } }) => (
+            <span className="text-xs text-muted-foreground">
+              {formatDateTime(row.original.last_refreshed_at)}
+            </span>
+          ),
+        },
+        {
+          id: 'actions',
+          enableSorting: false,
+          header: () => null,
+          cell: ({ row }: { row: { original: CdnSource } }) => (
+            <RowActions
+              onEdit={() => onEdit({ kind: 'cdn', entry: row.original })}
+              onDelete={() => onDelete({ kind: 'cdn', entry: row.original })}
+            />
+          ),
+        },
+      ] as ColumnDef<CdnSource>[]
+    }
+
+    return [
+      {
+        accessorKey: 'asn',
+        header: ({ column }: { column: { id: string } }) => (
+          <DataGridColumnHeader column={column as never} title="ASN" />
+        ),
+        cell: ({ row }: { row: { original: AsEntry } }) => (
+          <span className="font-mono text-sm">{row.original.asn}</span>
+        ),
+      },
+      {
+        accessorKey: 'asn_name',
+        header: 'Имя',
+        cell: ({ row }: { row: { original: AsEntry } }) => (
+          <span className="text-sm">{row.original.asn_name ?? '—'}</span>
+        ),
+      },
+      {
+        accessorKey: 'prefix_count',
+        header: 'Префиксов',
+        cell: ({ row }: { row: { original: AsEntry } }) => (
+          <span className="font-mono text-sm">{row.original.prefix_count ?? '—'}</span>
+        ),
+      },
+      {
+        id: 'community',
+        header: 'Community',
+        cell: ({ row }: { row: { original: AsEntry } }) => (
+          <span className="text-sm text-muted-foreground">
+            {communityLabel(row.original.community_id, communities)}
+          </span>
+        ),
+      },
+      {
+        id: 'actions',
+        enableSorting: false,
+        header: () => null,
+        cell: ({ row }: { row: { original: AsEntry } }) => (
+          <RowActions
+            onEdit={() => onEdit({ kind: 'as', entry: row.original })}
+            onDelete={() => onDelete({ kind: 'as', entry: row.original })}
+          />
+        ),
+      },
+    ] as ColumnDef<AsEntry>[]
+  }, [communities, mod.type, onDelete, onEdit])
+
+  type RowType = DomainEntry | IpRangeEntry | CdnSource | AsEntry
+  const data = rows as unknown as RowType[]
+
+  const table = useReactTable({
+    data,
+    columns: columns as ColumnDef<RowType>[],
+    ...createClientDataGridOptions<RowType>(),
+    getRowId: (row) => row.id,
+  })
+
+  return (
+    <DataGridShell
+      table={table}
+      recordCount={data.length}
+      isLoading={isLoading}
+      emptyMessage="Нет записей"
+    />
+  )
+}
+
+export type { DeleteTarget as ModuleEntryDeleteTarget }

apps/web/src/components/modules/module-entries-section.tsx

@@ -0,0 +1,255 @@
+import { useState } from 'react'
+import { Plus } from 'lucide-react'
+import { toast } from 'sonner'
+
+import {
+  AlertDialog,
+  AlertDialogAction,
+  AlertDialogCancel,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogFooter,
+  AlertDialogHeader,
+  AlertDialogTitle,
+} from '@evobgp/ui/components/alert-dialog'
+import { Button } from '@evobgp/ui/components/button'
+
+import { DataGridCard } from '@/components/data-grid-shell'
+import { QueryState } from '@/components/query-state'
+import { TableSkeleton } from '@/components/skeletons'
+import { ModuleEntriesGrid, type ModuleEntryDeleteTarget } from '@/components/modules/module-entries-grid'
+import { ModuleAsEntryDialog } from '@/components/modules/module-as-entry-dialog'
+import { ModuleCdnSourceDialog } from '@/components/modules/module-cdn-source-dialog'
+import { ModuleDomainEntryDialog } from '@/components/modules/module-domain-entry-dialog'
+import { ModuleIpRangeEntryDialog } from '@/components/modules/module-ip-range-entry-dialog'
+import { ApiError, apiMutate } from '@/lib/api-client'
+import type {
+  AsEntry,
+  BgpCommunity,
+  CdnSource,
+  DomainEntry,
+  IpRangeEntry,
+  ModuleRow,
+} from '@/types/api'
+
+interface ModuleEntriesSectionProps {
+  moduleId: string
+  mod: ModuleRow
+  items: Record<string, unknown>[]
+  communities: BgpCommunity[]
+  isLoading: boolean
+  isError: boolean
+  error: Error | null
+  onRetry: () => void
+  onChanged: () => void | Promise<void>
+}
+
+type DeleteTarget = ModuleEntryDeleteTarget
+
+const CARD_META: Record<
+  ModuleRow['type'],
+  { title: string; description: string; emptyTitle: string; emptyDescription: string }
+> = {
+  DOMAINS: {
+    title: 'Домены',
+    description: 'FQDN для резолвинга через DoH.',
+    emptyTitle: 'Нет доменов',
+    emptyDescription: 'Добавьте FQDN для резолвинга.',
+  },
+  IP_RANGES: {
+    title: 'IP-диапазоны',
+    description: 'Статические CIDR для анонса.',
+    emptyTitle: 'Нет диапазонов',
+    emptyDescription: 'Добавьте CIDR.',
+  },
+  CDN_CIDRS: {
+    title: 'CDN-источники',
+    description: 'URL источников для скачивания списков CIDR.',
+    emptyTitle: 'Нет источников',
+    emptyDescription: 'Добавьте CDN-источник.',
+  },
+  AS_PREFIXES: {
+    title: 'AS-записи',
+    description: 'ASN для получения префиксов через RIPEstat.',
+    emptyTitle: 'Нет записей',
+    emptyDescription: 'Добавьте ASN.',
+  },
+}
+
+export function ModuleEntriesSection({
+  moduleId,
+  mod,
+  items,
+  communities,
+  isLoading,
+  isError,
+  error,
+  onRetry,
+  onChanged,
+}: ModuleEntriesSectionProps) {
+  const meta = CARD_META[mod.type]
+  const [dialogOpen, setDialogOpen] = useState(false)
+  const [deleteTarget, setDeleteTarget] = useState<DeleteTarget | null>(null)
+  const [deleting, setDeleting] = useState(false)
+
+  const [editDomain, setEditDomain] = useState<DomainEntry | null>(null)
+  const [editIpRange, setEditIpRange] = useState<IpRangeEntry | null>(null)
+  const [editCdn, setEditCdn] = useState<CdnSource | null>(null)
+  const [editAs, setEditAs] = useState<AsEntry | null>(null)
+
+  function openCreate() {
+    setEditDomain(null)
+    setEditIpRange(null)
+    setEditCdn(null)
+    setEditAs(null)
+    setDialogOpen(true)
+  }
+
+  function closeDialog() {
+    setDialogOpen(false)
+    setEditDomain(null)
+    setEditIpRange(null)
+    setEditCdn(null)
+    setEditAs(null)
+  }
+
+  async function confirmDelete() {
+    if (!deleteTarget) return
+    setDeleting(true)
+    try {
+      const { kind, entry } = deleteTarget
+      const pathByKind = {
+        domain: `/v1/modules/${moduleId}/domain-entries/${entry.id}`,
+        'ip-range': `/v1/modules/${moduleId}/ip-range-entries/${entry.id}`,
+        cdn: `/v1/modules/${moduleId}/cdn-sources/${entry.id}`,
+        as: `/v1/modules/${moduleId}/as-entries/${entry.id}`,
+      } as const
+      await apiMutate(pathByKind[kind], 'DELETE', undefined, { idempotent: false })
+      toast.success('Удалено')
+      setDeleteTarget(null)
+      await onChanged()
+    } catch (e) {
+      toast.error(e instanceof ApiError ? e.message : String(e))
+    } finally {
+      setDeleting(false)
+    }
+  }
+
+  return (
+    <>
+      <DataGridCard
+        title={meta.title}
+        description={meta.description}
+        actions={
+          <Button size="sm" type="button" onClick={openCreate}>
+            <Plus />
+            Добавить
+          </Button>
+        }
+      >
+        <QueryState
+          data={items}
+          isLoading={isLoading}
+          isError={isError}
+          error={error}
+          empty={items.length === 0}
+          emptyTitle={meta.emptyTitle}
+          emptyDescription={meta.emptyDescription}
+          skeleton={<TableSkeleton rows={5} cols={3} />}
+          onRetry={onRetry}
+        >
+          {(rows) => (
+            <ModuleEntriesGrid
+              mod={mod}
+              rows={rows}
+              communities={communities}
+              isLoading={isLoading}
+              onEdit={(target) => {
+                if (target.kind === 'domain') setEditDomain(target.entry)
+                if (target.kind === 'ip-range') setEditIpRange(target.entry)
+                if (target.kind === 'cdn') setEditCdn(target.entry)
+                if (target.kind === 'as') setEditAs(target.entry)
+                setDialogOpen(true)
+              }}
+              onDelete={setDeleteTarget}
+            />
+          )}
+        </QueryState>
+      </DataGridCard>
+
+      {mod.type === 'DOMAINS' ? (
+        <ModuleDomainEntryDialog
+          open={dialogOpen}
+          moduleId={moduleId}
+          edit={editDomain}
+          communities={communities}
+          onOpenChange={(open) => (open ? setDialogOpen(true) : closeDialog())}
+          onSaved={onChanged}
+        />
+      ) : null}
+      {mod.type === 'IP_RANGES' ? (
+        <ModuleIpRangeEntryDialog
+          open={dialogOpen}
+          moduleId={moduleId}
+          edit={editIpRange}
+          communities={communities}
+          onOpenChange={(open) => (open ? setDialogOpen(true) : closeDialog())}
+          onSaved={onChanged}
+        />
+      ) : null}
+      {mod.type === 'CDN_CIDRS' ? (
+        <ModuleCdnSourceDialog
+          open={dialogOpen}
+          moduleId={moduleId}
+          edit={editCdn}
+          communities={communities}
+          onOpenChange={(open) => (open ? setDialogOpen(true) : closeDialog())}
+          onSaved={onChanged}
+        />
+      ) : null}
+      {mod.type === 'AS_PREFIXES' ? (
+        <ModuleAsEntryDialog
+          open={dialogOpen}
+          moduleId={moduleId}
+          edit={editAs}
+          communities={communities}
+          onOpenChange={(open) => (open ? setDialogOpen(true) : closeDialog())}
+          onSaved={onChanged}
+        />
+      ) : null}
+
+      <AlertDialog open={deleteTarget !== null} onOpenChange={(open) => !open && setDeleteTarget(null)}>
+        <AlertDialogContent>
+          <AlertDialogHeader>
+            <AlertDialogTitle>Удалить запись?</AlertDialogTitle>
+            <AlertDialogDescription>{deleteDescription(deleteTarget)}</AlertDialogDescription>
+          </AlertDialogHeader>
+          <AlertDialogFooter>
+            <AlertDialogCancel disabled={deleting}>Отмена</AlertDialogCancel>
+            <AlertDialogAction
+              variant="destructive"
+              disabled={deleting}
+              onClick={() => void confirmDelete()}
+            >
+              {deleting ? 'Удаление…' : 'Удалить'}
+            </AlertDialogAction>
+          </AlertDialogFooter>
+        </AlertDialogContent>
+      </AlertDialog>
+    </>
+  )
+}
+
+function deleteDescription(target: DeleteTarget | null): string {
+  if (!target) return ''
+  switch (target.kind) {
+    case 'domain':
+      return target.entry.fqdn
+    case 'ip-range':
+      return target.entry.prefix
+    case 'cdn':
+      return target.entry.url
+    case 'as':
+      return `AS${target.entry.asn}`
+  }
+}

apps/web/src/components/modules/module-ip-range-entry-dialog.tsx

@@ -0,0 +1,108 @@
+import { useEffect, useState } from 'react'
+import { toast } from 'sonner'
+
+import {
+  Dialog,
+  DialogContent,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+} from '@evobgp/ui/components/dialog'
+import { Input } from '@evobgp/ui/components/input'
+import { Label } from '@evobgp/ui/components/label'
+
+import { LoadingButton } from '@/components/loading-button'
+import { CommunitySelect } from '@/components/modules/community-select'
+import { ApiError, apiMutate } from '@/lib/api-client'
+import type { BgpCommunity, IpRangeEntry, IpRangeEntryCreate } from '@/types/api'
+
+interface ModuleIpRangeEntryDialogProps {
+  open: boolean
+  moduleId: string
+  edit: IpRangeEntry | null
+  communities: BgpCommunity[]
+  onOpenChange: (open: boolean) => void
+  onSaved: () => void | Promise<void>
+}
+
+export function ModuleIpRangeEntryDialog({
+  open,
+  moduleId,
+  edit,
+  communities,
+  onOpenChange,
+  onSaved,
+}: ModuleIpRangeEntryDialogProps) {
+  const [saving, setSaving] = useState(false)
+  const [form, setForm] = useState<IpRangeEntryCreate>({ prefix: '', community_id: '' })
+
+  useEffect(() => {
+    if (!open) return
+    setForm(
+      edit
+        ? { prefix: edit.prefix, community_id: edit.community_id }
+        : { prefix: '', community_id: '' },
+    )
+  }, [open, edit])
+
+  async function save() {
+    if (!form.prefix.trim() || !form.community_id) {
+      toast.error('Укажите префикс и community')
+      return
+    }
+    setSaving(true)
+    try {
+      const body = { prefix: form.prefix.trim(), community_id: form.community_id }
+      if (edit) {
+        await apiMutate(`/v1/modules/${moduleId}/ip-range-entries/${edit.id}`, 'PATCH', body)
+        toast.success('Диапазон обновлён')
+      } else {
+        await apiMutate(`/v1/modules/${moduleId}/ip-range-entries`, 'POST', body)
+        toast.success('Диапазон добавлен')
+      }
+      onOpenChange(false)
+      await onSaved()
+    } catch (e) {
+      toast.error(e instanceof ApiError ? e.message : String(e))
+    } finally {
+      setSaving(false)
+    }
+  }
+
+  return (
+    <Dialog open={open} onOpenChange={onOpenChange}>
+      <DialogContent className="sm:max-w-sm">
+        <DialogHeader>
+          <DialogTitle>{edit ? 'Редактировать диапазон' : 'Новый IP-диапазон'}</DialogTitle>
+        </DialogHeader>
+        <div className="space-y-4 py-2">
+          <div className="flex flex-col gap-1.5">
+            <Label htmlFor="ip-prefix">Префикс (CIDR)</Label>
+            <Input
+              id="ip-prefix"
+              placeholder="203.0.113.0/24"
+              value={form.prefix}
+              onChange={(e) => setForm((s) => ({ ...s, prefix: e.target.value }))}
+            />
+          </div>
+          <CommunitySelect
+            id="ip-comm"
+            label="Community (обязательно)"
+            value={form.community_id || null}
+            onValueChange={(v) => setForm((s) => ({ ...s, community_id: v ?? '' }))}
+            communities={communities}
+            placeholder="Выберите community"
+          />
+        </div>
+        <DialogFooter>
+          <LoadingButton variant="outline" onClick={() => onOpenChange(false)}>
+            Отмена
+          </LoadingButton>
+          <LoadingButton loading={saving} onClick={() => void save()}>
+            {edit ? 'Сохранить' : 'Добавить'}
+          </LoadingButton>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  )
+}

apps/web/src/components/modules/module-kpi-cards.tsx

@@ -0,0 +1,84 @@
+import {
+  ArrowDownUp,
+  Network,
+  RefreshCw,
+  ShieldCheck,
+  Timer,
+} from 'lucide-react'
+
+import { SectionCards, type SectionCardItem } from '@/components/section-cards'
+import { SectionCardsSkeleton } from '@/components/skeletons'
+import { formatDateTime, moduleIntervalLabel } from '@/lib/modules/display'
+import {
+  communityLabel,
+  dohProfileLabel,
+  moduleDohProfileIds,
+} from '@/lib/modules/helpers'
+import { dohPolicyRu } from '@/lib/ui-labels'
+import type { AsEntry, BgpCommunity, DohProfile, ModuleRow } from '@/types/api'
+
+interface ModuleKpiCardsProps {
+  mod: ModuleRow | null
+  communities: BgpCommunity[]
+  dohProfiles: DohProfile[]
+  asEntries: AsEntry[]
+  loading?: boolean
+}
+
+export function ModuleKpiCards({
+  mod,
+  communities,
+  dohProfiles,
+  asEntries,
+  loading = false,
+}: ModuleKpiCardsProps) {
+  if (loading || !mod) {
+    return <SectionCardsSkeleton count={5} />
+  }
+
+  const asPrefixTotal = asEntries.reduce((acc, entry) => acc + (entry.prefix_count ?? 0), 0)
+  const dohIds = moduleDohProfileIds(mod)
+
+  const items: SectionCardItem[] = [
+    {
+      label: 'Приоритет',
+      value: String(mod.priority ?? 0),
+      hint: 'порядок в сборке ревизии',
+      icon: <ArrowDownUp className="size-3.5" />,
+    },
+    {
+      label: 'Интервал',
+      value: moduleIntervalLabel(mod),
+      hint: 'refresh_interval_sec / cron',
+      icon: <Timer className="size-3.5" />,
+    },
+    {
+      label: 'DoH',
+      value: mod.type === 'DOMAINS' ? dohPolicyRu(mod.doh_resolver_policy) : '—',
+      hint:
+        mod.type === 'DOMAINS'
+          ? dohIds.length
+            ? dohIds.map((id) => dohProfileLabel(id, dohProfiles)).join('; ')
+            : 'Системный DNS'
+          : 'не применимо',
+      icon: <Network className="size-3.5" />,
+    },
+    {
+      label: 'Community по умолч.',
+      value: communityLabel(mod.default_community_id, communities),
+      hint: 'для записей без своего community',
+      icon: <ShieldCheck className="size-3.5" />,
+    },
+    {
+      label: 'Последнее обновление',
+      value: formatDateTime(mod.last_refreshed_at),
+      hint:
+        mod.type === 'AS_PREFIXES'
+          ? `ASN: ${asEntries.length}, префиксов: ${asPrefixTotal}`
+          : 'время последнего refresh',
+      icon: <RefreshCw className="size-3.5" />,
+    },
+  ]
+
+  return <SectionCards items={items} />
+}

apps/web/src/components/modules/modules-list-grid.tsx

@@ -0,0 +1,99 @@
+import { ColumnDef, useReactTable } from '@tanstack/react-table'
+import { useNavigate } from '@tanstack/react-router'
+import { Boxes } from 'lucide-react'
+import { useMemo } from 'react'
+
+import { DataGridShell } from '@/components/data-grid-shell'
+import { Badge } from '@/components/reui/badge'
+import { DataGridColumnHeader } from '@/components/reui/data-grid/data-grid-column-header'
+import { TruncatedText } from '@/components/truncated-text'
+import { createClientDataGridOptions } from '@/lib/data-grid-defaults'
+import type { ModuleRow } from '@/types/api'
+
+export function ModulesListGrid({
+  items,
+  isLoading = false,
+}: {
+  items: ModuleRow[]
+  isLoading?: boolean
+}) {
+  const navigate = useNavigate()
+
+  const columns = useMemo<ColumnDef<ModuleRow>[]>(
+    () => [
+      {
+        accessorKey: 'name',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Название" />,
+        cell: ({ row }) => (
+          <div className="flex items-center gap-2">
+            <Boxes className="size-4 text-muted-foreground" />
+            <TruncatedText className="max-w-[280px] font-medium">{row.original.name}</TruncatedText>
+          </div>
+        ),
+        meta: { headerTitle: 'Название' },
+      },
+      {
+        accessorKey: 'type',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Тип" />,
+        cell: ({ row }) => <Badge variant="outline">{row.original.type}</Badge>,
+        meta: { headerTitle: 'Тип' },
+      },
+      {
+        accessorKey: 'priority',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Приоритет" />,
+        cell: ({ row }) => (
+          <span className="font-mono text-sm tabular-nums">{row.original.priority}</span>
+        ),
+        meta: { headerTitle: 'Приоритет' },
+      },
+      {
+        id: 'enabled',
+        accessorFn: (row) => (row.enabled ? 'enabled' : 'disabled'),
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Состояние" />,
+        cell: ({ row }) =>
+          row.original.enabled ? (
+            <Badge variant="success">включён</Badge>
+          ) : (
+            <Badge variant="secondary">выключен</Badge>
+          ),
+        meta: { headerTitle: 'Состояние' },
+      },
+      {
+        id: 'last_refreshed_at',
+        accessorFn: (row) => row.last_refreshed_at ?? '',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Обновлено" />,
+        cell: ({ row }) => (
+          <span className="text-xs text-muted-foreground">
+            {row.original.last_refreshed_at
+              ? new Date(row.original.last_refreshed_at).toLocaleString('ru-RU')
+              : '—'}
+          </span>
+        ),
+        sortingFn: (a, b) => {
+          const av = a.original.last_refreshed_at ?? ''
+          const bv = b.original.last_refreshed_at ?? ''
+          return av.localeCompare(bv)
+        },
+        meta: { headerTitle: 'Обновлено' },
+      },
+    ],
+    [],
+  )
+
+  const table = useReactTable({
+    data: items,
+    columns,
+    ...createClientDataGridOptions<ModuleRow>(),
+    getRowId: (row) => row.id,
+  })
+
+  return (
+    <DataGridShell
+      table={table}
+      recordCount={items.length}
+      isLoading={isLoading}
+      emptyMessage="Нет модулей"
+      onRowClick={(row) => void navigate({ to: '/modules/$moduleId', params: { moduleId: row.id } })}
+    />
+  )
+}

apps/web/src/components/monitoring/monitoring-ready-grid.tsx

@@ -0,0 +1,123 @@
+import { ColumnDef, useReactTable } from '@tanstack/react-table'
+import { Database, HardDrive, HeartPulse, ListTodo, ShieldCheck } from 'lucide-react'
+import { useMemo } from 'react'
+
+import { Badge } from '@evobgp/ui/components/badge'
+
+import { DataGridShell } from '@/components/data-grid-shell'
+import { DataGridColumnHeader } from '@/components/reui/data-grid/data-grid-column-header'
+import { createClientDataGridOptions } from '@/lib/data-grid-defaults'
+import type { ReadyStatus } from '@/queries/monitoring'
+
+const READY_CHECK_ICONS: Record<string, typeof Database> = {
+  postgres: Database,
+  store: HardDrive,
+  jobs: ListTodo,
+}
+
+interface ReadyCheckRow {
+  id: string
+  label: string
+  subtitle?: string
+  icon: typeof Database
+  ok: boolean
+  statusLabel: string
+  variant: 'default' | 'destructive' | 'secondary'
+}
+
+export function MonitoringReadyGrid({
+  health,
+  ready,
+}: {
+  health?: { ok?: boolean; status?: string; error?: string } | null
+  ready: ReadyStatus
+}) {
+  const data = useMemo<ReadyCheckRow[]>(() => {
+    const checks = ready.checks ?? {}
+    const rows: ReadyCheckRow[] = [
+      {
+        id: 'liveness',
+        label: 'Liveness',
+        subtitle: '/v1/health',
+        icon: HeartPulse,
+        ok: health?.ok === true,
+        statusLabel: health?.ok ? 'OK' : 'Ошибка',
+        variant: health?.ok ? 'default' : 'destructive',
+      },
+      {
+        id: 'readiness',
+        label: 'Readiness',
+        subtitle: '/v1/ready',
+        icon: ShieldCheck,
+        ok: ready.status === 'ok',
+        statusLabel: ready.status ?? '—',
+        variant: ready.status === 'ok' ? 'default' : 'secondary',
+      },
+    ]
+    for (const key of Object.keys(checks)) {
+      const value = checks[key]
+      const ok = typeof value === 'boolean' ? value : value?.ok !== false
+      rows.push({
+        id: key,
+        label: key,
+        icon: READY_CHECK_ICONS[key] ?? ListTodo,
+        ok,
+        statusLabel: ok ? 'OK' : 'Ошибка',
+        variant: ok ? 'default' : 'destructive',
+      })
+    }
+    return rows
+  }, [health?.ok, ready.checks, ready.status])
+
+  const columns = useMemo<ColumnDef<ReadyCheckRow>[]>(
+    () => [
+      {
+        accessorKey: 'label',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Проверка" />,
+        cell: ({ row }) => {
+          const Icon = row.original.icon
+          return (
+            <div className="flex items-center gap-2">
+              <Icon className="size-4 shrink-0 text-muted-foreground" />
+              <div>
+                <p className="text-sm font-medium">{row.original.label}</p>
+                {row.original.subtitle ? (
+                  <p className="text-xs text-muted-foreground">{row.original.subtitle}</p>
+                ) : null}
+              </div>
+            </div>
+          )
+        },
+        meta: { headerTitle: 'Проверка' },
+      },
+      {
+        id: 'status',
+        enableSorting: false,
+        header: 'Статус',
+        cell: ({ row }) => (
+          <Badge variant={row.original.variant}>{row.original.statusLabel}</Badge>
+        ),
+        meta: { headerTitle: 'Статус' },
+      },
+    ],
+    [],
+  )
+
+  const table = useReactTable({
+    data,
+    columns,
+    ...createClientDataGridOptions<ReadyCheckRow>({
+      initialState: { pagination: { pageSize: 20 } },
+    }),
+    getRowId: (row) => row.id,
+  })
+
+  return (
+    <DataGridShell
+      table={table}
+      recordCount={data.length}
+      showPagination={false}
+      emptyMessage="Нет проверок"
+    />
+  )
+}

apps/web/src/components/network/network-peers-grid.tsx

@@ -0,0 +1,77 @@
+import { ColumnDef, useReactTable } from '@tanstack/react-table'
+import { useMemo } from 'react'
+
+import { DataGridShell } from '@/components/data-grid-shell'
+import { StatusBadge } from '@/components/status-badge'
+import { Badge } from '@/components/reui/badge'
+import { DataGridColumnHeader } from '@/components/reui/data-grid/data-grid-column-header'
+import { createClientDataGridOptions } from '@/lib/data-grid-defaults'
+import type { PeerRow } from '@/types/api'
+
+export function NetworkPeersGrid({
+  items,
+  isLoading = false,
+}: {
+  items: PeerRow[]
+  isLoading?: boolean
+}) {
+  const columns = useMemo<ColumnDef<PeerRow>[]>(
+    () => [
+      {
+        id: 'name',
+        accessorFn: (row) => row.name ?? row.neighbor,
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Имя" />,
+        cell: ({ row }) => (
+          <span className="font-medium">{row.original.name ?? row.original.neighbor}</span>
+        ),
+        meta: { headerTitle: 'Имя' },
+      },
+      {
+        accessorKey: 'neighbor',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Neighbor" />,
+        cell: ({ row }) => <span className="font-mono text-xs">{row.original.neighbor}</span>,
+        meta: { headerTitle: 'Neighbor' },
+      },
+      {
+        accessorKey: 'remote_asn',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="ASN" />,
+        cell: ({ row }) => (
+          <span className="font-mono text-xs">{row.original.remote_asn ?? '—'}</span>
+        ),
+        meta: { headerTitle: 'ASN' },
+      },
+      {
+        accessorKey: 'session_state',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Состояние" />,
+        cell: ({ row }) => (
+          <div className="flex items-center gap-1">
+            <StatusBadge status={row.original.session_state} />
+            {row.original.session_mismatch ? (
+              <Badge variant="warning" className="ml-1">
+                mismatch
+              </Badge>
+            ) : null}
+          </div>
+        ),
+        meta: { headerTitle: 'Состояние' },
+      },
+    ],
+    [],
+  )
+
+  const table = useReactTable({
+    data: items,
+    columns,
+    ...createClientDataGridOptions<PeerRow>(),
+    getRowId: (row) => row.id,
+  })
+
+  return (
+    <DataGridShell
+      table={table}
+      recordCount={items.length}
+      isLoading={isLoading}
+      emptyMessage="Нет пиров"
+    />
+  )
+}

apps/web/src/components/network/network-speakers-grid.tsx

@@ -0,0 +1,78 @@
+import { ColumnDef, useReactTable } from '@tanstack/react-table'
+import { useMemo } from 'react'
+
+import { DataGridShell } from '@/components/data-grid-shell'
+import { StatusBadge } from '@/components/status-badge'
+import { Badge } from '@/components/reui/badge'
+import { DataGridColumnHeader } from '@/components/reui/data-grid/data-grid-column-header'
+import { createClientDataGridOptions } from '@/lib/data-grid-defaults'
+import type { SpeakerRow } from '@/types/api'
+
+export function NetworkSpeakersGrid({
+  items,
+  isLoading = false,
+}: {
+  items: SpeakerRow[]
+  isLoading?: boolean
+}) {
+  const columns = useMemo<ColumnDef<SpeakerRow>[]>(
+    () => [
+      {
+        accessorKey: 'endpoint',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Endpoint" />,
+        cell: ({ row }) => <span className="font-mono text-xs">{row.original.endpoint}</span>,
+        meta: { headerTitle: 'Endpoint' },
+      },
+      {
+        accessorKey: 'role',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Роль" />,
+        cell: ({ row }) => <Badge variant="outline">{row.original.role}</Badge>,
+        meta: { headerTitle: 'Роль' },
+      },
+      {
+        id: 'agent',
+        enableSorting: false,
+        header: 'Agent',
+        cell: ({ row }) => {
+          const live = row.original.live
+          if (live?.agent_ok === true) return <StatusBadge status="ok" label="online" />
+          if (live?.agent_ok === false) return <StatusBadge status="error" label="offline" />
+          return <Badge variant="outline">—</Badge>
+        },
+        meta: { headerTitle: 'Agent' },
+      },
+      {
+        id: 'bgp',
+        enableSorting: false,
+        header: 'BGP',
+        cell: ({ row }) => {
+          const live = row.original.live
+          if (!live) return '—'
+          return (
+            <span className="text-xs">
+              {live.bgp_established ?? 0} / {live.bgp_sessions_total ?? 0}
+            </span>
+          )
+        },
+        meta: { headerTitle: 'BGP' },
+      },
+    ],
+    [],
+  )
+
+  const table = useReactTable({
+    data: items,
+    columns,
+    ...createClientDataGridOptions<SpeakerRow>(),
+    getRowId: (row) => row.id,
+  })
+
+  return (
+    <DataGridShell
+      table={table}
+      recordCount={items.length}
+      isLoading={isLoading}
+      emptyMessage="Нет спикеров"
+    />
+  )
+}

apps/web/src/components/operations/operations-jobs-grid.tsx

@@ -0,0 +1,131 @@
+import { ColumnDef, useReactTable } from '@tanstack/react-table'
+import { useMutation } from '@tanstack/react-query'
+import { useMemo } from 'react'
+import { toast } from 'sonner'
+
+import { Button } from '@evobgp/ui/components/button'
+
+import { DataGridShell } from '@/components/data-grid-shell'
+import { DataGridColumnHeader } from '@/components/reui/data-grid/data-grid-column-header'
+import { apiMutate } from '@/lib/api-client'
+import { createClientDataGridOptions } from '@/lib/data-grid-defaults'
+import type { JobRow } from '@/types/api'
+import type { QueryClient } from '@tanstack/react-query'
+
+function StatusBadgeColored({ status }: { status: string }) {
+  const cls =
+    status === 'succeeded'
+      ? 'text-success'
+      : status === 'failed' || status === 'cancelled'
+        ? 'text-destructive'
+        : 'text-info'
+  return <span className={`text-sm font-medium ${cls}`}>{status}</span>
+}
+
+export function OperationsJobsGrid({
+  items,
+  nameById,
+  qc,
+  isLoading = false,
+}: {
+  items: JobRow[]
+  nameById: Map<string, string>
+  qc: QueryClient
+  isLoading?: boolean
+}) {
+  const cancelMutation = useMutation({
+    mutationFn: (jobId: string) => apiMutate(`/v1/jobs/${jobId}/cancel`, 'POST', {}),
+    onSuccess: () => {
+      toast.success('Задача отменена')
+      void qc.invalidateQueries({ queryKey: ['operations'] })
+    },
+    onError: (e) => toast.error(e instanceof Error ? e.message : 'Не удалось отменить'),
+  })
+
+  const columns = useMemo<ColumnDef<JobRow>[]>(
+    () => [
+      {
+        accessorKey: 'kind',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Вид" />,
+        cell: ({ row }) => (
+          <div className="flex flex-col gap-0.5">
+            <span className="font-medium">{row.original.kind}</span>
+            {row.original.meta?.module_id ? (
+              <span className="text-xs text-muted-foreground">
+                {nameById.get(String(row.original.meta.module_id)) ??
+                  String(row.original.meta.module_id)}
+              </span>
+            ) : null}
+          </div>
+        ),
+        meta: { headerTitle: 'Вид' },
+      },
+      {
+        accessorKey: 'status',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Статус" />,
+        cell: ({ row }) => <StatusBadgeColored status={row.original.status} />,
+        meta: { headerTitle: 'Статус' },
+      },
+      {
+        id: 'created_at',
+        accessorFn: (row) => row.created_at ?? '',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Создана" />,
+        cell: ({ row }) => (
+          <span className="whitespace-nowrap text-xs text-muted-foreground">
+            {row.original.created_at
+              ? new Date(row.original.created_at).toLocaleString('ru-RU')
+              : '—'}
+          </span>
+        ),
+        meta: { headerTitle: 'Создана' },
+      },
+      {
+        id: 'finished_at',
+        accessorFn: (row) => row.finished_at ?? '',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Завершена" />,
+        cell: ({ row }) => (
+          <span className="whitespace-nowrap text-xs text-muted-foreground">
+            {row.original.finished_at
+              ? new Date(row.original.finished_at).toLocaleString('ru-RU')
+              : '—'}
+          </span>
+        ),
+        meta: { headerTitle: 'Завершена' },
+      },
+      {
+        id: 'actions',
+        enableSorting: false,
+        header: () => null,
+        cell: ({ row }) =>
+          row.original.status === 'running' || row.original.status === 'queued' ? (
+            <Button
+              variant="ghost"
+              size="icon-sm"
+              type="button"
+              className="text-destructive"
+              onClick={() => cancelMutation.mutate(row.original.job_id)}
+            >
+              ✕
+            </Button>
+          ) : null,
+      },
+    ],
+    [cancelMutation, nameById],
+  )
+
+  const table = useReactTable({
+    data: items,
+    columns,
+    ...createClientDataGridOptions<JobRow>(),
+    getRowId: (row) => row.job_id,
+  })
+
+  return (
+    <DataGridShell
+      table={table}
+      recordCount={items.length}
+      isLoading={isLoading}
+      emptyMessage="Нет задач"
+    />
+  )
+}

apps/web/src/components/operations/operations-revisions-grid.tsx

@@ -0,0 +1,105 @@
+import { ColumnDef, useReactTable } from '@tanstack/react-table'
+import { useMutation } from '@tanstack/react-query'
+import { RefreshCw } from 'lucide-react'
+import { useMemo } from 'react'
+import { toast } from 'sonner'
+
+import { Button } from '@evobgp/ui/components/button'
+
+import { DataGridShell } from '@/components/data-grid-shell'
+import { ConfirmDialog } from '@/components/confirm-dialog'
+import { DataGridColumnHeader } from '@/components/reui/data-grid/data-grid-column-header'
+import { apiMutate } from '@/lib/api-client'
+import { createClientDataGridOptions } from '@/lib/data-grid-defaults'
+import type { RevisionRow } from '@/types/api'
+import type { QueryClient } from '@tanstack/react-query'
+
+export function OperationsRevisionsGrid({
+  items,
+  qc,
+  isLoading = false,
+}: {
+  items: RevisionRow[]
+  qc: QueryClient
+  isLoading?: boolean
+}) {
+  const rollbackMutation = useMutation({
+    mutationFn: (id: string) =>
+      apiMutate(`/v1/revisions/${id}/rollback`, 'POST', {}).then(() => id),
+    onSuccess: () => {
+      toast.success('Откат выполнен')
+      void qc.invalidateQueries({ queryKey: ['operations'] })
+    },
+    onError: (e) => toast.error(e instanceof Error ? e.message : 'Не удалось откатить'),
+  })
+
+  const columns = useMemo<ColumnDef<RevisionRow>[]>(
+    () => [
+      {
+        id: 'id',
+        accessorFn: (row) => row.id,
+        header: ({ column }) => <DataGridColumnHeader column={column} title="ID" />,
+        cell: ({ row }) => (
+          <span className="font-mono text-xs">{row.original.id.slice(0, 12)}…</span>
+        ),
+        meta: { headerTitle: 'ID' },
+      },
+      {
+        accessorKey: 'created_at',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Создана" />,
+        cell: ({ row }) => (
+          <span className="text-xs text-muted-foreground">
+            {new Date(row.original.created_at).toLocaleString('ru-RU')}
+          </span>
+        ),
+        meta: { headerTitle: 'Создана' },
+      },
+      {
+        accessorKey: 'materialized_prefix_count',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Префиксов" />,
+        cell: ({ row }) => (
+          <span className="font-mono text-sm tabular-nums">
+            {row.original.materialized_prefix_count}
+          </span>
+        ),
+        meta: { headerTitle: 'Префиксов' },
+      },
+      {
+        id: 'actions',
+        enableSorting: false,
+        header: () => null,
+        cell: ({ row }) => (
+          <ConfirmDialog
+            trigger={
+              <Button variant="ghost" size="icon-sm" type="button" className="text-destructive">
+                <RefreshCw className="size-3.5" />
+              </Button>
+            }
+            title={`Откатиться к ревизии ${row.original.id.slice(0, 8)}…?`}
+            description="Будет создана новая ревизия на основе выбранной. Требуется роль operator."
+            confirmLabel="Откатить"
+            destructive
+            onConfirm={() => rollbackMutation.mutate(row.original.id)}
+          />
+        ),
+      },
+    ],
+    [rollbackMutation],
+  )
+
+  const table = useReactTable({
+    data: items,
+    columns,
+    ...createClientDataGridOptions<RevisionRow>(),
+    getRowId: (row) => row.id,
+  })
+
+  return (
+    <DataGridShell
+      table={table}
+      recordCount={items.length}
+      isLoading={isLoading}
+      emptyMessage="Нет ревизий"
+    />
+  )
+}

apps/web/src/components/reui/data-grid/data-grid-pagination.tsx

@@ -153,6 +153,10 @@ function DataGridPagination(props: DataGridPaginationProps): React.JSX.Element {
               {mergedProps.rowsPerPageLabel}
             </div>
             <Select
+              items={mergedProps?.sizes?.map((size: number) => ({
+                value: `${size}`,
+                label: `${size}`,
+              }))}
               value={`${pageSize}`}
               onValueChange={(value) => {
                 const newPageSize = Number(value)

