feat: enhance dashboard and monitoring components with new analytics skeletons

Added the AnalyticsDashboardSkeleton component to improve loading states in the dashboard and monitoring pages. Refactored the dashboard to utilize the new skeleton for initial loading, replacing the previous SectionCardsSkeleton. Updated the overview queries to increase job limit from 10 to 100 for better data handling. Enhanced the network and operations components to incorporate new analytics cards, streamlining the user experience and improving data presentation.

.codegraph/daemon.pid

@@ -1,6 +1,6 @@
 {
-  "pid": 59836,
+  "pid": 43636,
   "version": "0.9.9",
   "socketPath": "\\\\.\\pipe\\codegraph-97b92efdcc5351da",
-  "startedAt": 1783332305171
+  "startedAt": 1783570299043
 }

apps/web/src/components/access/access-api-keys-card.tsx

@@ -0,0 +1,103 @@
+import { useState } from 'react'
+import { Plus, RefreshCw } from 'lucide-react'
+
+import { Button } from '@evobgp/ui/components/button'
+
+import { AccessApiKeysGrid } from '@/components/access/access-api-keys-grid'
+import { DataGridCard } from '@/components/data-grid-shell'
+import { ApiKeyCreateDialog } from '@/components/access/api-key-create-dialog'
+import { ApiKeyTokenDialog } from '@/components/access/api-key-token-dialog'
+import { QueryState } from '@/components/query-state'
+import { TableSkeleton } from '@/components/skeletons'
+import { useRevokeApiKeyMutation, useRotateApiKeyMutation } from '@/queries/api-keys'
+import type { ApiKey, ApiKeyCreated } from '@/types/api'
+
+interface AccessApiKeysCardProps {
+  items: ApiKey[]
+  isLoading: boolean
+  isError: boolean
+  error: unknown
+  onRetry: () => void
+}
+
+export function AccessApiKeysCard({
+  items,
+  isLoading,
+  isError,
+  error,
+  onRetry,
+}: AccessApiKeysCardProps) {
+  const [createOpen, setCreateOpen] = useState(false)
+  const [tokenDialogOpen, setTokenDialogOpen] = useState(false)
+  const [revealedToken, setRevealedToken] = useState('')
+
+  const revoke = useRevokeApiKeyMutation()
+  const rotate = useRotateApiKeyMutation()
+
+  function showToken(created: ApiKeyCreated) {
+    setRevealedToken(created.token)
+    setTokenDialogOpen(true)
+  }
+
+  function handleRotated(id: string) {
+    rotate.mutate(id, {
+      onSuccess: (created) => showToken(created),
+    })
+  }
+
+  return (
+    <>
+      <DataGridCard
+        title="API-ключи"
+        description="Управление ключами tenant. Полный токен показывается только при создании и ротации."
+        actions={
+          <>
+            <Button size="sm" variant="outline" type="button" onClick={onRetry} disabled={isLoading}>
+              <RefreshCw className={isLoading ? 'animate-spin' : ''} />
+              Обновить
+            </Button>
+            <Button size="sm" type="button" onClick={() => setCreateOpen(true)}>
+              <Plus />
+              Создать
+            </Button>
+          </>
+        }
+      >
+        <QueryState
+          data={items}
+          isLoading={isLoading}
+          isError={isError}
+          error={error}
+          empty={items.length === 0}
+          emptyTitle="Нет ключей"
+          emptyDescription="Создайте API-ключ для автоматизации или отдельного доступа."
+          skeleton={<TableSkeleton rows={4} cols={6} />}
+          onRetry={onRetry}
+        >
+          {(data) => (
+            <AccessApiKeysGrid
+              items={data}
+              isLoading={isLoading}
+              onRotate={handleRotated}
+              onRevoke={(id) => revoke.mutate(id)}
+              rotatePending={rotate.isPending}
+              revokePending={revoke.isPending}
+            />
+          )}
+        </QueryState>
+      </DataGridCard>
+
+      <ApiKeyCreateDialog
+        open={createOpen}
+        onOpenChange={setCreateOpen}
+        onCreated={showToken}
+      />
+
+      <ApiKeyTokenDialog
+        open={tokenDialogOpen}
+        token={revealedToken}
+        onOpenChange={setTokenDialogOpen}
+      />
+    </>
+  )
+}

apps/web/src/components/access/access-api-keys-grid.tsx

@@ -0,0 +1,158 @@
+import { ColumnDef, useReactTable } from '@tanstack/react-table'
+import { RefreshCw, Trash2 } from 'lucide-react'
+import { useMemo } from 'react'
+
+import { Button } from '@evobgp/ui/components/button'
+
+import { DataGridShell } from '@/components/data-grid-shell'
+import { Badge } from '@/components/reui/badge'
+import { ConfirmDialog } from '@/components/confirm-dialog'
+import { StatusBadge } from '@/components/status-badge'
+import { DataGridColumnHeader } from '@/components/reui/data-grid/data-grid-column-header'
+import { formatApiKeyDate } from '@/lib/access/api-key-labels'
+import { createClientDataGridOptions } from '@/lib/data-grid-defaults'
+import type { ApiKey } from '@/types/api'
+
+export function AccessApiKeysGrid({
+  items,
+  isLoading = false,
+  onRotate,
+  onRevoke,
+  rotatePending = false,
+  revokePending = false,
+}: {
+  items: ApiKey[]
+  isLoading?: boolean
+  onRotate: (id: string) => void
+  onRevoke: (id: string) => void
+  rotatePending?: boolean
+  revokePending?: boolean
+}) {
+  const columns = useMemo<ColumnDef<ApiKey>[]>(
+    () => [
+      {
+        accessorKey: 'name',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Имя" />,
+        cell: ({ row }) => <span className="font-medium">{row.original.name}</span>,
+        meta: { headerTitle: 'Имя' },
+      },
+      {
+        accessorKey: 'role',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Роль" />,
+        cell: ({ row }) => (
+          <Badge variant="outline" className="font-mono text-xs">
+            {row.original.role}
+          </Badge>
+        ),
+        meta: { headerTitle: 'Роль' },
+      },
+      {
+        accessorKey: 'prefix',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Префикс" />,
+        cell: ({ row }) => (
+          <span className="font-mono text-xs text-muted-foreground">{row.original.prefix}…</span>
+        ),
+        meta: { headerTitle: 'Префикс' },
+      },
+      {
+        id: 'status',
+        enableSorting: false,
+        header: 'Статус',
+        cell: ({ row }) =>
+          row.original.revoked_at ? (
+            <StatusBadge status="error" label="отозван" />
+          ) : (
+            <StatusBadge status="active" label="активен" />
+          ),
+        meta: { headerTitle: 'Статус' },
+      },
+      {
+        id: 'expires_at',
+        accessorFn: (row) => row.expires_at ?? '',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Истекает" />,
+        cell: ({ row }) => (
+          <span className="text-sm text-muted-foreground">
+            {formatApiKeyDate(row.original.expires_at)}
+          </span>
+        ),
+        meta: { headerTitle: 'Истекает' },
+      },
+      {
+        id: 'last_used_at',
+        accessorFn: (row) => row.last_used_at ?? '',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Последнее использование" />,
+        cell: ({ row }) => (
+          <span className="text-sm text-muted-foreground">
+            {formatApiKeyDate(row.original.last_used_at)}
+          </span>
+        ),
+        meta: { headerTitle: 'Последнее использование' },
+      },
+      {
+        id: 'actions',
+        enableSorting: false,
+        header: () => null,
+        cell: ({ row }) => {
+          const k = row.original
+          return (
+            <div className="flex gap-1">
+              <ConfirmDialog
+                trigger={
+                  <Button
+                    variant="ghost"
+                    size="icon-sm"
+                    type="button"
+                    title="Ротировать"
+                    disabled={!!k.revoked_at || rotatePending}
+                  >
+                    <RefreshCw className="size-3.5" />
+                  </Button>
+                }
+                title="Ротировать ключ?"
+                description="Старый токен перестанет работать сразу."
+                confirmLabel="Ротировать"
+                onConfirm={() => onRotate(k.id)}
+              />
+              <ConfirmDialog
+                trigger={
+                  <Button
+                    variant="ghost"
+                    size="icon-sm"
+                    type="button"
+                    className="text-destructive"
+                    disabled={!!k.revoked_at || revokePending}
+                    title="Отозвать"
+                  >
+                    <Trash2 className="size-3.5" />
+                  </Button>
+                }
+                title="Отозвать API-ключ?"
+                description={`${k.name} (${k.prefix}…)`}
+                confirmLabel="Отозвать"
+                destructive
+                onConfirm={() => onRevoke(k.id)}
+              />
+            </div>
+          )
+        },
+      },
+    ],
+    [onRevoke, onRotate, revokePending, rotatePending],
+  )
+
+  const table = useReactTable({
+    data: items,
+    columns,
+    ...createClientDataGridOptions<ApiKey>(),
+    getRowId: (row) => row.id,
+  })
+
+  return (
+    <DataGridShell
+      table={table}
+      recordCount={items.length}
+      isLoading={isLoading}
+      emptyMessage="Нет ключей"
+    />
+  )
+}