apps/web/src/components/reui/frame.tsx

@@ -0,0 +1,175 @@
+import { cva, type VariantProps } from "class-variance-authority"
+
+import { cn } from "@evobgp/ui/lib/utils"
+
+/**
+ * CSS variable architecture for FramePanel theming:
+ *
+ * The Frame parent sets --frame-panel-bg and --frame-panel-border-color.
+ * FramePanel consumes them directly via bg-(--frame-panel-bg) and
+ * border-(--frame-panel-border-color). This means:
+ *
+ *   - variant="inverse" overrides those vars on Frame → all panels pick it up
+ *   - <FramePanel className="bg-blue-50"> adds a direct utility on the element
+ *     which wins over bg-(--frame-panel-bg) by Tailwind source order — no
+ *     :not() or !important needed
+ */
+const frameVariants = cva(
+  [
+    "relative flex flex-col bg-muted/50 gap-(--frame-gap) px-(--frame-px) py-(--frame-py) rounded-(--frame-radius)",
+    "(--radius-xl)] [--frame-radius:var(--radius-xl)]",
+    "(--radius-none)] (--radius-2xl)] (--radius-lg)] (--radius-none)]",
+    "[--frame-gap:--spacing(0.75)] [--frame-px:--spacing(0.75)] [--frame-py:--spacing(0.75)] [--frame-panel-header-gap:0rem] [--frame-panel-footer-gap:--spacing(1)]",
+    "[--frame-panel-px-adjust:0px] [--frame-panel-py-adjust:0px] [--frame-panel-header-px-adjust:0px] [--frame-panel-header-py-adjust:0px] [--frame-panel-footer-px-adjust:0px] [--frame-panel-footer-py-adjust:0px]",
+    "[--frame-panel-px:calc(var(--frame-panel-px-base)_+_var(--frame-panel-px-adjust))] [--frame-panel-py:calc(var(--frame-panel-py-base)_+_var(--frame-panel-py-adjust))] [--frame-panel-header-px:calc(var(--frame-panel-header-px-base)_+_var(--frame-panel-header-px-adjust))] [--frame-panel-header-py:calc(var(--frame-panel-header-py-base)_+_var(--frame-panel-header-py-adjust))] [--frame-panel-footer-px:calc(var(--frame-panel-footer-px-base)_+_var(--frame-panel-footer-px-adjust))] [--frame-panel-footer-py:calc(var(--frame-panel-footer-py-base)_+_var(--frame-panel-footer-py-adjust))]",
+    "(1)] (1)] (1.25)] (1.5)] (1.5)] (0.5)] (1)] (1)]",
+    // Default panel token values — overridden per-variant below
+    "[--frame-panel-bg:var(--color-card)] [--frame-panel-border-color:var(--color-border)] [--frame-border-color:var(--color-border)]",
+  ],
+  {
+    variants: {
+      variant: {
+        default: "border border-[var(--frame-border-color)] bg-clip-padding",
+        inverse:
+          "[--frame-panel-bg:color-mix(in_oklch,var(--color-muted)_40%,transparent)] border border-[var(--frame-border-color)] bg-background bg-clip-padding",
+        ghost: "",
+      },
+      spacing: {
+        xs: "[--frame-panel-px-base:--spacing(2)] [--frame-panel-py-base:--spacing(2)] [--frame-panel-header-px-base:--spacing(2)] [--frame-panel-header-py-base:--spacing(1)] [--frame-panel-footer-px-base:--spacing(2)] [--frame-panel-footer-py-base:--spacing(1)] (3)] (1)] (3)] (3)]",
+        sm: "[--frame-panel-px-base:--spacing(3)] [--frame-panel-py-base:--spacing(3.5)] [--frame-panel-header-px-base:--spacing(3)] [--frame-panel-header-py-base:--spacing(2.5)] [--frame-panel-footer-px-base:--spacing(3)] [--frame-panel-footer-py-base:--spacing(2.5)] (2)] (2)] (2)]",
+        default:
+          "[--frame-panel-px-base:--spacing(4)] [--frame-panel-py-base:--spacing(4)] [--frame-panel-header-px-base:--spacing(4)] [--frame-panel-header-py-base:--spacing(3)] [--frame-panel-footer-px-base:--spacing(4)] [--frame-panel-footer-py-base:--spacing(3)] (2)] (2)] (2)]",
+        lg: "[--frame-panel-px-base:--spacing(5)] [--frame-panel-py-base:--spacing(5)] [--frame-panel-header-px-base:--spacing(5)] [--frame-panel-header-py-base:--spacing(4)] [--frame-panel-footer-px-base:--spacing(5)] [--frame-panel-footer-py-base:--spacing(4)] (2)] (2)] (2)]",
+      },
+      stacked: {
+        true: [
+          "gap-0 *:has-[+[data-slot=frame-panel]]:rounded-b-none",
+          "*:has-[+[data-slot=frame-panel]]:before:hidden",
+          "*:[[data-slot=frame-panel]+[data-slot=frame-panel]]:rounded-t-none",
+          "*:[[data-slot=frame-panel]+[data-slot=frame-panel]]:border-t-0",
+        ],
+        false: [
+          "data-[spacing=sm]:*:[[data-slot=frame-panel]+[data-slot=frame-panel]]:mt-0.5",
+          "data-[spacing=default]:*:[[data-slot=frame-panel]+[data-slot=frame-panel]]:mt-1",
+          "data-[spacing=lg]:*:[[data-slot=frame-panel]+[data-slot=frame-panel]]:mt-2",
+        ],
+      },
+      dense: {
+        // Positional rules must stay as parent selectors — cannot be expressed via CSS vars
+        true: "p-0 gap-0 border-[var(--frame-border-color)] [&_[data-slot=frame-panel]]:-mx-px [&_[data-slot=frame-panel]]:before:hidden [&_[data-slot=frame-panel]:last-child]:-mb-px [&:not(:has([data-slot=frame-panel-header]))_[data-slot=frame-panel]:is(:first-child)]:-mt-px",
+        false: "",
+      },
+    },
+    defaultVariants: {
+      variant: "default",
+      spacing: "default",
+      stacked: false,
+      dense: false,
+    },
+  }
+)
+
+function Frame({
+  className,
+  variant,
+  spacing,
+  stacked,
+  dense,
+  ...props
+}: React.ComponentProps<"div"> & VariantProps<typeof frameVariants>) {
+  return (
+    <div
+      className={cn(
+        frameVariants({ variant, spacing, stacked, dense }),
+        className
+      )}
+      data-slot="frame"
+      data-spacing={spacing}
+      {...props}
+    />
+  )
+}
+
+function FramePanel({
+  className,
+  fit,
+  ...props
+}: React.ComponentProps<"div"> & { fit?: boolean }) {
+  return (
+    <div
+      className={cn(
+        // bg-(--frame-panel-bg) and border-(--frame-panel-border-color) consume the
+        // CSS vars set by the Frame parent. Any explicit bg-* or border-* class passed
+        // via className overrides these by Tailwind source order - no ! needed.
+        "relative overflow-hidden rounded-(--frame-radius) border border-(--frame-panel-border-color) bg-(--frame-panel-bg) bg-clip-padding shadow-xs",
+        // `fit` sizes the panel to its content; otherwise it grows to fill the frame.
+        !fit && "grow",
+        "before:pointer-events-none before:absolute before:inset-0 before:rounded-[calc(var(--frame-radius)-1px)] before:shadow-black/5",
+        "dark:bg-clip-border dark:before:shadow-white/5",
+        "px-(--frame-panel-px) py-(--frame-panel-py)",
+        className
+      )}
+      data-slot="frame-panel"
+      {...props}
+    />
+  )
+}
+
+function FrameHeader({ className, ...props }: React.ComponentProps<"header">) {
+  return (
+    <header
+      className={cn(
+        "flex flex-col gap-(--frame-panel-header-gap) px-(--frame-panel-header-px) py-(--frame-panel-header-py)",
+        className
+      )}
+      data-slot="frame-panel-header"
+      {...props}
+    />
+  )
+}
+
+function FrameTitle({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      className={cn("text-sm font-semibold", className)}
+      data-slot="frame-panel-title"
+      {...props}
+    />
+  )
+}
+
+function FrameDescription({
+  className,
+  ...props
+}: React.ComponentProps<"div">) {
+  return (
+    <div
+      className={cn("text-muted-foreground text-sm", className)}
+      data-slot="frame-panel-description"
+      {...props}
+    />
+  )
+}
+
+function FrameFooter({ className, ...props }: React.ComponentProps<"footer">) {
+  return (
+    <footer
+      className={cn(
+        "flex flex-col gap-(--frame-panel-footer-gap) px-(--frame-panel-footer-px) py-(--frame-panel-footer-py)",
+        className
+      )}
+      data-slot="frame-panel-footer"
+      {...props}
+    />
+  )
+}
+
+export {
+  Frame,
+  FramePanel,
+  FrameHeader,
+  FrameTitle,
+  FrameDescription,
+  FrameFooter,
+  frameVariants,
+}

apps/web/src/components/schedule/schedule-jobs-grid.tsx

@@ -0,0 +1,100 @@
+import { ColumnDef, useReactTable } from '@tanstack/react-table'
+import { useMemo } from 'react'
+
+import { Badge } from '@evobgp/ui/components/badge'
+
+import { DataGridShell } from '@/components/data-grid-shell'
+import { DataGridColumnHeader } from '@/components/reui/data-grid/data-grid-column-header'
+import { createClientDataGridOptions } from '@/lib/data-grid-defaults'
+import type { JobRow } from '@/types/api'
+
+export function ScheduleJobsGrid({
+  items,
+  isLoading = false,
+}: {
+  items: JobRow[]
+  isLoading?: boolean
+}) {
+  const columns = useMemo<ColumnDef<JobRow>[]>(
+    () => [
+      {
+        accessorKey: 'kind',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Вид" />,
+        cell: ({ row }) => <span className="font-medium">{row.original.kind}</span>,
+        meta: { headerTitle: 'Вид' },
+      },
+      {
+        accessorKey: 'status',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Статус" />,
+        cell: ({ row }) => (
+          <Badge
+            variant={
+              row.original.status === 'succeeded'
+                ? 'default'
+                : row.original.status === 'failed'
+                  ? 'destructive'
+                  : 'secondary'
+            }
+          >
+            {row.original.status}
+          </Badge>
+        ),
+        meta: { headerTitle: 'Статус' },
+      },
+      {
+        id: 'created_at',
+        accessorFn: (row) => row.created_at ?? '',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Создана" />,
+        cell: ({ row }) => (
+          <span className="whitespace-nowrap text-xs text-muted-foreground">
+            {row.original.created_at
+              ? new Date(row.original.created_at).toLocaleString('ru-RU')
+              : '—'}
+          </span>
+        ),
+        meta: { headerTitle: 'Создана' },
+      },
+      {
+        id: 'finished_at',
+        accessorFn: (row) => row.finished_at ?? '',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Завершена" />,
+        cell: ({ row }) => (
+          <span className="whitespace-nowrap text-xs text-muted-foreground">
+            {row.original.finished_at
+              ? new Date(row.original.finished_at).toLocaleString('ru-RU')
+              : '—'}
+          </span>
+        ),
+        meta: { headerTitle: 'Завершена' },
+      },
+      {
+        accessorKey: 'error',
+        enableSorting: false,
+        header: 'Ошибка',
+        cell: ({ row }) => (
+          <span className="max-w-xs truncate text-xs text-destructive">
+            {row.original.error ?? ''}
+          </span>
+        ),
+        meta: { headerTitle: 'Ошибка' },
+      },
+    ],
+    [],
+  )
+
+  const table = useReactTable({
+    data: items,
+    columns,
+    ...createClientDataGridOptions<JobRow>(),
+    getRowId: (row) => row.job_id,
+  })
+
+  return (
+    <DataGridShell
+      table={table}
+      recordCount={items.length}
+      isLoading={isLoading}
+      emptyMessage="Нет задач"
+    />
+  )
+}

apps/web/src/components/schedule/schedule-modules-grid.tsx

@@ -0,0 +1,113 @@
+import { ColumnDef, useReactTable } from '@tanstack/react-table'
+import { RefreshCw } from 'lucide-react'
+import { useMemo } from 'react'
+
+import { Badge } from '@evobgp/ui/components/badge'
+
+import { DataGridShell } from '@/components/data-grid-shell'
+import { LoadingButton } from '@/components/loading-button'
+import { DataGridColumnHeader } from '@/components/reui/data-grid/data-grid-column-header'
+import { createClientDataGridOptions } from '@/lib/data-grid-defaults'
+import type { ModuleRow } from '@/types/api'
+
+export function ScheduleModulesGrid({
+  items,
+  refreshing,
+  onRefresh,
+  isLoading = false,
+}: {
+  items: ModuleRow[]
+  refreshing: Record<string, boolean>
+  onRefresh: (id: string) => void
+  isLoading?: boolean
+}) {
+  const columns = useMemo<ColumnDef<ModuleRow>[]>(
+    () => [
+      {
+        accessorKey: 'name',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Модуль" />,
+        cell: ({ row }) => <span className="font-medium">{row.original.name}</span>,
+        meta: { headerTitle: 'Модуль' },
+      },
+      {
+        accessorKey: 'type',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Тип" />,
+        cell: ({ row }) => <Badge variant="outline">{row.original.type}</Badge>,
+        meta: { headerTitle: 'Тип' },
+      },
+      {
+        id: 'schedule',
+        accessorFn: (row) => row.cron_expr ?? String(row.refresh_interval_sec ?? ''),
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Расписание" />,
+        cell: ({ row }) => (
+          <span className="font-mono text-xs text-muted-foreground">
+            {row.original.cron_expr ??
+              (row.original.refresh_interval_sec ? `${row.original.refresh_interval_sec}s` : '—')}
+          </span>
+        ),
+        meta: { headerTitle: 'Расписание' },
+      },
+      {
+        id: 'last_refreshed_at',
+        accessorFn: (row) => row.last_refreshed_at ?? '',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Обновлено" />,
+        cell: ({ row }) => (
+          <span className="whitespace-nowrap text-xs text-muted-foreground">
+            {row.original.last_refreshed_at
+              ? new Date(row.original.last_refreshed_at).toLocaleString('ru-RU')
+              : '—'}
+          </span>
+        ),
+        meta: { headerTitle: 'Обновлено' },
+      },
+      {
+        id: 'enabled',
+        accessorFn: (row) => (row.enabled ? 'on' : 'off'),
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Статус" />,
+        cell: ({ row }) =>
+          row.original.enabled ? (
+            <Badge variant="default">Вкл</Badge>
+          ) : (
+            <Badge variant="secondary">Выкл</Badge>
+          ),
+        meta: { headerTitle: 'Статус' },
+      },
+      {
+        id: 'actions',
+        enableSorting: false,
+        header: () => null,
+        cell: ({ row }) => (
+          <div className="text-right">
+            <LoadingButton
+              size="sm"
+              variant="secondary"
+              type="button"
+              loading={!!refreshing[row.original.id]}
+              onClick={() => onRefresh(row.original.id)}
+            >
+              <RefreshCw />
+              Обновить
+            </LoadingButton>
+          </div>
+        ),
+      },
+    ],
+    [onRefresh, refreshing],
+  )
+
+  const table = useReactTable({
+    data: items,
+    columns,
+    ...createClientDataGridOptions<ModuleRow>(),
+    getRowId: (row) => row.id,
+  })
+
+  return (
+    <DataGridShell
+      table={table}
+      recordCount={items.length}
+      isLoading={isLoading}
+      emptyMessage="Нет модулей"
+    />
+  )
+}

apps/web/src/components/settings/settings-kv-grid.tsx

@@ -0,0 +1,57 @@
+import { ColumnDef, useReactTable } from '@tanstack/react-table'
+import { useMemo } from 'react'
+
+import { DataGridShell } from '@/components/data-grid-shell'
+import { DataGridColumnHeader } from '@/components/reui/data-grid/data-grid-column-header'
+import { createClientDataGridOptions } from '@/lib/data-grid-defaults'
+
+export interface SettingsKvRow {
+  id: string | number
+  key: string
+  value: string
+}
+
+export function SettingsKvGrid({
+  items,
+  isLoading = false,
+}: {
+  items: SettingsKvRow[]
+  isLoading?: boolean
+}) {
+  const columns = useMemo<ColumnDef<SettingsKvRow>[]>(
+    () => [
+      {
+        accessorKey: 'key',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Ключ" />,
+        cell: ({ row }) => <span className="font-mono text-xs">{row.original.key}</span>,
+        meta: { headerTitle: 'Ключ' },
+      },
+      {
+        accessorKey: 'value',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Значение" />,
+        cell: ({ row }) => <span className="font-mono text-xs">{row.original.value}</span>,
+        meta: { headerTitle: 'Значение' },
+      },
+    ],
+    [],
+  )
+
+  const table = useReactTable({
+    data: items,
+    columns,
+    ...createClientDataGridOptions<SettingsKvRow>({
+      initialState: { pagination: { pageSize: 25 } },
+    }),
+    getRowId: (row) => String(row.id),
+  })
+
+  return (
+    <DataGridShell
+      table={table}
+      recordCount={items.length}
+      isLoading={isLoading}
+      emptyMessage="Нет дополнительных настроек"
+      showPagination={items.length > 10}
+    />
+  )
+}

apps/web/src/components/status-badge.tsx

@@ -22,6 +22,11 @@ const STATUS_VARIANT: Record<string, BadgeVariant> = {
   stale: 'warning',
   warning: 'warning',
   mismatch: 'warning',
+  pending: 'warning',
+  approved: 'success',
+  revoked: 'destructive',
+  block: 'destructive',
+  accept: 'success',
 }
 
 export function StatusBadge({ status, label }: { status: string; label?: string }) {

apps/web/src/lib/access/api-key-labels.ts

@@ -0,0 +1,19 @@
+import type { ApiKeyRole } from '@/types/api'
+
+export const API_KEY_ROLE_ITEMS: ReadonlyArray<{ value: ApiKeyRole; label: string }> = [
+  { value: 'viewer', label: 'viewer — только чтение' },
+  { value: 'editor', label: 'editor — CRUD без apply' },
+  { value: 'operator', label: 'operator — полный доступ' },
+  { value: 'node', label: 'node — только API ноды' },
+]
+
+export function apiKeyRoleLabel(role: ApiKeyRole): string {
+  return API_KEY_ROLE_ITEMS.find((o) => o.value === role)?.label ?? role
+}
+
+export function formatApiKeyDate(iso: string | null | undefined): string {
+  if (!iso) return '—'
+  const d = new Date(iso)
+  if (Number.isNaN(d.getTime())) return '—'
+  return d.toLocaleString('ru-RU')
+}

apps/web/src/lib/api-client.ts

@@ -11,6 +11,9 @@ import type {
 
 export const TOKEN_STORAGE_KEY = 'evobgp_api_token'
 
+/** Локальный demo-токен (operator) при включённом demo-seed — см. docs/access.md */
+export const DEV_API_TOKEN = 'dev'
+
 export type Problem = {
   type?: string
   title?: string
@@ -18,14 +21,31 @@ export type Problem = {
   detail?: string
 }
 
+/** Убирает пробелы и опциональный префикс Bearer (UI часто вставляет «Bearer dev»). */
+export function normalizeApiToken(raw: string): string {
+  let t = raw.trim()
+  if (/^bearer\s+/i.test(t)) {
+    t = t.replace(/^bearer\s+/i, '').trim()
+  }
+  return t
+}
+
 function getToken(): string | null {
   if (typeof window === 'undefined') return null
-  return window.localStorage.getItem(TOKEN_STORAGE_KEY)
+  const raw = window.localStorage.getItem(TOKEN_STORAGE_KEY)
+  if (!raw) return null
+  const normalized = normalizeApiToken(raw)
+  return normalized || null
 }
 
 export function setToken(token: string | null): void {
   if (typeof window === 'undefined') return
-  if (token) window.localStorage.setItem(TOKEN_STORAGE_KEY, token)
+  if (!token) {
+    window.localStorage.removeItem(TOKEN_STORAGE_KEY)
+    return
+  }
+  const normalized = normalizeApiToken(token)
+  if (normalized) window.localStorage.setItem(TOKEN_STORAGE_KEY, normalized)
   else window.localStorage.removeItem(TOKEN_STORAGE_KEY)
 }
 

apps/web/src/lib/data-grid-defaults.ts

@@ -0,0 +1,44 @@
+import {
+  getCoreRowModel,
+  getPaginationRowModel,
+  getSortedRowModel,
+  type TableOptions,
+} from '@tanstack/react-table'
+
+import type { DataGridProps } from '@/components/reui/data-grid/data-grid'
+
+export const DATA_GRID_TABLE_LAYOUT: NonNullable<DataGridProps<object>['tableLayout']> = {
+  dense: true,
+  headerSticky: true,
+  rowBorder: true,
+}
+
+export const DATA_GRID_PAGINATION_RU = {
+  sizes: [10, 25, 50] as number[],
+  sizesLabel: 'Показать',
+  sizesDescription: 'на странице',
+  info: '{from}–{to} из {count}',
+  rowsPerPageLabel: 'Строк на странице',
+  previousPageLabel: 'Предыдущая страница',
+  nextPageLabel: 'Следующая страница',
+}
+
+export const DATA_GRID_DENSE_LAYOUT: NonNullable<DataGridProps<object>['tableLayout']> = {
+  ...DATA_GRID_TABLE_LAYOUT,
+  dense: true,
+}
+
+export function createClientDataGridOptions<TData extends object>(
+  overrides?: Partial<TableOptions<TData>>,
+): Pick<
+  TableOptions<TData>,
+  'getCoreRowModel' | 'getSortedRowModel' | 'getPaginationRowModel' | 'initialState'
+> {
+  return {
+    getCoreRowModel: getCoreRowModel(),
+    getSortedRowModel: getSortedRowModel(),
+    getPaginationRowModel: getPaginationRowModel(),
+    initialState: { pagination: { pageSize: 10 } },
+    ...overrides,
+  }
+}

apps/web/src/lib/modules/display.ts

@@ -0,0 +1,24 @@
+import type { ModuleRow } from '@/types/api'
+
+export function formatDateTime(value: string | null | undefined): string {
+  if (typeof value !== 'string' || value.trim().length === 0) return '—'
+  const parsed = new Date(value)
+  if (Number.isNaN(parsed.getTime())) return '—'
+  return parsed.toLocaleString('ru-RU')
+}
+
+export function moduleIntervalLabel(moduleRow: ModuleRow): string {
+  const cron = typeof moduleRow.cron_expr === 'string' ? moduleRow.cron_expr.trim() : ''
+  const raw = moduleRow.refresh_interval_sec as unknown
+  const interval =
+    typeof raw === 'number'
+      ? raw
+      : typeof raw === 'string' && raw.trim().length > 0
+        ? Number(raw)
+        : null
+  const intervalLabel = interval !== null && Number.isFinite(interval) ? `${interval}с` : ''
+  if (cron && intervalLabel) return `${intervalLabel} (${cron})`
+  if (cron) return cron
+  if (intervalLabel) return intervalLabel
+  return '—'
+}

apps/web/src/lib/modules/helpers.ts

@@ -0,0 +1,41 @@
+import type { BgpCommunity, DohProfile, ModuleRow } from '@/types/api'
+
+export const NONE_OPTION = '__none__'
+
+export function communityLabel(id: string | null | undefined, communities: BgpCommunity[]): string {
+  if (!id) return '—'
+  const c = communities.find((x) => x.id === id)
+  if (!c) return `${id.slice(0, 8)}…`
+  const t = c.title?.trim()
+  return t || c.community
+}
+
+export function communityOptionLabel(c: BgpCommunity): string {
+  const t = c.title?.trim()
+  return t || c.community
+}
+
+export function nullableSelectValue(value: string | null | undefined): string {
+  if (value === null || value === undefined || value === '') return NONE_OPTION
+  return value
+}
+
+export function fromNullableSelect(value: string): string | null {
+  if (value === NONE_OPTION || value === '') return null
+  return value
+}
+
+export function moduleDohProfileIds(modRow: ModuleRow | null): string[] {
+  if (!modRow) return []
+  if (modRow.doh_profile_ids?.length) return modRow.doh_profile_ids
+  return modRow.doh_profile_id ? [modRow.doh_profile_id] : []
+}
+
+export function dohProfileLabel(id: string, dohProfiles: DohProfile[]): string {
+  const p = dohProfiles.find((d) => d.id === id)
+  return p ? (p.name?.trim() ? `${p.name} (${p.url})` : p.url) : `${id.slice(0, 8)}…`
+}
+
+export function normalizeCdnSourceKind(k: string): 'plaintext' | 'json' {
+  return k.trim().toLowerCase() === 'json' ? 'json' : 'plaintext'
+}

apps/web/src/lib/ui-labels.ts

@@ -0,0 +1,29 @@
+import type { DohResolverPolicy } from '@/types/api'
+
+export function dohPolicyRu(policy: DohResolverPolicy | string | null | undefined): string {
+  switch (policy) {
+    case 'primary_only':
+      return 'Только первый'
+    case 'failover':
+      return 'Резервирование'
+    case 'union':
+      return 'Объединение'
+    default:
+      return 'Только первый'
+  }
+}
+
+export function moduleTypeRu(type: string): string {
+  switch (type) {
+    case 'AS_PREFIXES':
+      return 'AS (номера)'
+    case 'CDN_CIDRS':
+      return 'CDN CIDR'
+    case 'DOMAINS':
+      return 'Домены'
+    case 'IP_RANGES':
+      return 'IP-диапазоны'
+    default:
+      return type
+  }
+}

apps/web/src/queries/api-keys.ts

@@ -1,6 +1,8 @@
-import { queryOptions } from '@tanstack/react-query'
-import { apiJSON } from '@/lib/api-client'
-import type { ApiKey, ApiKeysResponse } from '@/types/api'
+import { queryOptions, useMutation, useQueryClient } from '@tanstack/react-query'
+import { toast } from 'sonner'
+
+import { apiJSON, apiMutate } from '@/lib/api-client'
+import type { ApiKey, ApiKeyCreate, ApiKeyCreated, ApiKeysResponse } from '@/types/api'
 
 export const apiKeysKeys = {
   all: ['api-keys'] as const,
@@ -17,3 +19,48 @@ export function apiKeysQueryOptions() {
     staleTime: 60_000,
   })
 }
+
+function invalidateApiKeysList(qc: ReturnType<typeof useQueryClient>) {
+  void qc.invalidateQueries({ queryKey: apiKeysKeys.list() })
+}
+
+export function useCreateApiKeyMutation() {
+  const qc = useQueryClient()
+  return useMutation({
+    mutationFn: (body: ApiKeyCreate) =>
+      apiMutate<ApiKeyCreated>('/v1/api-keys', 'POST', body, { idempotent: false }),
+    onSuccess: () => {
+      toast.success('Ключ создан')
+      invalidateApiKeysList(qc)
+    },
+    onError: (e) => toast.error(e instanceof Error ? e.message : 'Не удалось создать ключ'),
+  })
+}
+
+export function useRevokeApiKeyMutation() {
+  const qc = useQueryClient()
+  return useMutation({
+    mutationFn: (id: string) =>
+      apiMutate(`/v1/api-keys/${id}`, 'DELETE', undefined, { idempotent: false }),
+    onSuccess: () => {
+      toast.success('Ключ отозван')
+      invalidateApiKeysList(qc)
+    },
+    onError: (e) => toast.error(e instanceof Error ? e.message : 'Не удалось отозвать'),
+  })
+}
+
+export function useRotateApiKeyMutation() {
+  const qc = useQueryClient()
+  return useMutation({
+    mutationFn: (id: string) =>
+      apiMutate<ApiKeyCreated>(`/v1/api-keys/${id}/rotate`, 'POST', undefined, {
+        idempotent: false,
+      }),
+    onSuccess: () => {
+      toast.success('Ключ ротирован')
+      invalidateApiKeysList(qc)
+    },
+    onError: (e) => toast.error(e instanceof Error ? e.message : 'Не удалось ротировать'),
+  })
+}

apps/web/src/queries/firewall.ts

@@ -0,0 +1,100 @@
+import { queryOptions, useMutation, useQueryClient } from '@tanstack/react-query'
+import { toast } from 'sonner'
+
+import { apiJSON } from '@/lib/api-client'
+import type {
+  FirewallClient,
+  FirewallClientsResponse,
+  FirewallInstallContext,
+  FirewallRule,
+  FirewallRulesResponse,
+} from '@/types/api'
+
+export const firewallKeys = {
+  all: ['firewall'] as const,
+  clients: () => [...firewallKeys.all, 'clients'] as const,
+  installContext: () => [...firewallKeys.all, 'install-context'] as const,
+  rules: (scope: string, clientId?: string) =>
+    [...firewallKeys.all, 'rules', scope, clientId ?? ''] as const,
+}
+
+export function firewallInstallContextQueryOptions() {
+  return queryOptions<FirewallInstallContext>({
+    queryKey: firewallKeys.installContext(),
+    queryFn: () => apiJSON<FirewallInstallContext>('/v1/firewall/install-context'),
+    staleTime: 60_000,
+    retry: false,
+  })
+}
+
+export function firewallClientsQueryOptions() {
+  return queryOptions<FirewallClientsResponse>({
+    queryKey: firewallKeys.clients(),
+    queryFn: () => apiJSON<FirewallClientsResponse>('/v1/firewall/clients'),
+    staleTime: 15_000,
+  })
+}
+
+export function firewallRulesQueryOptions(scope: 'tenant' | 'client', clientId?: string) {
+  const qs =
+    scope === 'client' && clientId
+      ? `?scope=client&client_id=${encodeURIComponent(clientId)}`
+      : '?scope=tenant'
+  return queryOptions<FirewallRulesResponse>({
+    queryKey: firewallKeys.rules(scope, clientId),
+    queryFn: () => apiJSON<FirewallRulesResponse>(`/v1/firewall/rules${qs}`),
+    staleTime: 15_000,
+  })
+}
+
+export function useApproveFirewallClient() {
+  const qc = useQueryClient()
+  return useMutation({
+    mutationFn: (id: string) =>
+      apiJSON<FirewallClient>(`/v1/firewall/clients/${id}/approve`, { method: 'POST' }),
+    onSuccess: () => {
+      toast.success('Клиент одобрен')
+      void qc.invalidateQueries({ queryKey: firewallKeys.clients() })
+    },
+    onError: (e) => toast.error(e instanceof Error ? e.message : 'Не удалось одобрить'),
+  })
+}
+
+export function useDeleteFirewallClient() {
+  const qc = useQueryClient()
+  return useMutation({
+    mutationFn: (id: string) =>
+      apiJSON<void>(`/v1/firewall/clients/${id}`, { method: 'DELETE' }),
+    onSuccess: () => {
+      toast.success('Клиент удалён')
+      void qc.invalidateQueries({ queryKey: firewallKeys.clients() })
+    },
+    onError: (e) => toast.error(e instanceof Error ? e.message : 'Не удалось удалить'),
+  })
+}
+
+export function useCreateFirewallRule() {
+  const qc = useQueryClient()
+  return useMutation({
+    mutationFn: (body: Record<string, unknown>) =>
+      apiJSON<FirewallRule>('/v1/firewall/rules', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(body),
+      }),
+    onSuccess: () => {
+      void qc.invalidateQueries({ queryKey: firewallKeys.all })
+    },
+  })
+}
+
+export function useDeleteFirewallRule() {
+  const qc = useQueryClient()
+  return useMutation({
+    mutationFn: (id: string) =>
+      apiJSON<void>(`/v1/firewall/rules/${id}`, { method: 'DELETE' }),
+    onSuccess: () => {
+      void qc.invalidateQueries({ queryKey: firewallKeys.all })
+    },
+  })
+}

apps/web/src/routes/_auth.tsx

@@ -1,10 +1,14 @@
 import { createFileRoute, Outlet, redirect } from '@tanstack/react-router'
 
+import { normalizeApiToken, TOKEN_STORAGE_KEY } from '@/lib/api-client'
+
 export const Route = createFileRoute('/_auth')({
-  beforeLoad: () => {
-    const token =
-      typeof window !== 'undefined' ? window.localStorage.getItem('evobgp_api_token') : null
-    if (!token) {
+  beforeLoad: ({ location }) => {
+    // Настройки доступны без токена — сюда попадают при первом входе (в т.ч. для `dev`).
+    if (location.pathname === '/settings') return
+    const raw =
+      typeof window !== 'undefined' ? window.localStorage.getItem(TOKEN_STORAGE_KEY) : null
+    if (!raw || !normalizeApiToken(raw)) {
       throw redirect({ to: '/settings' })
     }
   },

apps/web/src/routes/_auth/access.tsx

@@ -1,29 +1,18 @@
-import { createFileRoute } from '@tanstack/react-router'
+import { createFileRoute, Link } from '@tanstack/react-router'
 import { useQuery } from '@tanstack/react-query'
+import { Info, KeyRound, RefreshCw, ShieldCheck, ShieldOff } from 'lucide-react'
+import { useMemo } from 'react'
 
-import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '@evobgp/ui/components/card'
+import { Alert, AlertDescription, AlertTitle } from '@evobgp/ui/components/alert'
 import { Button } from '@evobgp/ui/components/button'
-import {
-  Table,
-  TableBody,
-  TableCell,
-  TableHead,
-  TableHeader,
-  TableRow,
-} from '@evobgp/ui/components/table'
-import { RefreshCw } from 'lucide-react'
-import { toast } from 'sonner'
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '@evobgp/ui/components/card'
 
+import { AccessApiKeysCard } from '@/components/access/access-api-keys-card'
 import { PageHeader } from '@/components/page-header'
-import { QueryState } from '@/components/query-state'
-import { ConfirmDialog } from '@/components/confirm-dialog'
+import { SectionCards, type SectionCardItem } from '@/components/section-cards'
+import { SectionCardsSkeleton } from '@/components/skeletons'
 import { authSessionQueryOptions } from '@/queries/auth'
 import { apiKeysQueryOptions } from '@/queries/api-keys'
-import { apiMutate } from '@/lib/api-client'
-import { useMutation } from '@tanstack/react-query'
-import type { ApiKeyCreated } from '@/types/api'
-import { useState } from 'react'
-import { Copy } from 'lucide-react'
 
 export const Route = createFileRoute('/_auth/access')({
   component: AccessComponent,
@@ -39,20 +28,80 @@ function AccessComponent() {
     enabled: isOperator,
   })
 
+  const keys = keysQuery.data ?? []
+  const activeCount = keys.filter((k) => !k.revoked_at).length
+  const revokedCount = keys.filter((k) => k.revoked_at).length
+
+  const refreshing = sessionQuery.isFetching || keysQuery.isFetching
+
+  const kpiItems: SectionCardItem[] = useMemo(
+    () => [
+      {
+        label: 'Всего ключей',
+        value: keys.length,
+        icon: <KeyRound className="size-4" />,
+        hint: 'в tenant',
+      },
+      {
+        label: 'Активных',
+        value: activeCount,
+        icon: <ShieldCheck className="size-4" />,
+        hint: 'не отозваны',
+      },
+      {
+        label: 'Отозванных',
+        value: revokedCount,
+        icon: <ShieldOff className="size-4" />,
+        hint: 'revoked',
+        variant: revokedCount > 0 ? 'warning' : 'default',
+      },
+    ],
+    [keys.length, activeCount, revokedCount],
+  )
+
+  function refetchAll() {
+    void sessionQuery.refetch()
+    if (isOperator) void keysQuery.refetch()
+  }
+
   return (
-    <div className="mx-auto flex max-w-4xl flex-col gap-6">
+    <div className="flex flex-col gap-6">
       <PageHeader
         title="Права доступа"
         description="API-ключи control plane и текущая сессия Bearer-токена."
+        actions={
+          isOperator ? (
+            <Button variant="outline" size="sm" onClick={refetchAll} disabled={refreshing}>
+              <RefreshCw className={refreshing ? 'animate-spin' : ''} />
+              Обновить
+            </Button>
+          ) : undefined
+        }
       />
 
+      <Alert className="border-info/30 bg-info/5">
+        <Info className="text-info" />
+        <AlertTitle>О API-ключах</AlertTitle>
+        <AlertDescription>
+          Роли: <code className="text-xs">viewer</code> (чтение),{' '}
+          <code className="text-xs">editor</code> (CRUD), <code className="text-xs">operator</code>{' '}
+          (apply и настройки), <code className="text-xs">node</code> (API ноды). Полный токен
+          показывается один раз при создании и ротации. Токен браузера — в{' '}
+          <Link to="/settings" className="text-primary underline-offset-4 hover:underline">
+            настройках
+          </Link>
+          ; для локальной разработки с demo-seed подойдёт <code className="text-xs">dev</code>{' '}
+          (роль operator).
+        </AlertDescription>
+      </Alert>
+
       {session ? (
         <Card>
-          <CardHeader>
+          <CardHeader className="border-b py-3">
             <CardTitle className="text-base">Текущая сессия</CardTitle>
             <CardDescription>Tenant и роль ключа, с которым открыта панель.</CardDescription>
           </CardHeader>
-          <CardContent className="grid gap-3 text-sm sm:grid-cols-2">
+          <CardContent className="grid gap-3 p-4 text-sm sm:grid-cols-2">
             <div>
               <p className="text-muted-foreground">Tenant</p>
               <p className="break-all font-mono text-xs">{session.tenant_id}</p>
@@ -63,183 +112,46 @@ function AccessComponent() {
             </div>
           </CardContent>
         </Card>
-      ) : null}
+      ) : (
+        <Card>
+          <CardContent className="py-6 text-sm text-muted-foreground">
+            Не удалось определить сессию. Укажите токен в{' '}
+            <Link to="/settings" className="text-primary underline-offset-4 hover:underline">
+              настройках
+            </Link>{' '}
+            (для dev-окружения — <code className="text-xs">dev</code> при включённом demo-seed).
+            {sessionQuery.isError && sessionQuery.error instanceof Error ? (
+              <span className="mt-2 block text-destructive">{sessionQuery.error.message}</span>
+            ) : null}
+          </CardContent>
+        </Card>
+      )}
 
       {isOperator ? (
-        <ApiKeysCard
-          items={keysQuery.data ?? []}
-          isLoading={keysQuery.isLoading}
-          isError={keysQuery.isError}
-          error={keysQuery.error}
-          onRetry={() => keysQuery.refetch()}
-        />
+        <>
+          {keysQuery.isLoading ? (
+            <SectionCardsSkeleton count={3} />
+          ) : (
+            <SectionCards items={kpiItems} />
+          )}
+          <AccessApiKeysCard
+            items={keys}
+            isLoading={keysQuery.isLoading}
+            isError={keysQuery.isError}
+            error={keysQuery.error}
+            onRetry={() => keysQuery.refetch()}
+          />
+        </>
       ) : session ? (
         <Card>
           <CardContent className="py-6 text-sm text-muted-foreground">
             Управление API-ключами доступно только роли <strong>operator</strong>. Текущая роль:{' '}
-            <span className="font-mono">{session.role}</span>.
+            <span className="font-mono">{session.role}</span>. Для выдачи ключей войдите с
+            operator-ключом или создайте ключ через API / переменную{' '}
+            <code className="text-xs">EVOBGP_API_KEYS</code>.
           </CardContent>
         </Card>
       ) : null}
     </div>
   )
 }
-
-function ApiKeysCard({
-  items,
-  isLoading,
-  isError,
-  error,
-  onRetry,
-}: {
-  items: import('@/types/api').ApiKey[]
-  isLoading: boolean
-  isError: boolean
-  error: unknown
-  onRetry: () => void
-}) {
-  const [revealedToken, setRevealedToken] = useState<string | null>(null)
-
-  const revoke = useMutation({
-    mutationFn: (id: string) =>
-      apiMutate(`/v1/api-keys/${id}`, 'DELETE', undefined, { idempotent: false }),
-    onSuccess: () => toast.success('Ключ отозван'),
-    onError: (e) => toast.error(e instanceof Error ? e.message : 'Не удалось отозвать'),
-  })
-
-  const rotate = useMutation({
-    mutationFn: (id: string) =>
-      apiMutate<ApiKeyCreated>(`/v1/api-keys/${id}/rotate`, 'POST', undefined, {
-        idempotent: false,
-      }),
-    onSuccess: (created) => {
-      toast.success('Ключ ротирован')
-      setRevealedToken(created.token)
-    },
-    onError: (e) => toast.error(e instanceof Error ? e.message : 'Не удалось ротировать'),
-  })
-
-  async function copyToken() {
-    if (!revealedToken) return
-    try {
-      await navigator.clipboard.writeText(revealedToken)
-      toast.success('Скопировано')
-    } catch {
-      toast.error('Не удалось скопировать')
-    }
-  }
-
-  return (
-    <Card>
-      <CardHeader className="flex flex-col gap-3 border-b py-3 sm:flex-row sm:items-center sm:justify-between">
-        <div className="min-w-0 flex-1">
-          <CardTitle className="text-base">API-ключи</CardTitle>
-          <CardDescription>
-            Управление ключами tenant. Полный токен показывается только при создании и ротации.
-          </CardDescription>
-        </div>
-        <Button size="sm" variant="outline" onClick={onRetry} disabled={isLoading}>
-          <RefreshCw className={isLoading ? 'animate-spin' : ''} />
-          Обновить
-        </Button>
-      </CardHeader>
-      <CardContent className="p-0">
-        <QueryState
-          data={items}
-          isLoading={isLoading}
-          isError={isError}
-          error={error}
-          empty={items.length === 0}
-          emptyTitle="Нет ключей"
-          emptyDescription="Ключи можно создать через API."
-          onRetry={onRetry}
-        >
-          {(data) => (
-            <Table>
-              <TableHeader>
-                <TableRow>
-                  <TableHead>Имя</TableHead>
-                  <TableHead>Роль</TableHead>
-                  <TableHead>Префикс</TableHead>
-                  <TableHead>Статус</TableHead>
-                  <TableHead className="w-24" />
-                </TableRow>
-              </TableHeader>
-              <TableBody>
-                {data.map((k) => (
-                  <TableRow key={k.id}>
-                    <TableCell className="font-medium">{k.name}</TableCell>
-                    <TableCell className="font-mono text-sm">{k.role}</TableCell>
-                    <TableCell className="font-mono text-xs text-muted-foreground">{k.prefix}…</TableCell>
-                    <TableCell>
-                      {k.revoked_at ? (
-                        <span className="text-sm text-destructive">отозван</span>
-                      ) : (
-                        <span className="text-sm text-muted-foreground">активен</span>
-                      )}
-                    </TableCell>
-                    <TableCell>
-                      <div className="flex gap-1">
-                        <ConfirmDialog
-                          trigger={
-                            <Button
-                              variant="ghost"
-                              size="icon-sm"
-                              title="Ротировать"
-                              disabled={!!k.revoked_at}
-                            >
-                              <RefreshCw className="size-3.5" />
-                            </Button>
-                          }
-                          title="Ротировать ключ?"
-                          description="Старый токен перестанет работать сразу."
-                          confirmLabel="Ротировать"
-                          onConfirm={() => rotate.mutate(k.id)}
-                        />
-                        <ConfirmDialog
-                          trigger={
-                            <Button
-                              variant="ghost"
-                              size="icon-sm"
-                              className="text-destructive"
-                              disabled={!!k.revoked_at}
-                              title="Отозвать"
-                            >
-                              <Copy className="size-3.5" />
-                            </Button>
-                          }
-                          title="Отозвать API-ключ?"
-                          description={`${k.name} (${k.prefix}…)`}
-                          confirmLabel="Отозвать"
-                          destructive
-                          onConfirm={() => revoke.mutate(k.id)}
-                        />
-                      </div>
-                    </TableCell>
-                  </TableRow>
-                ))}
-              </TableBody>
-            </Table>
-          )}
-        </QueryState>
-      </CardContent>
-
-      {revealedToken ? (
-        <div className="flex flex-col gap-3 border-t p-4">
-          <div className="text-sm font-medium">Новый токен (сохраните сейчас):</div>
-          <div className="break-all rounded-md border bg-muted/40 p-3 font-mono text-xs">
-            {revealedToken}
-          </div>
-          <div className="flex gap-2">
-            <Button variant="outline" size="sm" onClick={copyToken}>
-              <Copy /> Копировать
-            </Button>
-            <Button size="sm" onClick={() => setRevealedToken(null)}>
-              Готово
-            </Button>
-          </div>
-        </div>
-      ) : null}
-    </Card>
-  )
-}

apps/web/src/routes/_auth/dashboard.tsx

@@ -1,4 +1,4 @@
-import { createFileRoute } from '@tanstack/react-router'
+import { createFileRoute, useNavigate } from '@tanstack/react-router'
 import { useQueries } from '@tanstack/react-query'
 import {
   Boxes,
@@ -6,26 +6,29 @@ import {
   Clock,
   GitBranch,
   Info,
-  Network,
-  Play,
-  Plus,
   Radio,
   RefreshCw,
   Activity,
-  Share2,
-  Tags,
-  Gauge,
   XCircle,
 } from 'lucide-react'
-import { Link } from '@tanstack/react-router'
 import { useState } from 'react'
 
 import { Alert, AlertDescription, AlertTitle } from '@evobgp/ui/components/alert'
 import { Button } from '@evobgp/ui/components/button'
-import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '@evobgp/ui/components/card'
 import { Skeleton } from '@evobgp/ui/components/skeleton'
 