apps/web/src/components/access/api-key-create-dialog.tsx

@@ -0,0 +1,115 @@
+import { useEffect, useState } from 'react'
+import { toast } from 'sonner'
+
+import { Button } from '@evobgp/ui/components/button'
+import {
+  Dialog,
+  DialogContent,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+} from '@evobgp/ui/components/dialog'
+import { Input } from '@evobgp/ui/components/input'
+import { Label } from '@evobgp/ui/components/label'
+
+import { LoadingButton } from '@/components/loading-button'
+import { SelectField } from '@/components/select-field'
+import { API_KEY_ROLE_ITEMS } from '@/lib/access/api-key-labels'
+import { useCreateApiKeyMutation } from '@/queries/api-keys'
+import type { ApiKeyCreate, ApiKeyCreated, ApiKeyRole } from '@/types/api'
+
+interface ApiKeyCreateDialogProps {
+  open: boolean
+  onOpenChange: (open: boolean) => void
+  onCreated: (created: ApiKeyCreated) => void
+}
+
+export function ApiKeyCreateDialog({ open, onOpenChange, onCreated }: ApiKeyCreateDialogProps) {
+  const createMutation = useCreateApiKeyMutation()
+  const [name, setName] = useState('')
+  const [role, setRole] = useState<ApiKeyRole>('editor')
+  const [expiresLocal, setExpiresLocal] = useState('')
+
+  useEffect(() => {
+    if (!open) return
+    setName('')
+    setRole('editor')
+    setExpiresLocal('')
+  }, [open])
+
+  function handleOpenChange(next: boolean) {
+    onOpenChange(next)
+  }
+
+  async function save() {
+    if (!name.trim()) {
+      toast.error('Укажите имя')
+      return
+    }
+    const body: ApiKeyCreate = {
+      name: name.trim(),
+      role,
+    }
+    if (expiresLocal.trim()) {
+      const d = new Date(expiresLocal)
+      if (Number.isNaN(d.getTime())) {
+        toast.error('Некорректная дата истечения')
+        return
+      }
+      body.expires_at = d.toISOString()
+    }
+    try {
+      const created = await createMutation.mutateAsync(body)
+      onOpenChange(false)
+      onCreated(created)
+    } catch {
+      // toast handled in mutation
+    }
+  }
+
+  return (
+    <Dialog open={open} onOpenChange={handleOpenChange}>
+      <DialogContent className="sm:max-w-sm">
+        <DialogHeader>
+          <DialogTitle>Новый API-ключ</DialogTitle>
+        </DialogHeader>
+        <div className="flex flex-col gap-4 py-2">
+          <div className="flex flex-col gap-2">
+            <Label htmlFor="key-name">Имя</Label>
+            <Input
+              id="key-name"
+              value={name}
+              onChange={(e) => setName(e.target.value)}
+              placeholder="CI / оператор UI"
+            />
+          </div>
+          <SelectField
+            id="key-role"
+            label="Роль"
+            items={[...API_KEY_ROLE_ITEMS]}
+            value={role}
+            placeholder="Выберите роль"
+            onValueChange={(v) => v && setRole(v as ApiKeyRole)}
+          />
+          <div className="flex flex-col gap-2">
+            <Label htmlFor="key-expires">Истекает (опционально)</Label>
+            <Input
+              id="key-expires"
+              type="datetime-local"
+              value={expiresLocal}
+              onChange={(e) => setExpiresLocal(e.target.value)}
+            />
+          </div>
+        </div>
+        <DialogFooter>
+          <Button variant="outline" onClick={() => handleOpenChange(false)}>
+            Отмена
+          </Button>
+          <LoadingButton onClick={save} loading={createMutation.isPending}>
+            Создать
+          </LoadingButton>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  )
+}

apps/web/src/components/access/api-key-token-dialog.tsx

@@ -0,0 +1,51 @@
+import { Copy } from 'lucide-react'
+import { toast } from 'sonner'
+
+import { Button } from '@evobgp/ui/components/button'
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+} from '@evobgp/ui/components/dialog'
+
+interface ApiKeyTokenDialogProps {
+  open: boolean
+  token: string
+  onOpenChange: (open: boolean) => void
+}
+
+export function ApiKeyTokenDialog({ open, token, onOpenChange }: ApiKeyTokenDialogProps) {
+  async function copyToken() {
+    if (!token) return
+    try {
+      await navigator.clipboard.writeText(token)
+      toast.success('Скопировано')
+    } catch {
+      toast.error('Не удалось скопировать')
+    }
+  }
+
+  return (
+    <Dialog open={open} onOpenChange={onOpenChange}>
+      <DialogContent className="sm:max-w-md">
+        <DialogHeader>
+          <DialogTitle>Сохраните токен</DialogTitle>
+          <DialogDescription>
+            Он больше не будет показан. Скопируйте в безопасное хранилище.
+          </DialogDescription>
+        </DialogHeader>
+        <div className="break-all rounded-md border bg-muted/40 p-3 font-mono text-xs">{token}</div>
+        <DialogFooter>
+          <Button variant="outline" onClick={copyToken}>
+            <Copy />
+            Копировать
+          </Button>
+          <Button onClick={() => onOpenChange(false)}>Готово</Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  )
+}

apps/web/src/components/analytics/analytics-activity-list.tsx

@@ -0,0 +1,54 @@
+import { AlertTriangle, CheckCircle, Info } from 'lucide-react'
+
+import { cn } from '@evobgp/ui/lib/utils'
+
+import { StatusBadge } from '@/components/status-badge'
+import type { PlatformActivityItem } from '@/lib/metrics'
+
+const KIND_ICON = {
+  job: Info,
+  revision: CheckCircle,
+  network: AlertTriangle,
+} as const
+
+const KIND_ICON_CLASS = {
+  job: 'text-info',
+  revision: 'text-success',
+  network: 'text-warning',
+} as const
+
+export function AnalyticsActivityList({
+  items,
+  className,
+}: {
+  items: PlatformActivityItem[]
+  className?: string
+}) {
+  if (items.length === 0) {
+    return <p className="text-sm text-muted-foreground">Нет недавних событий</p>
+  }
+
+  return (
+    <ul className={cn('space-y-3', className)}>
+      {items.map((item) => {
+        const Icon = KIND_ICON[item.kind]
+        return (
+          <li key={item.id} className="flex items-start justify-between gap-3">
+            <div className="flex min-w-0 items-start gap-2.5">
+              <span
+                className={cn(
+                  'mt-0.5 flex size-7 shrink-0 items-center justify-center rounded-full bg-muted/60',
+                  KIND_ICON_CLASS[item.kind],
+                )}
+              >
+                <Icon className="size-3.5" />
+              </span>
+              <p className="text-sm leading-snug">{item.message}</p>
+            </div>
+            <StatusBadge status={item.status} label={item.statusLabel} />
+          </li>
+        )
+      })}
+    </ul>
+  )
+}

apps/web/src/components/analytics/analytics-card-shell.tsx

@@ -0,0 +1,64 @@
+import type { ReactNode } from 'react'
+import { Info } from 'lucide-react'
+
+import {
+  Card,
+  CardContent,
+  CardDescription,
+  CardFooter,
+  CardHeader,
+  CardTitle,
+} from '@evobgp/ui/components/card'
+import { cn } from '@evobgp/ui/lib/utils'
+import {
+  Tooltip,
+  TooltipContent,
+  TooltipTrigger,
+} from '@evobgp/ui/components/tooltip'
+
+export function AnalyticsCardShell({
+  title,
+  description,
+  info,
+  actions,
+  footer,
+  className,
+  children,
+}: {
+  title: string
+  description?: string
+  info?: string
+  actions?: ReactNode
+  footer?: ReactNode
+  className?: string
+  children: ReactNode
+}) {
+  return (
+    <Card className={cn('flex h-full flex-col gap-0 overflow-hidden', className)}>
+      <CardHeader className="flex flex-row items-start justify-between gap-3 border-b py-4">
+        <div className="min-w-0 space-y-1">
+          <CardTitle className="flex items-center gap-2 text-base">
+            {title}
+            {info ? (
+              <Tooltip>
+                <TooltipTrigger
+                  className="inline-flex text-muted-foreground transition-colors hover:text-foreground"
+                  aria-label="Подробнее"
+                >
+                  <Info className="size-3.5" />
+                </TooltipTrigger>
+                <TooltipContent side="top" className="max-w-xs text-xs">
+                  {info}
+                </TooltipContent>
+              </Tooltip>
+            ) : null}
+          </CardTitle>
+          {description ? <CardDescription>{description}</CardDescription> : null}
+        </div>
+        {actions ? <div className="shrink-0">{actions}</div> : null}
+      </CardHeader>
+      <CardContent className="flex flex-1 flex-col gap-5 p-5">{children}</CardContent>
+      {footer ? <CardFooter className="gap-2 border-t p-4">{footer}</CardFooter> : null}
+    </Card>
+  )
+}