+import { DashboardNetworkPanel } from '@/components/dashboard/dashboard-network-panel'
+import { DashboardQuickActions } from '@/components/dashboard/dashboard-quick-actions'
+import { DashboardRecentJobsGrid } from '@/components/dashboard/dashboard-recent-jobs-grid'
+import { DashboardRecentRevisionsGrid } from '@/components/dashboard/dashboard-recent-revisions-grid'
 import { PageHeader } from '@/components/page-header'
+import {
+  Frame,
+  FrameDescription,
+  FrameHeader,
+  FramePanel,
+  FrameTitle,
+} from '@/components/reui/frame'
 import { SectionCards, type SectionCardItem } from '@/components/section-cards'
 import { SectionCardsSkeleton } from '@/components/skeletons'
 
@@ -46,6 +49,7 @@ export const Route = createFileRoute('/_auth/dashboard')({
 })
 
 function DashboardComponent() {
+  const navigate = useNavigate()
   const [lastUpdated, setLastUpdated] = useState<Date | null>(null)
 
   const results = useQueries({
@@ -95,7 +99,7 @@ function DashboardComponent() {
       value: initialLoading ? '—' : String(modules.length),
       icon: <Boxes className="size-4" />,
       hint: countBadge(modules.length, modulesHasMore, 'AS, CDN, домены, IP'),
-      onClick: () => window.location.assign('/modules'),
+      onClick: () => navigate({ to: '/modules' }),
     },
     {
       label: 'Пиры',
@@ -104,7 +108,7 @@ function DashboardComponent() {
       hint: countBadge(peers.length, peersHasMore, 'Established / включённых'),
       badge: net.peersMismatch > 0 ? `mismatch ${net.peersMismatch}` : undefined,
       variant: net.peersMismatch > 0 ? 'warning' : 'default',
-      onClick: () => window.location.assign('/network?tab=peers'),
+      onClick: () => navigate({ to: '/network', search: { tab: 'peers' } }),
     },
     {
       label: 'Спикеры',
@@ -112,26 +116,29 @@ function DashboardComponent() {
       icon: <Radio className="size-4" />,
       hint: countBadge(speakers.length, speakersHasMore, 'online / всего'),
       variant: net.speakersOnline < net.speakersTotal ? 'warning' : 'default',
-      onClick: () => window.location.assign('/network?tab=overview'),
+      onClick: () => navigate({ to: '/network', search: { tab: 'overview' } }),
     },
     {
       label: 'Ревизии',
       value: initialLoading ? '—' : String(revisions.length),
       icon: <Activity className="size-4" />,
       hint: countBadge(revisions.length, revisionsHasMore, 'configs'),
-      onClick: () => window.location.assign('/operations'),
+      onClick: () => navigate({ to: '/operations', search: { tab: 'revisions' } }),
     },
     {
       label: 'Активных задач',
       value: initialLoading ? '—' : String(running),
       icon: <Clock className="size-4" />,
       hint: 'queued и running',
-      onClick: () => window.location.assign('/operations?tab=jobs'),
+      onClick: () => navigate({ to: '/operations', search: { tab: 'jobs' } }),
     },
   ]
 
+  const activityLoading =
+    refreshing && jobs.length === 0 && revisions.length === 0 && peers.length === 0 && speakers.length === 0
+
   return (
-    <div className="flex flex-col gap-6">
+    <div className="flex flex-col gap-5">
       <PageHeader
         title="Обзор"
         description={
@@ -162,46 +169,61 @@ function DashboardComponent() {
         loadError={modulesQ.isError || peersQ.isError ? 'Некоторые данные не загружены' : null}
       />
 
-      {initialLoading ? <SectionCardsSkeleton count={5} /> : <SectionCards items={items} />}
+      {initialLoading ? <SectionCardsSkeleton count={5} /> : <SectionCards items={items} className="gap-3" />}
 
       <div className="grid gap-4 lg:grid-cols-3">
-        <RecentJobsCard jobs={jobs} nameById={nameById} loading={refreshing} />
-        <RecentRevisionsCard revisions={revisions} loading={refreshing} />
-        <NetworkStatusCard peers={peers} speakers={speakers} loading={refreshing} />
+        <Frame spacing="sm" className="h-full">
+          <FramePanel className="flex h-full flex-col p-0">
+            <FrameHeader className="border-b">
+              <FrameTitle>Недавние задачи</FrameTitle>
+              <FrameDescription>Последние фоновые операции</FrameDescription>
+            </FrameHeader>
+            {activityLoading ? (
+              <Skeleton className="m-3 h-24 w-auto" />
+            ) : (
+              <DashboardRecentJobsGrid jobs={jobs} nameById={nameById} isLoading={refreshing} />
+            )}
+          </FramePanel>
+        </Frame>
+
+        <Frame spacing="sm" className="h-full">
+          <FramePanel className="flex h-full flex-col p-0">
+            <FrameHeader className="border-b">
+              <FrameTitle>Последние ревизии</FrameTitle>
+              <FrameDescription>История конфигураций</FrameDescription>
+            </FrameHeader>
+            {activityLoading ? (
+              <Skeleton className="m-3 h-24 w-auto" />
+            ) : (
+              <DashboardRecentRevisionsGrid revisions={revisions} isLoading={refreshing} />
+            )}
+          </FramePanel>
+        </Frame>
+
+        <Frame spacing="sm" className="h-full">
+          <FramePanel className="flex h-full flex-col p-0">
+            <FrameHeader className="border-b">
+              <FrameTitle>Состояние сети</FrameTitle>
+              <FrameDescription>BGP-сессии и спикеры</FrameDescription>
+            </FrameHeader>
+            {activityLoading ? (
+              <Skeleton className="m-3 h-24 w-auto" />
+            ) : (
+              <DashboardNetworkPanel peers={peers} speakers={speakers} />
+            )}
+          </FramePanel>
+        </Frame>
       </div>
 
-      <Card>
-        <CardHeader className="border-b py-3">
-          <CardTitle className="text-base">Быстрые действия</CardTitle>
-          <CardDescription>Частые переходы к настройке и деплою</CardDescription>
-        </CardHeader>
-        <CardContent className="flex flex-wrap gap-2 p-4">
-          <Button variant="outline" size="sm" render={<Link to="/modules" />}>
-            <Plus className="size-4" />
-            Создать модуль
-          </Button>
-          <Button variant="outline" size="sm" onClick={() => (window.location.href = '/directories')}>
-            <Tags className="size-4" />
-            Добавить community
-          </Button>
-          <Button variant="outline" size="sm" onClick={() => (window.location.href = '/network?tab=overview')}>
-            <Network className="size-4" />
-            Сеть
-          </Button>
-          <Button variant="outline" size="sm" onClick={() => (window.location.href = '/network?tab=peers')}>
-            <Share2 className="size-4" />
-            Добавить пира
-          </Button>
-          <Button variant="outline" size="sm" onClick={() => (window.location.href = '/operations')}>
-            <Play className="size-4" />
-            Деплой (Apply)
-          </Button>
-          <Button variant="outline" size="sm" onClick={() => (window.location.href = '/monitoring')}>
-            <Gauge className="size-4" />
-            Мониторинг
-          </Button>
-        </CardContent>
-      </Card>
+      <Frame spacing="sm">
+        <FramePanel className="p-0">
+          <FrameHeader className="border-b">
+            <FrameTitle>Быстрые действия</FrameTitle>
+            <FrameDescription>Частые переходы к настройке и деплою</FrameDescription>
+          </FrameHeader>
+          <DashboardQuickActions />
+        </FramePanel>
+      </Frame>
     </div>
   )
 }
@@ -255,146 +277,3 @@ function HealthAlert({
     </Alert>
   )
 }
-
-function RecentJobsCard({
-  jobs,
-  nameById,
-  loading,
-}: {
-  jobs: import('@/types/api').JobRow[]
-  nameById: Map<string, string>
-  loading: boolean
-}) {
-  return (
-    <Card>
-      <CardHeader className="border-b py-3">
-        <CardTitle className="text-base">Недавние задачи</CardTitle>
-        <CardDescription>Последние фоновые операции</CardDescription>
-      </CardHeader>
-      <CardContent className="p-3">
-        {loading && jobs.length === 0 ? (
-          <Skeleton className="h-24 w-full" />
-        ) : jobs.length === 0 ? (
-          <p className="px-2 py-6 text-center text-sm text-muted-foreground">Нет задач</p>
-        ) : (
-          <ul className="flex flex-col gap-1">
-            {jobs.slice(0, 8).map((j) => (
-              <li
-                key={j.job_id}
-                className="flex items-center justify-between gap-2 rounded px-2 py-1 text-sm hover:bg-muted/40"
-              >
-                <span className="flex min-w-0 flex-col gap-0.5">
-                  <span className="truncate font-mono text-xs text-muted-foreground">{j.kind}</span>
-                  <span className="truncate text-xs">
-                    {j.meta?.module_id ? nameById.get(String(j.meta.module_id)) ?? '' : ''}
-                  </span>
-                </span>
-                <span
-                  className={
-                    j.status === 'succeeded'
-                      ? 'text-xs text-success'
-                      : j.status === 'failed'
-                        ? 'text-xs text-destructive'
-                        : 'text-xs text-muted-foreground'
-                  }
-                >
-                  {j.status}
-                </span>
-              </li>
-            ))}
-          </ul>
-        )}
-      </CardContent>
-    </Card>
-  )
-}
-
-function RecentRevisionsCard({
-  revisions,
-  loading,
-}: {
-  revisions: import('@/types/api').RevisionRow[]
-  loading: boolean
-}) {
-  return (
-    <Card>
-      <CardHeader className="border-b py-3">
-        <CardTitle className="text-base">Последние ревизии</CardTitle>
-        <CardDescription>История конфигураций</CardDescription>
-      </CardHeader>
-      <CardContent className="p-3">
-        {loading && revisions.length === 0 ? (
-          <Skeleton className="h-24 w-full" />
-        ) : revisions.length === 0 ? (
-          <p className="px-2 py-6 text-center text-sm text-muted-foreground">Нет ревизий</p>
-        ) : (
-          <ul className="flex flex-col gap-1">
-            {revisions.slice(0, 8).map((r) => (
-              <li
-                key={r.id}
-                className="flex items-center justify-between gap-2 rounded px-2 py-1 text-sm hover:bg-muted/40"
-              >
-                <span className="truncate font-mono text-xs text-muted-foreground">{r.id.slice(0, 10)}…</span>
-                <span className="text-xs text-muted-foreground">
-                  {new Date(r.created_at).toLocaleString('ru-RU')}
-                </span>
-              </li>
-            ))}
-          </ul>
-        )}
-      </CardContent>
-    </Card>
-  )
-}
-
-function NetworkStatusCard({
-  peers,
-  speakers,
-  loading,
-}: {
-  peers: import('@/types/api').PeerRow[]
-  speakers: import('@/types/api').SpeakerRow[]
-  loading: boolean
-}) {
-  const m = aggregateNetworkMetrics(peers, speakers)
-  return (
-    <Card>
-      <CardHeader className="border-b py-3">
-        <CardTitle className="text-base">Состояние сети</CardTitle>
-        <CardDescription>BGP-сессии и спикеры</CardDescription>
-      </CardHeader>
-      <CardContent className="p-3">
-        {loading && peers.length === 0 && speakers.length === 0 ? (
-          <Skeleton className="h-24 w-full" />
-        ) : (
-          <div className="flex flex-col gap-2 px-1 py-1 text-sm">
-            <Row label="Пиры Established" value={`${m.peersEstablished} / ${m.peersEnabled}`} />
-            <Row label="Спикеры online" value={`${m.speakersOnline} / ${m.speakersTotal}`} />
-            {m.peersMismatch > 0 ? (
-              <Row label="Mismatches" value={String(m.peersMismatch)} variant="warning" />
-            ) : null}
-          </div>
-        )}
-      </CardContent>
-    </Card>
-  )
-}
-
-function Row({
-  label,
-  value,
-  variant = 'default',
-}: {
-  label: string
-  value: string
-  variant?: 'default' | 'warning'
-}) {
-  return (
-    <div className="flex items-center justify-between gap-2">
-      <span className="text-muted-foreground">{label}</span>
-      <span className={variant === 'warning' ? 'font-medium text-warning-foreground' : 'font-medium tabular-nums'}>
-        {value}
-      </span>
-    </div>
-  )
-}

apps/web/src/routes/_auth/directories.tsx

@@ -3,19 +3,12 @@ import { useQuery } from '@tanstack/react-query'
 import { BookText, Globe, Info, RefreshCw, Tags } from 'lucide-react'
 
 import { Alert, AlertDescription, AlertTitle } from '@evobgp/ui/components/alert'
-import { Badge } from '@evobgp/ui/components/badge'
 import { Button } from '@evobgp/ui/components/button'
-import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '@evobgp/ui/components/card'
 import { Tabs, TabsContent, TabsList, TabsTrigger } from '@evobgp/ui/components/tabs'
-import {
-  Table,
-  TableBody,
-  TableCell,
-  TableHead,
-  TableHeader,
-  TableRow,
-} from '@evobgp/ui/components/table'
 
+import { DataGridCard } from '@/components/data-grid-shell'
+import { DirectoriesCommunitiesGrid } from '@/components/directories/directories-communities-grid'
+import { DirectoriesDohGrid } from '@/components/directories/directories-doh-grid'
 import { PageHeader } from '@/components/page-header'
 import { QueryState } from '@/components/query-state'
 import { SectionCards, type SectionCardItem } from '@/components/section-cards'
@@ -94,91 +87,50 @@ function DirectoriesComponent() {
         </TabsList>
 
         <TabsContent value="communities" className="mt-4">
-          <Card>
-            <CardHeader className="border-b py-3">
-              <CardTitle className="text-base">Сообщества BGP</CardTitle>
-              <CardDescription>Теги для префиксов в фильтрах BIRD</CardDescription>
-            </CardHeader>
-            <CardContent className="p-0">
-              <QueryState
-                data={communities}
-                isLoading={communitiesQ.isLoading}
-                isError={communitiesQ.isError}
-                error={communitiesQ.error}
-                empty={communities.length === 0}
-                emptyTitle="Нет сообществ"
-                skeleton={<TableSkeleton rows={4} cols={3} />}
-                onRetry={() => communitiesQ.refetch()}
-              >
-                {(items) => (
-                  <Table>
-                    <TableHeader>
-                      <TableRow>
-                        <TableHead>Название</TableHead>
-                        <TableHead>Значение</TableHead>
-                        <TableHead>Тип</TableHead>
-                      </TableRow>
-                    </TableHeader>
-                    <TableBody>
-                      {items.map((c) => (
-                        <TableRow key={c.id}>
-                          <TableCell className="font-medium">{c.title}</TableCell>
-                          <TableCell className="font-mono text-xs">{c.community}</TableCell>
-                          <TableCell>
-                            <Badge variant="outline">community</Badge>
-                          </TableCell>
-                        </TableRow>
-                      ))}
-                    </TableBody>
-                  </Table>
-                )}
-              </QueryState>
-            </CardContent>
-          </Card>
+          <DataGridCard
+            title="Сообщества BGP"
+            description="Теги для префиксов в фильтрах BIRD"
+          >
+            <QueryState
+              data={communities}
+              isLoading={communitiesQ.isLoading}
+              isError={communitiesQ.isError}
+              error={communitiesQ.error}
+              empty={communities.length === 0}
+              emptyTitle="Нет сообществ"
+              skeleton={<TableSkeleton rows={4} cols={3} />}
+              onRetry={() => communitiesQ.refetch()}
+            >
+              {(items) => (
+                <DirectoriesCommunitiesGrid
+                  items={items}
+                  isLoading={communitiesQ.isFetching && !communitiesQ.isLoading}
+                />
+              )}
+            </QueryState>
+          </DataGridCard>
         </TabsContent>
 
         <TabsContent value="doh" className="mt-4">
-          <Card>
-            <CardHeader className="border-b py-3">
-              <CardTitle className="text-base">DoH профили</CardTitle>
-              <CardDescription>Резолверы DNS-over-HTTPS для доменных модулей</CardDescription>
-            </CardHeader>
-            <CardContent className="p-0">
-              <QueryState
-                data={dohProfiles}
-                isLoading={dohQ.isLoading}
-                isError={dohQ.isError}
-                error={dohQ.error}
-                empty={dohProfiles.length === 0}
-                emptyTitle="Нет DoH профилей"
-                skeleton={<TableSkeleton rows={4} cols={3} />}
-                onRetry={() => dohQ.refetch()}
-              >
-                {(items) => (
-                  <Table>
-                    <TableHeader>
-                      <TableRow>
-                        <TableHead>Название</TableHead>
-                        <TableHead>URL</TableHead>
-                        <TableHead>По умолчанию</TableHead>
-                      </TableRow>
-                    </TableHeader>
-                    <TableBody>
-                      {items.map((p) => (
-                        <TableRow key={p.id}>
-                          <TableCell className="font-medium">{p.name ?? p.url}</TableCell>
-                          <TableCell className="font-mono text-xs">{p.url}</TableCell>
-                          <TableCell>
-                            <Badge variant="outline">—</Badge>
-                          </TableCell>
-                        </TableRow>
-                      ))}
-                    </TableBody>
-                  </Table>
-                )}
-              </QueryState>
-            </CardContent>
-          </Card>
+          <DataGridCard title="DoH профили" description="Резолверы DNS-over-HTTPS для доменных модулей">
+            <QueryState
+              data={dohProfiles}
+              isLoading={dohQ.isLoading}
+              isError={dohQ.isError}
+              error={dohQ.error}
+              empty={dohProfiles.length === 0}
+              emptyTitle="Нет DoH профилей"
+              skeleton={<TableSkeleton rows={4} cols={3} />}
+              onRetry={() => dohQ.refetch()}
+            >
+              {(items) => (
+                <DirectoriesDohGrid
+                  items={items}
+                  isLoading={dohQ.isFetching && !dohQ.isLoading}
+                />
+              )}
+            </QueryState>
+          </DataGridCard>
         </TabsContent>
       </Tabs>
     </div>

apps/web/src/routes/_auth/firewall.tsx

@@ -0,0 +1,309 @@
+import { createFileRoute } from '@tanstack/react-router'
+import { useQuery } from '@tanstack/react-query'
+import { Copy, Info, RefreshCw, Shield } from 'lucide-react'
+import { useEffect, useMemo, useState } from 'react'
+import { toast } from 'sonner'
+
+import { Alert, AlertDescription, AlertTitle } from '@evobgp/ui/components/alert'
+import { Button } from '@evobgp/ui/components/button'
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '@evobgp/ui/components/card'
+import { Input } from '@evobgp/ui/components/input'
+import { Label } from '@evobgp/ui/components/label'
+import { Tabs, TabsContent, TabsList, TabsTrigger } from '@evobgp/ui/components/tabs'
+
+import { FirewallClientsGrid } from '@/components/firewall/firewall-clients-grid'
+import { FirewallRulesGrid } from '@/components/firewall/firewall-rules-grid'
+import { PageHeader } from '@/components/page-header'
+import { CommunitySelect } from '@/components/modules/community-select'
+import { QueryState } from '@/components/query-state'
+import { TableSkeleton } from '@/components/skeletons'
+import { directoriesCommunitiesQueryOptions } from '@/queries/directories'
+import {
+  firewallClientsQueryOptions,
+  firewallInstallContextQueryOptions,
+  firewallRulesQueryOptions,
+  useApproveFirewallClient,
+  useCreateFirewallRule,
+  useDeleteFirewallClient,
+  useDeleteFirewallRule,
+} from '@/queries/firewall'
+
+function httpsOrigin(origin: string): string {
+  try {
+    const u = new URL(origin)
+    u.protocol = 'https:'
+    return u.origin
+  } catch {
+    return origin.replace(/^http:/i, 'https:')
+  }
+}
+
+export const Route = createFileRoute('/_auth/firewall')({
+  component: FirewallPage,
+})
+
+function FirewallPage() {
+  const installCtxQ = useQuery(firewallInstallContextQueryOptions())
+  const communitiesQ = useQuery(directoriesCommunitiesQueryOptions())
+  const clientsQ = useQuery(firewallClientsQueryOptions())
+  const rulesQ = useQuery(firewallRulesQueryOptions('tenant'))
+  const approve = useApproveFirewallClient()
+  const deleteClient = useDeleteFirewallClient()
+  const createRule = useCreateFirewallRule()
+  const deleteRule = useDeleteFirewallRule()
+
+  const installCtx = installCtxQ.data
+
+  const [clientName, setClientName] = useState('web-01')
+  const [cpUrl, setCpUrl] = useState(() =>
+    typeof window !== 'undefined' ? httpsOrigin(window.location.origin) : 'https://api.example.com',
+  )
+  const [seed, setSeed] = useState('')
+
+  useEffect(() => {
+    if (installCtx?.suggested_cp_url) {
+      setCpUrl(httpsOrigin(installCtx.suggested_cp_url))
+    }
+    if (installCtx?.bundle_seed) {
+      setSeed(installCtx.bundle_seed)
+    }
+  }, [installCtx?.bundle_seed, installCtx?.suggested_cp_url])
+  const [ruleAction, setRuleAction] = useState<'block' | 'accept'>('block')
+  const [ruleCommunityId, setRuleCommunityId] = useState<string | null>(null)
+  const [ruleComment, setRuleComment] = useState('')
+
+  const communities = communitiesQ.data?.items ?? []
+
+  const { activeClients, pending } = useMemo(() => {
+    const all = clientsQ.data?.items ?? []
+    return {
+      activeClients: all.filter((c) => c.status !== 'revoked'),
+      pending: all.filter((c) => c.status === 'pending'),
+    }
+  }, [clientsQ.data?.items])
+  const rules = rulesQ.data?.items ?? []
+
+  const installCmd = useMemo(() => {
+    const s = seed.trim() || '<bundle_seed_hex>'
+    return `curl -fsSL ${cpUrl.replace(/\/$/, '')}/v1/firewall/install.sh | \\
+  EVOBGP_CP_URL=${cpUrl.replace(/\/$/, '')} \\
+  EVOBGP_SEED=${s} \\
+  EVOBGP_CLIENT_NAME="${clientName}" \\
+  bash`
+  }, [clientName, cpUrl, seed])
+
+  async function copyInstall() {
+    if (!seed.trim()) {
+      toast.error(
+        installCtx?.bundle_seed_configured === false
+          ? 'На CP не задан EVOBGP_BUNDLE_SEED_HEX'
+          : 'Bundle seed недоступен (нужна роль operator)',
+      )
+      return
+    }
+    try {
+      await navigator.clipboard.writeText(installCmd)
+      toast.success('Команда скопирована')
+    } catch {
+      toast.error('Не удалось скопировать')
+    }
+  }
+
+  return (
+    <div className="flex flex-col gap-6">
+      <PageHeader
+        title="Firewall blocklist"
+        description="Linux-серверы: синхронизация CIDR по policy block/accept"
+        actions={
+          <Button
+            variant="outline"
+            size="sm"
+            onClick={() => {
+              void clientsQ.refetch()
+              void rulesQ.refetch()
+            }}
+            disabled={clientsQ.isFetching}
+          >
+            <RefreshCw className={clientsQ.isFetching ? 'animate-spin' : ''} />
+            Обновить
+          </Button>
+        }
+      />
+
+      <Alert className="border-info/30 bg-info/5">
+        <Info className="text-info" />
+        <AlertTitle>Политика</AlertTitle>
+        <AlertDescription>
+          Правила сопоставляются с <strong>BGP community</strong> префиксов опубликованной revision.{' '}
+          <strong>block</strong> добавляет префиксы community в kernel; <strong>accept</strong> — не блокирует.
+          Community «Все» — правило для любого community. Default без совпадений — accept.
+        </AlertDescription>
+      </Alert>
+
+      <Card>
+        <CardHeader>
+          <CardTitle className="flex items-center gap-2">
+            <Shield className="size-5" />
+            Установка на сервер
+          </CardTitle>
+          <CardDescription>One-liner для root на целевом Linux (bash, curl). После enroll — approve в «Запросы».</CardDescription>
+        </CardHeader>
+        <CardContent className="flex flex-col gap-4">
+          <div className="grid gap-4 sm:grid-cols-3">
+            <div className="space-y-2">
+              <Label htmlFor="fw-name">Имя сервера</Label>
+              <Input id="fw-name" value={clientName} onChange={(e) => setClientName(e.target.value)} />
+            </div>
+            <div className="space-y-2">
+              <Label htmlFor="fw-url">URL API</Label>
+              <Input id="fw-url" value={cpUrl} onChange={(e) => setCpUrl(e.target.value)} />
+            </div>
+            <div className="space-y-2">
+              <Label htmlFor="fw-seed">Bundle seed</Label>
+              <Input
+                id="fw-seed"
+                type="password"
+                readOnly
+                placeholder="EVOBGP_BUNDLE_SEED_HEX"
+                value={seed}
+                className="font-mono text-xs"
+              />
+              <p className="text-muted-foreground text-xs">
+                {installCtxQ.isLoading
+                  ? 'Загрузка из control plane…'
+                  : installCtx?.bundle_seed_configured
+                    ? 'Из переменной EVOBGP_BUNDLE_SEED_HEX на CP (docker compose / .env)'
+                    : 'На CP не задан EVOBGP_BUNDLE_SEED_HEX — enroll невозможен'}
+              </p>
+            </div>
+          </div>
+          <pre className="overflow-x-auto rounded-md border bg-muted/40 p-3 text-xs">{installCmd}</pre>
+          <Button variant="outline" size="sm" className="w-fit" onClick={copyInstall}>
+            <Copy />
+            Копировать команду
+          </Button>
+        </CardContent>
+      </Card>
+
+      <Tabs defaultValue="clients">
+        <TabsList>
+          <TabsTrigger value="clients">Клиенты ({activeClients.length})</TabsTrigger>
+          <TabsTrigger value="rules">Правила ({rules.length})</TabsTrigger>
+          <TabsTrigger value="requests">Запросы ({pending.length})</TabsTrigger>
+        </TabsList>
+
+        <TabsContent value="clients" className="mt-4">
+          <QueryState
+            data={clientsQ.data}
+            isLoading={clientsQ.isLoading}
+            isError={clientsQ.isError}
+            error={clientsQ.error}
+            onRetry={() => void clientsQ.refetch()}
+            skeleton={<TableSkeleton rows={5} cols={6} />}
+          >
+            {() => (
+              <FirewallClientsGrid
+                clients={activeClients}
+                isLoading={clientsQ.isFetching && !clientsQ.isLoading}
+                onApprove={(id) => approve.mutate(id)}
+                onReject={(id) => deleteClient.mutate(id)}
+                approvePending={approve.isPending}
+                rejectPending={deleteClient.isPending}
+              />
+            )}
+          </QueryState>
+        </TabsContent>
+
+        <TabsContent value="rules" className="mt-4 space-y-4">
+          <div className="flex flex-wrap items-end gap-3">
+            <div className="space-y-1">
+              <Label>Действие</Label>
+              <select
+                className="border-input bg-background h-9 rounded-md border px-2 text-sm"
+                value={ruleAction}
+                onChange={(e) => setRuleAction(e.target.value as 'block' | 'accept')}
+              >
+                <option value="block">block</option>
+                <option value="accept">accept</option>
+              </select>
+            </div>
+            <CommunitySelect
+              id="fw-rule-community"
+              label="Community"
+              value={ruleCommunityId}
+              onValueChange={setRuleCommunityId}
+              communities={communities}
+              nullable
+              placeholder="Все communities"
+            />
+            <div className="space-y-1">
+              <Label htmlFor="fw-rule-comment">Комментарий</Label>
+              <Input
+                id="fw-rule-comment"
+                className="max-w-xs"
+                placeholder="Комментарий"
+                value={ruleComment}
+                onChange={(e) => setRuleComment(e.target.value)}
+              />
+            </div>
+            <Button
+              size="sm"
+              className="mb-0.5"
+              onClick={() =>
+                createRule.mutate({
+                  scope: 'tenant',
+                  action: ruleAction,
+                  community_id: ruleCommunityId,
+                  comment: ruleComment,
+                })
+              }
+            >
+              Добавить правило
+            </Button>
+          </div>
+          <QueryState
+            data={rulesQ.data}
+            isLoading={rulesQ.isLoading}
+            isError={rulesQ.isError}
+            error={rulesQ.error}
+            onRetry={() => void rulesQ.refetch()}
+            skeleton={<TableSkeleton rows={5} cols={5} />}
+          >
+            {() => (
+              <FirewallRulesGrid
+                rules={rules}
+                communities={communities}
+                isLoading={rulesQ.isFetching && !rulesQ.isLoading}
+                onDelete={(id) => deleteRule.mutate(id)}
+                deletePending={deleteRule.isPending}
+              />
+            )}
+          </QueryState>
+        </TabsContent>
+
+        <TabsContent value="requests" className="mt-4">
+          <QueryState
+            data={clientsQ.data}
+            isLoading={clientsQ.isLoading}
+            isError={clientsQ.isError}
+            error={clientsQ.error}
+            onRetry={() => void clientsQ.refetch()}
+            skeleton={<TableSkeleton rows={3} cols={6} />}
+          >
+            {() => (
+              <FirewallClientsGrid
+                clients={pending}
+                isLoading={clientsQ.isFetching && !clientsQ.isLoading}
+                onApprove={(id) => approve.mutate(id)}
+                onReject={(id) => deleteClient.mutate(id)}
+                approvePending={approve.isPending}
+                rejectPending={deleteClient.isPending}
+                emptyTitle="Нет pending-запросов"
+              />
+            )}
+          </QueryState>
+        </TabsContent>
+      </Tabs>
+    </div>
+  )
+}

apps/web/src/routes/_auth/modules/$moduleId.tsx

@@ -1,44 +1,82 @@
 import { createFileRoute, Link } from '@tanstack/react-router'
-import { useQuery } from '@tanstack/react-query'
-import { ArrowLeft, RefreshCw } from 'lucide-react'
+import { useQuery, useQueryClient } from '@tanstack/react-query'
+import { ArrowLeft, Info, RefreshCw } from 'lucide-react'
 
+import { Alert, AlertDescription, AlertTitle } from '@evobgp/ui/components/alert'
 import { Button } from '@evobgp/ui/components/button'
-import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '@evobgp/ui/components/card'
-import {
-  Table,
-  TableBody,
-  TableCell,
-  TableHead,
-  TableHeader,
-  TableRow,
-} from '@evobgp/ui/components/table'
-import { Badge } from '@/components/reui/badge'
 
 import { PageHeader } from '@/components/page-header'
 import { QueryState } from '@/components/query-state'
 import { TableSkeleton } from '@/components/skeletons'
 import { StatusBadge } from '@/components/status-badge'
-import { moduleDetailQueryOptions, moduleEntriesQueryOptions } from '@/queries/modules'
+import { ModuleEntriesSection } from '@/components/modules/module-entries-section'
+import { ModuleKpiCards } from '@/components/modules/module-kpi-cards'
+import { moduleTypeRu } from '@/lib/ui-labels'
+import {
+  directoriesCommunitiesQueryOptions,
+  directoriesDohQueryOptions,
+} from '@/queries/directories'
+import { moduleDetailQueryOptions, moduleEntriesQueryOptions, modulesKeys } from '@/queries/modules'
+import type { AsEntry, ModuleRow } from '@/types/api'
 
 export const Route = createFileRoute('/_auth/modules/$moduleId')({
   component: ModuleDetailComponent,
 })
 
+function moduleTypeAlert(type: ModuleRow['type']): string {
+  switch (type) {
+    case 'AS_PREFIXES':
+      return 'Модуль AS получает префиксы через RIPEstat по указанным ASN. После refresh счётчики префиксов обновляются в таблице записей.'
+    case 'CDN_CIDRS':
+      return 'Модуль CDN скачивает списки CIDR по URL (plaintext или JSON). Используйте предпросмотр при добавлении источника.'
+    case 'DOMAINS':
+      return 'Модуль доменов резолвит FQDN через DoH-профили и конвертирует IP в префиксы. Политика и профили настраиваются в редактировании модуля.'
+    case 'IP_RANGES':
+      return 'Модуль IP-диапазонов использует статические CIDR без внешнего refresh (сервер может вернуть 204). Записи участвуют в агрегации напрямую.'
+  }
+}
+
 function ModuleDetailComponent() {
   const { moduleId } = Route.useParams()
+  const queryClient = useQueryClient()
   const detail = useQuery(moduleDetailQueryOptions(moduleId))
   const mod = detail.data
 
+  const communitiesQ = useQuery(directoriesCommunitiesQueryOptions())
+  const dohQ = useQuery(directoriesDohQueryOptions())
+
   const entriesQuery = useQuery({
     ...moduleEntriesQueryOptions(moduleId, mod?.type ?? 'DOMAINS'),
     enabled: !!mod,
   })
 
+  const asEntriesQ = useQuery({
+    ...moduleEntriesQueryOptions(moduleId, 'AS_PREFIXES'),
+    enabled: mod?.type === 'AS_PREFIXES',
+    select: (data) => data.items as unknown as AsEntry[],
+  })
+
+  async function refreshAll() {
+    await Promise.all([detail.refetch(), entriesQuery.refetch(), communitiesQ.refetch(), dohQ.refetch()])
+  }
+
+  async function onEntriesChanged() {
+    await entriesQuery.refetch()
+    if (mod?.type === 'AS_PREFIXES') {
+      await queryClient.invalidateQueries({ queryKey: modulesKeys.asEntries(moduleId) })
+    }
+    await detail.refetch()
+  }
+
+  const communities = communitiesQ.data?.items ?? []
+  const dohProfiles = dohQ.data?.items ?? []
+  const asEntries = mod?.type === 'AS_PREFIXES' ? (asEntriesQ.data ?? []) : []
+
   return (
     <div className="flex flex-col gap-6">
       <PageHeader
         title={mod?.name ?? moduleId}
-        description={mod ? `Тип: ${mod.type}` : 'Загрузка модуля…'}
+        description={mod ? `Тип: ${moduleTypeRu(mod.type)} (${mod.type})` : 'Загрузка модуля…'}
         actions={
           <>
             <Button variant="outline" size="sm" render={<Link to="/modules" />}>
@@ -48,10 +86,7 @@ function ModuleDetailComponent() {
             <Button
               variant="outline"
               size="sm"
-              onClick={() => {
-                void detail.refetch()
-                void entriesQuery.refetch()
-              }}
+              onClick={() => void refreshAll()}
               disabled={detail.isFetching}
             >
               <RefreshCw className={detail.isFetching ? 'animate-spin' : ''} />
@@ -70,133 +105,43 @@ function ModuleDetailComponent() {
         onRetry={() => detail.refetch()}
       >
         {(m) => (
-          <>
-            <div className="grid gap-4 md:grid-cols-2">
-              <Card>
-                <CardHeader className="border-b py-3">
-                  <CardTitle className="text-base">Параметры</CardTitle>
-                </CardHeader>
-                <CardContent className="grid grid-cols-2 gap-3 p-4 text-sm">
-                  <Field label="ID" value={<code className="font-mono text-xs">{m.id}</code>} />
-                  <Field label="Тип" value={<Badge variant="outline">{m.type}</Badge>} />
-                  <Field label="Приоритет" value={<span className="font-mono">{m.priority}</span>} />
-                  <Field
-                    label="Состояние"
-                    value={
-                      m.enabled ? (
-                        <StatusBadge status="active" label="включён" />
-                      ) : (
-                        <StatusBadge status="paused" label="выключен" />
-                      )
-                    }
-                  />
-                  <Field
-                    label="Интервал"
-                    value={
-                      m.refresh_interval_sec ? `${m.refresh_interval_sec}s` : '—'
-                    }
-                  />
-                  <Field
-                    label="Cron"
-                    value={m.cron_expr ? <code className="font-mono text-xs">{m.cron_expr}</code> : '—'}
-                  />
-                  <Field
-                    label="Последний рефреш"
-                    value={
-                      m.last_refreshed_at
-                        ? new Date(m.last_refreshed_at).toLocaleString('ru-RU')
-                        : '—'
-                    }
-                  />
-                </CardContent>
-              </Card>
-
-              <Card>
-                <CardHeader className="border-b py-3">
-                  <CardTitle className="text-base">Маршрутные списки</CardTitle>
-                  <CardDescription>Источник префиксов для модуля</CardDescription>
-                </CardHeader>
-                <CardContent className="p-0">
-                  <QueryState
-                    data={entriesQuery.data?.items}
-                    isLoading={entriesQuery.isLoading}
-                    isError={entriesQuery.isError}
-                    error={entriesQuery.error}
-                    empty={(entriesQuery.data?.items?.length ?? 0) === 0}
-                    emptyTitle="Записей нет"
-                    emptyDescription="Добавьте записи через API или создание ревизии."
-                    skeleton={<TableSkeleton rows={5} cols={2} />}
-                    onRetry={() => entriesQuery.refetch()}
-                  >
-                    {(items) => <EntriesTable items={items} moduleType={m.type} />}
-                  </QueryState>
-                </CardContent>
-              </Card>
+          <div className="flex flex-col gap-6">
+            <div className="flex flex-wrap items-center gap-2">
+              {m.enabled ? (
+                <StatusBadge status="active" label="включён" />
+              ) : (
+                <StatusBadge status="paused" label="выключен" />
+              )}
             </div>
-          </>
+
+            <Alert>
+              <Info />
+              <AlertTitle>О модуле</AlertTitle>
+              <AlertDescription>{moduleTypeAlert(m.type)}</AlertDescription>
+            </Alert>
+
+            <ModuleKpiCards
+              mod={m}
+              communities={communities}
+              dohProfiles={dohProfiles}
+              asEntries={asEntries}
+              loading={detail.isLoading || communitiesQ.isLoading}
+            />
+
+            <ModuleEntriesSection
+              moduleId={moduleId}
+              mod={m}
+              items={entriesQuery.data?.items ?? []}
+              communities={communities}
+              isLoading={entriesQuery.isLoading}
+              isError={entriesQuery.isError}
+              error={entriesQuery.error}
+              onRetry={() => entriesQuery.refetch()}
+              onChanged={onEntriesChanged}
+            />
+          </div>
         )}
       </QueryState>
     </div>
   )
 }
-
-function Field({ label, value }: { label: string; value: React.ReactNode }) {
-  return (
-    <div className="flex flex-col gap-0.5">
-      <span className="text-xs text-muted-foreground">{label}</span>
-      <span>{value}</span>
-    </div>
-  )
-}
-
-function EntriesTable({
-  items,
-  moduleType,
-}: {
-  items: Record<string, unknown>[]
-  moduleType: string
-}) {
-  const primary = ENTRY_PRIMARY_KEY[moduleType as keyof typeof ENTRY_PRIMARY_KEY] ?? 'id'
-  const secondary = ENTRY_SECONDARY_KEY[moduleType as keyof typeof ENTRY_SECONDARY_KEY] ?? null
-
-  return (
-    <Table>
-      <TableHeader>
-        <TableRow>
-          <TableHead>{primary}</TableHead>
-          {secondary ? <TableHead>{secondary}</TableHead> : null}
-        </TableRow>
-      </TableHeader>
-      <TableBody>
-        {items.map((item, idx) => {
-          const id = String(item.id ?? idx)
-          const primaryVal = String(item[primary] ?? '—')
-          return (
-            <TableRow key={id}>
-              <TableCell className="font-mono text-sm">{primaryVal}</TableCell>
-              {secondary ? (
-                <TableCell className="font-mono text-xs text-muted-foreground">
-                  {String(item[secondary] ?? '—')}
-                </TableCell>
-              ) : null}
-            </TableRow>
-          )
-        })}
-      </TableBody>
-    </Table>
-  )
-}
-
-const ENTRY_PRIMARY_KEY = {
-  DOMAINS: 'fqdn',
-  AS_PREFIXES: 'asn',
-  CDN_CIDRS: 'url',
-  IP_RANGES: 'prefix',
-} as const
-
-const ENTRY_SECONDARY_KEY = {
-  DOMAINS: 'community_id',
-  AS_PREFIXES: 'community_id',
-  CDN_CIDRS: 'community_id',
-  IP_RANGES: 'community_id',
-} as const

apps/web/src/routes/_auth/modules/index.tsx

@@ -1,25 +1,15 @@
 import { Link, createFileRoute } from '@tanstack/react-router'
 import { useQuery } from '@tanstack/react-query'
-import { Boxes, Plus, RefreshCw } from 'lucide-react'
+import { Plus, RefreshCw } from 'lucide-react'
 
 import { Button } from '@evobgp/ui/components/button'
-import { Card, CardContent, CardHeader, CardTitle } from '@evobgp/ui/components/card'
-import {
-  Table,
-  TableBody,
-  TableCell,
-  TableHead,
-  TableHeader,
-  TableRow,
-} from '@evobgp/ui/components/table'
-import { Badge } from '@/components/reui/badge'
 
+import { DataGridCard } from '@/components/data-grid-shell'
+import { ModulesListGrid } from '@/components/modules/modules-list-grid'
 import { PageHeader } from '@/components/page-header'
 import { QueryState } from '@/components/query-state'
 import { TableSkeleton } from '@/components/skeletons'
-import { TruncatedText } from '@/components/truncated-text'
 import { modulesListQueryOptions } from '@/queries/modules'
-import type { ModuleRow } from '@/types/api'
 
 export const Route = createFileRoute('/_auth/modules/')({
   component: ModulesListComponent,
@@ -48,76 +38,34 @@ function ModulesListComponent() {
         }
       />
 
-      <Card>
-        <CardHeader className="flex flex-row items-center justify-between border-b py-3">
-          <CardTitle className="text-base">Все модули</CardTitle>
+      <DataGridCard
+        title="Все модули"
+        actions={
           <Button size="sm" render={<Link to="/modules/new" />}>
             <Plus />
             Создать
           </Button>
-        </CardHeader>
-        <CardContent className="p-0">
-          <QueryState
-            data={query.data?.items}
-            isLoading={query.isLoading}
-            isError={query.isError}
-            error={query.error}
-            empty={query.data?.items?.length === 0}
-            emptyTitle="Нет модулей"
-            emptyDescription="Создайте первый модуль (AS, CDN, домены, IP)."
-            skeleton={<TableSkeleton rows={6} cols={5} />}
-            onRetry={() => query.refetch()}
-          >
-            {(items) => <ModulesTable items={items} />}
-          </QueryState>
-        </CardContent>
-      </Card>
+        }
+      >
+        <QueryState
+          data={query.data?.items}
+          isLoading={query.isLoading}
+          isError={query.isError}
+          error={query.error}
+          empty={query.data?.items?.length === 0}
+          emptyTitle="Нет модулей"
+          emptyDescription="Создайте первый модуль (AS, CDN, домены, IP)."
+          skeleton={<TableSkeleton rows={6} cols={5} />}
+          onRetry={() => query.refetch()}
+        >
+          {(items) => (
+            <ModulesListGrid
+              items={items}
+              isLoading={query.isFetching && !query.isLoading}
+            />
+          )}
+        </QueryState>
+      </DataGridCard>
     </div>
   )
 }
-
-function ModulesTable({ items }: { items: ModuleRow[] }) {
-  return (
-    <Table>
-      <TableHeader>
-        <TableRow>
-          <TableHead>Название</TableHead>
-          <TableHead>Тип</TableHead>
-          <TableHead>Приоритет</TableHead>
-          <TableHead>Состояние</TableHead>
-          <TableHead>Обновлено</TableHead>
-        </TableRow>
-      </TableHeader>
-      <TableBody>
-        {items.map((m) => (
-          <TableRow
-            key={m.id}
-            className="cursor-pointer hover:bg-muted/40"
-            onClick={() => (window.location.href = `/modules/${m.id}`)}
-          >
-            <TableCell className="font-medium">
-              <div className="flex items-center gap-2">
-                <Boxes className="size-4 text-muted-foreground" />
-                <TruncatedText className="max-w-[280px]">{m.name}</TruncatedText>
-              </div>
-            </TableCell>
-            <TableCell>
-              <Badge variant="outline">{m.type}</Badge>
-            </TableCell>
-            <TableCell className="font-mono text-sm tabular-nums">{m.priority}</TableCell>
-            <TableCell>
-              {m.enabled ? (
-                <Badge variant="success">включён</Badge>
-              ) : (
-                <Badge variant="secondary">выключен</Badge>
-              )}
-            </TableCell>
-            <TableCell className="text-xs text-muted-foreground">
-              {m.last_refreshed_at ? new Date(m.last_refreshed_at).toLocaleString('ru-RU') : '—'}
-            </TableCell>
-          </TableRow>
-        ))}
-      </TableBody>
-    </Table>
-  )
-}

apps/web/src/routes/_auth/monitoring.tsx

@@ -1,6 +1,6 @@
 import { createFileRoute, useSearch } from '@tanstack/react-router'
 import { useQuery } from '@tanstack/react-query'
-import { Activity, AlertTriangle, Bird, Database, Gauge, HardDrive, HeartPulse, Info, ListTodo, RefreshCw, ShieldCheck } from 'lucide-react'
+import { Activity, AlertTriangle, Bird, Database, Gauge, HeartPulse, Info, ListTodo, RefreshCw } from 'lucide-react'
 
 import { Alert, AlertDescription, AlertTitle } from '@evobgp/ui/components/alert'
 import { Badge } from '@evobgp/ui/components/badge'
@@ -8,15 +8,8 @@ import { Button } from '@evobgp/ui/components/button'
 import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '@evobgp/ui/components/card'
 import { Separator } from '@evobgp/ui/components/separator'
 import { Tabs, TabsContent, TabsList, TabsTrigger } from '@evobgp/ui/components/tabs'
-import {
-  Table,
-  TableBody,
-  TableCell,
-  TableHead,
-  TableHeader,
-  TableRow,
-} from '@evobgp/ui/components/table'
 
+import { MonitoringReadyGrid } from '@/components/monitoring/monitoring-ready-grid'
 import { PageHeader } from '@/components/page-header'
 import { QueryState } from '@/components/query-state'
 import { SectionCards, type SectionCardItem } from '@/components/section-cards'
@@ -147,7 +140,7 @@ function MonitoringComponent() {
                   skeleton={<div className="h-40" />}
                   onRetry={() => readyQ.refetch()}
                 >
-                  {(ready) => <ReadyTable health={healthQ.data} ready={ready} />}
+                  {(ready) => <MonitoringReadyGrid health={healthQ.data} ready={ready} />}
                 </QueryState>
               </CardContent>
             </Card>
@@ -342,84 +335,6 @@ function overallHint(input: OverallInput): string {
   return 'Все системы работают в штатном режиме'
 }
 
-function ReadyTable({
-  health,
-  ready,
-}: {
-  health?: { ok?: boolean; status?: string; error?: string } | null
-  ready: ReadyStatus
-}) {
-  const checks = ready.checks ?? {}
-  const iconByKey: Record<string, typeof Database> = {
-    postgres: Database,
-    store: HardDrive,
-    jobs: ListTodo,
-  }
-  return (
-    <Table>
-      <TableHeader>
-        <TableRow>
-          <TableHead className="w-[55%]">Проверка</TableHead>
-          <TableHead>Статус</TableHead>
-        </TableRow>
-      </TableHeader>
-      <TableBody>
-        <TableRow>
-          <TableCell>
-            <div className="flex items-center gap-2">
-              <HeartPulse className="size-4 shrink-0 text-muted-foreground" />
-              <div>
-                <p className="text-sm font-medium">Liveness</p>
-                <p className="text-xs text-muted-foreground">/v1/health</p>
-              </div>
-            </div>
-          </TableCell>
-          <TableCell>
-            <Badge variant={health?.ok ? 'default' : 'destructive'}>
-              {health?.ok ? 'OK' : 'Ошибка'}
-            </Badge>
-          </TableCell>
-        </TableRow>
-        <TableRow>
-          <TableCell>
-            <div className="flex items-center gap-2">
-              <ShieldCheck className="size-4 shrink-0 text-muted-foreground" />
-              <div>
-                <p className="text-sm font-medium">Readiness</p>
-                <p className="text-xs text-muted-foreground">/v1/ready</p>
-              </div>
-            </div>
-          </TableCell>
-          <TableCell>
-            <Badge variant={ready.status === 'ok' ? 'default' : 'secondary'}>
-              {ready.status ?? '—'}
-            </Badge>
-          </TableCell>
-        </TableRow>
-        {Object.entries(checks).map(([key, value]) => {
-          const ok = typeof value === 'boolean' ? value : value?.ok !== false
-          const Icon = iconByKey[key] ?? ListTodo
-          return (
-            <TableRow key={key}>
-              <TableCell>
-                <div className="flex items-center gap-2">
-                  <Icon className="size-4 shrink-0 text-muted-foreground" />
-                  <div>
-                    <p className="text-sm font-medium">{key}</p>
-                  </div>
-                </div>
-              </TableCell>
-              <TableCell>
-                <Badge variant={ok ? 'default' : 'destructive'}>{ok ? 'OK' : 'Ошибка'}</Badge>
-              </TableCell>
-            </TableRow>
-          )
-        })}
-      </TableBody>
-    </Table>
-  )
-}
-
 function BirdSummary({ bird }: { bird: import('@/types/api').BirdStatus }) {
   if (!bird.birdc_configured) {
     return (

apps/web/src/routes/_auth/network.tsx

@@ -5,17 +5,10 @@ import { Button } from '@evobgp/ui/components/button'
 import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '@evobgp/ui/components/card'
 import { Info, RefreshCw } from 'lucide-react'
 import { Tabs, TabsContent, TabsList, TabsTrigger } from '@evobgp/ui/components/tabs'
-import {
-  Table,
-  TableBody,
-  TableCell,
-  TableHead,
-  TableHeader,
-  TableRow,
-} from '@evobgp/ui/components/table'
-import { Badge } from '@/components/reui/badge'
-import { StatusBadge } from '@/components/status-badge'
 
+import { DataGridCard } from '@/components/data-grid-shell'
+import { NetworkPeersGrid } from '@/components/network/network-peers-grid'
+import { NetworkSpeakersGrid } from '@/components/network/network-speakers-grid'
 import { PageHeader } from '@/components/page-header'
 import { QueryState } from '@/components/query-state'
 import { TableSkeleton } from '@/components/skeletons'
@@ -115,47 +108,47 @@ function NetworkComponent() {
         </TabsContent>
 
         <TabsContent value="peers" className="mt-4">
-          <Card>
-            <CardHeader className="border-b py-3">
-              <CardTitle className="text-base">Пиры</CardTitle>
-            </CardHeader>
-            <CardContent className="p-0">
-              <QueryState
-                data={peers}
-                isLoading={peersQ.isLoading}
-                isError={peersQ.isError}
-                error={peersQ.error}
-                empty={peers.length === 0}
-                emptyTitle="Нет пиров"
-                skeleton={<TableSkeleton rows={6} cols={4} />}
-                onRetry={() => peersQ.refetch()}
-              >
-                {(items) => <PeersTable items={items} />}
-              </QueryState>
-            </CardContent>
-          </Card>
+          <DataGridCard title="Пиры">
+            <QueryState
+              data={peers}
+              isLoading={peersQ.isLoading}
+              isError={peersQ.isError}
+              error={peersQ.error}
+              empty={peers.length === 0}
+              emptyTitle="Нет пиров"
+              skeleton={<TableSkeleton rows={6} cols={4} />}
+              onRetry={() => peersQ.refetch()}
+            >
+              {(items) => (
+                <NetworkPeersGrid
+                  items={items}
+                  isLoading={peersQ.isFetching && !peersQ.isLoading}
+                />
+              )}
+            </QueryState>
+          </DataGridCard>
         </TabsContent>
 
         <TabsContent value="speakers" className="mt-4">
-          <Card>
-            <CardHeader className="border-b py-3">
-              <CardTitle className="text-base">Спикеры</CardTitle>
-            </CardHeader>
-            <CardContent className="p-0">
-              <QueryState
-                data={speakers}
-                isLoading={speakersQ.isLoading}
-                isError={speakersQ.isError}
-                error={speakersQ.error}
-                empty={speakers.length === 0}
-                emptyTitle="Нет спикеров"
-                skeleton={<TableSkeleton rows={6} cols={4} />}
-                onRetry={() => speakersQ.refetch()}
-              >
-                {(items) => <SpeakersTable items={items} />}
-              </QueryState>
-            </CardContent>
-          </Card>
+          <DataGridCard title="Спикеры">
+            <QueryState
+              data={speakers}
+              isLoading={speakersQ.isLoading}
+              isError={speakersQ.isError}
+              error={speakersQ.error}
+              empty={speakers.length === 0}
+              emptyTitle="Нет спикеров"
+              skeleton={<TableSkeleton rows={6} cols={4} />}
+              onRetry={() => speakersQ.refetch()}
+            >
+              {(items) => (
+                <NetworkSpeakersGrid
+                  items={items}
+                  isLoading={speakersQ.isFetching && !speakersQ.isLoading}
+                />
+              )}
+            </QueryState>
+          </DataGridCard>
         </TabsContent>
 
         <TabsContent value="control-plane" className="mt-4">
@@ -196,78 +189,3 @@ function BirdSummary({ bird }: { bird: import('@/types/api').BirdStatus }) {
     </div>
   )
 }
-
-function PeersTable({ items }: { items: import('@/types/api').PeerRow[] }) {
-  return (
-    <Table>
-      <TableHeader>
-        <TableRow>
-          <TableHead>Имя</TableHead>
-          <TableHead>Neighbor</TableHead>
-          <TableHead>ASN</TableHead>
-          <TableHead>Состояние</TableHead>
-        </TableRow>
-      </TableHeader>
-      <TableBody>
-        {items.map((p) => (
-          <TableRow key={p.id}>
-            <TableCell className="font-medium">{p.name ?? p.neighbor}</TableCell>
-            <TableCell className="font-mono text-xs">{p.neighbor}</TableCell>
-            <TableCell className="font-mono text-xs">{p.remote_asn ?? '—'}</TableCell>
-            <TableCell>
-              <StatusBadge status={p.session_state} />
-              {p.session_mismatch ? (
-                <Badge variant="warning" className="ml-1">
-                  mismatch
-                </Badge>
-              ) : null}
-            </TableCell>
-          </TableRow>
-        ))}
-      </TableBody>
-    </Table>
-  )
-}
-
-function SpeakersTable({ items }: { items: import('@/types/api').SpeakerRow[] }) {
-  return (
-    <Table>
-      <TableHeader>
-        <TableRow>
-          <TableHead>Endpoint</TableHead>
-          <TableHead>Роль</TableHead>
-          <TableHead>Agent</TableHead>
-          <TableHead>BGP</TableHead>
-        </TableRow>
-      </TableHeader>
-      <TableBody>
-        {items.map((s) => (
-          <TableRow key={s.id}>
-            <TableCell className="font-mono text-xs">{s.endpoint}</TableCell>
-            <TableCell>
-              <Badge variant="outline">{s.role}</Badge>
-            </TableCell>
-            <TableCell>
-              {s.live?.agent_ok === true ? (
-                <StatusBadge status="ok" label="online" />
-              ) : s.live?.agent_ok === false ? (
-                <StatusBadge status="error" label="offline" />
-              ) : (
-                <Badge variant="outline">—</Badge>
-              )}
-            </TableCell>
-            <TableCell>
-              {s.live ? (
-                <span className="text-xs">
-                  {s.live.bgp_established ?? 0} / {s.live.bgp_sessions_total ?? 0}
-                </span>
-              ) : (
-                '—'
-              )}
-            </TableCell>
-          </TableRow>
-        ))}
-      </TableBody>
-    </Table>
-  )
-}

apps/web/src/routes/_auth/operations.tsx

@@ -2,7 +2,7 @@ import { createFileRoute, useSearch } from '@tanstack/react-router'
 import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query'
 import { AlertTriangle, Clock, Activity, Info, RefreshCw } from 'lucide-react'
 import { toast } from 'sonner'
-import { useState } from 'react'
+import { useState, useMemo } from 'react'
 
 import { Alert, AlertDescription, AlertTitle } from '@evobgp/ui/components/alert'
 import { Button } from '@evobgp/ui/components/button'
@@ -12,17 +12,13 @@ import {
   SelectContent,
   SelectItem,
   SelectTrigger,
+  SelectValue,
 } from '@evobgp/ui/components/select'
 import { Tabs, TabsContent, TabsList, TabsTrigger } from '@evobgp/ui/components/tabs'
-import {
-  Table,
-  TableBody,
-  TableCell,
-  TableHead,
-  TableHeader,
-  TableRow,
-} from '@evobgp/ui/components/table'
 
+import { DataGridCard } from '@/components/data-grid-shell'
+import { OperationsJobsGrid } from '@/components/operations/operations-jobs-grid'
+import { OperationsRevisionsGrid } from '@/components/operations/operations-revisions-grid'
 import { PageHeader } from '@/components/page-header'
 import { QueryState } from '@/components/query-state'
 import { SectionCards, type SectionCardItem } from '@/components/section-cards'
@@ -32,7 +28,6 @@ import { ConfirmDialog } from '@/components/confirm-dialog'
 import { operationsJobsQueryOptions, operationsRevisionsQueryOptions, operationsDiffQueryOptions } from '@/queries/operations'
 import { moduleNameById, overviewModulesQueryOptions } from '@/queries/overview'
 import { apiMutate, waitForJob } from '@/lib/api-client'
-import type { JobRow } from '@/types/api'
 
 export const Route = createFileRoute('/_auth/operations')({
   component: OperationsComponent,
@@ -176,24 +171,25 @@ function OperationsComponent() {
         </TabsList>
 
         <TabsContent value="revisions" className="mt-4">
-          <Card>
-            <CardHeader className="border-b py-3">
-              <CardTitle className="text-base">История ревизий</CardTitle>
-            </CardHeader>
-            <CardContent className="p-0">
-              <QueryState
-                data={revisions}
-                isLoading={revisionsQ.isLoading}
-                isError={revisionsQ.isError}
-                error={revisionsQ.error}
-                empty={revisions.length === 0}
-                emptyTitle="Нет ревизий"
-                onRetry={() => revisionsQ.refetch()}
-              >
-                {(items) => <RevisionsTable items={items} qc={qc} />}
-              </QueryState>
-            </CardContent>
-          </Card>
+          <DataGridCard title="История ревизий">
+            <QueryState
+              data={revisions}
+              isLoading={revisionsQ.isLoading}
+              isError={revisionsQ.isError}
+              error={revisionsQ.error}
+              empty={revisions.length === 0}
+              emptyTitle="Нет ревизий"
+              onRetry={() => revisionsQ.refetch()}
+            >
+              {(items) => (
+                <OperationsRevisionsGrid
+                  items={items}
+                  qc={qc}
+                  isLoading={revisionsQ.isFetching && !revisionsQ.isLoading}
+                />
+              )}
+            </QueryState>
+          </DataGridCard>
         </TabsContent>
 
         <TabsContent value="diff" className="mt-4">
@@ -201,172 +197,44 @@ function OperationsComponent() {
         </TabsContent>
 
         <TabsContent value="jobs" className="mt-4">
-          <Card>
-            <CardHeader className="border-b py-3">
-              <CardTitle className="text-base">Задачи</CardTitle>
-            </CardHeader>
-            <CardContent className="p-0">
-              <QueryState
-                data={jobs}
-                isLoading={jobsQ.isLoading}
-                isError={jobsQ.isError}
-                error={jobsQ.error}
-                empty={jobs.length === 0}
-                emptyTitle="Нет задач"
-                onRetry={() => jobsQ.refetch()}
-              >
-                {(items) => <JobsTable items={items} nameById={nameById} qc={qc} />}
-              </QueryState>
-            </CardContent>
-          </Card>
+          <DataGridCard title="Задачи">
+            <QueryState
+              data={jobs}
+              isLoading={jobsQ.isLoading}
+              isError={jobsQ.isError}
+              error={jobsQ.error}
+              empty={jobs.length === 0}
+              emptyTitle="Нет задач"
+              onRetry={() => jobsQ.refetch()}
+            >
+              {(items) => (
+                <OperationsJobsGrid
+                  items={items}
+                  nameById={nameById}
+                  qc={qc}
+                  isLoading={jobsQ.isFetching && !jobsQ.isLoading}
+                />
+              )}
+            </QueryState>
+          </DataGridCard>
         </TabsContent>
       </Tabs>
     </div>
   )
 }
 
-function RevisionsTable({
-  items,
-  qc,
-}: {
-  items: import('@/types/api').RevisionRow[]
-  qc: import('@tanstack/react-query').QueryClient
-}) {
-  const rollbackMutation = useMutation({
-    mutationFn: (id: string) =>
-      apiMutate(`/v1/revisions/${id}/rollback`, 'POST', {}).then(() => id),
-    onSuccess: () => {
-      toast.success('Откат выполнен')
-      void qc.invalidateQueries({ queryKey: ['operations'] })
-    },
-    onError: (e) => toast.error(e instanceof Error ? e.message : 'Не удалось откатить'),
-  })
-
-  return (
-    <Table>
-      <TableHeader>
-        <TableRow>
-          <TableHead>ID</TableHead>
-          <TableHead>Создана</TableHead>
-          <TableHead>Префиксов</TableHead>
-          <TableHead className="w-24" />
-        </TableRow>
-      </TableHeader>
-      <TableBody>
-        {items.map((r) => (
-          <TableRow key={r.id}>
-            <TableCell className="font-mono text-xs">{r.id.slice(0, 12)}…</TableCell>
-            <TableCell className="text-xs text-muted-foreground">
-              {new Date(r.created_at).toLocaleString('ru-RU')}
-            </TableCell>
-            <TableCell className="font-mono text-sm tabular-nums">
-              {r.materialized_prefix_count}
-            </TableCell>
-            <TableCell>
-              <ConfirmDialog
-                trigger={
-                  <Button variant="ghost" size="icon-sm" className="text-destructive">
-                    <RefreshCw className="size-3.5" />
-                  </Button>
-                }
-                title={`Откатиться к ревизии ${r.id.slice(0, 8)}…?`}
-                description="Будет создана новая ревизия на основе выбранной. Требуется роль operator."
-                confirmLabel="Откатить"
-                destructive
-                onConfirm={() => rollbackMutation.mutate(r.id)}
-              />
-            </TableCell>
-          </TableRow>
-        ))}
-      </TableBody>
-    </Table>
-  )
-}
-
-function JobsTable({
-  items,
-  nameById,
-  qc,
-}: {
-  items: JobRow[]
-  nameById: Map<string, string>
-  qc: import('@tanstack/react-query').QueryClient
-}) {
-  const cancelMutation = useMutation({
-    mutationFn: (jobId: string) => apiMutate(`/v1/jobs/${jobId}/cancel`, 'POST', {}),
-    onSuccess: () => {
-      toast.success('Задача отменена')
-      void qc.invalidateQueries({ queryKey: ['operations'] })
-    },
-    onError: (e) => toast.error(e instanceof Error ? e.message : 'Не удалось отменить'),
-  })
-
-  return (
-    <Table>
-      <TableHeader>
-        <TableRow>
-          <TableHead>Вид</TableHead>
-          <TableHead>Статус</TableHead>
-          <TableHead>Создана</TableHead>
-          <TableHead>Завершена</TableHead>
-          <TableHead className="w-20" />
-        </TableRow>
-      </TableHeader>
-      <TableBody>
-        {items.map((j) => (
-          <TableRow key={j.job_id}>
-            <TableCell className="font-medium">
-              <div className="flex flex-col gap-0.5">
-                <span>{j.kind}</span>
-                {j.meta?.module_id ? (
-                  <span className="text-xs text-muted-foreground">
-                    {nameById.get(String(j.meta.module_id)) ?? String(j.meta.module_id)}
-                  </span>
-                ) : null}
-              </div>
-            </TableCell>
-            <TableCell>
-              <StatusBadgeColored status={j.status} />
-            </TableCell>
-            <TableCell className="whitespace-nowrap text-xs text-muted-foreground">
-              {j.created_at ? new Date(j.created_at).toLocaleString('ru-RU') : '—'}
-            </TableCell>
-            <TableCell className="whitespace-nowrap text-xs text-muted-foreground">
-              {j.finished_at ? new Date(j.finished_at).toLocaleString('ru-RU') : '—'}
-            </TableCell>
-            <TableCell>
-              {j.status === 'running' || j.status === 'queued' ? (
-                <Button
-                  variant="ghost"
-                  size="icon-sm"
-                  className="text-destructive"
-                  onClick={() => cancelMutation.mutate(j.job_id)}
-                >
-                  ✕
-                </Button>
-              ) : null}
-            </TableCell>
-          </TableRow>
-        ))}
-      </TableBody>
-    </Table>
-  )
-}
-
-function StatusBadgeColored({ status }: { status: string }) {
-  const cls =
-    status === 'succeeded'
-      ? 'text-success'
-      : status === 'failed' || status === 'cancelled'
-        ? 'text-destructive'
-        : 'text-info'
-  return <span className={`text-sm font-medium ${cls}`}>{status}</span>
-}
-
 function DiffTab({ revisions }: { revisions: import('@/types/api').RevisionRow[] }) {
   const [a, setA] = useState('')
   const [b, setB] = useState('')
   const diffQ = useQuery(operationsDiffQueryOptions(a, b))
+  const revisionItems = useMemo(
+    () =>
+      revisions.map((r) => ({
+        value: r.id,
+        label: `${r.id.slice(0, 12)}…`,
+      })),
+    [revisions],
+  )
 
   return (
     <Card>
@@ -377,8 +245,10 @@ function DiffTab({ revisions }: { revisions: import('@/types/api').RevisionRow[]
         <div className="flex flex-wrap items-end gap-3">
           <div className="flex w-full max-w-xs flex-col gap-1">
             <span className="text-xs text-muted-foreground">Ревизия A</span>
-            <Select value={a} onValueChange={(v) => v && setA(v)}>
-              <SelectTrigger>{a ? a.slice(0, 12) + '…' : 'Выберите'}</SelectTrigger>
+            <Select items={revisionItems} value={a} onValueChange={(v) => v && setA(v)}>
+              <SelectTrigger>
+                <SelectValue placeholder="Выберите" />
+              </SelectTrigger>
               <SelectContent>
                 {revisions.map((r) => (
                   <SelectItem key={r.id} value={r.id}>
@@ -390,8 +260,10 @@ function DiffTab({ revisions }: { revisions: import('@/types/api').RevisionRow[]
           </div>
           <div className="flex w-full max-w-xs flex-col gap-1">
             <span className="text-xs text-muted-foreground">Ревизия B</span>
-            <Select value={b} onValueChange={(v) => v && setB(v)}>
-              <SelectTrigger>{b ? b.slice(0, 12) + '…' : 'Выберите'}</SelectTrigger>
+            <Select items={revisionItems} value={b} onValueChange={(v) => v && setB(v)}>
+              <SelectTrigger>
+                <SelectValue placeholder="Выберите" />
+              </SelectTrigger>
               <SelectContent>
                 {revisions.map((r) => (
                   <SelectItem key={r.id} value={r.id}>

apps/web/src/routes/_auth/schedule.tsx

@@ -5,24 +5,16 @@ import { toast } from 'sonner'
 import { useState } from 'react'
 
 import { Alert, AlertDescription, AlertTitle } from '@evobgp/ui/components/alert'
-import { Badge } from '@evobgp/ui/components/badge'
 import { Button } from '@evobgp/ui/components/button'
-import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '@evobgp/ui/components/card'
 import { Tabs, TabsContent, TabsList, TabsTrigger } from '@evobgp/ui/components/tabs'
-import {
-  Table,
-  TableBody,
-  TableCell,
-  TableHead,
-  TableHeader,
-  TableRow,
-} from '@evobgp/ui/components/table'
 
+import { DataGridCard } from '@/components/data-grid-shell'
+import { ScheduleJobsGrid } from '@/components/schedule/schedule-jobs-grid'
+import { ScheduleModulesGrid } from '@/components/schedule/schedule-modules-grid'
 import { PageHeader } from '@/components/page-header'
 import { QueryState } from '@/components/query-state'
 import { SectionCards, type SectionCardItem } from '@/components/section-cards'
 import { SectionCardsSkeleton } from '@/components/skeletons'
-import { LoadingButton } from '@/components/loading-button'
 
 import { operationsJobsQueryOptions } from '@/queries/operations'
 import { modulesListQueryOptions } from '@/queries/modules'
@@ -108,82 +100,33 @@ function ScheduleComponent() {
 
       {loading ? <SectionCardsSkeleton count={3} /> : <SectionCards items={items} />}
 
-      <Card>
-        <CardHeader>
-          <CardTitle className="text-base">Модули</CardTitle>
-          <CardDescription>Расписание обновления и ручной запуск ingest</CardDescription>
-        </CardHeader>
-        <CardContent className="p-0">
-          <QueryState
-            data={modules}
-            isLoading={modulesQ.isLoading}
-            isError={modulesQ.isError}
-            error={modulesQ.error}
-            empty={modules.length === 0}
-            emptyTitle="Нет модулей"
-            onRetry={() => modulesQ.refetch()}
-          >
-            {(items) => (
-              <Table>
-                <TableHeader>
-                  <TableRow>
-                    <TableHead>Модуль</TableHead>
-                    <TableHead>Тип</TableHead>
-                    <TableHead>Расписание</TableHead>
-                    <TableHead>Обновлено</TableHead>
-                    <TableHead>Статус</TableHead>
-                    <TableHead className="w-32 text-right" />
-                  </TableRow>
-                </TableHeader>
-                <TableBody>
-                  {items.map((m) => (
-                    <TableRow key={m.id}>
-                      <TableCell className="font-medium">{m.name}</TableCell>
-                      <TableCell>
-                        <Badge variant="outline">{m.type}</Badge>
-                      </TableCell>
-                      <TableCell className="font-mono text-xs text-muted-foreground">
-                        {m.cron_expr ?? (m.refresh_interval_sec ? `${m.refresh_interval_sec}s` : '—')}
-                      </TableCell>
-                      <TableCell className="whitespace-nowrap text-xs text-muted-foreground">
-                        {m.last_refreshed_at ? new Date(m.last_refreshed_at).toLocaleString('ru-RU') : '—'}
-                      </TableCell>
-                      <TableCell>
-                        {m.enabled ? (
-                          <Badge variant="default">Вкл</Badge>
-                        ) : (
-                          <Badge variant="secondary">Выкл</Badge>
-                        )}
-                      </TableCell>
-                      <TableCell className="text-right">
-                        <LoadingButton
-                          size="sm"
-                          variant="secondary"
-                          loading={!!refreshing[m.id]}
-                          onClick={() => refreshMutation.mutate(m.id)}
-                        >
-                          <RefreshCw />
-                          Обновить
-                        </LoadingButton>
-                      </TableCell>
-                    </TableRow>
-                  ))}
-                </TableBody>
-              </Table>
-            )}
-          </QueryState>
-        </CardContent>
-      </Card>
+      <DataGridCard
+        title="Модули"
+        description="Расписание обновления и ручной запуск ingest"
+      >
+        <QueryState
+          data={modules}
+          isLoading={modulesQ.isLoading}
+          isError={modulesQ.isError}
+          error={modulesQ.error}
+          empty={modules.length === 0}
+          emptyTitle="Нет модулей"
+          onRetry={() => modulesQ.refetch()}
+        >
+          {(items) => (
+            <ScheduleModulesGrid
+              items={items}
+              refreshing={refreshing}
+              onRefresh={(id) => refreshMutation.mutate(id)}
+              isLoading={modulesQ.isFetching && !modulesQ.isLoading}
+            />
+          )}
+        </QueryState>
+      </DataGridCard>
 
-      <Card>
-        <CardHeader>
-          <CardTitle className="text-base">Задачи</CardTitle>
-          <CardDescription>Последние задачи из API</CardDescription>
-        </CardHeader>
-        <CardContent className="p-0">
-          <JobsTabs jobs={jobs} loading={jobsQ.isLoading} />
-        </CardContent>
-      </Card>
+      <DataGridCard title="Задачи" description="Последние задачи из API">
+        <JobsTabs jobs={jobs} loading={jobsQ.isLoading} />
+      </DataGridCard>
     </div>
   )
 }
@@ -196,68 +139,20 @@ function JobsTabs({ jobs, loading }: { jobs: JobRow[]; loading: boolean }) {
 
   return (
     <Tabs defaultValue="all">
-      <TabsList>
+      <TabsList className="m-3 mb-0">
         <TabsTrigger value="all">Все ({jobs.length})</TabsTrigger>
         <TabsTrigger value="refresh">Обновление ({refresh.length})</TabsTrigger>
         <TabsTrigger value="failed">С ошибкой ({failed.length})</TabsTrigger>
       </TabsList>
       <TabsContent value="all" className="mt-0">
-        <JobsTable items={jobs} loading={loading} />
+        <ScheduleJobsGrid items={jobs} isLoading={loading} />
       </TabsContent>
       <TabsContent value="refresh" className="mt-0">
-        <JobsTable items={refresh} loading={loading} />
+        <ScheduleJobsGrid items={refresh} isLoading={loading} />
       </TabsContent>
       <TabsContent value="failed" className="mt-0">
-        <JobsTable items={failed} loading={loading} />
+        <ScheduleJobsGrid items={failed} isLoading={loading} />
       </TabsContent>
     </Tabs>
   )
 }
-
-function JobsTable({ items, loading }: { items: JobRow[]; loading: boolean }) {
-  if (loading) return <div className="p-6 text-center text-sm text-muted-foreground">Загрузка…</div>
-  if (items.length === 0)
-    return <div className="p-6 text-center text-sm text-muted-foreground">Нет задач</div>
-  return (
-    <Table>
-      <TableHeader>
-        <TableRow>
-          <TableHead>Вид</TableHead>
-          <TableHead>Статус</TableHead>
-          <TableHead>Создана</TableHead>
-          <TableHead>Завершена</TableHead>
-          <TableHead>Ошибка</TableHead>
-        </TableRow>
-      </TableHeader>
-      <TableBody>
-        {items.map((j) => (
-          <TableRow key={j.job_id}>
-            <TableCell className="font-medium">{j.kind}</TableCell>
-            <TableCell>
-              <Badge
-                variant={
-                  j.status === 'succeeded'
-                    ? 'default'
-                    : j.status === 'failed'
-                      ? 'destructive'
-                      : 'secondary'
-                }
-              >
-                {j.status}
-              </Badge>
-            </TableCell>
-            <TableCell className="whitespace-nowrap text-xs text-muted-foreground">
-              {j.created_at ? new Date(j.created_at).toLocaleString('ru-RU') : '—'}
-            </TableCell>
-            <TableCell className="whitespace-nowrap text-xs text-muted-foreground">
-              {j.finished_at ? new Date(j.finished_at).toLocaleString('ru-RU') : '—'}
-            </TableCell>
-            <TableCell className="max-w-xs truncate text-xs text-destructive">
-              {j.error ?? ''}
-            </TableCell>
-          </TableRow>
-        ))}
-      </TableBody>
-    </Table>
-  )
-}

apps/web/src/routes/_auth/settings.tsx

@@ -1,17 +1,25 @@
-import { createFileRoute } from '@tanstack/react-router'
-import { useQuery } from '@tanstack/react-query'
+import { createFileRoute, useNavigate } from '@tanstack/react-router'
+import { useQuery, useQueryClient } from '@tanstack/react-query'
 
+import { Alert, AlertDescription, AlertTitle } from '@evobgp/ui/components/alert'
+import { Button } from '@evobgp/ui/components/button'
 import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '@evobgp/ui/components/card'
 import { Input } from '@evobgp/ui/components/input'
 import { Label } from '@evobgp/ui/components/label'
-import { Select, SelectContent, SelectItem, SelectTrigger } from '@evobgp/ui/components/select'
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from '@evobgp/ui/components/select'
 
 import { PageHeader } from '@/components/page-header'
 import { LoadingButton } from '@/components/loading-button'
-import { setToken, TOKEN_STORAGE_KEY } from '@/lib/api-client'
-import { authSessionQueryOptions } from '@/queries/auth'
+import { DEV_API_TOKEN, normalizeApiToken, setToken, TOKEN_STORAGE_KEY } from '@/lib/api-client'
+import { authKeys, authSessionQueryOptions } from '@/queries/auth'
 import { toast } from 'sonner'
-import { Save } from 'lucide-react'
+import { Info, Save } from 'lucide-react'
 import { useTheme } from 'next-themes'
 import { useEffect, useState } from 'react'
 
@@ -19,8 +27,21 @@ export const Route = createFileRoute('/_auth/settings')({
   component: SettingsComponent,
 })
 
+const THEME_SELECT_ITEMS = [
+  { value: 'light', label: 'Светлая' },
+  { value: 'dark', label: 'Тёмная' },
+  { value: 'system', label: 'Как в системе' },
+] as const
+
 function SettingsComponent() {
-  const { data: session } = useQuery(authSessionQueryOptions())
+  const navigate = useNavigate()
+  const qc = useQueryClient()
+  const { data: session, isError: sessionError, error: sessionQueryError } = useQuery({
+    ...authSessionQueryOptions(),
+    enabled: Boolean(
+      typeof window !== 'undefined' && window.localStorage.getItem(TOKEN_STORAGE_KEY)?.trim(),
+    ),
+  })
   const { theme, setTheme } = useTheme()
   const [token, setTokenValue] = useState('')
 
@@ -29,10 +50,23 @@ function SettingsComponent() {
     setTokenValue(t)
   }, [])
 
-  function saveTokenHandler() {
-    const t = token.trim()
-    setToken(t || null)
+  async function applyToken(raw: string) {
+    const normalized = normalizeApiToken(raw)
+    setToken(normalized || null)
+    setTokenValue(normalized)
+    await qc.invalidateQueries({ queryKey: authKeys.all })
     toast.success('Токен сохранён')
+    if (normalized) {
+      void navigate({ to: '/dashboard' })
+    }
+  }
+
+  function saveTokenHandler() {
+    void applyToken(token)
+  }
+
+  function useDevToken() {
+    void applyToken(DEV_API_TOKEN)
   }
 
   return (
@@ -42,11 +76,21 @@ function SettingsComponent() {
         description="Параметры интерфейса и подключения браузера к API."
       />
 
+      <Alert className="border-info/30 bg-info/5">
+        <Info className="text-info" />
+        <AlertTitle>Локальная разработка</AlertTitle>
+        <AlertDescription>
+          При включённом demo-seed API принимает токен <code className="text-xs">dev</code> (роль{' '}
+          <code className="text-xs">operator</code>). Вводите только значение токена, без префикса{' '}
+          <code className="text-xs">Bearer</code> — он добавляется автоматически.
+        </AlertDescription>
+      </Alert>
+
       <Card>
         <CardHeader>
           <CardTitle>Подключение к API</CardTitle>
           <CardDescription>
-            Bearer-токен хранится только в этом браузере (localStorage). Управление ключами tenant — в
+            Токен хранится только в этом браузере (localStorage). Управление ключами tenant — в
             разделе «Права доступа».
           </CardDescription>
         </CardHeader>
@@ -59,19 +103,33 @@ function SettingsComponent() {
               autoComplete="off"
               value={token}
               onChange={(e) => setTokenValue(e.target.value)}
-              placeholder="Bearer …"
+              placeholder="dev или API-ключ"
             />
           </div>
-          <LoadingButton onClick={saveTokenHandler}>
-            <Save />
-            Сохранить токен
-          </LoadingButton>
+          <div className="flex flex-wrap gap-2">
+            <LoadingButton onClick={saveTokenHandler}>
+              <Save />
+              Сохранить токен
+            </LoadingButton>
+            <Button type="button" variant="outline" onClick={useDevToken}>
+              Использовать dev
+            </Button>
+          </div>
           {session ? (
             <p className="text-xs text-muted-foreground">
               Активная сессия: tenant <code className="font-mono">{session.tenant_id}</code>, роль{' '}
               <code className="font-mono">{session.role}</code>.
             </p>
           ) : null}
+          {sessionError ? (
+            <p className="text-xs text-destructive">
+              {sessionQueryError instanceof Error
+                ? sessionQueryError.message
+                : 'Не удалось проверить сессию'}
+              . Для токена <code className="font-mono">dev</code> нужен demo-seed (
+              <code className="text-xs">EVOBGP_SEED_DEMO</code> ≠ 0) и запущенный API.
+            </p>
+          ) : null}
         </CardContent>
       </Card>
 