apps/web/src/components/analytics/analytics-kpi-row.tsx

@@ -0,0 +1,50 @@
+import { Minus, TrendingDown, TrendingUp } from 'lucide-react'
+
+import { cn } from '@evobgp/ui/lib/utils'
+
+export type AnalyticsKpiItem = {
+  label: string
+  value: string
+  delta?: {
+    direction: 'up' | 'down' | 'neutral'
+    label: string
+    tone?: 'success' | 'warning' | 'destructive' | 'muted'
+  }
+}
+
+const TONE_CLASS = {
+  success: 'text-success',
+  warning: 'text-warning',
+  destructive: 'text-destructive',
+  muted: 'text-muted-foreground',
+} as const
+
+function DeltaIcon({ direction }: { direction: AnalyticsKpiItem['delta'] extends infer D ? D extends { direction: infer Dir } ? Dir : never : never }) {
+  if (direction === 'up') return <TrendingUp className="size-3" />
+  if (direction === 'down') return <TrendingDown className="size-3" />
+  return <Minus className="size-3" />
+}
+
+export function AnalyticsKpiRow({ items, className }: { items: AnalyticsKpiItem[]; className?: string }) {
+  return (
+    <div className={cn('grid gap-4 sm:grid-cols-3', className)}>
+      {items.map((item) => (
+        <div key={item.label} className="min-w-0 space-y-1">
+          <p className="text-xs text-muted-foreground">{item.label}</p>
+          <p className="text-2xl font-semibold tracking-tight tabular-nums">{item.value}</p>
+          {item.delta ? (
+            <p
+              className={cn(
+                'flex items-center gap-1 text-xs',
+                TONE_CLASS[item.delta.tone ?? 'muted'],
+              )}
+            >
+              <DeltaIcon direction={item.delta.direction} />
+              {item.delta.label}
+            </p>
+          ) : null}
+        </div>
+      ))}
+    </div>
+  )
+}

apps/web/src/components/analytics/analytics-progress.tsx

@@ -0,0 +1,31 @@
+import {
+  Progress,
+  ProgressIndicator,
+  ProgressTrack,
+} from '@evobgp/ui/components/progress'
+import { cn } from '@evobgp/ui/lib/utils'
+
+export function AnalyticsProgress({
+  label,
+  value,
+  className,
+}: {
+  label: string
+  value: number
+  className?: string
+}) {
+  const clamped = Math.max(0, Math.min(100, value))
+  return (
+    <div className={cn('space-y-2', className)}>
+      <div className="flex items-center justify-between gap-2 text-sm">
+        <span className="text-muted-foreground">{label}</span>
+        <span className="font-medium tabular-nums">{clamped}%</span>
+      </div>
+      <Progress value={clamped} className="gap-0">
+        <ProgressTrack className="h-2">
+          <ProgressIndicator className="bg-foreground" />
+        </ProgressTrack>
+      </Progress>
+    </div>
+  )
+}

apps/web/src/components/analytics/analytics-segment-control.tsx

@@ -0,0 +1,35 @@
+import { Button } from '@evobgp/ui/components/button'
+import { ButtonGroup } from '@evobgp/ui/components/button-group'
+import { cn } from '@evobgp/ui/lib/utils'
+
+export function AnalyticsSegmentControl<T extends string>({
+  value,
+  onChange,
+  options,
+  className,
+}: {
+  value: T
+  onChange: (value: T) => void
+  options: { value: T; label: string }[]
+  className?: string
+}) {
+  return (
+    <ButtonGroup className={cn('rounded-lg bg-muted/50 p-0.5', className)}>
+      {options.map((option) => (
+        <Button
+          key={option.value}
+          type="button"
+          size="sm"
+          variant={value === option.value ? 'secondary' : 'ghost'}
+          className={cn(
+            'h-7 rounded-md px-2.5 text-xs',
+            value === option.value && 'bg-background shadow-sm',
+          )}
+          onClick={() => onChange(option.value)}
+        >
+          {option.label}
+        </Button>
+      ))}
+    </ButtonGroup>
+  )
+}

apps/web/src/components/analytics/chart-bar-strip.tsx

@@ -0,0 +1,41 @@
+import { Bar, BarChart, XAxis } from 'recharts'
+
+import { ChartContainer, type ChartConfig } from '@evobgp/ui/components/chart'
+import { cn } from '@evobgp/ui/lib/utils'
+
+import type { CapacityBar } from '@/lib/metrics'
+
+const chartConfig = {
+  value: { label: 'Загрузка', color: 'var(--color-chart-2)' },
+} satisfies ChartConfig
+
+export function ChartBarStrip({
+  bars,
+  className,
+}: {
+  bars: CapacityBar[]
+  className?: string
+}) {
+  if (bars.length === 0) {
+    return (
+      <div className={cn('flex h-36 items-center justify-center text-sm text-muted-foreground', className)}>
+        Нет данных для графика
+      </div>
+    )
+  }
+
+  const data = bars.map((bar, index) => ({
+    ...bar,
+    slot: index + 1,
+    fill: bar.value >= 80 ? 'var(--color-chart-2)' : 'var(--color-chart-3)',
+  }))
+
+  return (
+    <ChartContainer config={chartConfig} className={cn('aspect-auto h-36 w-full', className)}>
+      <BarChart data={data} margin={{ top: 4, right: 0, left: 0, bottom: 0 }}>
+        <XAxis dataKey="slot" hide />
+        <Bar dataKey="value" radius={[3, 3, 0, 0]} maxBarSize={10} />
+      </BarChart>
+    </ChartContainer>
+  )
+}

apps/web/src/components/analytics/chart-donut-metric.tsx

@@ -0,0 +1,100 @@
+import { Cell, Label, Pie, PieChart } from 'recharts'
+
+import {
+  ChartContainer,
+  type ChartConfig,
+} from '@evobgp/ui/components/chart'
+import { cn } from '@evobgp/ui/lib/utils'
+
+import type { BreakdownSlice } from '@/lib/metrics'
+
+export function ChartDonutMetric({
+  slices,
+  centerLabel,
+  centerValue,
+  className,
+}: {
+  slices: BreakdownSlice[]
+  centerLabel: string
+  centerValue: string | number
+  className?: string
+}) {
+  const chartConfig = slices.reduce<ChartConfig>((acc, slice) => {
+    acc[slice.key] = { label: slice.label, color: slice.color }
+    return acc
+  }, {})
+
+  const data = slices.map((slice) => ({
+    ...slice,
+    fill: slice.color,
+  }))
+
+  const total = slices.reduce((sum, slice) => sum + slice.count, 0)
+
+  if (total === 0) {
+    return (
+      <div className={cn('flex h-48 items-center justify-center text-sm text-muted-foreground', className)}>
+        Нет данных
+      </div>
+    )
+  }
+
+  return (
+    <div className={cn('flex items-center gap-6', className)}>
+      <ChartContainer config={chartConfig} className="mx-0 aspect-square h-44 w-44 shrink-0">
+        <PieChart>
+          <Pie
+            data={data}
+            dataKey="count"
+            nameKey="label"
+            innerRadius={52}
+            outerRadius={72}
+            strokeWidth={2}
+            stroke="var(--color-card)"
+          >
+            {data.map((entry) => (
+              <Cell key={entry.key} fill={entry.fill} />
+            ))}
+            <Label
+              content={({ viewBox }) => {
+                if (!viewBox || !('cx' in viewBox) || !('cy' in viewBox)) return null
+                const { cx, cy } = viewBox
+                return (
+                  <text x={cx} y={cy} textAnchor="middle" dominantBaseline="middle">
+                    <tspan x={cx} y={(cy ?? 0) - 6} className="fill-muted-foreground text-xs">
+                      {centerLabel}
+                    </tspan>
+                    <tspan x={cx} y={(cy ?? 0) + 14} className="fill-foreground text-xl font-semibold">
+                      {centerValue}
+                    </tspan>
+                  </text>
+                )
+              }}
+            />
+          </Pie>
+        </PieChart>
+      </ChartContainer>
+
+      <ul className="min-w-0 flex-1 space-y-3">
+        {slices.map((slice) => {
+          const pct = total > 0 ? ((slice.count / total) * 100).toFixed(1) : '0'
+          return (
+            <li key={slice.key} className="flex items-center justify-between gap-3 text-sm">
+              <div className="flex min-w-0 items-center gap-2">
+                <span
+                  className="size-2 shrink-0 rounded-full"
+                  style={{ backgroundColor: slice.color }}
+                />
+                <span className="truncate text-muted-foreground">{slice.label}</span>
+              </div>
+              <div className="shrink-0 text-right tabular-nums">
+                <span className="font-semibold">{slice.count}</span>
+                <span className="ml-2 text-muted-foreground">{pct}%</span>
+              </div>
+            </li>
+          )
+        })}
+      </ul>
+    </div>
+  )
+}