@@ -84,8 +142,14 @@ function SettingsComponent() {
         </CardHeader>
         <CardContent className="flex flex-col gap-2">
           <Label htmlFor="theme-select">Тема</Label>
-          <Select value={theme ?? 'system'} onValueChange={(v) => v && setTheme(v)}>
-            <SelectTrigger id="theme-select" className="w-full max-w-xs" />
+          <Select
+            items={[...THEME_SELECT_ITEMS]}
+            value={theme ?? 'system'}
+            onValueChange={(v) => v && setTheme(v)}
+          >
+            <SelectTrigger id="theme-select" className="w-full max-w-xs">
+              <SelectValue placeholder="Выберите тему" />
+            </SelectTrigger>
             <SelectContent>
               <SelectItem value="light">Светлая</SelectItem>
               <SelectItem value="dark">Тёмная</SelectItem>

apps/web/src/routes/_auth/tenant-settings.tsx

@@ -13,17 +13,12 @@ import {
   SelectContent,
   SelectItem,
   SelectTrigger,
+  SelectValue,
 } from '@evobgp/ui/components/select'
 import { Tabs, TabsContent, TabsList, TabsTrigger } from '@evobgp/ui/components/tabs'
-import {
-  Table,
-  TableBody,
-  TableCell,
-  TableHead,
-  TableHeader,
-  TableRow,
-} from '@evobgp/ui/components/table'
 
+
+import { SettingsKvGrid } from '@/components/settings/settings-kv-grid'
 import { PageHeader } from '@/components/page-header'
 import { QueryState } from '@/components/query-state'
 import { LoadingButton } from '@/components/loading-button'
@@ -34,6 +29,7 @@ import {
   RUNTIME_LOGS_SETTING_KEYS,
   buildPayload,
   partitionSettings,
+  settingsKeys,
   settingsQueryOptions,
   type BirdSettingKey,
 } from '@/queries/settings'
@@ -48,6 +44,16 @@ export const Route = createFileRoute('/_auth/tenant-settings')({
   }),
 })
 
+const RUNTIME_LOGS_ENABLED_ITEMS = [
+  { value: 'true', label: 'Вкл' },
+  { value: 'false', label: 'Выкл' },
+] as const
+
+const RUNTIME_LOGS_MODE_ITEMS = [
+  { value: 'truncate', label: 'truncate — обнулить' },
+  { value: 'delete', label: 'delete — удалить файл' },
+] as const
+
 const BIRD_LABELS: Record<BirdSettingKey, string> = {
   bird_router_id: 'Router ID',
   bird_local_ipv4: 'Локальный IPv4',
@@ -82,7 +88,7 @@ function TenantSettingsComponent() {
       apiMutate('/v1/settings', 'PATCH', payload),
     onSuccess: () => {
       toast.success('Параметры сохранены')
-      void qc.invalidateQueries({ queryKey: ['settings'] })
+      void qc.invalidateQueries({ queryKey: settingsKeys.all })
     },
     onError: (e) => toast.error(e instanceof Error ? e.message : 'Не удалось сохранить'),
   })
@@ -241,6 +247,7 @@ function TenantSettingsComponent() {
                     <div className="flex flex-col gap-1.5">
                       <Label>Авто-очистка включена</Label>
                       <Select
+                        items={[...RUNTIME_LOGS_ENABLED_ITEMS]}
                         value={runtimeLogsForm.runtime_logs_auto_enabled ?? 'false'}
                         onValueChange={(v) =>
                           v &&
@@ -251,7 +258,7 @@ function TenantSettingsComponent() {
                         }
                       >
                         <SelectTrigger>
-                          {runtimeLogsForm.runtime_logs_auto_enabled === 'true' ? 'Вкл' : 'Выкл'}
+                          <SelectValue placeholder="Выберите" />
                         </SelectTrigger>
                         <SelectContent>
                           <SelectItem value="true">Вкл</SelectItem>
@@ -298,6 +305,7 @@ function TenantSettingsComponent() {
                     <div className="flex flex-col gap-1.5">
                       <Label>Режим очистки</Label>
                       <Select
+                        items={[...RUNTIME_LOGS_MODE_ITEMS]}
                         value={runtimeLogsForm.runtime_logs_auto_mode ?? ''}
                         onValueChange={(v) =>
                           v &&
@@ -308,11 +316,11 @@ function TenantSettingsComponent() {
                         }
                       >
                         <SelectTrigger>
-                          {runtimeLogsForm.runtime_logs_auto_mode || 'Выберите'}
+                          <SelectValue placeholder="Выберите" />
                         </SelectTrigger>
                         <SelectContent>
-                          <SelectItem value="delete">Delete</SelectItem>
-                          <SelectItem value="truncate">Truncate</SelectItem>
+                          <SelectItem value="truncate">truncate — обнулить</SelectItem>
+                          <SelectItem value="delete">delete — удалить файл</SelectItem>
                         </SelectContent>
                       </Select>
                       <p className="font-mono text-xs text-muted-foreground">
@@ -352,22 +360,10 @@ function TenantSettingsComponent() {
                 onRetry={() => settingsQ.refetch()}
               >
                 {(items) => (
-                  <Table>
-                    <TableHeader>
-                      <TableRow>
-                        <TableHead>Ключ</TableHead>
-                        <TableHead>Значение</TableHead>
-                      </TableRow>
-                    </TableHeader>
-                    <TableBody>
-                      {items.map((row) => (
-                        <TableRow key={row.id}>
-                          <TableCell className="font-mono text-xs">{row.key}</TableCell>
-                          <TableCell className="font-mono text-xs">{row.value}</TableCell>
-                        </TableRow>
-                      ))}
-                    </TableBody>
-                  </Table>
+                  <SettingsKvGrid
+                    items={items}
+                    isLoading={settingsQ.isFetching && !settingsQ.isLoading}
+                  />
                 )}
               </QueryState>
             </CardContent>

apps/web/src/types/api.ts

@@ -343,3 +343,42 @@ export type ApiKeyCreated = ApiKey & { token: string }
 export type AsyncJobAccepted = {
   job_id: string
 }
+
+// ---- Firewall blocklist ----
+export type FirewallClient = {
+  id: string
+  name: string
+  hostname?: string
+  token_prefix: string
+  status: 'pending' | 'approved' | 'revoked'
+  last_seen_at?: string | null
+  last_seen_at_source?: string
+  last_apply_at?: string | null
+  last_apply_status?: string
+  last_apply_prefix_count?: number
+  last_apply_packets_dropped?: number
+  last_apply_packets_accepted?: number
+  last_apply_source?: string
+  client_version?: string
+  created_at: string
+}
+
+export type FirewallClientsResponse = { items: FirewallClient[] }
+
+export type FirewallRule = {
+  id: string
+  client_id?: string | null
+  priority: number
+  action: 'block' | 'accept'
+  community_id?: string | null
+  comment?: string
+}
+
+export type FirewallRulesResponse = { items: FirewallRule[] }
+
+export type FirewallInstallContext = {
+  bundle_seed: string
+  bundle_seed_configured: boolean
+  suggested_cp_url: string
+  install_sh_url: string
+}

apps/web/tsconfig.tsbuildinfo

@@ -1 +1 @@
-{"root":["./src/main.tsx","./src/routetree.gen.ts","./src/components/confirm-dialog.tsx","./src/components/empty-state.tsx","./src/components/loading-button.tsx","./src/components/mode-toggle.tsx","./src/components/page-header.tsx","./src/components/page-shell.tsx","./src/components/query-state.tsx","./src/components/section-cards.tsx","./src/components/skeletons.tsx","./src/components/status-badge.tsx","./src/components/theme-provider.tsx","./src/components/truncated-text.tsx","./src/components/layout/app-shell.tsx","./src/components/reui/autocomplete.tsx","./src/components/reui/badge.tsx","./src/components/reui/date-selector.tsx","./src/components/reui/filters.tsx","./src/components/reui/number-field.tsx","./src/components/reui/data-grid/data-grid-column-filter.tsx","./src/components/reui/data-grid/data-grid-column-header.tsx","./src/components/reui/data-grid/data-grid-column-visibility.tsx","./src/components/reui/data-grid/data-grid-pagination.tsx","./src/components/reui/data-grid/data-grid-scroll-area.tsx","./src/components/reui/data-grid/data-grid-table-dnd-rows.tsx","./src/components/reui/data-grid/data-grid-table-dnd.tsx","./src/components/reui/data-grid/data-grid-table-virtual.tsx","./src/components/reui/data-grid/data-grid-table.tsx","./src/components/reui/data-grid/data-grid.tsx","./src/lib/api-client.ts","./src/lib/queryclient.ts","./src/lib/router.ts","./src/queries/api-keys.ts","./src/queries/auth.ts","./src/queries/directories.ts","./src/queries/modules.ts","./src/queries/monitoring.ts","./src/queries/network.ts","./src/queries/operations.ts","./src/queries/overview.ts","./src/queries/settings.ts","./src/routes/__root.tsx","./src/routes/_auth.tsx","./src/routes/index.tsx","./src/routes/_auth/access.tsx","./src/routes/_auth/dashboard.tsx","./src/routes/_auth/directories.tsx","./src/routes/_auth/monitoring.tsx","./src/routes/_auth/network.tsx","./src/routes/_auth/operations.tsx","./src/routes/_auth/schedule.tsx","./src/routes/_auth/settings.tsx","./src/routes/_auth/tenant-settings.tsx","./src/routes/_auth/modules/$moduleid.tsx","./src/routes/_auth/modules/index.tsx","./src/routes/_auth/modules/new.tsx","./src/types/api.ts","./vite.config.ts"],"version":"5.9.3"}
+{"root":["./src/main.tsx","./src/routetree.gen.ts","./src/components/confirm-dialog.tsx","./src/components/data-grid-shell.tsx","./src/components/empty-state.tsx","./src/components/loading-button.tsx","./src/components/mode-toggle.tsx","./src/components/page-header.tsx","./src/components/page-shell.tsx","./src/components/query-state.tsx","./src/components/section-cards.tsx","./src/components/skeletons.tsx","./src/components/status-badge.tsx","./src/components/theme-provider.tsx","./src/components/truncated-text.tsx","./src/components/access/access-api-keys-card.tsx","./src/components/access/access-api-keys-grid.tsx","./src/components/access/api-key-create-dialog.tsx","./src/components/access/api-key-token-dialog.tsx","./src/components/dashboard/dashboard-network-panel.tsx","./src/components/dashboard/dashboard-quick-actions.tsx","./src/components/dashboard/dashboard-recent-jobs-grid.tsx","./src/components/dashboard/dashboard-recent-revisions-grid.tsx","./src/components/directories/directories-communities-grid.tsx","./src/components/directories/directories-doh-grid.tsx","./src/components/firewall/firewall-clients-grid.tsx","./src/components/firewall/firewall-rules-grid.tsx","./src/components/layout/app-shell.tsx","./src/components/modules/community-select.tsx","./src/components/modules/module-as-entry-dialog.tsx","./src/components/modules/module-cdn-source-dialog.tsx","./src/components/modules/module-domain-entry-dialog.tsx","./src/components/modules/module-entries-grid.tsx","./src/components/modules/module-entries-section.tsx","./src/components/modules/module-ip-range-entry-dialog.tsx","./src/components/modules/module-kpi-cards.tsx","./src/components/modules/modules-list-grid.tsx","./src/components/monitoring/monitoring-ready-grid.tsx","./src/components/network/network-peers-grid.tsx","./src/components/network/network-speakers-grid.tsx","./src/components/operations/operations-jobs-grid.tsx","./src/components/operations/operations-revisions-grid.tsx","./src/components/reui/autocomplete.tsx","./src/components/reui/badge.tsx","./src/components/reui/date-selector.tsx","./src/components/reui/filters.tsx","./src/components/reui/frame.tsx","./src/components/reui/number-field.tsx","./src/components/reui/data-grid/data-grid-column-filter.tsx","./src/components/reui/data-grid/data-grid-column-header.tsx","./src/components/reui/data-grid/data-grid-column-visibility.tsx","./src/components/reui/data-grid/data-grid-pagination.tsx","./src/components/reui/data-grid/data-grid-scroll-area.tsx","./src/components/reui/data-grid/data-grid-table-dnd-rows.tsx","./src/components/reui/data-grid/data-grid-table-dnd.tsx","./src/components/reui/data-grid/data-grid-table-virtual.tsx","./src/components/reui/data-grid/data-grid-table.tsx","./src/components/reui/data-grid/data-grid.tsx","./src/components/schedule/schedule-jobs-grid.tsx","./src/components/schedule/schedule-modules-grid.tsx","./src/components/settings/settings-kv-grid.tsx","./src/lib/api-client.ts","./src/lib/data-grid-defaults.ts","./src/lib/queryclient.ts","./src/lib/router.ts","./src/lib/ui-labels.ts","./src/lib/access/api-key-labels.ts","./src/lib/modules/display.ts","./src/lib/modules/helpers.ts","./src/queries/api-keys.ts","./src/queries/auth.ts","./src/queries/directories.ts","./src/queries/firewall.ts","./src/queries/modules.ts","./src/queries/monitoring.ts","./src/queries/network.ts","./src/queries/operations.ts","./src/queries/overview.ts","./src/queries/settings.ts","./src/routes/__root.tsx","./src/routes/_auth.tsx","./src/routes/index.tsx","./src/routes/_auth/access.tsx","./src/routes/_auth/dashboard.tsx","./src/routes/_auth/directories.tsx","./src/routes/_auth/firewall.tsx","./src/routes/_auth/monitoring.tsx","./src/routes/_auth/network.tsx","./src/routes/_auth/operations.tsx","./src/routes/_auth/schedule.tsx","./src/routes/_auth/settings.tsx","./src/routes/_auth/tenant-settings.tsx","./src/routes/_auth/modules/$moduleid.tsx","./src/routes/_auth/modules/index.tsx","./src/routes/_auth/modules/new.tsx","./src/types/api.ts","./vite.config.ts"],"version":"5.9.3"}

deploy/compose/docker-compose.production.example.yaml

@@ -159,10 +159,18 @@ services:
         condition: service_started
     labels:
       - traefik.enable=true
+      # Публичные firewall-эндпоинты — без WEBUI_IP_WHITELIST (установка с произвольных серверов).
+      - traefik.http.routers.evobgp-firewall-public.rule=Host(`${WEBUI_DOMAIN}`) && (Path(`/v1/firewall/install.sh`) || Path(`/v1/firewall/sync-script`) || PathPrefix(`/v1/firewall/enroll`))
+      - traefik.http.routers.evobgp-firewall-public.entrypoints=websecure
+      - traefik.http.routers.evobgp-firewall-public.tls=true
+      - traefik.http.routers.evobgp-firewall-public.tls.certresolver=letsencrypt
+      - traefik.http.routers.evobgp-firewall-public.priority=100
+      - traefik.http.routers.evobgp-firewall-public.service=evobgp-web
       - traefik.http.routers.evobgp-web.rule=Host(`${WEBUI_DOMAIN}`)
       - traefik.http.routers.evobgp-web.entrypoints=websecure
       - traefik.http.routers.evobgp-web.tls=true
       - traefik.http.routers.evobgp-web.tls.certresolver=letsencrypt
+      - traefik.http.routers.evobgp-web.priority=10
       - traefik.http.routers.evobgp-web.middlewares=webui-ipwhitelist@docker
       - traefik.http.middlewares.webui-ipwhitelist.ipallowlist.sourcerange=${WEBUI_IP_WHITELIST}
       - traefik.http.services.evobgp-web.loadbalancer.server.port=80

deploy/compose/docker-compose.yaml

@@ -247,10 +247,18 @@ services:
       - evobgp-all
     labels:
       - traefik.enable=true
+      # Публичные firewall-эндпоинты — без WEBUI_IP_WHITELIST (установка с произвольных серверов).
+      - traefik.http.routers.evobgp-firewall-public.rule=Host(`${WEBUI_DOMAIN}`) && (Path(`/v1/firewall/install.sh`) || Path(`/v1/firewall/sync-script`) || PathPrefix(`/v1/firewall/enroll`))
+      - traefik.http.routers.evobgp-firewall-public.entrypoints=websecure
+      - traefik.http.routers.evobgp-firewall-public.tls=true
+      - traefik.http.routers.evobgp-firewall-public.tls.certresolver=letsencrypt
+      - traefik.http.routers.evobgp-firewall-public.priority=100
+      - traefik.http.routers.evobgp-firewall-public.service=evobgp-web
       - traefik.http.routers.evobgp-web.rule=Host(`${WEBUI_DOMAIN}`)
       - traefik.http.routers.evobgp-web.entrypoints=websecure
       - traefik.http.routers.evobgp-web.tls=true
       - traefik.http.routers.evobgp-web.tls.certresolver=letsencrypt
+      - traefik.http.routers.evobgp-web.priority=10
       - traefik.http.routers.evobgp-web.middlewares=webui-ipwhitelist@docker
       - traefik.http.middlewares.webui-ipwhitelist.ipallowlist.sourcerange=${WEBUI_IP_WHITELIST}
       - traefik.http.services.evobgp-web.loadbalancer.server.port=80

deploy/compose/stack.microvps-full.yaml

@@ -162,10 +162,18 @@ services:
         condition: service_started
     labels:
       - traefik.enable=true
+      # Публичные firewall-эндпоинты — без WEBUI_IP_WHITELIST (установка с произвольных серверов).
+      - traefik.http.routers.evobgp-firewall-public.rule=Host(`${WEBUI_DOMAIN}`) && (Path(`/v1/firewall/install.sh`) || Path(`/v1/firewall/sync-script`) || PathPrefix(`/v1/firewall/enroll`))
+      - traefik.http.routers.evobgp-firewall-public.entrypoints=websecure
+      - traefik.http.routers.evobgp-firewall-public.tls=true
+      - traefik.http.routers.evobgp-firewall-public.tls.certresolver=letsencrypt
+      - traefik.http.routers.evobgp-firewall-public.priority=100
+      - traefik.http.routers.evobgp-firewall-public.service=evobgp-web
       - traefik.http.routers.evobgp-web.rule=Host(`${WEBUI_DOMAIN}`)
       - traefik.http.routers.evobgp-web.entrypoints=websecure
       - traefik.http.routers.evobgp-web.tls=true
       - traefik.http.routers.evobgp-web.tls.certresolver=letsencrypt
+      - traefik.http.routers.evobgp-web.priority=10
       - traefik.http.routers.evobgp-web.middlewares=webui-ipwhitelist@docker
       - traefik.http.middlewares.webui-ipwhitelist.ipallowlist.sourcerange=${WEBUI_IP_WHITELIST}
       - traefik.http.services.evobgp-web.loadbalancer.server.port=80

deploy/docker/bird/bird-from-source.sh

@@ -18,7 +18,7 @@ apt-get install -y --no-install-recommends \
 
 cd /tmp
 rm -rf "bird-${BIRD_VERSION}"
-curl -fsSL "https://bird.network.cz/download/bird-${BIRD_VERSION}.tar.gz" | tar xz
+curl -fsSL "https://bird.nic.cz/download/bird-${BIRD_VERSION}.tar.gz" | tar xz
 cd "bird-${BIRD_VERSION}"
 ./configure --prefix=/usr/local --enable-client
 make -j"$(nproc)"

deploy/docker/evobgp-web/Dockerfile

@@ -5,7 +5,7 @@
 
 FROM public.ecr.aws/docker/library/node:22-alpine AS deps
 WORKDIR /repo
-RUN corepack enable
+RUN corepack enable && corepack prepare [email protected] --activate
 COPY pnpm-workspace.yaml pnpm-lock.yaml package.json ./
 COPY apps/web/package.json ./apps/web/
 COPY packages/ui/package.json ./packages/ui/

deploy/docker/evobgp-web/nginx.conf

@@ -17,7 +17,7 @@ server {
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto;
     }
 
     location = /metrics {

deploy/docker/gobinary/Dockerfile

@@ -58,6 +58,8 @@ RUN apt-get update \
 FROM runtime-base AS runtime
 ARG BIN=evobgp-api
 COPY --from=build-all /out/${BIN} /usr/local/bin/evobgp
+COPY scripts/firewall /opt/evobgp/scripts/firewall
+ENV EVOBGP_FIREWALL_SCRIPTS=/opt/evobgp/scripts/firewall
 EXPOSE 8080
 ENTRYPOINT ["/usr/local/bin/evobgp"]
 

docs/access.md

@@ -43,6 +43,7 @@ opkey|01ARZ3NDEKTSV4RRFFQ69G5FAV|operator,nodekey|01ARZ3NDEKTSV4RRFFQ69G5FAV|nod
 | `editor` | 2 | Чтение + создание/изменение CRUD (модули, записи, peers и т.д.), без опасных операций уровня оператора. |
 | `operator` | 3 | Полный операторский доступ: apply, rollback, настройки, отмена задач и т.п. (как задано в handlers). |
 | `node` | отдельная | Только API для реплики: latest revision, скачивание бандла, enroll. Роль **`node` запрещена** для обычного CRUD — ответ `403 Forbidden`. |
+| `firewall` | отдельная | Только data-plane firewall-клиента: `GET /v1/firewall/blocklist`, `POST /v1/firewall/apply-report`, `POST /v1/firewall/heartbeat`. Токен в таблице `firewall_client`, не в `api_key`. См. [firewall.md](firewall.md). |
 
 Обратное ограничение: для эндпоинтов ноды требуется именно роль **`node`**; остальные роли получают отказ.
 
@@ -50,6 +51,8 @@ opkey|01ARZ3NDEKTSV4RRFFQ69G5FAV|operator,nodekey|01ARZ3NDEKTSV4RRFFQ69G5FAV|nod
 
 Если в store доступен демо-tenant (`DemoIDs`, обычно `EVOBGP_SEED_DEMO` не равен `0`), заголовок **`Authorization: Bearer dev`** даёт роль **`operator`** для этого tenant. **Не зависит** от `EVOBGP_DEV_INSECURE`.
 
+Без demo-tenant токен `dev` может быть задан в `EVOBGP_API_KEYS` (break-glass).
+
 **Запрещено** в продакшене: не оставляйте demo-seed с известным токеном `dev` на боевых данных. Переменная `EVOBGP_DEV_INSECURE` в текущей версии **не влияет** на аутентификацию (оставлена в compose для совместимости; не включайте в production — см. SEC-02 в инженерных правилах).
 
 ### PostgreSQL monitoring и maintenance (control plane)

docs/architecture.md

@@ -41,7 +41,8 @@
 | `broker` | Опциональный `EVOBGP_BROKER_URL` для будущей шины; сейчас задачи только in-process (`jobs.Registry`), пакет лишь логирует факт настройки URL. |
 | `pipeline` | Ingest+render в одном шаге для `module_refresh`: выборка префиксов (CDN/AS/IP/пустые DOMAINS), `CreateRenderRevision`, превью BIRD через `birdfmt`. |
 | `nodedispatch` | Panel→Node HTTP wake-up (`POST /v1/agent/sync`) после `deploy_apply`. |
-| `agentserver` | HTTP API на реплике (`serve`): sync + health для Traefik. |
+| `agentserver` | HTTP API на реплике (`serve`): sync + health для Traefik; опционально firewall failover (`/v1/firewall/*`). |
+| `firewall` | Вычисление policy block/accept → плоский CIDR blocklist. |
 
 ## Удалённые спикеры
 

docs/firewall.md

@@ -0,0 +1,52 @@
+# Firewall blocklist
+
+Подсистема синхронизации blocklist на произвольные Linux-серверы через bash-скрипт и HTTP API.
+
+## Авторизация
+
+1. **Enroll** — `POST /v1/firewall/enroll` с заголовком `X-EvoBGP-Seed` (значение `EVOBGP_BUNDLE_SEED_HEX` на CP). Клиент генерирует токен `evobgp_fw_*` локально.
+2. **Approve** — operator в Web UI (`/firewall` → Запросы).
+3. **Sync** — `GET /v1/firewall/blocklist` с `Authorization: Bearer <client_token>`.
+
+## Политика block/accept
+
+- **`block`** — добавить префиксы выбранного BGP community в kernel blocklist.
+- **`accept`** — не блокировать префиксы этого community.
+- **Community** — правило применяется к префиксам с этим `community_id` в опубликованной revision; пустое значение («Все») — ко всем communities.
+- **Default** — accept (пустой blocklist без явных `block`).
+
+Порядок: сначала per-server overrides клиента, затем tenant-default. Для каждого community берётся первое подходящее правило по приоритету.
+
+Справочник communities: Web UI → Справочники, или модули с привязкой community к префиксам.
+
+## Установка на сервер
+
+Публичные URL (без API-ключа, вне `WEBUI_IP_WHITELIST` Traefik): `GET /v1/firewall/install.sh`, `GET /v1/firewall/sync-script`, `POST /v1/firewall/enroll`. Всегда **HTTPS**.
+
+Требуется миграция **`000027_firewall`** в PostgreSQL (применяется при старте API с актуальным бинарём). Если enroll отвечает `503` / `database schema outdated` — перезапустите `evobgp-api` / `evobgp-all` после деплоя новой версии.
+
+```bash
+curl -fsSL https://<api>/v1/firewall/install.sh | \
+  EVOBGP_CP_URL=https://<api> \
+  EVOBGP_SEED=<bundle_seed_hex> \
+  EVOBGP_CLIENT_NAME="web-01" \
+  bash
+```
+
+Файлы: `/etc/evobgp/firewall.conf`, `/usr/local/sbin/evobgp-firewall.sh`, systemd timer `evobgp-firewall.timer`.
+
+После **approve** в UI выполните на сервере (или дождитесь timer):
+
+```bash
+sudo rm -f /var/lib/evobgp-firewall/last_hash
+sudo /usr/local/sbin/evobgp-firewall.sh
+sudo nft list table inet evobgp_blocklist
+```
+
+Для парсинга JSON нужен `jq` или `python3` (install.sh ставит `jq` на Debian/Ubuntu при отсутствии).
+
+## Failover через speaker
+
+При `EVOBGP_FIREWALL_FAILOVER_ENABLED=1` на speaker-agent CP реплицирует состояние через `POST /v1/agent/firewall-replicate`. Клиенты используют тот же DNS-домен.
+
+См. также [access.md](access.md), [remote-speakers.md](remote-speakers.md).

docs/openapi.yaml

@@ -58,6 +58,8 @@ tags:
       Файловые runtime-логи Docker-сервисов (каталог EVOBGP_RUNTIME_LOGS_DIR).
       Доступно только в процессе evobgp-all с примонтированным volume; иначе 503.
       Просмотр — viewer+; очистка — operator+ (синхронно, с audit).
+  - name: Firewall
+    description: Linux firewall blocklist clients, policy rules (block/accept), and data-plane sync.
 
 security:
   - bearerAuth: []
@@ -1579,6 +1581,92 @@ components:
           type: string
           format: date-time
 
+    FirewallClient:
+      type: object
+      properties:
+        id:
+          $ref: "#/components/schemas/ResourceId"
+        name:
+          type: string
+        hostname:
+          type: string
+        token_prefix:
+          type: string
+        status:
+          type: string
+          enum: [pending, approved, revoked]
+        last_seen_at:
+          type: string
+          format: date-time
+        last_apply_at:
+          type: string
+          format: date-time
+        last_apply_status:
+          type: string
+        last_apply_prefix_count:
+          type: integer
+        last_apply_packets_dropped:
+          type: integer
+          format: int64
+          description: Cumulative packets dropped by blocklist rule (from client kernel counter).
+        last_apply_packets_accepted:
+          type: integer
+          format: int64
+          description: Cumulative packets accepted past blocklist chain (nft counter accept rule).
+        client_version:
+          type: string
+
+    FirewallInstallContext:
+      type: object
+      description: Контекст для one-liner установки firewall-клиента (только operator).
+      properties:
+        bundle_seed:
+          type: string
+          description: Значение EVOBGP_BUNDLE_SEED_HEX на control plane.
+        bundle_seed_configured:
+          type: boolean
+        suggested_cp_url:
+          type: string
+          format: uri
+        install_sh_url:
+          type: string
+          format: uri
+
+    FirewallRule:
+      type: object
+      properties:
+        id:
+          $ref: "#/components/schemas/ResourceId"
+        client_id:
+          $ref: "#/components/schemas/ResourceId"
+          nullable: true
+        priority:
+          type: integer
+        action:
+          type: string
+          enum: [block, accept]
+        community_id:
+          $ref: "#/components/schemas/ResourceId"
+          nullable: true
+        comment:
+          type: string
+
+    FirewallBlocklist:
+      type: object
+      properties:
+        client_id:
+          $ref: "#/components/schemas/ResourceId"
+        revision_id:
+          $ref: "#/components/schemas/ResourceId"
+        prefixes:
+          type: array
+          items:
+            type: string
+        total:
+          type: integer
+        hash:
+          type: string
+
 paths:
   /v1/health:
     get:
@@ -4299,3 +4387,201 @@ paths:
           $ref: "#/components/responses/Forbidden"
         default:
           $ref: "#/components/responses/DefaultProblem"
+
+  /v1/firewall/install-context:
+    get:
+      tags: [Firewall]
+      summary: Install context for firewall one-liner (operator)
+      operationId: getFirewallInstallContext
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/FirewallInstallContext"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        default:
+          $ref: "#/components/responses/DefaultProblem"
+
+  /v1/firewall/enroll:
+    post:
+      tags: [Firewall]
+      summary: Enroll firewall client (public, X-EvoBGP-Seed)
+      security: []
+      operationId: firewallEnroll
+      parameters:
+        - name: X-EvoBGP-Seed
+          in: header
+          required: true
+          schema:
+            type: string
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [name, client_token]
+              properties:
+                name:
+                  type: string
+                hostname:
+                  type: string
+                client_token:
+                  type: string
+                client_version:
+                  type: string
+      responses:
+        "201":
+          description: Client created (pending).
+        default:
+          $ref: "#/components/responses/DefaultProblem"
+
+  /v1/firewall/clients:
+    get:
+      tags: [Firewall]
+      summary: List firewall clients
+      operationId: listFirewallClients
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  items:
+                    type: array
+                    items:
+                      $ref: "#/components/schemas/FirewallClient"
+        default:
+          $ref: "#/components/responses/DefaultProblem"
+
+  /v1/firewall/clients/{id}/approve:
+    post:
+      tags: [Firewall]
+      summary: Approve pending client
+      operationId: approveFirewallClient
+      parameters:
+        - name: id
+          in: path
+          required: true
+          schema:
+            $ref: "#/components/schemas/ResourceId"
+      responses:
+        "200":
+          description: Approved
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/FirewallClient"
+        default:
+          $ref: "#/components/responses/DefaultProblem"
+
+  /v1/firewall/clients/{id}/revoke:
+    post:
+      tags: [Firewall]
+      summary: Reject pending or revoke approved client
+      operationId: revokeFirewallClient
+      parameters:
+        - name: id
+          in: path
+          required: true
+          schema:
+            $ref: "#/components/schemas/ResourceId"
+      responses:
+        "200":
+          description: Revoked
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  status:
+                    type: string
+                    enum: [revoked]
+        default:
+          $ref: "#/components/responses/DefaultProblem"
+
+  /v1/firewall/rules:
+    get:
+      tags: [Firewall]
+      summary: List firewall rules
+      operationId: listFirewallRules
+      parameters:
+        - name: scope
+          in: query
+          schema:
+            type: string
+            enum: [tenant, client]
+        - name: client_id
+          in: query
+          schema:
+            $ref: "#/components/schemas/ResourceId"
+      responses:
+        "200":
+          description: OK
+        default:
+          $ref: "#/components/responses/DefaultProblem"
+    post:
+      tags: [Firewall]
+      summary: Create firewall rule
+      operationId: createFirewallRule
+      responses:
+        "201":
+          description: Created
+        default:
+          $ref: "#/components/responses/DefaultProblem"
+
+  /v1/firewall/blocklist:
+    get:
+      tags: [Firewall]
+      summary: Get evaluated blocklist (firewall client token)
+      operationId: getFirewallBlocklist
+      responses:
+        "200":
+          description: Blocklist
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/FirewallBlocklist"
+        default:
+          $ref: "#/components/responses/DefaultProblem"
+
+  /v1/firewall/apply-report:
+    post:
+      tags: [Firewall]
+      summary: Report last apply status
+      operationId: firewallApplyReport
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                status:
+                  type: string
+                error:
+                  type: string
+                prefix_count:
+                  type: integer
+                ip_count:
+                  type: integer
+                packets_dropped:
+                  type: integer
+                  format: int64
+                packets_accepted:
+                  type: integer
+                  format: int64
+                kernel_method:
+                  type: string
+                source:
+                  type: string
+      responses:
+        "200":
+          description: OK
+        default:
+          $ref: "#/components/responses/DefaultProblem"

docs/quickstart.md

@@ -153,6 +153,7 @@ docker compose --env-file .env --env-file .env.web-sec --profile microvps-full u
 - `http://<WEBUI_DOMAIN>` должен редиректить на `https://<WEBUI_DOMAIN>`;
 - с IP из `WEBUI_IP_WHITELIST` UI доступен по HTTPS;
 - с неразрешенного IP Traefik вернет `403`.
+- исключение: `GET /v1/firewall/install.sh`, `GET /v1/firewall/sync-script`, `POST /v1/firewall/enroll` — публичные, без whitelist (см. [firewall.md](firewall.md)).
 
 Health API: `http://<IP>:8080/v1/health`.
 

docs/remote-speakers.md

@@ -114,5 +114,7 @@ Tenant `/v1/settings` (`bird_bgp_source_ipv4`) — fallback для master / ес
 | `EVOBGP_NODE_DISPATCH_ENABLED=1` | CP |
 | `EVOBGP_AGENT_SECRET` | реплика |
 | `EVOBGP_NODE_TOKEN` | реплика |
+| `EVOBGP_FIREWALL_FAILOVER_ENABLED=1` | реплика (опционально: отдавать `/v1/firewall/blocklist` при недоступности CP) |
+| `EVOBGP_FIREWALL_STATE_FILE` | реплика (default `/var/lib/evobgp-agent/firewall-state.json`) |
 | `EVOBGP_BUNDLE_PUBKEY_BASE64` | реплика |
 | `PANEL_IP_WHITELIST` | Traefik на реплике |

internal/agentserver/firewall.go

@@ -0,0 +1,256 @@
+package agentserver
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"io"
+	"log"
+	"net/http"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+	"sync"
+	"time"
+
+	"evobgp/internal/authkey"
+	"evobgp/internal/firewall"
+)
+
+type firewallReplicatePayload struct {
+	TenantID            string                `json:"tenant_id"`
+	RevisionID          string                `json:"revision_id"`
+	GeneratedAt         string                `json:"generated_at"`
+	UpdatedAt           string                `json:"updated_at"`
+	ClientsByHash       map[string]clientMeta `json:"clients_by_hash"`
+	Rules               []firewallRuleJSON    `json:"rules"`
+	PrefixesByCommunity map[string][]string   `json:"prefixes_by_community"`
+}
+
+type clientMeta struct {
+	ClientID string `json:"client_id"`
+	Name     string `json:"name"`
+}
+
+type firewallRuleJSON struct {
+	ClientID    *string `json:"client_id"`
+	Priority    int     `json:"priority"`
+	Action      string  `json:"action"`
+	CommunityID *string `json:"community_id"`
+}
+
+type firewallAgent struct {
+	mu        sync.RWMutex
+	stateFile string
+	cpURL     string
+	enabled   bool
+	state     firewallReplicatePayload
+}
+
+func newFirewallAgent(cfg Config) *firewallAgent {
+	enabled := strings.TrimSpace(os.Getenv("EVOBGP_FIREWALL_FAILOVER_ENABLED")) == "1"
+	stateFile := envOr("EVOBGP_FIREWALL_STATE_FILE", "/var/lib/evobgp-agent/firewall-state.json")
+	fa := &firewallAgent{
+		stateFile: stateFile,
+		cpURL:     strings.TrimSpace(cfg.ControlPlaneURL),
+		enabled:   enabled,
+	}
+	if enabled {
+		_ = fa.load()
+	}
+	return fa
+}
+
+func (s *Server) handleFirewallReplicate(w http.ResponseWriter, r *http.Request) {
+	if !s.authorize(r) {
+		writeProblem(w, http.StatusUnauthorized, "missing or invalid Authorization")
+		return
+	}
+	var raw struct {
+		TenantID    string `json:"tenant_id"`
+		RevisionID  string `json:"revision_id"`
+		GeneratedAt string `json:"generated_at"`
+		Clients     []struct {
+			TokenHashHex string `json:"token_hash_hex"`
+			ClientID     string `json:"client_id"`
+			Name         string `json:"name"`
+		} `json:"clients"`
+		Rules               []firewallRuleJSON  `json:"rules"`
+		PrefixesByCommunity map[string][]string `json:"prefixes_by_community"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&raw); err != nil {
+		writeProblem(w, http.StatusBadRequest, "invalid JSON body")
+		return
+	}
+	byHash := make(map[string]clientMeta, len(raw.Clients))
+	for _, c := range raw.Clients {
+		byHash[strings.ToLower(c.TokenHashHex)] = clientMeta{ClientID: c.ClientID, Name: c.Name}
+	}
+	payload := firewallReplicatePayload{
+		TenantID:            raw.TenantID,
+		RevisionID:          raw.RevisionID,
+		GeneratedAt:         raw.GeneratedAt,
+		UpdatedAt:           time.Now().UTC().Format(time.RFC3339),
+		ClientsByHash:       byHash,
+		Rules:               raw.Rules,
+		PrefixesByCommunity: raw.PrefixesByCommunity,
+	}
+	s.firewall.mu.Lock()
+	s.firewall.state = payload
+	s.firewall.mu.Unlock()
+	if err := s.firewall.save(); err != nil {
+		log.Printf("agentserver: firewall state save: %v", err)
+	}
+	writeJSON(w, http.StatusOK, map[string]any{
+		"ok":            true,
+		"clients_count": len(byHash),
+		"rules_count":   len(raw.Rules),
+		"prefix_count":  len(raw.PrefixesByCommunity),
+	})
+}
+
+func (fa *firewallAgent) handleBlocklist(w http.ResponseWriter, r *http.Request) {
+	token := bearerToken(r)
+	if token == "" {
+		writeProblem(w, http.StatusUnauthorized, "missing bearer token")
+		return
+	}
+	hash := hex.EncodeToString(authkey.HashToken(token))
+	fa.mu.RLock()
+	st := fa.state
+	meta, ok := st.ClientsByHash[hash]
+	fa.mu.RUnlock()
+	if !ok {
+		writeProblem(w, http.StatusUnauthorized, "unknown firewall client")
+		return
+	}
+	rules := make([]firewall.Rule, 0, len(st.Rules))
+	for _, r := range st.Rules {
+		rules = append(rules, firewall.Rule{
+			ClientID:    r.ClientID,
+			Priority:    r.Priority,
+			Action:      r.Action,
+			CommunityID: r.CommunityID,
+		})
+	}
+	prefixes := firewall.Evaluate(meta.ClientID, rules, st.PrefixesByCommunity)
+	updatedAt, _ := time.Parse(time.RFC3339, st.UpdatedAt)
+	age := int(time.Since(updatedAt).Seconds())
+	if updatedAt.IsZero() {
+		age = 0
+	}
+	w.Header().Set("X-EvoBGP-Source", "speaker")
+	w.Header().Set("X-EvoBGP-Revision-ID", st.RevisionID)
+	w.Header().Set("X-EvoBGP-Generated-At", st.GeneratedAt)
+	w.Header().Set("X-EvoBGP-Rules-Version", firewall.RulesVersionHash(rules))
+	if age > 3600 {
+		w.Header().Set("X-EvoBGP-Stale", "true")
+	}
+	if age > 0 {
+		w.Header().Set("Age", strconvItoa(age))
+	}
+	resp := map[string]any{
+		"client_id":             meta.ClientID,
+		"revision_id":           st.RevisionID,
+		"generated_at":          st.GeneratedAt,
+		"source":                "speaker",
+		"rules_applied":         len(rules),
+		"communities_evaluated": len(st.PrefixesByCommunity),
+		"prefixes":              prefixes,
+		"total":                 len(prefixes),
+		"hash":                  prefixHash(prefixes),
+	}
+	if strings.Contains(r.Header.Get("Accept"), "text/plain") {
+		w.Header().Set("Content-Type", "text/plain; charset=utf-8")
+		for _, p := range prefixes {
+			_, _ = w.Write([]byte(p + "\n"))
+		}
+		return
+	}
+	writeJSON(w, http.StatusOK, resp)
+}
+
+func (fa *firewallAgent) handleApplyReportForward(w http.ResponseWriter, r *http.Request) {
+	body, _ := io.ReadAll(r.Body)
+	forwarded := false
+	if fa.cpURL != "" {
+		req, err := http.NewRequestWithContext(r.Context(), http.MethodPost, strings.TrimSuffix(fa.cpURL, "/")+"/v1/firewall/apply-report", strings.NewReader(string(body)))
+		if err == nil {
+			req.Header.Set("Authorization", r.Header.Get("Authorization"))
+			req.Header.Set("Content-Type", "application/json")
+			resp, err := http.DefaultClient.Do(req)
+			if err == nil {
+				forwarded = resp.StatusCode >= 200 && resp.StatusCode < 300
+				_ = resp.Body.Close()
+			}
+		}
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"ok": true, "forwarded": forwarded})
+}
+
+func (fa *firewallAgent) load() error {
+	b, err := os.ReadFile(fa.stateFile)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil
+		}
+		return err
+	}
+	var st firewallReplicatePayload
+	if err := json.Unmarshal(b, &st); err != nil {
+		return err
+	}
+	fa.mu.Lock()
+	fa.state = st
+	fa.mu.Unlock()
+	return nil
+}
+
+func (fa *firewallAgent) save() error {
+	fa.mu.RLock()
+	b, err := json.MarshalIndent(fa.state, "", "  ")
+	fa.mu.RUnlock()
+	if err != nil {
+		return err
+	}
+	dir := filepath.Dir(fa.stateFile)
+	if err := os.MkdirAll(dir, 0o755); err != nil {
+		return err
+	}
+	tmp := fa.stateFile + ".tmp"
+	if err := os.WriteFile(tmp, b, 0o600); err != nil {
+		return err
+	}
+	return os.Rename(tmp, fa.stateFile)
+}
+
+func bearerToken(r *http.Request) string {
+	h := r.Header.Get("Authorization")
+	const p = "Bearer "
+	if !strings.HasPrefix(h, p) {
+		return ""
+	}
+	return strings.TrimSpace(h[len(p):])
+}
+
+func prefixHash(prefixes []string) string {
+	cp := append([]string(nil), prefixes...)
+	sort.Strings(cp)
+	sum := sha256.Sum256([]byte(strings.Join(cp, "\n")))
+	return "sha256:" + hex.EncodeToString(sum[:])
+}
+
+func strconvItoa(n int) string {
+	if n == 0 {
+		return "0"
+	}
+	var b [20]byte
+	i := len(b)
+	for n > 0 {
+		i--
+		b[i] = byte('0' + n%10)
+		n /= 10
+	}
+	return string(b[i:])
+}

internal/agentserver/server.go

@@ -36,16 +36,22 @@ type Config struct {
 
 // Server serves Panel→Node internal API (Remnawave-style wake-up).
 type Server struct {
-	cfg Config
-	mux *http.ServeMux
+	cfg      Config
+	mux      *http.ServeMux
+	firewall *firewallAgent
 }
 