apps/web/src/components/analytics/dashboard-network-capacity-card.tsx

@@ -0,0 +1,107 @@
+import { useMemo, useState } from 'react'
+
+import {
+  Avatar,
+  AvatarFallback,
+  AvatarGroup,
+  AvatarGroupCount,
+} from '@evobgp/ui/components/avatar'
+
+import { AnalyticsCardShell } from '@/components/analytics/analytics-card-shell'
+import { AnalyticsSegmentControl } from '@/components/analytics/analytics-segment-control'
+import { ChartBarStrip } from '@/components/analytics/chart-bar-strip'
+import {
+  capacityUtilization,
+  peerCapacityBars,
+  speakerCapacityBars,
+} from '@/lib/metrics'
+import { runningJobCount } from '@/queries/overview'
+import type { JobRow, PeerRow, SpeakerRow } from '@/types/api'
+
+type CapacityMode = 'peers' | 'speakers'
+
+function speakerInitials(speaker: SpeakerRow): string {
+  const label = speaker.live?.label ?? speaker.agent_domain ?? speaker.endpoint ?? speaker.id
+  const parts = label.split(/[.\-_@/]/).filter(Boolean)
+  if (parts.length >= 2) return (parts[0][0] + parts[1][0]).toUpperCase()
+  return label.slice(0, 2).toUpperCase()
+}
+
+export function DashboardNetworkCapacityCard({
+  peers,
+  speakers,
+  jobs,
+  loading,
+}: {
+  peers: PeerRow[]
+  speakers: SpeakerRow[]
+  jobs: JobRow[]
+  loading?: boolean
+}) {
+  const [mode, setMode] = useState<CapacityMode>('peers')
+
+  const bars = useMemo(
+    () => (mode === 'peers' ? peerCapacityBars(peers) : speakerCapacityBars(speakers)),
+    [mode, peers, speakers],
+  )
+  const utilization = capacityUtilization(bars)
+  const queued = runningJobCount(jobs)
+  const previewSpeakers = speakers.slice(0, 3)
+
+  const deltaLabel =
+    mode === 'peers'
+      ? `${peers.filter((p) => p.enabled !== false && p.session_state === 'Established').length} Established`
+      : `${speakers.filter((s) => s.live?.agent_ok).length} online`
+
+  return (
+    <AnalyticsCardShell
+      title="Загрузка BGP"
+      description="Текущая утилизация сессий по пирам и спикерам"
+      info="Каждый столбец — enabled peer или speaker. Высота отражает Established/online."
+      actions={
+        <AnalyticsSegmentControl
+          value={mode}
+          onChange={setMode}
+          options={[
+            { value: 'peers', label: 'Пиры' },
+            { value: 'speakers', label: 'Спикеры' },
+          ]}
+        />
+      }
+    >
+      <div className="space-y-1">
+        <p className="text-3xl font-semibold tracking-tight tabular-nums">
+          {loading ? '—' : `${utilization}%`}
+        </p>
+        <p className="text-sm text-success">{loading ? '…' : `${deltaLabel} · снимок live`}</p>
+      </div>
+
+      {loading ? (
+        <div className="flex h-36 items-center justify-center text-sm text-muted-foreground">
+          Загрузка…
+        </div>
+      ) : (
+        <ChartBarStrip bars={bars} />
+      )}
+
+      <div className="flex items-center justify-between gap-3 text-sm">
+        <p className="text-muted-foreground">
+          Активных задач: <span className="font-medium text-foreground">{loading ? '—' : queued}</span>
+        </p>
+        <div className="flex items-center gap-2">
+          <AvatarGroup>
+            {previewSpeakers.map((speaker) => (
+              <Avatar key={speaker.id} size="sm">
+                <AvatarFallback>{speakerInitials(speaker)}</AvatarFallback>
+              </Avatar>
+            ))}
+            {speakers.length > 3 ? (
+              <AvatarGroupCount>+{speakers.length - 3}</AvatarGroupCount>
+            ) : null}
+          </AvatarGroup>
+          <span className="text-muted-foreground">{speakers.length} спикеров</span>
+        </div>
+      </div>
+    </AnalyticsCardShell>
+  )
+}