 // New builds an agent HTTP server.
 func New(cfg Config) *Server {
-	s := &Server{cfg: cfg, mux: http.NewServeMux()}
+	s := &Server{cfg: cfg, mux: http.NewServeMux(), firewall: newFirewallAgent(cfg)}
 	s.mux.HandleFunc("GET /v1/agent/health", s.handleHealth)
 	s.mux.HandleFunc("GET /v1/agent/bird/protocols", s.handleBirdProtocols)
 	s.mux.HandleFunc("POST /v1/agent/sync", s.handleSync)
+	if s.firewall.enabled {
+		s.mux.HandleFunc("GET /v1/firewall/blocklist", s.firewall.handleBlocklist)
+		s.mux.HandleFunc("POST /v1/firewall/apply-report", s.firewall.handleApplyReportForward)
+		s.mux.HandleFunc("POST /v1/agent/firewall-replicate", s.handleFirewallReplicate)
+	}
 	return s
 }
 

internal/firewall/policy.go

@@ -0,0 +1,127 @@
+// Package firewall evaluates block/accept policy rules into CIDR blocklists.
+package firewall
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"sort"
+	"strconv"
+	"strings"
+)
+
+// Rule is one ordered firewall policy rule for evaluation.
+type Rule struct {
+	ClientID    *string
+	Priority    int
+	Action      string // "block" | "accept"
+	CommunityID *string
+}
+
+// Evaluate returns a deduplicated flat CIDR list to block in the kernel.
+// communityPrefixes maps community ID to prefixes; key "" holds prefixes without community.
+// Default when no rule matches: accept (do not block).
+func Evaluate(clientID string, rules []Rule, communityPrefixes map[string][]string) []string {
+	ordered := mergeRules(clientID, rules)
+	if len(communityPrefixes) == 0 {
+		return nil
+	}
+	keys := make([]string, 0, len(communityPrefixes))
+	for k := range communityPrefixes {
+		keys = append(keys, k)
+	}
+	sort.Strings(keys)
+
+	var out []string
+	seen := make(map[string]struct{})
+	for _, commKey := range keys {
+		if !shouldBlockCommunity(commKey, ordered) {
+			continue
+		}
+		for _, p := range communityPrefixes[commKey] {
+			p = strings.TrimSpace(p)
+			if p == "" {
+				continue
+			}
+			if _, ok := seen[p]; ok {
+				continue
+			}
+			seen[p] = struct{}{}
+			out = append(out, p)
+		}
+	}
+	return out
+}
+
+func mergeRules(clientID string, rules []Rule) []Rule {
+	var clientRules, tenantRules []Rule
+	for _, r := range rules {
+		if r.ClientID != nil && strings.TrimSpace(*r.ClientID) == clientID {
+			clientRules = append(clientRules, r)
+			continue
+		}
+		if r.ClientID == nil {
+			tenantRules = append(tenantRules, r)
+		}
+	}
+	sort.Slice(clientRules, func(i, j int) bool { return clientRules[i].Priority < clientRules[j].Priority })
+	sort.Slice(tenantRules, func(i, j int) bool { return tenantRules[i].Priority < tenantRules[j].Priority })
+	out := make([]Rule, 0, len(clientRules)+len(tenantRules))
+	out = append(out, clientRules...)
+	out = append(out, tenantRules...)
+	return out
+}
+
+func shouldBlockCommunity(communityKey string, ordered []Rule) bool {
+	for _, r := range ordered {
+		if r.CommunityID == nil || strings.TrimSpace(*r.CommunityID) == communityKey {
+			return strings.EqualFold(strings.TrimSpace(r.Action), "block")
+		}
+	}
+	return false
+}
+
+// RulesVersionHash returns a stable fingerprint of rules for cache headers.
+func RulesVersionHash(rules []Rule) string {
+	if len(rules) == 0 {
+		return "sha256:empty"
+	}
+	cp := append([]Rule(nil), rules...)
+	sort.Slice(cp, func(i, j int) bool {
+		a, b := cp[i], cp[j]
+		ac, bc := "", ""
+		if a.ClientID != nil {
+			ac = *a.ClientID
+		}
+		if b.ClientID != nil {
+			bc = *b.ClientID
+		}
+		if ac != bc {
+			return ac < bc
+		}
+		if a.Priority != b.Priority {
+			return a.Priority < b.Priority
+		}
+		return a.Action < b.Action
+	})
+	var b strings.Builder
+	for _, r := range cp {
+		cid := "*"
+		if r.CommunityID != nil {
+			cid = *r.CommunityID
+		}
+		cl := "tenant"
+		if r.ClientID != nil {
+			cl = *r.ClientID
+		}
+		b.WriteString(cl)
+		b.WriteByte('|')
+		b.WriteString(r.Action)
+		b.WriteByte('|')
+		b.WriteString(cid)
+		b.WriteByte('|')
+		b.WriteString(strconv.Itoa(r.Priority))
+		b.WriteByte(';')
+	}
+	sum := sha256.Sum256([]byte(b.String()))
+	return "sha256:" + hex.EncodeToString(sum[:])
+}

internal/firewall/policy_test.go

@@ -0,0 +1,75 @@
+package firewall
+
+import (
+	"testing"
+)
+
+func TestEvaluate_emptyRules(t *testing.T) {
+	prefixes := map[string][]string{"c1": {"1.2.3.0/24"}}
+	got := Evaluate("client1", nil, prefixes)
+	if len(got) != 0 {
+		t.Fatalf("expected empty blocklist, got %v", got)
+	}
+}
+
+func TestEvaluate_onlyAccept(t *testing.T) {
+	wild := (*string)(nil)
+	rules := []Rule{{Priority: 1, Action: "accept", CommunityID: wild}}
+	prefixes := map[string][]string{"c1": {"1.2.3.0/24"}}
+	got := Evaluate("client1", rules, prefixes)
+	if len(got) != 0 {
+		t.Fatalf("accept alone must not block, got %v", got)
+	}
+}
+
+func TestEvaluate_explicitBlock(t *testing.T) {
+	cid := "c1"
+	rules := []Rule{{Priority: 1, Action: "block", CommunityID: &cid}}
+	prefixes := map[string][]string{"c1": {"1.2.3.0/24", "5.6.7.8/32"}, "c2": {"9.9.9.9/32"}}
+	got := Evaluate("client1", rules, prefixes)
+	if len(got) != 2 {
+		t.Fatalf("expected 2 prefixes, got %v", got)
+	}
+}
+
+func TestEvaluate_clientOverrideAccept(t *testing.T) {
+	wild := (*string)(nil)
+	cTrusted := "trusted"
+	clientID := "srv1"
+	rules := []Rule{
+		{Priority: 1, Action: "block", CommunityID: wild},
+		{ClientID: &clientID, Priority: 1, Action: "accept", CommunityID: &cTrusted},
+	}
+	prefixes := map[string][]string{
+		"trusted": {"1.1.1.0/24"},
+		"bad":     {"2.2.2.0/24"},
+	}
+	got := Evaluate(clientID, rules, prefixes)
+	if len(got) != 1 || got[0] != "2.2.2.0/24" {
+		t.Fatalf("expected only bad community, got %v", got)
+	}
+}
+
+func TestEvaluate_clientOverrideWins(t *testing.T) {
+	cid := "c1"
+	clientID := "srv1"
+	rules := []Rule{
+		{Priority: 1, Action: "accept", CommunityID: &cid},
+		{ClientID: &clientID, Priority: 1, Action: "block", CommunityID: &cid},
+	}
+	prefixes := map[string][]string{"c1": {"1.2.3.0/24"}}
+	got := Evaluate(clientID, rules, prefixes)
+	if len(got) != 1 {
+		t.Fatalf("client override should block, got %v", got)
+	}
+}
+
+func TestEvaluate_noCommunityKey(t *testing.T) {
+	empty := ""
+	rules := []Rule{{Priority: 1, Action: "block", CommunityID: &empty}}
+	prefixes := map[string][]string{"": {"10.0.0.0/8"}}
+	got := Evaluate("c", rules, prefixes)
+	if len(got) != 1 {
+		t.Fatalf("expected prefix without community, got %v", got)
+	}
+}

internal/firewallscripts/embed.go

@@ -0,0 +1,10 @@
+// Package firewallscripts embeds bash installers served by GET /v1/firewall/install.sh.
+// Источник правды — scripts/firewall/; при изменении скопируйте файлы сюда или запустите:
+//
+//	go generate ./internal/firewallscripts/...
+package firewallscripts
+
+import "embed"
+
+//go:embed install.sh evobgp-firewall.sh uninstall.sh
+var FS embed.FS

internal/firewallscripts/evobgp-firewall.sh

@@ -0,0 +1,365 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+CONF_FILE=/etc/evobgp/firewall.conf
+LOG_FILE=/var/log/evobgp-firewall.log
+STATE_DIR=/var/lib/evobgp-firewall
+HASH_FILE="${STATE_DIR}/last_hash"
+PREFIX_FILE="${STATE_DIR}/last_prefixes.txt"
+
+log() { echo "$(date -u +%Y-%m-%dT%H:%M:%SZ) $*" | tee -a "$LOG_FILE"; }
+
+if [[ ! -f "$CONF_FILE" ]]; then
+  log "missing $CONF_FILE"
+  exit 1
+fi
+# shellcheck disable=SC1090
+source "$CONF_FILE"
+
+: "${EVOBGP_CP_URL:?}"
+: "${CLIENT_TOKEN:?}"
+CLIENT_TOKEN="${CLIENT_TOKEN//$'\r'/}"
+CLIENT_TOKEN="${CLIENT_TOKEN//$'\n'/}"
+
+mkdir -p "$STATE_DIR"
+BACKEND="${KERNEL_BACKEND:-auto}"
+
+curl_get_blocklist_file() {
+  local url="$1"
+  local dest="$2"
+  local code
+  code=$(curl -sS -o "$dest" -w "%{http_code}" \
+    -H "Authorization: Bearer ${CLIENT_TOKEN}" \
+    -H "Accept: application/json" \
+    "${url}/v1/firewall/blocklist") || return 1
+  if [[ "$code" == "403" ]]; then
+    log "pending approval"
+    return 2
+  fi
+  if [[ "$code" != "200" ]]; then
+    log "blocklist HTTP $code from $url"
+    return 1
+  fi
+  return 0
+}
+
+try_fetch_blocklist() {
+  local urls=()
+  if [[ -n "${EVOBGP_FAILOVER_URLS:-}" ]]; then
+    IFS=',' read -r -a urls <<<"$EVOBGP_FAILOVER_URLS"
+  else
+    urls=("${EVOBGP_CP_URL%/}")
+  fi
+  local u
+  for u in "${urls[@]}"; do
+    u="${u// /}"
+    u="${u%/}"
+    local rc=0
+    curl_get_blocklist_file "$u" "$PREFIX_FILE" || rc=$?
+    if [[ "$rc" == 2 ]]; then
+      exit 0
+    fi
+    if [[ "$rc" == 0 ]]; then
+      CP_HIT="$u"
+      return 0
+    fi
+  done
+  return 1
+}
+
+parse_blocklist_file() {
+  local f="$1"
+  if [[ ! -s "$f" ]]; then
+    log "blocklist file empty: $f"
+    return 1
+  fi
+  if command -v jq >/dev/null 2>&1; then
+    HASH=$(jq -r '.hash // empty' "$f")
+    TOTAL=$(jq -r '.total // 0' "$f")
+    mapfile -t PREFIXES < <(jq -r '.prefixes[]? // empty' "$f")
+    return 0
+  fi
+  if command -v python3 >/dev/null 2>&1; then
+    local parsed
+    parsed=$(python3 - "$f" <<'PY'
+import json, sys
+with open(sys.argv[1], encoding="utf-8") as fh:
+    data = json.load(fh)
+print(data.get("hash") or "")
+print(data.get("total") or 0)
+for p in data.get("prefixes") or []:
+    if p:
+        print(p)
+PY
+    )
+    HASH=$(echo "$parsed" | sed -n '1p')
+    TOTAL=$(echo "$parsed" | sed -n '2p')
+    mapfile -t PREFIXES < <(echo "$parsed" | sed -n '3,$p')
+    return 0
+  fi
+  HASH=$(grep -o '"hash"[[:space:]]*:[[:space:]]*"[^"]*"' "$f" | head -1 | sed 's/.*"\(sha256:[^"]*\)".*/\1/')
+  TOTAL=$(grep -o '"total"[[:space:]]*:[[:space:]]*[0-9]*' "$f" | head -1 | grep -o '[0-9]*$' || true)
+  mapfile -t PREFIXES < <(grep -oE '"[0-9]+(\.[0-9]+){3}/[0-9]+"' "$f" | tr -d '"' || true)
+  return 0
+}
+
+nft_join_elements() {
+  local out="" p
+  for p in "$@"; do
+    if [[ -n "$out" ]]; then
+      out+=", "
+    fi
+    out+="$p"
+  done
+  printf '%s' "$out"
+}
+
+nft_add_v4_chunk() {
+  local table=$1 name=$2
+  shift 2
+  local joined
+  joined=$(nft_join_elements "$@")
+  if nft add element "$table" "$name" v4 "{ ${joined} }" 2>>"$LOG_FILE"; then
+    return 0
+  fi
+  log "nft batch add failed (chunk=$#), retrying one-by-one"
+  local p ok=0
+  for p in "$@"; do
+    if nft add element "$table" "$name" v4 "{ $p }" 2>>"$LOG_FILE"; then
+      ok=$((ok + 1))
+    fi
+  done
+  [[ "$ok" -gt 0 ]]
+}
+
+if ! try_fetch_blocklist; then
+  log "all endpoints failed"
+  exit 1
+fi
+
+HASH=""
+TOTAL=0
+PREFIXES=()
+parse_blocklist_file "$PREFIX_FILE"
+log "blocklist bytes=$(wc -c <"$PREFIX_FILE" | tr -d ' ') parsed=${#PREFIXES[@]} api_total=${TOTAL:-0}"
+
+if [[ -z "${TOTAL// }" ]]; then
+  TOTAL=${#PREFIXES[@]}
+fi
+
+PACKETS_DROPPED=0
+PACKETS_ACCEPTED=0
+KERNEL_METHOD=""
+APPLIED_V4=0
+
+count_ipv4_prefixes() {
+  local n=0 p
+  for p in "${PREFIXES[@]}"; do
+    [[ "$p" == *:* ]] && continue
+    n=$((n + 1))
+  done
+  APPLIED_V4=$n
+}
+
+nft_rule_packets() {
+  local line=$1
+  if [[ "$line" =~ counter[[:space:]]+packets[[:space:]]+([0-9]+) ]]; then
+    echo "${BASH_REMATCH[1]}"
+  else
+    echo 0
+  fi
+}
+
+ensure_nft_counters() {
+  local table=inet name=evobgp_blocklist
+  nft list chain "$table" "$name" input >/dev/null 2>&1 || return 0
+  local drop_line
+  drop_line=$(nft -a list chain "$table" "$name" input 2>/dev/null | grep 'ip saddr @v4' | grep drop | head -1 || true)
+  if [[ -n "$drop_line" && "$drop_line" != *counter* ]]; then
+    local handle
+    handle=$(echo "$drop_line" | sed -n 's/.*# handle \([0-9]\+\).*/\1/p')
+    if [[ -n "$handle" ]]; then
+      nft delete rule "$table" "$name" input handle "$handle" 2>>"$LOG_FILE" || true
+      drop_line=""
+    fi
+  fi
+  if [[ -z "$drop_line" ]]; then
+    nft add rule "$table" "$name" input ip saddr @v4 counter drop
+  fi
+  if ! nft list chain "$table" "$name" input 2>/dev/null | grep -qE '[[:space:]]counter[[:space:]]+accept'; then
+    nft add rule "$table" "$name" input counter accept
+  fi
+}
+
+collect_nft_packet_stats() {
+  PACKETS_DROPPED=0
+  PACKETS_ACCEPTED=0
+  local line pkts
+  while IFS= read -r line; do
+    if [[ "$line" == *"ip saddr @v4"* && "$line" == *drop* ]]; then
+      pkts=$(nft_rule_packets "$line")
+      [[ -n "$pkts" ]] && PACKETS_DROPPED=$pkts
+    elif [[ "$line" == *counter* && "$line" == *accept* && "$line" != *@v4* ]]; then
+      pkts=$(nft_rule_packets "$line")
+      [[ -n "$pkts" ]] && PACKETS_ACCEPTED=$pkts
+    fi
+  done < <(nft list chain inet evobgp_blocklist input 2>/dev/null || true)
+}
+
+collect_ipset_packet_stats() {
+  PACKETS_DROPPED=0
+  PACKETS_ACCEPTED=0
+  local pkts
+  pkts=$(iptables -L INPUT -v -n -x 2>/dev/null | awk '/match-set evobgp_blocklist_v4/ {print $1; exit}')
+  [[ "$pkts" =~ ^[0-9]+$ ]] && PACKETS_DROPPED=$pkts
+}
+
+collect_packet_stats() {
+  case "${KERNEL_METHOD:-$BACKEND}" in
+    nft)
+      ensure_nft_counters
+      collect_nft_packet_stats
+      ;;
+    ipset)
+      collect_ipset_packet_stats
+      ;;
+    iptables)
+      PACKETS_DROPPED=$(iptables -L INPUT -v -n -x 2>/dev/null | awk '/DROP/ {s+=$1} END {print s+0}')
+      PACKETS_ACCEPTED=0
+      ;;
+    *)
+      if command -v nft >/dev/null 2>&1 && nft list chain inet evobgp_blocklist input >/dev/null 2>&1; then
+        KERNEL_METHOD=nft
+        ensure_nft_counters
+        collect_nft_packet_stats
+      elif iptables -L INPUT -v -n -x 2>/dev/null | grep -q 'evobgp_blocklist_v4'; then
+        KERNEL_METHOD=ipset
+        collect_ipset_packet_stats
+      fi
+      ;;
+  esac
+}
+
+send_client_reports() {
+  collect_packet_stats
+  local km="${KERNEL_METHOD:-$BACKEND}"
+  local report
+  report=$(printf '{"status":"ok","prefix_count":%s,"ip_count":%s,"packets_dropped":%s,"packets_accepted":%s,"source":"cp","kernel_method":"%s"}' \
+    "${TOTAL:-0}" "${APPLIED_V4:-0}" "${PACKETS_DROPPED:-0}" "${PACKETS_ACCEPTED:-0}" "$km")
+  curl -fsS -X POST "${EVOBGP_CP_URL%/}/v1/firewall/apply-report" \
+    -H "Authorization: Bearer ${CLIENT_TOKEN}" \
+    -H "Content-Type: application/json" \
+    -d "$report" >/dev/null 2>&1 || true
+  curl -fsS -X POST "${EVOBGP_CP_URL%/}/v1/firewall/heartbeat" \
+    -H "Authorization: Bearer ${CLIENT_TOKEN}" \
+    -H "Content-Type: application/json" \
+    -d '{"source":"cp"}' >/dev/null 2>&1 || true
+}
+
+if [[ -f "$HASH_FILE" && "$(tr -d '\r\n' <"$HASH_FILE")" == "$HASH" && -n "$HASH" ]]; then
+  count_ipv4_prefixes
+  log "unchanged hash $HASH — skip kernel apply (ipv4=${APPLIED_V4})"
+  send_client_reports
+  exit 0
+fi
+
+apply_nft() {
+  local table=inet
+  local name=evobgp_blocklist
+  local v4=()
+  local p
+  for p in "${PREFIXES[@]}"; do
+    [[ "$p" == *:* ]] && continue
+    v4+=("$p")
+  done
+
+  nft list table "$table" "$name" >/dev/null 2>&1 || nft add table "$table" "$name"
+  nft list set "$table" "$name" v4 >/dev/null 2>&1 || \
+    nft add set "$table" "$name" v4 '{ type ipv4_addr; flags interval; }'
+  nft flush set "$table" "$name" v4
+
+  if ((${#v4[@]})); then
+    local batch=()
+    local chunk=64
+    for p in "${v4[@]}"; do
+      batch+=("$p")
+      if ((${#batch[@]} >= chunk)); then
+        nft_add_v4_chunk "$table" "$name" "${batch[@]}" || log "nft chunk add partial failure"
+        batch=()
+      fi
+    done
+    if ((${#batch[@]})); then
+      nft_add_v4_chunk "$table" "$name" "${batch[@]}" || log "nft tail chunk add partial failure"
+    fi
+  fi
+
+  nft list chain "$table" "$name" input >/dev/null 2>&1 || {
+    nft add chain "$table" "$name" input '{ type filter hook input priority 0; policy accept; }'
+    nft add rule "$table" "$name" input ip saddr @v4 counter drop
+    nft add rule "$table" "$name" input counter accept
+  }
+  ensure_nft_counters
+  KERNEL_METHOD=nft
+  APPLIED_V4=${#v4[@]}
+}
+
+apply_ipset() {
+  local set=evobgp_blocklist_v4
+  local n=0
+  ipset list "$set" >/dev/null 2>&1 || ipset create "$set" hash:net family inet hashsize 4096 maxelem 1048576
+  ipset flush "$set"
+  local p
+  for p in "${PREFIXES[@]}"; do
+    [[ "$p" == *:* ]] && continue
+    ipset add "$set" "$p" -exist
+    n=$((n + 1))
+  done
+  iptables -C INPUT -m set --match-set "$set" src -j DROP 2>/dev/null || \
+    iptables -I INPUT -m set --match-set "$set" src -j DROP
+  KERNEL_METHOD=ipset
+  APPLIED_V4=$n
+}
+
+apply_iptables_only() {
+  iptables -D INPUT -m comment --comment evobgp-block -j DROP 2>/dev/null || true
+  local n=0
+  local p
+  for p in "${PREFIXES[@]}"; do
+    [[ "$p" == *:* ]] && continue
+    iptables -C INPUT -s "$p" -j DROP 2>/dev/null || iptables -A INPUT -s "$p" -j DROP
+    n=$((n + 1))
+  done
+  KERNEL_METHOD=iptables
+  APPLIED_V4=$n
+}
+
+clear_block() {
+  case "$BACKEND" in
+    nft) nft delete table inet evobgp_blocklist 2>/dev/null || true ;;
+    ipset)
+      ipset destroy evobgp_blocklist_v4 2>/dev/null || true
+      iptables -D INPUT -m set --match-set evobgp_blocklist_v4 src -j DROP 2>/dev/null || true
+      ;;
+    iptables) iptables -S INPUT | grep -i evobgp | sed 's/^-A /-D /' | while read -r line; do iptables $line 2>/dev/null || true; done ;;
+  esac
+  APPLIED_V4=0
+  KERNEL_METHOD="${BACKEND:-auto}"
+}
+
+APPLIED_V4=0
+KERNEL_METHOD=""
+if [[ "${TOTAL:-0}" == "0" || ${#PREFIXES[@]} -eq 0 ]]; then
+  clear_block
+  log "cleared blocklist (api total=${TOTAL:-0}) backend=$BACKEND"
+else
+  case "$BACKEND" in
+    nft|auto) if command -v nft >/dev/null 2>&1; then apply_nft; else apply_ipset; fi ;;
+    ipset) apply_ipset ;;
+    iptables) apply_iptables_only ;;
+    *) apply_ipset ;;
+  esac
+  log "applied api_total=${TOTAL} ipv4_in_kernel=${APPLIED_V4} from ${CP_HIT:-$EVOBGP_CP_URL} backend=$BACKEND hash=${HASH:-empty}"
+fi
+
+echo "$HASH" >"$HASH_FILE"
+send_client_reports

internal/firewallscripts/install.sh

@@ -0,0 +1,129 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [[ "${EUID:-$(id -u)}" -ne 0 ]]; then
+  echo "evobgp-firewall install: run as root" >&2
+  exit 1
+fi
+
+for cmd in curl bash; do
+  command -v "$cmd" >/dev/null 2>&1 || { echo "missing $cmd" >&2; exit 1; }
+done
+
+if ! command -v jq >/dev/null 2>&1 && ! command -v python3 >/dev/null 2>&1; then
+  if command -v apt-get >/dev/null 2>&1; then
+    apt-get update -qq && apt-get install -y -qq jq
+  fi
+fi
+if ! command -v jq >/dev/null 2>&1 && ! command -v python3 >/dev/null 2>&1; then
+  echo "evobgp-firewall install: install jq or python3 for blocklist JSON parsing" >&2
+  exit 1
+fi
+
+: "${EVOBGP_CP_URL:?EVOBGP_CP_URL required}"
+: "${EVOBGP_SEED:?EVOBGP_SEED required}"
+: "${EVOBGP_CLIENT_NAME:?EVOBGP_CLIENT_NAME required}"
+
+CONF_DIR=/etc/evobgp
+CONF_FILE="${CONF_DIR}/firewall.conf"
+SYNC_SCRIPT=/usr/local/sbin/evobgp-firewall.sh
+
+if [[ -f "$CONF_FILE" && "${EVOBGP_INSTALL_FORCE:-}" != "1" ]]; then
+  echo "Already installed ($CONF_FILE). Set EVOBGP_INSTALL_FORCE=1 to reinstall." >&2
+  exit 1
+fi
+
+gen_token() {
+  if command -v openssl >/dev/null 2>&1; then
+    echo -n "evobgp_fw_$(openssl rand -base64 32 | tr '+/' '-_' | tr -d '=')"
+  else
+    echo -n "evobgp_fw_$(head -c 32 /dev/urandom | base64 | tr '+/' '-_' | tr -d '=\n')"
+  fi
+}
+
+CLIENT_TOKEN="$(gen_token)"
+HOSTNAME="$(hostname -f 2>/dev/null || hostname)"
+CP_URL="${EVOBGP_CP_URL%/}"
+
+ENROLL_BODY=$(printf '{"name":"%s","hostname":"%s","client_token":"%s","client_version":"install.sh/1"}' \
+  "$EVOBGP_CLIENT_NAME" "$HOSTNAME" "$CLIENT_TOKEN")
+
+ENROLL_TMP=$(mktemp)
+trap 'rm -f "$ENROLL_TMP"' EXIT
+ENROLL_CODE=$(curl -sS -o "$ENROLL_TMP" -w "%{http_code}" -X POST "${CP_URL}/v1/firewall/enroll" \
+  -H "Content-Type: application/json" \
+  -H "X-EvoBGP-Seed: ${EVOBGP_SEED}" \
+  -d "$ENROLL_BODY")
+if [[ "$ENROLL_CODE" != "201" ]]; then
+  echo "evobgp-firewall enroll failed: HTTP ${ENROLL_CODE} from ${CP_URL}/v1/firewall/enroll" >&2
+  cat "$ENROLL_TMP" >&2
+  exit 1
+fi
+RESP=$(cat "$ENROLL_TMP")
+
+CLIENT_ID=""
+if command -v jq >/dev/null 2>&1; then
+  CLIENT_ID=$(echo "$RESP" | jq -r '.client_id')
+else
+  CLIENT_ID=$(echo "$RESP" | sed -n 's/.*"client_id"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p')
+fi
+
+mkdir -p "$CONF_DIR"
+chmod 700 "$CONF_DIR"
+cat >"$CONF_FILE" <<EOF
+EVOBGP_CP_URL=${CP_URL}
+CLIENT_ID=${CLIENT_ID}
+CLIENT_TOKEN=${CLIENT_TOKEN}
+CLIENT_NAME=${EVOBGP_CLIENT_NAME}
+KERNEL_BACKEND=auto
+EOF
+chmod 600 "$CONF_FILE"
+
+curl -fsSL "${CP_URL}/v1/firewall/sync-script" -o "$SYNC_SCRIPT"
+chmod 755 "$SYNC_SCRIPT"
+
+if command -v nft >/dev/null 2>&1; then
+  BACKEND=nft
+elif command -v ipset >/dev/null 2>&1 && command -v iptables >/dev/null 2>&1; then
+  BACKEND=ipset
+elif command -v iptables >/dev/null 2>&1; then
+  BACKEND=iptables
+else
+  echo "no supported firewall backend (nft/ipset/iptables)" >&2
+  exit 1
+fi
+sed -i "s/^KERNEL_BACKEND=.*/KERNEL_BACKEND=${BACKEND}/" "$CONF_FILE" 2>/dev/null || \
+  echo "KERNEL_BACKEND=${BACKEND}" >>"$CONF_FILE"
+
+INTERVAL="${EVOBGP_SYNC_INTERVAL:-5min}"
+if command -v systemctl >/dev/null 2>&1; then
+  cat >/etc/systemd/system/evobgp-firewall.service <<'UNIT'
+[Unit]
+Description=EvoBGP firewall blocklist sync
+After=network-online.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/sbin/evobgp-firewall.sh
+UNIT
+  cat >/etc/systemd/system/evobgp-firewall.timer <<UNIT
+[Unit]
+Description=EvoBGP firewall sync timer
+
+[Timer]
+OnBootSec=2min
+OnUnitActiveSec=${INTERVAL}
+Unit=evobgp-firewall.service
+
+[Install]
+WantedBy=timers.target
+UNIT
+  systemctl daemon-reload
+  systemctl enable --now evobgp-firewall.timer
+  echo "Tip: after UI approve, run: rm -f /var/lib/evobgp-firewall/last_hash && ${SYNC_SCRIPT}"
+else
+  echo "*/5 * * * * root ${SYNC_SCRIPT}" >/etc/cron.d/evobgp-firewall
+fi
+
+echo "Client ID: ${CLIENT_ID}"
+echo "Status: pending — approve in EvoBGP UI → Firewall → Запросы"

internal/firewallscripts/sync_test.go

@@ -0,0 +1,34 @@
+package firewallscripts
+
+import (
+	"bytes"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestScriptsMatchRepoSource(t *testing.T) {
+	root := filepath.Join("..", "..", "scripts", "firewall")
+	for _, name := range []string{"install.sh", "evobgp-firewall.sh", "uninstall.sh"} {
+		embedded, err := FS.ReadFile(name)
+		if err != nil {
+			t.Fatalf("embedded %s: %v", name, err)
+		}
+		source, err := os.ReadFile(filepath.Join(root, name))
+		if err != nil {
+			t.Skipf("source %s not found (cwd=%s): %v", name, mustWd(t), err)
+		}
+		if !bytes.Equal(embedded, source) {
+			t.Fatalf("%s drift: copy scripts/firewall/%s to internal/firewallscripts/", name, name)
+		}
+	}
+}
+
+func mustWd(t *testing.T) string {
+	t.Helper()
+	wd, err := os.Getwd()
+	if err != nil {
+		t.Fatal(err)
+	}
+	return wd
+}

internal/firewallscripts/uninstall.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+systemctl disable --now evobgp-firewall.timer 2>/dev/null || true
+rm -f /etc/cron.d/evobgp-firewall
+rm -f /etc/systemd/system/evobgp-firewall.service /etc/systemd/system/evobgp-firewall.timer
+systemctl daemon-reload 2>/dev/null || true
+
+nft delete table inet evobgp_blocklist 2>/dev/null || true
+ipset destroy evobgp_blocklist_v4 2>/dev/null || true
+iptables -D INPUT -m set --match-set evobgp_blocklist_v4 src -j DROP 2>/dev/null || true
+
+rm -f /usr/local/sbin/evobgp-firewall.sh /usr/local/sbin/evobgp-firewall-uninstall.sh
+rm -rf /var/lib/evobgp-firewall
+if [[ "${EVOBGP_UNINSTALL_REMOVE_CONF:-}" == "1" ]]; then
+  rm -f /etc/evobgp/firewall.conf
+fi
+
+echo "evobgp-firewall uninstalled"

internal/httpapi/auth.go

@@ -4,6 +4,8 @@ import (
 	"context"
 	"net/http"
 	"strings"
+
+	"evobgp/internal/authkey"
 )
 
 type ctxKey int
@@ -63,27 +65,51 @@ func (s *Server) authMiddleware(next http.Handler) http.Handler {
 			return
 		}
 		raw := strings.TrimSpace(strings.TrimPrefix(h, p))
-		if raw == "dev" {
-			if a, ok := s.devAuth(); ok {
-				r = r.WithContext(context.WithValue(r.Context(), authCtxKey, a))
-				next.ServeHTTP(w, r)
-				return
-			}
-		}
-		matched, ok := s.keyResolver.Lookup(raw)
+		a, ok := s.resolveAuth(raw)
 		if !ok {
 			writeProblem(w, http.StatusUnauthorized, "Unauthorized", "unknown api key")
 			return
 		}
-		a := Auth{TenantID: matched.tenantID, Role: matched.role, Token: raw, APIKeyID: matched.keyID}
-		if matched.keyID != "" {
-			go func(id string) { _ = s.store.TouchAPIKeyLastUsed(id) }(matched.keyID)
+		if a.APIKeyID != "" {
+			go func(id string) { _ = s.store.TouchAPIKeyLastUsed(id) }(a.APIKeyID)
 		}
 		r = r.WithContext(context.WithValue(r.Context(), authCtxKey, a))
 		next.ServeHTTP(w, r)
 	})
 }
 
+func authFromKeyRecord(raw string, rec apiKeyRecord) Auth {
+	return Auth{TenantID: rec.tenantID, Role: rec.role, Token: raw, APIKeyID: rec.keyID}
+}
+
+// resolveAuth maps a bearer token to tenant identity.
+// For the literal token "dev", the demo shortcut (devAuth) takes precedence when demo-seed
+// is available; env/DB mapping is used only when demo tenant is absent.
+func (s *Server) resolveAuth(raw string) (Auth, bool) {
+	if raw == "dev" {
+		if a, ok := s.devAuth(); ok {
+			return a, true
+		}
+		if rec, ok := s.keyResolver.Lookup(raw); ok {
+			return authFromKeyRecord(raw, rec), true
+		}
+		return Auth{}, false
+	}
+	rec, ok := s.keyResolver.Lookup(raw)
+	if !ok {
+		if s.firewallResolver != nil {
+			if fw, ok := s.firewallResolver.Lookup(raw); ok {
+				return Auth{TenantID: fw.tenantID, Role: "firewall", Token: raw, APIKeyID: fw.clientID}, true
+			}
+		}
+		if client, err := s.store.LookupFirewallClientByTokenHash(authkey.HashToken(raw)); err == nil {
+			return Auth{TenantID: client.TenantID, Role: "firewall", Token: raw, APIKeyID: client.ID}, true
+		}
+		return Auth{}, false
+	}
+	return authFromKeyRecord(raw, rec), true
+}
+
 func (s *Server) devAuth() (Auth, bool) {
 	tid, _, _, _, _ := s.store.DemoIDs()
 	if tid == "" {
@@ -118,6 +144,14 @@ func (s *Server) requireAtLeast(w http.ResponseWriter, a Auth, need string) bool
 	return true
 }
 
+func (s *Server) requireFirewall(w http.ResponseWriter, a Auth) bool {
+	if strings.ToLower(a.Role) != "firewall" {
+		writeProblem(w, http.StatusForbidden, "Forbidden", "firewall client role required")
+		return false
+	}
+	return true
+}
+
 func (s *Server) requireNode(w http.ResponseWriter, a Auth) bool {
 	if strings.ToLower(a.Role) != "node" {
 		writeProblem(w, http.StatusForbidden, "Forbidden", "node role required")

internal/httpapi/auth_dev_settings_test.go

@@ -0,0 +1,101 @@
+package httpapi
+
+import (
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+func TestBearerDevGetSettings(t *testing.T) {
+	srv, err := New(Options{SeedDemo: true, BundleSeedHex: testBundleSeed})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer srv.Close()
+
+	ts := httptest.NewServer(srv.Handler())
+	defer ts.Close()
+
+	req, _ := http.NewRequest(http.MethodGet, ts.URL+"/v1/settings", nil)
+	req.Header.Set("Authorization", "Bearer dev")
+	resp, err := ts.Client().Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+	if resp.StatusCode != http.StatusOK {
+		b, _ := io.ReadAll(resp.Body)
+		t.Fatalf("status=%d body=%s", resp.StatusCode, b)
+	}
+}
+
+func TestBearerDevPrefersDemoTenantOverEnvKey(t *testing.T) {
+	srv, err := New(Options{SeedDemo: true, BundleSeedHex: testBundleSeed})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer srv.Close()
+
+	demoTenant, _, _, _, _ := srv.Store().DemoIDs()
+	otherTenant := "00000000-0000-4000-8000-000000000001"
+	mustSetTestAPIKeys(t, srv, "dev|"+otherTenant+"|operator")
+
+	ts := httptest.NewServer(srv.Handler())
+	defer ts.Close()
+
+	req, _ := http.NewRequest(http.MethodGet, ts.URL+"/v1/auth/session", nil)
+	req.Header.Set("Authorization", "Bearer dev")
+	resp, err := ts.Client().Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+	if resp.StatusCode != http.StatusOK {
+		b, _ := io.ReadAll(resp.Body)
+		t.Fatalf("session status=%d body=%s", resp.StatusCode, b)
+	}
+	var body map[string]any
+	if err := json.NewDecoder(resp.Body).Decode(&body); err != nil {
+		t.Fatal(err)
+	}
+	got, _ := body["tenant_id"].(string)
+	if got != demoTenant {
+		t.Fatalf("tenant_id=%q want demo tenant %q (env=%q)", got, demoTenant, otherTenant)
+	}
+}
+
+func TestBearerDevFallsBackToEnvKeyWithoutDemo(t *testing.T) {
+	srv, err := New(Options{SeedDemo: false, BundleSeedHex: testBundleSeed})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer srv.Close()
+
+	otherTenant := "00000000-0000-4000-8000-000000000001"
+	mustSetTestAPIKeys(t, srv, "dev|"+otherTenant+"|operator")
+
+	ts := httptest.NewServer(srv.Handler())
+	defer ts.Close()
+
+	req, _ := http.NewRequest(http.MethodGet, ts.URL+"/v1/auth/session", nil)
+	req.Header.Set("Authorization", "Bearer dev")
+	resp, err := ts.Client().Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+	if resp.StatusCode != http.StatusOK {
+		b, _ := io.ReadAll(resp.Body)
+		t.Fatalf("session status=%d body=%s", resp.StatusCode, b)
+	}
+	var body map[string]any
+	if err := json.NewDecoder(resp.Body).Decode(&body); err != nil {
+		t.Fatal(err)
+	}
+	got, _ := body["tenant_id"].(string)
+	if got != otherTenant {
+		t.Fatalf("tenant_id=%q want env key tenant %q", got, otherTenant)
+	}
+}

internal/httpapi/firewall_replicate.go

@@ -0,0 +1,118 @@
+package httpapi
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"io"
+	"log"
+	"net/http"
+	"strings"
+	"time"
+
+	"evobgp/internal/nodedispatch"
+	"evobgp/internal/store"
+)
+
+func (s *Server) replicateFirewallStateToSpeakers(tenantID string) {
+	if !nodedispatch.Enabled() {
+		return
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 45*time.Second)
+	defer cancel()
+
+	clients, err := s.store.ListApprovedFirewallClientsForReplication(tenantID)
+	if err != nil {
+		log.Printf("httpapi: firewall replicate clients: %v", err)
+		return
+	}
+	rules, err := s.store.ListAllFirewallRulesForReplication(tenantID)
+	if err != nil {
+		log.Printf("httpapi: firewall replicate rules: %v", err)
+		return
+	}
+	revs, _, _ := s.store.ListRevisions(tenantID, "", "", 1)
+	if len(revs) == 0 {
+		return
+	}
+	revID := revs[0].ID
+	prefixesByCommunity, _, err := s.loadPrefixesByCommunity(tenantID, revID)
+	if err != nil {
+		log.Printf("httpapi: firewall replicate prefixes: %v", err)
+		return
+	}
+
+	payloadRules := make([]map[string]any, 0, len(rules))
+	for _, r := range rules {
+		payloadRules = append(payloadRules, map[string]any{
+			"client_id":    r.ClientID,
+			"priority":     r.Priority,
+			"action":       r.Action,
+			"community_id": r.CommunityID,
+		})
+	}
+	payloadClients := make([]map[string]any, 0, len(clients))
+	for _, c := range clients {
+		payloadClients = append(payloadClients, map[string]any{
+			"token_hash_hex": c.TokenHashHex,
+			"client_id":      c.ClientID,
+			"name":           c.Name,
+		})
+	}
+	body := map[string]any{
+		"tenant_id":             tenantID,
+		"revision_id":           revID,
+		"generated_at":          time.Now().UTC().Format(time.RFC3339),
+		"clients":               payloadClients,
+		"rules":                 payloadRules,
+		"prefixes_by_community": prefixesByCommunity,
+	}
+
+	speakers := s.store.ListSpeakersForTenant(tenantID)
+	for _, sp := range speakers {
+		meta := store.ParseSpeakerMeta(sp.MetaJSON)
+		if !store.SpeakerNeedsRemoteDispatch(sp.Role, meta) || !meta.FirewallFailover {
+			continue
+		}
+		domain := strings.TrimSpace(meta.AgentDomain)
+		if domain == "" {
+			continue
+		}
+		url := "https://" + strings.TrimSuffix(domain, "/") + "/v1/agent/firewall-replicate"
+		status, errMsg := postFirewallReplicate(ctx, url, meta.AgentSecret, body)
+		patch := store.SpeakerMeta{
+			LastFirewallReplicateAt:     time.Now().UTC().Format(time.RFC3339Nano),
+			LastFirewallReplicateStatus: status,
+			LastFirewallReplicateError:  errMsg,
+		}
+		merged := store.MergeSpeakerMetaJSON(sp.MetaJSON, patch)
+		mp := merged
+		if _, err := s.store.UpdateSpeaker(tenantID, sp.ID, &store.SpeakerPatch{MetaJSON: &mp}); err != nil {
+			log.Printf("httpapi: firewall replicate meta update %s: %v", sp.ID, err)
+		}
+	}
+}
+
+func postFirewallReplicate(ctx context.Context, url, secret string, body map[string]any) (status, errMsg string) {
+	b, err := json.Marshal(body)
+	if err != nil {
+		return "error", err.Error()
+	}
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, url, bytes.NewReader(b))
+	if err != nil {
+		return "error", err.Error()
+	}
+	req.Header.Set("Authorization", "Bearer "+strings.TrimSpace(secret))
+	req.Header.Set("Content-Type", "application/json")
+	client := &http.Client{Timeout: 30 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		return "error", err.Error()
+	}
+	defer func() { _ = resp.Body.Close() }()
+	_, _ = io.Copy(io.Discard, resp.Body)
+	if resp.StatusCode >= 200 && resp.StatusCode < 300 {
+		return "ok", ""
+	}
+	return "error", resp.Status
+}

internal/httpapi/firewall_resolver.go

@@ -0,0 +1,57 @@
+package httpapi
+
+import (
+	"encoding/hex"
+	"sync"
+
+	"evobgp/internal/authkey"
+	"evobgp/internal/store"
+)
+
+type firewallAuthRow struct {
+	tenantID string
+	clientID string
+}
+
+type firewallTokenResolver struct {
+	mu     sync.RWMutex
+	byHash map[string]firewallAuthRow
+}
+
+func newFirewallTokenResolver(st store.Backend) (*firewallTokenResolver, error) {
+	r := &firewallTokenResolver{byHash: make(map[string]firewallAuthRow)}
+	return r, r.reloadFromStore(st)
+}
+
+func (r *firewallTokenResolver) reloadFromStore(st store.Backend) error {
+	rows, err := st.ListActiveFirewallClientHashes()
+	if err != nil {
+		return err
+	}
+	byHash := make(map[string]firewallAuthRow, len(rows))
+	for _, row := range rows {
+		if len(row.TokenHash) != 32 {
+			continue
+		}
+		byHash[hex.EncodeToString(row.TokenHash)] = firewallAuthRow{
+			tenantID: row.TenantID,
+			clientID: row.ID,
+		}
+	}
+	r.mu.Lock()
+	r.byHash = byHash
+	r.mu.Unlock()
+	return nil
+}
+
+func (r *firewallTokenResolver) Reload(st store.Backend) error {
+	return r.reloadFromStore(st)
+}
+
+func (r *firewallTokenResolver) Lookup(raw string) (firewallAuthRow, bool) {
+	hash := authkey.HashToken(raw)
+	r.mu.RLock()
+	defer r.mu.RUnlock()
+	rec, ok := r.byHash[hex.EncodeToString(hash)]
+	return rec, ok
+}

internal/httpapi/routes.go

@@ -35,6 +35,9 @@ func (s *Server) Handler() http.Handler {
 	s.mux.HandleFunc("GET /v1/health", s.handleHealth)
 	s.mux.HandleFunc("GET /v1/ready", s.handleReady)
 	s.mux.HandleFunc("GET /v1/version", s.handleVersion)
+	s.mux.HandleFunc("POST /v1/firewall/enroll", s.handleFirewallEnrollPublic)
+	s.mux.HandleFunc("GET /v1/firewall/install.sh", s.handleFirewallInstallScript)
+	s.mux.HandleFunc("GET /v1/firewall/sync-script", s.handleFirewallSyncScript)
 	s.mux.Handle("/v1/", s.authMiddleware(wrappedV1))
 	return s.withCORS(observability.HTTPMiddleware(s.mux))
 }
@@ -82,6 +85,7 @@ func (s *Server) registerV1(m *http.ServeMux) {
 	s.registerPostgresMaintenanceRoutes(m)
 	s.registerMaintenanceRoutes(m)
 	s.registerRuntimeLogsRoutes(m)
+	s.registerFirewallRoutes(m)
 }
 
 func (s *Server) handleHealth(w http.ResponseWriter, r *http.Request) {

internal/httpapi/routes_crud.go

@@ -16,6 +16,8 @@ import (
 	"evobgp/internal/pipeline"
 	"evobgp/internal/runtimelogs"
 	"evobgp/internal/store"
+
+	"github.com/jackc/pgx/v5/pgconn"
 )
 
 func (s *Server) registerCRUDRoutes(m *http.ServeMux) {
@@ -188,9 +190,29 @@ func writeStoreErr(w http.ResponseWriter, err error) {
 		writeProblem(w, http.StatusUnprocessableEntity, "Unprocessable Entity", invalidInputDetail)
 		return
 	}
+	if writePostgresStoreErr(w, err) {
+		return
+	}
 	writeInternalError(w, "store", err)
 }
 
+func writePostgresStoreErr(w http.ResponseWriter, err error) bool {
+	var pgErr *pgconn.PgError
+	if !errors.As(err, &pgErr) {
+		return false
+	}
+	switch pgErr.Code {
+	case "42P01":
+		writeProblem(w, http.StatusServiceUnavailable, "Service Unavailable",
+			"database schema outdated; restart API after deploy or apply migration 000027_firewall")
+		return true
+	case "23505":
+		writeProblem(w, http.StatusConflict, "Conflict", "resource already exists")
+		return true
+	}
+	return false
+}
+
 func (s *Server) handleListCDNSources(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
 	if !ok || !s.requireAtLeast(w, a, "viewer") {

internal/httpapi/routes_firewall.go

@@ -0,0 +1,663 @@
+package httpapi
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"io"
+	"net/http"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+	"time"
+
+	"evobgp/internal/authkey"
+	"evobgp/internal/firewall"
+	"evobgp/internal/firewallscripts"
+	"evobgp/internal/store"
+)
+
+func (s *Server) registerFirewallRoutes(m *http.ServeMux) {
+	m.HandleFunc("GET /firewall/install-context", s.handleFirewallInstallContext)
+	m.HandleFunc("GET /firewall/clients", s.handleListFirewallClients)
+	m.HandleFunc("GET /firewall/clients/{id}", s.handleGetFirewallClient)
+	m.HandleFunc("GET /firewall/clients/{id}/preview", s.handleFirewallClientPreview)
+	m.HandleFunc("PATCH /firewall/clients/{id}", s.handlePatchFirewallClient)
+	m.HandleFunc("POST /firewall/clients/{id}/approve", s.handleApproveFirewallClient)
+	m.HandleFunc("POST /firewall/clients/{id}/revoke", s.handleRevokeFirewallClient)
+	m.HandleFunc("DELETE /firewall/clients/{id}", s.handleDeleteFirewallClient)
+
+	m.HandleFunc("GET /firewall/rules", s.handleListFirewallRules)
+	m.HandleFunc("POST /firewall/rules", s.handleCreateFirewallRule)
+	m.HandleFunc("PATCH /firewall/rules/{id}", s.handlePatchFirewallRule)
+	m.HandleFunc("DELETE /firewall/rules/{id}", s.handleDeleteFirewallRule)
+	m.HandleFunc("POST /firewall/rules:reorder", s.handleReorderFirewallRules)
+
+	m.HandleFunc("GET /firewall/blocklist", s.handleFirewallBlocklist)
+	m.HandleFunc("POST /firewall/apply-report", s.handleFirewallApplyReport)
+	m.HandleFunc("POST /firewall/heartbeat", s.handleFirewallHeartbeat)
+}
+
+func (s *Server) handleFirewallInstallContext(w http.ResponseWriter, r *http.Request) {
+	a, ok := authFromContext(r.Context())
+	if !ok || !s.requireAtLeast(w, a, "operator") {
+		return
+	}
+	seed := strings.TrimSpace(s.bundleSeedHex)
+	writeJSON(w, http.StatusOK, map[string]any{
+		"bundle_seed":            seed,
+		"bundle_seed_configured": seed != "",
+		"suggested_cp_url":       publicHTTPSBaseURL(r),
+		"install_sh_url":         publicHTTPSBaseURL(r) + "/v1/firewall/install.sh",
+	})
+}
+
+// publicHTTPSBaseURL is the external HTTPS origin for firewall install/enroll links.
+func publicHTTPSBaseURL(r *http.Request) string {
+	host := strings.TrimSpace(r.Host)
+	if xf := strings.TrimSpace(r.Header.Get("X-Forwarded-Host")); xf != "" {
+		host = strings.TrimSpace(strings.Split(xf, ",")[0])
+	}
+	if host == "" {
+		return ""
+	}
+	return "https://" + host
+}
+
+func requestBaseURL(r *http.Request) string {
+	return publicHTTPSBaseURL(r)
+}
+
+func (s *Server) handleFirewallEnrollPublic(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		writeProblem(w, http.StatusMethodNotAllowed, "Method Not Allowed", "POST required")
+		return
+	}
+	seed := strings.TrimSpace(r.Header.Get("X-EvoBGP-Seed"))
+	if seed == "" || s.bundleSeedHex == "" || !strings.EqualFold(seed, s.bundleSeedHex) {
+		writeProblem(w, http.StatusForbidden, "Forbidden", "invalid or missing X-EvoBGP-Seed")
+		return
+	}
+	var body struct {
+		Name          string `json:"name"`
+		Hostname      string `json:"hostname"`
+		ClientToken   string `json:"client_token"`
+		ClientVersion string `json:"client_version"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&body); err != nil && !errors.Is(err, io.EOF) {
+		writeProblem(w, http.StatusBadRequest, "Bad Request", "invalid JSON body")
+		return
+	}
+	name := strings.TrimSpace(body.Name)
+	tok := strings.TrimSpace(body.ClientToken)
+	if name == "" || tok == "" {
+		writeProblem(w, http.StatusUnprocessableEntity, "Unprocessable Entity", "name and client_token are required")
+		return
+	}
+	if !strings.HasPrefix(tok, "evobgp_fw_") {
+		writeProblem(w, http.StatusUnprocessableEntity, "Unprocessable Entity", "client_token must use evobgp_fw_ prefix")
+		return
+	}
+	tenantID, err := s.firewallEnrollTenantID()
+	if err != nil {
+		writeInternalError(w, "internal", err)
+		return
+	}
+	hash := authkey.HashToken(tok)
+	prefix := tok
+	if len(prefix) > 12 {
+		prefix = prefix[:12]
+	}
+	client, err := s.store.CreateFirewallClient(tenantID, &store.FirewallClientCreate{
+		Name:          name,
+		Hostname:      strings.TrimSpace(body.Hostname),
+		TokenPrefix:   prefix,
+		TokenHash:     hash,
+		ClientVersion: strings.TrimSpace(body.ClientVersion),
+	})
+	if err != nil {
+		if errors.Is(err, store.ErrInvalidInput) {
+			writeProblem(w, http.StatusConflict, "Conflict", "client token already enrolled")
+			return
+		}
+		writeStoreErr(w, err)
+		return
+	}
+	writeJSON(w, http.StatusCreated, map[string]any{
+		"client_id": client.ID,
+		"status":    client.Status,
+		"message":   "pending operator approval in EvoBGP UI",
+	})
+}
+
+func (s *Server) firewallEnrollTenantID() (string, error) {
+	tid, _, _, _, _ := s.store.DemoIDs()
+	if tid != "" {
+		return tid, nil
+	}
+	ids, err := s.store.ListTenantIDs()
+	if err != nil {
+		return "", err
+	}
+	if len(ids) == 0 {
+		return "", errors.New("httpapi: no tenant for firewall enroll")
+	}
+	return ids[0], nil
+}
+
+func (s *Server) handleFirewallInstallScript(w http.ResponseWriter, r *http.Request) {
+	s.serveFirewallScript(w, "install.sh")
+}
+
+func (s *Server) handleFirewallSyncScript(w http.ResponseWriter, r *http.Request) {
+	s.serveFirewallScript(w, "evobgp-firewall.sh")
+}
+
+func (s *Server) serveFirewallScript(w http.ResponseWriter, name string) {
+	b, err := readFirewallScript(name)
+	if err != nil {
+		writeProblem(w, http.StatusNotFound, "Not Found", "script not found")
+		return
+	}
+	w.Header().Set("Content-Type", "text/x-shellscript; charset=utf-8")
+	w.WriteHeader(http.StatusOK)
+	_, _ = w.Write(b)
+}
+
+func readFirewallScript(name string) ([]byte, error) {
+	if b, err := firewallscripts.FS.ReadFile(name); err == nil {
+		return b, nil
+	}
+	candidates := []string{}
+	if dir := strings.TrimSpace(os.Getenv("EVOBGP_FIREWALL_SCRIPTS")); dir != "" {
+		candidates = append(candidates, filepath.Join(dir, name))
+	}
+	candidates = append(candidates, filepath.Join("scripts", "firewall", name))
+	for _, p := range candidates {
+		b, err := os.ReadFile(p)
+		if err == nil {
+			return b, nil
+		}
+	}
+	return nil, os.ErrNotExist
+}
+
+func (s *Server) handleListFirewallClients(w http.ResponseWriter, r *http.Request) {
+	a, ok := authFromContext(r.Context())
+	if !ok || !s.requireAtLeast(w, a, "viewer") {
+		return
+	}
+	items, err := s.store.ListFirewallClients(a.TenantID)
+	if err != nil {
+		writeInternalError(w, "internal", err)
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"items": items})
+}
+
+func (s *Server) handleGetFirewallClient(w http.ResponseWriter, r *http.Request) {
+	a, ok := authFromContext(r.Context())
+	if !ok || !s.requireAtLeast(w, a, "viewer") {
+		return
+	}
+	id := strings.TrimSpace(r.PathValue("id"))
+	client, err := s.store.GetFirewallClient(a.TenantID, id)
+	if err != nil {
+		writeProblem(w, http.StatusNotFound, "Not Found", "client not found")
+		return
+	}
+	writeJSON(w, http.StatusOK, client)
+}
+
+func (s *Server) handlePatchFirewallClient(w http.ResponseWriter, r *http.Request) {
+	a, ok := authFromContext(r.Context())
+	if !ok || !s.requireAtLeast(w, a, "operator") {
+		return
+	}
+	id := strings.TrimSpace(r.PathValue("id"))
+	var patch store.FirewallClientPatch
+	if err := json.NewDecoder(r.Body).Decode(&patch); err != nil {
+		writeProblem(w, http.StatusBadRequest, "Bad Request", "invalid JSON body")
+		return
+	}
+	client, err := s.store.UpdateFirewallClient(a.TenantID, id, &patch)
+	if err != nil {
+		writeProblem(w, http.StatusNotFound, "Not Found", "client not found")
+		return
+	}
+	writeJSON(w, http.StatusOK, client)
+}
+
+func (s *Server) handleApproveFirewallClient(w http.ResponseWriter, r *http.Request) {
+	a, ok := authFromContext(r.Context())
+	if !ok || !s.requireAtLeast(w, a, "operator") {
+		return
+	}
+	id := strings.TrimSpace(r.PathValue("id"))
+	client, err := s.store.ApproveFirewallClient(a.TenantID, id, a.APIKeyID)
+	if err != nil {
+		writeProblem(w, http.StatusNotFound, "Not Found", "client not found")
+		return
+	}
+	_ = s.firewallResolver.Reload(s.store)
+	go s.replicateFirewallStateToSpeakers(a.TenantID)
+	writeJSON(w, http.StatusOK, client)
+}
+
+func (s *Server) handleRevokeFirewallClient(w http.ResponseWriter, r *http.Request) {
+	a, ok := authFromContext(r.Context())
+	if !ok || !s.requireAtLeast(w, a, "operator") {
+		return
+	}
+	id := strings.TrimSpace(r.PathValue("id"))
+	if err := s.store.RevokeFirewallClient(a.TenantID, id); err != nil {
+		writeProblem(w, http.StatusNotFound, "Not Found", "client not found")
+		return
+	}
+	_ = s.firewallResolver.Reload(s.store)
+	go s.replicateFirewallStateToSpeakers(a.TenantID)
+	writeJSON(w, http.StatusOK, map[string]string{"status": "revoked"})
+}
+
+func (s *Server) handleDeleteFirewallClient(w http.ResponseWriter, r *http.Request) {
+	a, ok := authFromContext(r.Context())
+	if !ok || !s.requireAtLeast(w, a, "operator") {
+		return
+	}
+	id := strings.TrimSpace(r.PathValue("id"))
+	if err := s.store.DeleteFirewallClient(a.TenantID, id); err != nil {
+		writeProblem(w, http.StatusNotFound, "Not Found", "client not found")
+		return
+	}
+	_ = s.firewallResolver.Reload(s.store)
+	go s.replicateFirewallStateToSpeakers(a.TenantID)
+	w.WriteHeader(http.StatusNoContent)
+}
+
+func (s *Server) handleListFirewallRules(w http.ResponseWriter, r *http.Request) {
+	a, ok := authFromContext(r.Context())
+	if !ok || !s.requireAtLeast(w, a, "viewer") {
+		return
+	}
+	scope := strings.TrimSpace(r.URL.Query().Get("scope"))
+	var clientID *string
+	if scope == "client" {
+		cid := strings.TrimSpace(r.URL.Query().Get("client_id"))
+		if cid == "" {
+			writeProblem(w, http.StatusUnprocessableEntity, "Unprocessable Entity", "client_id required for scope=client")
+			return
+		}
+		clientID = &cid
+	}
+	items, err := s.store.ListFirewallRules(a.TenantID, clientID)
+	if err != nil {
+		writeInternalError(w, "internal", err)
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"items": items})
+}
+
+func (s *Server) handleCreateFirewallRule(w http.ResponseWriter, r *http.Request) {
+	a, ok := authFromContext(r.Context())
+	if !ok || !s.requireAtLeast(w, a, "operator") {
+		return
+	}
+	var body struct {
+		Scope       string  `json:"scope"`
+		ClientID    *string `json:"client_id"`
+		Action      string  `json:"action"`
+		CommunityID *string `json:"community_id"`
+		Comment     string  `json:"comment"`
+		Priority    *int    `json:"priority"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
+		writeProblem(w, http.StatusBadRequest, "Bad Request", "invalid JSON body")
+		return
+	}
+	var clientID *string
+	if strings.TrimSpace(body.Scope) == "client" {
+		if body.ClientID == nil || strings.TrimSpace(*body.ClientID) == "" {
+			writeProblem(w, http.StatusUnprocessableEntity, "Unprocessable Entity", "client_id required for scope=client")
+			return
+		}
+		cid := strings.TrimSpace(*body.ClientID)
+		clientID = &cid
+	}
+	rule, err := s.store.CreateFirewallRule(a.TenantID, clientID, &store.FirewallRuleCreate{
+		Priority:    body.Priority,
+		Action:      body.Action,
+		CommunityID: body.CommunityID,
+		Comment:     body.Comment,
+	})
+	if err != nil {
+		writeProblem(w, http.StatusUnprocessableEntity, "Unprocessable Entity", "invalid rule")
+		return
+	}
+	go s.replicateFirewallStateToSpeakers(a.TenantID)
+	writeJSON(w, http.StatusCreated, rule)
+}
+
+func (s *Server) handlePatchFirewallRule(w http.ResponseWriter, r *http.Request) {
+	a, ok := authFromContext(r.Context())
+	if !ok || !s.requireAtLeast(w, a, "operator") {
+		return
+	}
+	id := strings.TrimSpace(r.PathValue("id"))
+	var patch store.FirewallRulePatch
+	if err := json.NewDecoder(r.Body).Decode(&patch); err != nil {
+		writeProblem(w, http.StatusBadRequest, "Bad Request", "invalid JSON body")
+		return
+	}
+	rule, err := s.store.UpdateFirewallRule(a.TenantID, id, &patch)
+	if err != nil {
+		writeProblem(w, http.StatusNotFound, "Not Found", "rule not found")
+		return
+	}
+	go s.replicateFirewallStateToSpeakers(a.TenantID)
+	writeJSON(w, http.StatusOK, rule)
+}
+
+func (s *Server) handleDeleteFirewallRule(w http.ResponseWriter, r *http.Request) {
+	a, ok := authFromContext(r.Context())
+	if !ok || !s.requireAtLeast(w, a, "operator") {
+		return
+	}
+	id := strings.TrimSpace(r.PathValue("id"))
+	if err := s.store.DeleteFirewallRule(a.TenantID, id); err != nil {
+		writeProblem(w, http.StatusNotFound, "Not Found", "rule not found")
+		return
+	}
+	go s.replicateFirewallStateToSpeakers(a.TenantID)
+	w.WriteHeader(http.StatusNoContent)
+}
+
+func (s *Server) handleReorderFirewallRules(w http.ResponseWriter, r *http.Request) {
+	a, ok := authFromContext(r.Context())
+	if !ok || !s.requireAtLeast(w, a, "operator") {
+		return
+	}
+	var body struct {
+		Scope      string   `json:"scope"`
+		ClientID   *string  `json:"client_id"`
+		OrderedIDs []string `json:"ordered_ids"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
+		writeProblem(w, http.StatusBadRequest, "Bad Request", "invalid JSON body")
+		return
+	}
+	var clientID *string
+	if strings.TrimSpace(body.Scope) == "client" {
+		if body.ClientID == nil || strings.TrimSpace(*body.ClientID) == "" {
+			writeProblem(w, http.StatusUnprocessableEntity, "Unprocessable Entity", "client_id required")
+			return
+		}
+		cid := strings.TrimSpace(*body.ClientID)
+		clientID = &cid
+	}
+	if err := s.store.ReorderFirewallRules(a.TenantID, clientID, body.OrderedIDs); err != nil {
+		writeProblem(w, http.StatusUnprocessableEntity, "Unprocessable Entity", "invalid reorder")
+		return
+	}
+	go s.replicateFirewallStateToSpeakers(a.TenantID)
+	writeJSON(w, http.StatusOK, map[string]bool{"ok": true})
+}
+
+func (s *Server) handleFirewallBlocklist(w http.ResponseWriter, r *http.Request) {
+	a, ok := authFromContext(r.Context())
+	if !ok || !s.requireFirewall(w, a) {
+		return
+	}
+	client, err := s.store.GetFirewallClient(a.TenantID, a.APIKeyID)
+	if err != nil {
+		writeProblem(w, http.StatusUnauthorized, "Unauthorized", "unknown firewall client")
+		return
+	}
+	if client.Status != "approved" {
+		w.Header().Set("Retry-After", "60")
+		writeProblem(w, http.StatusForbidden, "Forbidden", "client pending approval")
+		return
+	}
+	_ = s.store.TouchFirewallClientLastSeen(client.ID, "cp", clientIP(r), r.UserAgent())
+	resp, err := s.buildFirewallBlocklist(r.Context(), client)
+	if err != nil {
+		if errors.Is(err, errNoFirewallRevision) {
+			writeProblem(w, http.StatusNotFound, "Not Found", "no published revision")
+			return
+		}
+		writeInternalError(w, "internal", err)
+		return
+	}
+	w.Header().Set("X-EvoBGP-Source", "cp")
+	w.Header().Set("X-EvoBGP-Revision-ID", resp.RevisionID)
+	w.Header().Set("X-EvoBGP-Generated-At", resp.GeneratedAt)
+	w.Header().Set("X-EvoBGP-Rules-Version", resp.RulesVersion)
+	if strings.Contains(r.Header.Get("Accept"), "text/plain") {
+		w.Header().Set("Content-Type", "text/plain; charset=utf-8")
+		for _, p := range resp.Prefixes {
+			_, _ = w.Write([]byte(p + "\n"))
+		}
+		return
+	}
+	writeJSON(w, http.StatusOK, resp)
+}
+
+func (s *Server) handleFirewallApplyReport(w http.ResponseWriter, r *http.Request) {
+	a, ok := authFromContext(r.Context())
+	if !ok || !s.requireFirewall(w, a) {
+		return
+	}
+	var body struct {
+		Status          string `json:"status"`
+		Error           string `json:"error"`
+		PrefixCount     int    `json:"prefix_count"`
+		IPCount         int    `json:"ip_count"`
+		PacketsDropped  int64  `json:"packets_dropped"`
+		PacketsAccepted int64  `json:"packets_accepted"`
+		Version         string `json:"version"`
+		KernelMethod    string `json:"kernel_method"`
+		Source          string `json:"source"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
+		writeProblem(w, http.StatusBadRequest, "Bad Request", "invalid JSON body")
+		return
+	}
+	src := strings.TrimSpace(body.Source)
+	if src == "" {
+		src = "cp"
+	}
+	_ = s.store.TouchFirewallClientLastApply(
+		a.APIKeyID, src, body.Status, body.Error,
+		body.PrefixCount, body.IPCount, body.PacketsDropped, body.PacketsAccepted,
+	)
+	writeJSON(w, http.StatusOK, map[string]bool{"ok": true})
+}
+
+func (s *Server) handleFirewallHeartbeat(w http.ResponseWriter, r *http.Request) {
+	a, ok := authFromContext(r.Context())
+	if !ok || !s.requireFirewall(w, a) {
+		return
+	}
+	var body struct {
+		Source string `json:"source"`
+	}
+	_ = json.NewDecoder(r.Body).Decode(&body)
+	src := strings.TrimSpace(body.Source)
+	if src == "" {
+		src = "cp"
+	}
+	_ = s.store.TouchFirewallClientLastSeen(a.APIKeyID, src, clientIP(r), r.UserAgent())
+	writeJSON(w, http.StatusOK, map[string]bool{"ok": true})
+}
+
+func (s *Server) handleFirewallClientPreview(w http.ResponseWriter, r *http.Request) {
+	a, ok := authFromContext(r.Context())
+	if !ok || !s.requireAtLeast(w, a, "viewer") {
+		return
+	}
+	id := strings.TrimSpace(r.PathValue("id"))
+	client, err := s.store.GetFirewallClient(a.TenantID, id)
+	if err != nil {
+		writeProblem(w, http.StatusNotFound, "Not Found", "client not found")
+		return
+	}
+	resp, err := s.buildFirewallBlocklist(r.Context(), client)
+	if err != nil {
+		if errors.Is(err, errNoFirewallRevision) {
+			writeProblem(w, http.StatusNotFound, "Not Found", "no published revision")
+			return
+		}
+		writeInternalError(w, "internal", err)
+		return
+	}
+	writeJSON(w, http.StatusOK, resp)
+}
+
+var errNoFirewallRevision = errors.New("httpapi: no firewall revision")
+
+type firewallBlocklistResponse struct {
+	ClientID             string   `json:"client_id"`
+	RevisionID           string   `json:"revision_id"`
+	GeneratedAt          string   `json:"generated_at"`
+	Source               string   `json:"source"`
+	RulesApplied         int      `json:"rules_applied"`
+	CommunitiesEvaluated int      `json:"communities_evaluated"`
+	CommunitiesBlocked   int      `json:"communities_blocked"`
+	Prefixes             []string `json:"prefixes"`
+	Total                int      `json:"total"`
+	Hash                 string   `json:"hash"`
+	RulesVersion         string   `json:"-"`
+}
+
+func (s *Server) buildFirewallBlocklist(ctx context.Context, client *store.FirewallClient) (*firewallBlocklistResponse, error) {
+	_ = ctx
+	revs, _, _ := s.store.ListRevisions(client.TenantID, "", "", 1)
+	if len(revs) == 0 {
+		return nil, errNoFirewallRevision
+	}
+	rev := revs[0]
+	prefixesByCommunity, commCount, err := s.loadPrefixesByCommunity(client.TenantID, rev.ID)
+	if err != nil {
+		return nil, err
+	}
+	rules, err := s.store.ListAllFirewallRulesForClient(client.TenantID, client.ID)
+	if err != nil {
+		return nil, err
+	}
+	fwRules := storeRulesToFirewall(rules)
+	blocked := firewall.Evaluate(client.ID, fwRules, prefixesByCommunity)
+	blockedComm := countBlockedCommunities(client.ID, fwRules, prefixesByCommunity)
+	hash := prefixListHash(blocked)
+	return &firewallBlocklistResponse{
+		ClientID:             client.ID,
+		RevisionID:           rev.ID,
+		GeneratedAt:          time.Now().UTC().Format(time.RFC3339),
+		Source:               "cp",
+		RulesApplied:         len(rules),
+		CommunitiesEvaluated: commCount,
+		CommunitiesBlocked:   blockedComm,
+		Prefixes:             blocked,
+		Total:                len(blocked),
+		Hash:                 hash,
+		RulesVersion:         firewall.RulesVersionHash(fwRules),
+	}, nil
+}
+
+func (s *Server) loadPrefixesByCommunity(tenantID, revisionID string) (map[string][]string, int, error) {
+	out := make(map[string][]string)
+	communities := make(map[string]struct{})
+	cursor := ""
+	for {
+		rows, next, more := s.store.ListRevisionPrefixes(tenantID, revisionID, cursor, 5000)
+		for _, row := range rows {
+			key := ""
+			if row.CommunityID != nil {
+				key = strings.TrimSpace(*row.CommunityID)
+			}
+			communities[key] = struct{}{}
+			out[key] = append(out[key], strings.TrimSpace(row.Prefix))
+		}
+		if !more {
+			break
+		}
+		cursor = next
+	}
+	return out, len(communities), nil
+}
+
+func storeRulesToFirewall(rules []*store.FirewallRule) []firewall.Rule {
+	out := make([]firewall.Rule, 0, len(rules))
+	for _, r := range rules {
+		var cid *string
+		if r.CommunityID != nil {
+			v := *r.CommunityID
+			cid = &v
+		}
+		var cl *string
+		if r.ClientID != nil {
+			v := *r.ClientID
+			cl = &v
+		}
+		out = append(out, firewall.Rule{
+			ClientID:    cl,
+			Priority:    r.Priority,
+			Action:      r.Action,
+			CommunityID: cid,
+		})
+	}
+	return out
+}
+
+func countBlockedCommunities(clientID string, rules []firewall.Rule, prefixesByCommunity map[string][]string) int {
+	n := 0
+	for k := range prefixesByCommunity {
+		ordered := mergeRulesForCount(clientID, rules)
+		for _, r := range ordered {
+			if r.CommunityID == nil || strings.TrimSpace(*r.CommunityID) == k {
+				if strings.EqualFold(r.Action, "block") {
+					n++
+				}
+				break
+			}
+		}
+	}
+	return n
+}
+
+func mergeRulesForCount(clientID string, rules []firewall.Rule) []firewall.Rule {
+	var clientRules, tenantRules []firewall.Rule
+	for _, r := range rules {
+		if r.ClientID != nil && *r.ClientID == clientID {
+			clientRules = append(clientRules, r)
+			continue
+		}
+		if r.ClientID == nil {
+			tenantRules = append(tenantRules, r)
+		}
+	}
+	sort.Slice(clientRules, func(i, j int) bool { return clientRules[i].Priority < clientRules[j].Priority })
+	sort.Slice(tenantRules, func(i, j int) bool { return tenantRules[i].Priority < tenantRules[j].Priority })
+	out := append([]firewall.Rule{}, clientRules...)
+	return append(out, tenantRules...)
+}
+
+func prefixListHash(prefixes []string) string {
+	cp := append([]string(nil), prefixes...)
+	sort.Strings(cp)
+	sum := sha256.Sum256([]byte(strings.Join(cp, "\n")))
+	return "sha256:" + hex.EncodeToString(sum[:])
+}
+
+func clientIP(r *http.Request) string {
+	if xff := strings.TrimSpace(r.Header.Get("X-Forwarded-For")); xff != "" {
+		parts := strings.Split(xff, ",")
+		return strings.TrimSpace(parts[0])
+	}
+	host := r.RemoteAddr
+	if i := strings.LastIndex(host, ":"); i >= 0 {
+		return host[:i]
+	}
+	return host
+}

internal/httpapi/routes_firewall_test.go

@@ -0,0 +1,304 @@
+package httpapi
+
+import (
+	"encoding/json"
+	"errors"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"evobgp/internal/authkey"
+	"evobgp/internal/store"
+)
+
+func TestFirewallEnrollAndBlocklist(t *testing.T) {
+	srv, err := New(Options{SeedDemo: true, BundleSeedHex: testBundleSeed})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer srv.Close()
+	tenant, _, _, _, _ := srv.Store().DemoIDs()
+	mustSetTestAPIKeys(t, srv, "opkey|"+tenant+"|operator")
+
+	ts := httptest.NewServer(srv.Handler())
+	defer ts.Close()
+	client := ts.Client()
+
+	tok := "evobgp_fw_testtoken123456789012345678901234"
+	enrollBody := `{"name":"web-01","hostname":"web-01.local","client_token":"` + tok + `","client_version":"test/1"}`
+	reqEnroll, _ := http.NewRequest(http.MethodPost, ts.URL+"/v1/firewall/enroll", strings.NewReader(enrollBody))
+	reqEnroll.Header.Set("Content-Type", "application/json")
+	reqEnroll.Header.Set("X-EvoBGP-Seed", testBundleSeed)
+	respEnroll, err := client.Do(reqEnroll)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = respEnroll.Body.Close() }()
+	if respEnroll.StatusCode != http.StatusCreated {
+		b, _ := io.ReadAll(respEnroll.Body)
+		t.Fatalf("enroll status=%d body=%s", respEnroll.StatusCode, b)
+	}
+	var enroll map[string]any
+	if err := json.NewDecoder(respEnroll.Body).Decode(&enroll); err != nil {
+		t.Fatal(err)
+	}
+	clientID, _ := enroll["client_id"].(string)
+	if clientID == "" {
+		t.Fatal("missing client_id")
+	}
+
+	reqBlock, _ := http.NewRequest(http.MethodGet, ts.URL+"/v1/firewall/blocklist", nil)
+	reqBlock.Header.Set("Authorization", "Bearer "+tok)
+	respBlock, err := client.Do(reqBlock)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = respBlock.Body.Close() }()
+	if respBlock.StatusCode != http.StatusForbidden {
+		t.Fatalf("pending blocklist want 403 got %d", respBlock.StatusCode)
+	}
+
+	reqApprove, _ := http.NewRequest(http.MethodPost, ts.URL+"/v1/firewall/clients/"+clientID+"/approve", nil)
+	reqApprove.Header.Set("Authorization", "Bearer opkey")
+	respApprove, err := client.Do(reqApprove)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = respApprove.Body.Close() }()
+	if respApprove.StatusCode != http.StatusOK {
+		b, _ := io.ReadAll(respApprove.Body)
+		t.Fatalf("approve status=%d body=%s", respApprove.StatusCode, b)
+	}
+
+	_, err = srv.Store().CreateFirewallRule(tenant, nil, &store.FirewallRuleCreate{Action: "accept", Comment: "default"})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	reqBlock2, _ := http.NewRequest(http.MethodGet, ts.URL+"/v1/firewall/blocklist", nil)
+	reqBlock2.Header.Set("Authorization", "Bearer "+tok)
+	respBlock2, err := client.Do(reqBlock2)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = respBlock2.Body.Close() }()
+	if respBlock2.StatusCode != http.StatusOK {
+		b, _ := io.ReadAll(respBlock2.Body)
+		t.Fatalf("blocklist status=%d body=%s", respBlock2.StatusCode, b)
+	}
+	var bl map[string]any
+	if err := json.NewDecoder(respBlock2.Body).Decode(&bl); err != nil {
+		t.Fatal(err)
+	}
+	if total, _ := bl["total"].(float64); total != 0 {
+		t.Fatalf("accept-only want empty blocklist, total=%v", total)
+	}
+
+	reportBody := `{"status":"ok","prefix_count":0,"ip_count":0,"packets_dropped":42,"packets_accepted":1000,"source":"cp","kernel_method":"nft"}`
+	reqReport, _ := http.NewRequest(http.MethodPost, ts.URL+"/v1/firewall/apply-report", strings.NewReader(reportBody))
+	reqReport.Header.Set("Authorization", "Bearer "+tok)
+	reqReport.Header.Set("Content-Type", "application/json")
+	respReport, err := client.Do(reqReport)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = respReport.Body.Close() }()
+	if respReport.StatusCode != http.StatusOK {
+		b, _ := io.ReadAll(respReport.Body)
+		t.Fatalf("apply-report status=%d body=%s", respReport.StatusCode, b)
+	}
+	gotClient, err := srv.Store().GetFirewallClient(tenant, clientID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if gotClient.LastApplyPacketsDropped != 42 || gotClient.LastApplyPacketsAccepted != 1000 {
+		t.Fatalf("packet stats dropped=%d accepted=%d", gotClient.LastApplyPacketsDropped, gotClient.LastApplyPacketsAccepted)
+	}
+}
+
+func TestFirewallEnrollBadSeed(t *testing.T) {
+	srv, err := New(Options{SeedDemo: true, BundleSeedHex: testBundleSeed})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer srv.Close()
+	ts := httptest.NewServer(srv.Handler())
+	defer ts.Close()
+
+	body := `{"name":"x","client_token":"evobgp_fw_` + strings.Repeat("a", 40) + `"}`
+	req, _ := http.NewRequest(http.MethodPost, ts.URL+"/v1/firewall/enroll", strings.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("X-EvoBGP-Seed", "deadbeef")
+	resp, err := ts.Client().Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+	if resp.StatusCode != http.StatusForbidden {
+		t.Fatalf("want 403 got %d", resp.StatusCode)
+	}
+}
+
+func TestFirewallInstallScriptPublic(t *testing.T) {
+	srv, err := New(Options{SeedDemo: true, BundleSeedHex: testBundleSeed})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer srv.Close()
+	ts := httptest.NewServer(srv.Handler())
+	defer ts.Close()
+
+	for _, path := range []string{"/v1/firewall/install.sh", "/v1/firewall/sync-script"} {
+		req, _ := http.NewRequest(http.MethodGet, ts.URL+path, nil)
+		resp, err := ts.Client().Do(req)
+		if err != nil {
+			t.Fatal(err)
+		}
+		func() {
+			defer func() { _ = resp.Body.Close() }()
+			if resp.StatusCode != http.StatusOK {
+				b, _ := io.ReadAll(resp.Body)
+				t.Fatalf("%s status=%d body=%s", path, resp.StatusCode, b)
+			}
+			ct := resp.Header.Get("Content-Type")
+			if !strings.Contains(ct, "shellscript") {
+				t.Fatalf("%s content-type=%q", path, ct)
+			}
+			b, _ := io.ReadAll(resp.Body)
+			if !strings.HasPrefix(string(b), "#!/") {
+				t.Fatalf("%s missing shebang", path)
+			}
+		}()
+	}
+}
+
+func TestFirewallInstallContext(t *testing.T) {
+	srv, err := New(Options{SeedDemo: true, BundleSeedHex: testBundleSeed})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer srv.Close()
+	tenant, _, _, _, _ := srv.Store().DemoIDs()
+	mustSetTestAPIKeys(t, srv, "opkey|"+tenant+"|operator,vwkey|"+tenant+"|viewer")
+
+	ts := httptest.NewServer(srv.Handler())
+	defer ts.Close()
+	client := ts.Client()
+
+	reqOp, _ := http.NewRequest(http.MethodGet, ts.URL+"/v1/firewall/install-context", nil)
+	reqOp.Header.Set("Authorization", "Bearer opkey")
+	respOp, err := client.Do(reqOp)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = respOp.Body.Close() }()
+	if respOp.StatusCode != http.StatusOK {
+		b, _ := io.ReadAll(respOp.Body)
+		t.Fatalf("operator install-context status=%d body=%s", respOp.StatusCode, b)
+	}
+	var ctx map[string]any
+	if err := json.NewDecoder(respOp.Body).Decode(&ctx); err != nil {
+		t.Fatal(err)
+	}
+	if seed, _ := ctx["bundle_seed"].(string); seed != testBundleSeed {
+		t.Fatalf("bundle_seed=%q want %q", seed, testBundleSeed)
+	}
+	if configured, _ := ctx["bundle_seed_configured"].(bool); !configured {
+		t.Fatal("bundle_seed_configured want true")
+	}
+	if url, _ := ctx["suggested_cp_url"].(string); !strings.HasPrefix(url, "https://") {
+		t.Fatalf("suggested_cp_url=%q want https", url)
+	}
+	if url, _ := ctx["install_sh_url"].(string); !strings.HasPrefix(url, "https://") || !strings.HasSuffix(url, "/v1/firewall/install.sh") {
+		t.Fatalf("install_sh_url=%q", url)
+	}
+
+	reqVw, _ := http.NewRequest(http.MethodGet, ts.URL+"/v1/firewall/install-context", nil)
+	reqVw.Header.Set("Authorization", "Bearer vwkey")
+	respVw, err := client.Do(reqVw)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = respVw.Body.Close() }()
+	if respVw.StatusCode != http.StatusForbidden {
+		t.Fatalf("viewer install-context want 403 got %d", respVw.StatusCode)
+	}
+}
+
+func TestFirewallDeletePendingClient(t *testing.T) {
+	srv, err := New(Options{SeedDemo: true, BundleSeedHex: testBundleSeed})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer srv.Close()
+	tenant, _, _, _, _ := srv.Store().DemoIDs()
+	mustSetTestAPIKeys(t, srv, "opkey|"+tenant+"|operator")
+
+	ts := httptest.NewServer(srv.Handler())
+	defer ts.Close()
+	client := ts.Client()
+
+	tok := "evobgp_fw_revoketest123456789012345678901"
+	enrollBody := `{"name":"reject-me","hostname":"test.local","client_token":"` + tok + `","client_version":"test/1"}`
+	reqEnroll, _ := http.NewRequest(http.MethodPost, ts.URL+"/v1/firewall/enroll", strings.NewReader(enrollBody))
+	reqEnroll.Header.Set("Content-Type", "application/json")
+	reqEnroll.Header.Set("X-EvoBGP-Seed", testBundleSeed)
+	respEnroll, err := client.Do(reqEnroll)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = respEnroll.Body.Close() }()
+	if respEnroll.StatusCode != http.StatusCreated {
+		b, _ := io.ReadAll(respEnroll.Body)
+		t.Fatalf("enroll status=%d body=%s", respEnroll.StatusCode, b)
+	}
+	var enroll map[string]any
+	if err := json.NewDecoder(respEnroll.Body).Decode(&enroll); err != nil {
+		t.Fatal(err)
+	}
+	clientID, _ := enroll["client_id"].(string)
+	if clientID == "" {
+		t.Fatal("missing client_id")
+	}
+
+	reqDelete, _ := http.NewRequest(http.MethodDelete, ts.URL+"/v1/firewall/clients/"+clientID, nil)
+	reqDelete.Header.Set("Authorization", "Bearer opkey")
+	respDelete, err := client.Do(reqDelete)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = respDelete.Body.Close() }()
+	if respDelete.StatusCode != http.StatusNoContent {
+		b, _ := io.ReadAll(respDelete.Body)
+		t.Fatalf("delete status=%d body=%s", respDelete.StatusCode, b)
+	}
+
+	_, err = srv.Store().GetFirewallClient(tenant, clientID)
+	if err == nil {
+		t.Fatal("client should be deleted")
+	}
+	if !errors.Is(err, store.ErrNotFound) {
+		t.Fatalf("delete err=%v", err)
+	}
+
+	reqBlock, _ := http.NewRequest(http.MethodGet, ts.URL+"/v1/firewall/blocklist", nil)
+	reqBlock.Header.Set("Authorization", "Bearer "+tok)
+	respBlock, err := client.Do(reqBlock)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = respBlock.Body.Close() }()
+	if respBlock.StatusCode != http.StatusUnauthorized {
+		t.Fatalf("deleted blocklist want 401 got %d", respBlock.StatusCode)
+	}
+}
+
+func TestFirewallTokenHashMatchesAuthkey(t *testing.T) {
+	tok := "evobgp_fw_sample"
+	h := authkey.HashToken(tok)
+	if len(h) != 32 {
+		t.Fatalf("hash len %d", len(h))
+	}
+}

internal/httpapi/server.go

@@ -29,6 +29,8 @@ type Server struct {
 	jobs                    *jobs.Registry
 	bundlePriv              ed25519.PrivateKey
 	keyResolver             *apiKeyResolver
+	firewallResolver        *firewallTokenResolver
+	bundleSeedHex           string
 	corsOrigins             []string
 	cdnHTTP                 *http.Client
 	runtimeLogs             *runtimelogs.Service
@@ -74,6 +76,10 @@ func New(opts Options) (*Server, error) {
 	if err != nil {
 		return nil, err
 	}
+	fwResolver, err := newFirewallTokenResolver(backend)
+	if err != nil {
+		return nil, err
+	}
 	var pgMon *pgmonitor.Service
 	var maintCfg *maintenance.ConfigProvider
 	var maintStats *maintenance.DBStatsProvider
@@ -92,6 +98,8 @@ func New(opts Options) (*Server, error) {
 		jobs:                    reg,
 		bundlePriv:              priv,
 		keyResolver:             resolver,
+		firewallResolver:        fwResolver,
+		bundleSeedHex:           strings.TrimSpace(opts.BundleSeedHex),
 		corsOrigins:             parseCORSOrigins(opts.CORSAllowedOrigins),
 		cdnHTTP:                 NewCDNHTTPClient(),
 		runtimeLogs:             runtimelogs.NewService(runtimelogs.ConfigFromEnv()),

internal/jobs/job.go

@@ -184,6 +184,10 @@ type Registry struct {
 	onTerminal  func(j *Job)
 	onEnqueued  func(j *Job)
 	onRunning   func(j *Job)
+	// inflightRefresh counts refresh-kind jobs (module_refresh, tenant_refresh) per tenant that
+	// have been enqueued but not yet finalized in finishModuleRefreshSuccess. Used for deterministic
+	// deploy coalescing under tenantRefreshMu (instead of polling job statuses).
+	inflightRefresh map[string]int
 }
 
 type idempoKey struct {
@@ -194,10 +198,11 @@ type idempoKey struct {
 func NewRegistry(workerStart func(j *Job)) *Registry {
 	maxWorkers := registryMaxConcurrentJobs()
 	return &Registry{
-		byID:        make(map[string]*Job),
-		byIdempo:    make(map[idempoKey]*Job),
-		workerStart: workerStart,
-		workerSem:   make(chan struct{}, maxWorkers),
+		byID:            make(map[string]*Job),
+		byIdempo:        make(map[idempoKey]*Job),
+		workerStart:     workerStart,
+		workerSem:       make(chan struct{}, maxWorkers),
+		inflightRefresh: make(map[string]int),
 	}
 }
 
@@ -340,6 +345,9 @@ func (r *Registry) Enqueue(tenantID, kind string, idempotencyKey *string, module
 		r.byIdempo[idempoKey{tenant: tenantID, key: *idempotencyKey}] = j
 	}
 	r.byID[j.ID] = j
+	if isRefreshKind(kind) {
+		r.inflightRefresh[tenantID]++
+	}
 	r.pruneTerminalIfOver(maxJobs)
 	enqueuedHook := r.onEnqueued
 	workerStart := r.workerStart
@@ -474,6 +482,34 @@ func (r *Registry) CountOtherActiveRefresh(tenantID, excludeJobID string) int {
 	return n
 }
 
+// isRefreshKind reports whether a job kind participates in deploy coalescing.
+func isRefreshKind(kind string) bool {
+	return kind == KindModuleRefresh || kind == KindTenantRefresh
+}
+
+// finalizeRefreshCoalesce is called from finishModuleRefreshSuccess under tenantRefreshMu.
+// It atomically decrements the per-tenant inflight refresh counter and reports whether the
+// caller is the last outstanding refresh for the tenant (and therefore should render+deploy).
+//
+// Unlike CountOtherActiveRefresh (which polls job statuses and races under -race), this counter
+// is incremented in Enqueue under r.mu and decremented here, so the "last one" decision is
+// deterministic regardless of how fast each refresh's ingest completes.
+func (r *Registry) finalizeRefreshCoalesce(tenantID string) bool {
+	if r == nil {
+		return true
+	}
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	n := r.inflightRefresh[tenantID]
+	if n <= 1 {
+		// Last (or already-balanced to zero) — clear the slot and let the caller deploy.
+		delete(r.inflightRefresh, tenantID)
+		return true
+	}
+	r.inflightRefresh[tenantID] = n - 1
+	return false
+}
+
 func parseCursor(s string, off *int) error {
 	_, err := fmt.Sscanf(s, "%d", off)
 	return err

internal/jobs/worker.go

@@ -119,26 +119,7 @@ func (w *Worker) Process(j *Job) {
 
 	switch j.Kind {
 	case KindModuleRefresh:
-		mid, _ := j.Meta["module_id"].(string)
-		if strings.TrimSpace(mid) == "" {
-			j.Fail("missing module_id in job meta")
-			return
-		}
-		ctx, cancel := j.workContext()
-		defer cancel()
-		if ctx.Err() != nil {
-			j.MarkCancelled()
-			return
-		}
-		if err := pipeline.RefreshModuleIngest(ctx, w.Store, w.httpClient(), j.TenantID, mid); err != nil {
-			if ctx.Err() != nil {
-				j.MarkCancelled()
-				return
-			}
-			j.Fail(err.Error())
-			return
-		}
-		w.finishModuleRefreshSuccess(j, mid)
+		w.runModuleRefresh(j)
 	case KindTenantRefresh:
 		w.runTenantRefresh(j)
 	case KindPeerReconcile:
@@ -295,7 +276,55 @@ func (w *Worker) tenantRefreshMu(tenantID string) *sync.Mutex {
 
 // finishModuleRefreshSuccess marks the refresh job and, for the last active refresh in tenant,
 // creates one aggregate revision and enqueues a single deploy_apply.
+// runModuleRefresh handles a single module_refresh job and guarantees the per-tenant inflight
+// slot is released exactly once — even on failure/cancellation before finishModuleRefreshSuccess.
+func (w *Worker) runModuleRefresh(j *Job) {
+	coalesceFinalized := false
+	defer func() {
+		if !coalesceFinalized && w != nil && w.Registry != nil {
+			// Refresh failed/was cancelled before reaching finishModuleRefreshSuccess.
+			// Decrement the counter under the tenant mutex so the "last one" logic stays sound.
+			mu := w.tenantRefreshMu(j.TenantID)
+			mu.Lock()
+			w.Registry.finalizeRefreshCoalesce(j.TenantID)
+			mu.Unlock()
+		}
+	}()
+
+	mid, _ := j.Meta["module_id"].(string)
+	if strings.TrimSpace(mid) == "" {
+		j.Fail("missing module_id in job meta")
+		return
+	}
+	ctx, cancel := j.workContext()
+	defer cancel()
+	if ctx.Err() != nil {
+		j.MarkCancelled()
+		return
+	}
+	if err := pipeline.RefreshModuleIngest(ctx, w.Store, w.httpClient(), j.TenantID, mid); err != nil {
+		if ctx.Err() != nil {
+			j.MarkCancelled()
+			return
+		}
+		j.Fail(err.Error())
+		return
+	}
+	w.finishModuleRefreshSuccess(j, mid)
+	coalesceFinalized = true
+}
+
 func (w *Worker) runTenantRefresh(j *Job) {
+	coalesceFinalized := false
+	defer func() {
+		if !coalesceFinalized && w != nil && w.Registry != nil {
+			mu := w.tenantRefreshMu(j.TenantID)
+			mu.Lock()
+			w.Registry.finalizeRefreshCoalesce(j.TenantID)
+			mu.Unlock()
+		}
+	}()
+
 	moduleIDs := moduleIDsFromJobMeta(j.Meta)
 	if len(moduleIDs) == 0 {
 		j.Fail("missing module_ids in job meta")
@@ -318,6 +347,7 @@ func (w *Worker) runTenantRefresh(j *Job) {
 	}
 	j.mergeMeta(map[string]any{"module_ids": moduleIDs, "modules_refreshed": len(moduleIDs)})
 	w.finishModuleRefreshSuccess(j, trigger)
+	coalesceFinalized = true
 }
 
 func moduleIDsFromJobMeta(meta map[string]any) []string {
@@ -346,6 +376,9 @@ func moduleIDsFromJobMeta(meta map[string]any) []string {
 
 func (w *Worker) finishModuleRefreshSuccess(j *Job, triggerModuleID string) {
 	if w == nil || w.Store == nil {
+		if w != nil && w.Registry != nil {
+			w.Registry.finalizeRefreshCoalesce(j.TenantID)
+		}
 		j.Succeed()
 		return
 	}
@@ -354,11 +387,15 @@ func (w *Worker) finishModuleRefreshSuccess(j *Job, triggerModuleID string) {
 	defer mu.Unlock()
 	ctx, cancel := j.workContext()
 	defer cancel()
-	deferDeploy := false
+	// Determine whether this is the last outstanding refresh for the tenant. The counter is
+	// incremented in Enqueue (under r.mu) and decremented here, so the "last one" decision is
+	// deterministic regardless of ingest timing — unlike the previous status-polling approach
+	// (CountOtherActiveRefresh) which could race under -race.
+	isLastRefresh := true
 	if w.Registry != nil {
-		deferDeploy = w.Registry.CountOtherActiveRefresh(j.TenantID, j.ID) > 0
+		isLastRefresh = w.Registry.finalizeRefreshCoalesce(j.TenantID)
 	}
-	if deferDeploy {
+	if !isLastRefresh {
 		j.mergeMeta(map[string]any{
 			"deploy_apply_deferred":     true,
 			"deploy_apply_defer_reason": "parallel_module_refresh",

internal/repository/postgres_entities.go

@@ -589,6 +589,9 @@ func (p *Postgres) DeleteIPRangeEntry(tenantID, moduleID, entryID string) error
 }
 
 func (p *Postgres) ListGlobalSettings(tenantID string) (map[string]any, error) {
+	if _, err := uuid.Parse(tenantID); err != nil {
+		return nil, store.ErrInvalidInput
+	}
 	ctx := context.Background()
 	rows, err := p.pool.Query(ctx, `SELECT key, value_json FROM global_settings WHERE tenant_id=$1`, tenantID)
 	if err != nil {
@@ -610,6 +613,9 @@ func (p *Postgres) ListGlobalSettings(tenantID string) (map[string]any, error) {
 }
 
 func (p *Postgres) PatchGlobalSettings(tenantID string, patch map[string]any) error {
+	if _, err := uuid.Parse(tenantID); err != nil {
+		return store.ErrInvalidInput
+	}
 	if patch == nil {
 		return nil
 	}

internal/repository/postgres_firewall.go

@@ -0,0 +1,500 @@
+package repository
+
+import (
+	"context"
+	"encoding/hex"
+	"errors"
+	"strings"
+	"time"
+
+	"evobgp/internal/store"
+
+	"github.com/google/uuid"
+	"github.com/jackc/pgx/v5"
+)
+
+const firewallClientSelectCols = `
+	id, name, COALESCE(hostname, ''), token_prefix, status,
+	last_seen_at, COALESCE(last_seen_at_source, ''), COALESCE(last_seen_ip, ''),
+	last_apply_at, COALESCE(last_apply_status, ''), COALESCE(last_apply_error, ''),
+	COALESCE(last_apply_prefix_count, 0), COALESCE(last_apply_ip_count, 0),
+	COALESCE(last_apply_packets_dropped, 0), COALESCE(last_apply_packets_accepted, 0),
+	COALESCE(last_apply_source, ''),
+	COALESCE(client_version, ''), created_at, approved_at, approved_by_api_key_id, revoked_at`
+
+func (p *Postgres) ListFirewallClients(tenantID string) ([]*store.FirewallClient, error) {
+	ctx := context.Background()
+	rows, err := p.pool.Query(ctx, `
+		SELECT `+firewallClientSelectCols+`
+		FROM firewall_client WHERE tenant_id=$1 ORDER BY created_at DESC`, tenantID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var out []*store.FirewallClient
+	for rows.Next() {
+		c, err := scanFirewallClientRow(rows.Scan, tenantID)
+		if err != nil {
+			return nil, err
+		}
+		out = append(out, c)
+	}
+	return out, rows.Err()
+}
+
+func (p *Postgres) GetFirewallClient(tenantID, id string) (*store.FirewallClient, error) {
+	ctx := context.Background()
+	row := p.pool.QueryRow(ctx, `
+		SELECT `+firewallClientSelectCols+`
+		FROM firewall_client WHERE id=$1 AND tenant_id=$2`, id, tenantID)
+	c, err := scanFirewallClientRow(row.Scan, tenantID)
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return nil, store.ErrNotFound
+		}
+		return nil, err
+	}
+	return c, nil
+}
+
+func (p *Postgres) CreateFirewallClient(tenantID string, in *store.FirewallClientCreate) (*store.FirewallClient, error) {
+	if in == nil || strings.TrimSpace(in.Name) == "" || len(in.TokenHash) != 32 {
+		return nil, store.ErrInvalidInput
+	}
+	id := uuid.NewString()
+	ctx := context.Background()
+	_, err := p.pool.Exec(ctx, `
+		INSERT INTO firewall_client (id, tenant_id, name, hostname, token_prefix, token_hash, client_version)
+		VALUES ($1,$2,$3,$4,$5,$6,$7)`,
+		id, tenantID, strings.TrimSpace(in.Name), strings.TrimSpace(in.Hostname),
+		in.TokenPrefix, in.TokenHash, strings.TrimSpace(in.ClientVersion))
+	if err != nil {
+		return nil, err
+	}
+	return p.GetFirewallClient(tenantID, id)
+}
+
+func (p *Postgres) UpdateFirewallClient(tenantID, id string, patch *store.FirewallClientPatch) (*store.FirewallClient, error) {
+	cur, err := p.GetFirewallClient(tenantID, id)
+	if err != nil {
+		return nil, err
+	}
+	if patch == nil {
+		return nil, store.ErrInvalidInput
+	}
+	name := cur.Name
+	hostname := cur.Hostname
+	if patch.Name != nil {
+		name = strings.TrimSpace(*patch.Name)
+		if name == "" {
+			return nil, store.ErrInvalidInput
+		}
+	}
+	if patch.Hostname != nil {
+		hostname = strings.TrimSpace(*patch.Hostname)
+	}
+	ctx := context.Background()
+	_, err = p.pool.Exec(ctx, `UPDATE firewall_client SET name=$3, hostname=$4 WHERE id=$1 AND tenant_id=$2`,
+		id, tenantID, name, hostname)
+	if err != nil {
+		return nil, err
+	}
+	return p.GetFirewallClient(tenantID, id)
+}
+
+func (p *Postgres) ApproveFirewallClient(tenantID, id, approverAPIKeyID string) (*store.FirewallClient, error) {
+	ctx := context.Background()
+	tag, err := p.pool.Exec(ctx, `
+		UPDATE firewall_client
+		SET status='approved', approved_at=now(), approved_by_api_key_id=$3, revoked_at=NULL
+		WHERE id=$1 AND tenant_id=$2 AND status != 'revoked'`, id, tenantID, nullIfEmpty(approverAPIKeyID))
+	if err != nil {
+		return nil, err
+	}
+	if tag.RowsAffected() == 0 {
+		return nil, store.ErrNotFound
+	}
+	return p.GetFirewallClient(tenantID, id)
+}
+
+func (p *Postgres) RevokeFirewallClient(tenantID, id string) error {
+	ctx := context.Background()
+	tag, err := p.pool.Exec(ctx, `
+		UPDATE firewall_client SET status='revoked', revoked_at=now() WHERE id=$1 AND tenant_id=$2`, id, tenantID)
+	if err != nil {
+		return err
+	}
+	if tag.RowsAffected() == 0 {
+		return store.ErrNotFound
+	}
+	return nil
+}
+
+func (p *Postgres) DeleteFirewallClient(tenantID, id string) error {
+	ctx := context.Background()
+	tag, err := p.pool.Exec(ctx, `DELETE FROM firewall_client WHERE id=$1 AND tenant_id=$2`, id, tenantID)
+	if err != nil {
+		return err
+	}
+	if tag.RowsAffected() == 0 {
+		return store.ErrNotFound
+	}
+	return nil
+}
+
+func (p *Postgres) LookupFirewallClientByTokenHash(hash []byte) (*store.FirewallClient, error) {
+	if len(hash) != 32 {
+		return nil, store.ErrNotFound
+	}
+	ctx := context.Background()
+	row := p.pool.QueryRow(ctx, `
+		SELECT tenant_id, `+firewallClientSelectCols+`
+		FROM firewall_client WHERE token_hash=$1`, hash)
+	c, err := scanFirewallClientLookupRow(row.Scan)
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return nil, store.ErrNotFound
+		}
+		return nil, err
+	}
+	return c, nil
+}
+
+func (p *Postgres) TouchFirewallClientLastSeen(id, source, clientIP, clientVersion string) error {
+	ctx := context.Background()
+	_, err := p.pool.Exec(ctx, `
+		UPDATE firewall_client SET last_seen_at=now(), last_seen_at_source=$2, last_seen_ip=$3,
+			client_version=COALESCE(NULLIF($4,''), client_version)
+		WHERE id=$1`, id, strings.TrimSpace(source), strings.TrimSpace(clientIP), strings.TrimSpace(clientVersion))
+	return err
+}
+
+func (p *Postgres) TouchFirewallClientLastApply(id, source, status, errMsg string, prefixCount, ipCount int, packetsDropped, packetsAccepted int64) error {
+	ctx := context.Background()
+	_, err := p.pool.Exec(ctx, `
+		UPDATE firewall_client SET last_apply_at=now(), last_apply_source=$2, last_apply_status=$3,
+			last_apply_error=$4, last_apply_prefix_count=$5, last_apply_ip_count=$6,
+			last_apply_packets_dropped=$7, last_apply_packets_accepted=$8
+		WHERE id=$1`, id, strings.TrimSpace(source), strings.TrimSpace(status), strings.TrimSpace(errMsg), prefixCount, ipCount, packetsDropped, packetsAccepted)
+	return err
+}
+
+func (p *Postgres) ListActiveFirewallClientHashes() ([]store.FirewallClientAuthRow, error) {
+	ctx := context.Background()
+	rows, err := p.pool.Query(ctx, `
+		SELECT id, tenant_id, token_hash FROM firewall_client WHERE status='approved'`)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var out []store.FirewallClientAuthRow
+	for rows.Next() {
+		var row store.FirewallClientAuthRow
+		if err := rows.Scan(&row.ID, &row.TenantID, &row.TokenHash); err != nil {
+			return nil, err
+		}
+		if len(row.TokenHash) != 32 {
+			continue
+		}
+		out = append(out, row)
+	}
+	return out, rows.Err()
+}
+
+func (p *Postgres) ListApprovedFirewallClientsForReplication(tenantID string) ([]store.FirewallClientReplicationRow, error) {
+	ctx := context.Background()
+	rows, err := p.pool.Query(ctx, `
+		SELECT id, name, token_hash FROM firewall_client
+		WHERE tenant_id=$1 AND status='approved' ORDER BY id`, tenantID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var out []store.FirewallClientReplicationRow
+	for rows.Next() {
+		var id, name string
+		var hash []byte
+		if err := rows.Scan(&id, &name, &hash); err != nil {
+			return nil, err
+		}
+		out = append(out, store.FirewallClientReplicationRow{
+			ClientID:     id,
+			Name:         name,
+			TokenHashHex: hex.EncodeToString(hash),
+		})
+	}
+	return out, rows.Err()
+}
+
+func (p *Postgres) ListFirewallRules(tenantID string, clientID *string) ([]*store.FirewallRule, error) {
+	ctx := context.Background()
+	var rows pgx.Rows
+	var err error
+	if clientID == nil {
+		rows, err = p.pool.Query(ctx, `
+			SELECT id, client_id, priority, action, community_id, comment, created_at, updated_at
+			FROM firewall_rule WHERE tenant_id=$1 AND client_id IS NULL ORDER BY priority`, tenantID)
+	} else {
+		rows, err = p.pool.Query(ctx, `
+			SELECT id, client_id, priority, action, community_id, comment, created_at, updated_at
+			FROM firewall_rule WHERE tenant_id=$1 AND client_id=$2 ORDER BY priority`, tenantID, *clientID)
+	}
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	return scanFirewallRules(rows, tenantID)
+}
+
+func (p *Postgres) ListAllFirewallRulesForClient(tenantID, clientID string) ([]*store.FirewallRule, error) {
+	ctx := context.Background()
+	rows, err := p.pool.Query(ctx, `
+		SELECT id, client_id, priority, action, community_id, comment, created_at, updated_at
+		FROM firewall_rule
+		WHERE tenant_id=$1 AND (client_id IS NULL OR client_id=$2)
+		ORDER BY CASE WHEN client_id IS NULL THEN 1 ELSE 0 END, priority`, tenantID, clientID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	return scanFirewallRules(rows, tenantID)
+}
+
+func (p *Postgres) ListAllFirewallRulesForReplication(tenantID string) ([]*store.FirewallRule, error) {
+	ctx := context.Background()
+	rows, err := p.pool.Query(ctx, `
+		SELECT id, client_id, priority, action, community_id, comment, created_at, updated_at
+		FROM firewall_rule WHERE tenant_id=$1
+		ORDER BY CASE WHEN client_id IS NULL THEN 1 ELSE 0 END, client_id, priority`, tenantID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	return scanFirewallRules(rows, tenantID)
+}
+
+func (p *Postgres) CreateFirewallRule(tenantID string, clientID *string, in *store.FirewallRuleCreate) (*store.FirewallRule, error) {
+	if in == nil || !store.ValidFirewallAction(in.Action) {
+		return nil, store.ErrInvalidInput
+	}
+	if clientID != nil {
+		if _, err := p.GetFirewallClient(tenantID, *clientID); err != nil {
+			return nil, err
+		}
+	}
+	priority := 1
+	if in.Priority != nil && *in.Priority >= 1 {
+		priority = *in.Priority
+	} else {
+		next, err := p.nextFirewallRulePriority(tenantID, clientID)
+		if err != nil {
+			return nil, err
+		}
+		priority = next
+	}
+	id := uuid.NewString()
+	ctx := context.Background()
+	_, err := p.pool.Exec(ctx, `
+		INSERT INTO firewall_rule (id, tenant_id, client_id, priority, action, community_id, comment)
+		VALUES ($1,$2,$3,$4,$5,$6,$7)`,
+		id, tenantID, clientID, priority, strings.ToLower(strings.TrimSpace(in.Action)), in.CommunityID, strings.TrimSpace(in.Comment))
+	if err != nil {
+		return nil, err
+	}
+	return p.GetFirewallRule(tenantID, id)
+}
+
+func (p *Postgres) GetFirewallRule(tenantID, id string) (*store.FirewallRule, error) {
+	ctx := context.Background()
+	row := p.pool.QueryRow(ctx, `
+		SELECT id, client_id, priority, action, community_id, comment, created_at, updated_at
+		FROM firewall_rule WHERE id=$1 AND tenant_id=$2`, id, tenantID)
+	r, err := scanFirewallRuleRow(row.Scan, tenantID)
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return nil, store.ErrNotFound
+		}
+		return nil, err
+	}
+	return r, nil
+}
+
+func (p *Postgres) UpdateFirewallRule(tenantID, ruleID string, patch *store.FirewallRulePatch) (*store.FirewallRule, error) {
+	cur, err := p.GetFirewallRule(tenantID, ruleID)
+	if err != nil {
+		return nil, err
+	}
+	if patch == nil {
+		return nil, store.ErrInvalidInput
+	}
+	action := cur.Action
+	communityID := cur.CommunityID
+	comment := cur.Comment
+	if patch.Action != nil {
+		if !store.ValidFirewallAction(*patch.Action) {
+			return nil, store.ErrInvalidInput
+		}
+		action = strings.ToLower(strings.TrimSpace(*patch.Action))
+	}
+	if patch.ClearCommunity {
+		communityID = nil
+	} else if patch.CommunityID != nil {
+		communityID = patch.CommunityID
+	}
+	if patch.Comment != nil {
+		comment = strings.TrimSpace(*patch.Comment)
+	}
+	ctx := context.Background()
+	_, err = p.pool.Exec(ctx, `
+		UPDATE firewall_rule SET action=$3, community_id=$4, comment=$5, updated_at=now()
+		WHERE id=$1 AND tenant_id=$2`, ruleID, tenantID, action, communityID, comment)
+	if err != nil {
+		return nil, err
+	}
+	return p.GetFirewallRule(tenantID, ruleID)
+}
+
+func (p *Postgres) DeleteFirewallRule(tenantID, ruleID string) error {
+	ctx := context.Background()
+	tag, err := p.pool.Exec(ctx, `DELETE FROM firewall_rule WHERE id=$1 AND tenant_id=$2`, ruleID, tenantID)
+	if err != nil {
+		return err
+	}
+	if tag.RowsAffected() == 0 {
+		return store.ErrNotFound
+	}
+	return nil
+}
+
+func (p *Postgres) ReorderFirewallRules(tenantID string, clientID *string, orderedIDs []string) error {
+	ctx := context.Background()
+	tx, err := p.pool.Begin(ctx)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = tx.Rollback(ctx) }()
+	for i, id := range orderedIDs {
+		var execErr error
+		if clientID == nil {
+			_, execErr = tx.Exec(ctx, `
+				UPDATE firewall_rule SET priority=$3, updated_at=now()
+				WHERE id=$1 AND tenant_id=$2 AND client_id IS NULL`, id, tenantID, i+1)
+		} else {
+			_, execErr = tx.Exec(ctx, `
+				UPDATE firewall_rule SET priority=$4, updated_at=now()
+				WHERE id=$1 AND tenant_id=$2 AND client_id=$3`, id, tenantID, *clientID, i+1)
+		}
+		if execErr != nil {
+			return execErr
+		}
+	}
+	return tx.Commit(ctx)
+}
+
+func (p *Postgres) nextFirewallRulePriority(tenantID string, clientID *string) (int, error) {
+	ctx := context.Background()
+	var max int
+	var err error
+	if clientID == nil {
+		err = p.pool.QueryRow(ctx, `
+			SELECT COALESCE(MAX(priority),0) FROM firewall_rule WHERE tenant_id=$1 AND client_id IS NULL`, tenantID).Scan(&max)
+	} else {
+		err = p.pool.QueryRow(ctx, `
+			SELECT COALESCE(MAX(priority),0) FROM firewall_rule WHERE tenant_id=$1 AND client_id=$2`, tenantID, *clientID).Scan(&max)
+	}
+	if err != nil {
+		return 0, err
+	}
+	return max + 1, nil
+}
+
+func scanFirewallRules(rows pgx.Rows, tenantID string) ([]*store.FirewallRule, error) {
+	var out []*store.FirewallRule
+	for rows.Next() {
+		r, err := scanFirewallRuleRow(rows.Scan, tenantID)
+		if err != nil {
+			return nil, err
+		}
+		out = append(out, r)
+	}
+	return out, rows.Err()
+}
+
+func scanFirewallRuleRow(scan scanFn, tenantID string) (*store.FirewallRule, error) {
+	var r store.FirewallRule
+	r.TenantID = tenantID
+	var clientID, communityID *string
+	if err := scan(&r.ID, &clientID, &r.Priority, &r.Action, &communityID, &r.Comment, &r.CreatedAt, &r.UpdatedAt); err != nil {
+		return nil, err
+	}
+	r.ClientID = clientID
+	r.CommunityID = communityID
+	return &r, nil
+}
+
+func scanFirewallClientRow(scan scanFn, tenantID string) (*store.FirewallClient, error) {
+	var c store.FirewallClient
+	c.TenantID = tenantID
+	var approvedBy *string
+	var lastSeen, lastApply, approved, revoked *time.Time
+	var prefixCount, ipCount *int
+	var packetsDropped, packetsAccepted *int64
+	if err := scan(
+		&c.ID, &c.Name, &c.Hostname, &c.TokenPrefix, &c.Status,
+		&lastSeen, &c.LastSeenAtSource, &c.LastSeenIP,
+		&lastApply, &c.LastApplyStatus, &c.LastApplyError,
+		&prefixCount, &ipCount, &packetsDropped, &packetsAccepted, &c.LastApplySource,
+		&c.ClientVersion, &c.CreatedAt, &approved, &approvedBy, &revoked,
+	); err != nil {
+		return nil, err
+	}
+	return finishFirewallClientScan(&c, lastSeen, lastApply, approved, revoked, approvedBy, prefixCount, ipCount, packetsDropped, packetsAccepted), nil
+}
+
+func scanFirewallClientLookupRow(scan scanFn) (*store.FirewallClient, error) {
+	var c store.FirewallClient
+	var approvedBy *string
+	var lastSeen, lastApply, approved, revoked *time.Time
+	var prefixCount, ipCount *int
+	var packetsDropped, packetsAccepted *int64
+	if err := scan(
+		&c.TenantID, &c.ID, &c.Name, &c.Hostname, &c.TokenPrefix, &c.Status,
+		&lastSeen, &c.LastSeenAtSource, &c.LastSeenIP,
+		&lastApply, &c.LastApplyStatus, &c.LastApplyError,
+		&prefixCount, &ipCount, &packetsDropped, &packetsAccepted, &c.LastApplySource,
+		&c.ClientVersion, &c.CreatedAt, &approved, &approvedBy, &revoked,
+	); err != nil {
+		return nil, err
+	}
+	return finishFirewallClientScan(&c, lastSeen, lastApply, approved, revoked, approvedBy, prefixCount, ipCount, packetsDropped, packetsAccepted), nil
+}
+
+func finishFirewallClientScan(c *store.FirewallClient, lastSeen, lastApply, approved, revoked *time.Time, approvedBy *string, prefixCount, ipCount *int, packetsDropped, packetsAccepted *int64) *store.FirewallClient {
+	c.LastSeenAt = lastSeen
+	c.LastApplyAt = lastApply
+	c.ApprovedAt = approved
+	c.RevokedAt = revoked
+	if approvedBy != nil {
+		c.ApprovedByAPIKeyID = *approvedBy
+	}
+	if prefixCount != nil {
+		c.LastApplyPrefixCount = *prefixCount
+	}
+	if ipCount != nil {
+		c.LastApplyIPCount = *ipCount
+	}
+	if packetsDropped != nil {
+		c.LastApplyPacketsDropped = *packetsDropped
+	}
+	if packetsAccepted != nil {
+		c.LastApplyPacketsAccepted = *packetsAccepted
+	}
+	return c
+}
+
+func nullIfEmpty(s string) any {
+	if strings.TrimSpace(s) == "" {
+		return nil
+	}
+	return s
+}

internal/repository/postgres_firewall_test.go

@@ -0,0 +1,52 @@
+package repository
+
+import (
+	"context"
+	"os"
+	"testing"
+
+	"evobgp/internal/authkey"
+	"evobgp/internal/db"
+	"evobgp/internal/store"
+)
+
+func TestPostgresFirewallClientCreateAndGetIntegration(t *testing.T) {
+	dsn := os.Getenv("EVOBGP_TEST_DATABASE_URL")
+	if dsn == "" {
+		t.Skip("EVOBGP_TEST_DATABASE_URL not set")
+	}
+	ctx := context.Background()
+	pool, err := db.OpenPostgresPool(ctx, dsn)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer pool.Close()
+	pg, err := NewPostgres(ctx, pool, true)
+	if err != nil {
+		t.Fatal(err)
+	}
+	tenant, _, _, _, _ := pg.DemoIDs()
+	if tenant == "" {
+		t.Fatal("demo tenant required")
+	}
+	tok := "evobgp_fw_pgtest_" + t.Name()
+	hash := authkey.HashToken(tok)
+	client, err := pg.CreateFirewallClient(tenant, &store.FirewallClientCreate{
+		Name:          "pg-firewall-test",
+		Hostname:      "test.local",
+		TokenPrefix:   tok[:12],
+		TokenHash:     hash,
+		ClientVersion: "test/1",
+	})
+	if err != nil {
+		t.Fatalf("create: %v", err)
+	}
+	got, err := pg.GetFirewallClient(tenant, client.ID)
+	if err != nil {
+		t.Fatalf("get: %v", err)
+	}
+	if got.Name != "pg-firewall-test" || got.Status != "pending" {
+		t.Fatalf("got %+v", got)
+	}
+	_ = pg.DeleteFirewallClient(tenant, client.ID)
+}

internal/store/backend.go

@@ -131,6 +131,28 @@ type Backend interface {
 	// Runtime log cleanup audit (filesystem ops logged per tenant).
 	AppendRuntimeLogCleanupAudit(tenantID, actor, filename, action string, sizeBefore int64, sizeAfter *int64, detail map[string]any) (string, error)
 	ListRuntimeLogCleanupAudit(tenantID, cursor string, limit int) ([]*RuntimeLogCleanupAudit, string, bool, error)
+
+	// Firewall blocklist clients and policy rules.
+	ListFirewallClients(tenantID string) ([]*FirewallClient, error)
+	GetFirewallClient(tenantID, id string) (*FirewallClient, error)
+	CreateFirewallClient(tenantID string, in *FirewallClientCreate) (*FirewallClient, error)
+	UpdateFirewallClient(tenantID, id string, patch *FirewallClientPatch) (*FirewallClient, error)
+	ApproveFirewallClient(tenantID, id, approverAPIKeyID string) (*FirewallClient, error)
+	RevokeFirewallClient(tenantID, id string) error
+	DeleteFirewallClient(tenantID, id string) error
+	LookupFirewallClientByTokenHash(hash []byte) (*FirewallClient, error)
+	TouchFirewallClientLastSeen(id, source, clientIP, clientVersion string) error
+	TouchFirewallClientLastApply(id, source, status, errMsg string, prefixCount, ipCount int, packetsDropped, packetsAccepted int64) error
+	ListActiveFirewallClientHashes() ([]FirewallClientAuthRow, error)
+	ListApprovedFirewallClientsForReplication(tenantID string) ([]FirewallClientReplicationRow, error)
+
+	ListFirewallRules(tenantID string, clientID *string) ([]*FirewallRule, error)
+	ListAllFirewallRulesForClient(tenantID, clientID string) ([]*FirewallRule, error)
+	ListAllFirewallRulesForReplication(tenantID string) ([]*FirewallRule, error)
+	CreateFirewallRule(tenantID string, clientID *string, in *FirewallRuleCreate) (*FirewallRule, error)
+	UpdateFirewallRule(tenantID, ruleID string, patch *FirewallRulePatch) (*FirewallRule, error)
+	DeleteFirewallRule(tenantID, ruleID string) error
+	ReorderFirewallRules(tenantID string, clientID *string, orderedIDs []string) error
 }
 
 // ASNPrefixCacheEntry is a cached RIPEstat response for one ASN.