apps/web/src/components/analytics/dashboard-operations-flow-card.tsx

@@ -0,0 +1,59 @@
+import { useMemo, useState } from 'react'
+
+import { AnalyticsCardShell } from '@/components/analytics/analytics-card-shell'
+import { AnalyticsSegmentControl } from '@/components/analytics/analytics-segment-control'
+import { ChartDonutMetric } from '@/components/analytics/chart-donut-metric'
+import { jobStatusBreakdown, moduleTypeBreakdown } from '@/lib/metrics'
+import type { JobRow, ModuleRow } from '@/types/api'
+
+type FlowMode = 'jobs' | 'modules'
+
+export function DashboardOperationsFlowCard({
+  jobs,
+  modules,
+  loading,
+}: {
+  jobs: JobRow[]
+  modules: ModuleRow[]
+  loading?: boolean
+}) {
+  const [mode, setMode] = useState<FlowMode>('jobs')
+
+  const slices = useMemo(
+    () => (mode === 'jobs' ? jobStatusBreakdown(jobs) : moduleTypeBreakdown(modules)),
+    [mode, jobs, modules],
+  )
+
+  const total = slices.reduce((sum, slice) => sum + slice.count, 0)
+  const centerLabel = mode === 'jobs' ? 'Задачи' : 'Модули'
+
+  return (
+    <AnalyticsCardShell
+      title="Поток операций"
+      description="Распределение фоновых задач и типов модулей"
+      info="Donut строится по текущей выборке API (до 100 последних задач)."
+      actions={
+        <AnalyticsSegmentControl
+          value={mode}
+          onChange={setMode}
+          options={[
+            { value: 'jobs', label: 'Задачи' },
+            { value: 'modules', label: 'Модули' },
+          ]}
+        />
+      }
+    >
+      {loading ? (
+        <div className="flex h-48 items-center justify-center text-sm text-muted-foreground">
+          Загрузка…
+        </div>
+      ) : (
+        <ChartDonutMetric
+          slices={slices}
+          centerLabel={centerLabel}
+          centerValue={total}
+        />
+      )}
+    </AnalyticsCardShell>
+  )
+}

apps/web/src/components/analytics/dashboard-platform-card.tsx

@@ -0,0 +1,141 @@
+import { useNavigate } from '@tanstack/react-router'
+import { useMemo } from 'react'
+
+import { Button } from '@evobgp/ui/components/button'
+
+import { AnalyticsActivityList } from '@/components/analytics/analytics-activity-list'
+import { AnalyticsCardShell } from '@/components/analytics/analytics-card-shell'
+import { AnalyticsKpiRow } from '@/components/analytics/analytics-kpi-row'
+import { AnalyticsProgress } from '@/components/analytics/analytics-progress'
+import {
+  deploymentProgress,
+  recentPlatformActivity,
+} from '@/lib/metrics'
+import { runningJobCount } from '@/queries/overview'
+import type { JobRow, ModuleRow, PeerRow, RevisionRow, SpeakerRow } from '@/types/api'
+
+export function DashboardPlatformCard({
+  modules,
+  peers,
+  speakers,
+  jobs,
+  revisions,
+  loading,
+}: {
+  modules: ModuleRow[]
+  peers: PeerRow[]
+  speakers: SpeakerRow[]
+  jobs: JobRow[]
+  revisions: RevisionRow[]
+  loading?: boolean
+}) {
+  const navigate = useNavigate()
+
+  const enabledModules = modules.filter((m) => m.enabled !== false).length
+  const peersEnabled = peers.filter((p) => p.enabled !== false).length
+  const peersEstablished = peers.filter(
+    (p) => p.enabled !== false && p.session_state === 'Established',
+  ).length
+  const peersMismatch = peers.filter((p) => p.session_mismatch).length
+  const speakersOnline = speakers.filter((s) => s.live?.agent_ok).length
+  const failedJobs = jobs.filter((j) =>
+    ['failed', 'error', 'cancelled'].includes(j.status.toLowerCase()),
+  ).length
+  const running = runningJobCount(jobs)
+  const riskCount = peersMismatch + failedJobs + Math.max(0, speakers.length - speakersOnline)
+
+  const bgpPct =
+    peersEnabled > 0 ? Math.round((peersEstablished / peersEnabled) * 100) : null
+
+  const deploy = useMemo(() => deploymentProgress(speakers), [speakers])
+  const activity = useMemo(
+    () => recentPlatformActivity(jobs, revisions, peers, speakers),
+    [jobs, revisions, peers, speakers],
+  )
+
+  const kpis = [
+    {
+      label: 'Модули активны',
+      value: loading ? '—' : `${enabledModules}/${modules.length || 0}`,
+      delta: {
+        direction: 'neutral' as const,
+        label: `${modules.length} всего`,
+        tone: 'muted' as const,
+      },
+    },
+    {
+      label: 'BGP готовность',
+      value: loading || bgpPct === null ? '—' : `${bgpPct}%`,
+      delta: {
+        direction: (bgpPct !== null && bgpPct >= 90 ? 'up' : bgpPct !== null && bgpPct < 70 ? 'down' : 'neutral') as
+          | 'up'
+          | 'down'
+          | 'neutral',
+        label:
+          bgpPct === null
+            ? 'нет включённых пиров'
+            : `${peersEstablished} Established`,
+        tone: (bgpPct !== null && bgpPct >= 90
+          ? 'success'
+          : bgpPct !== null && bgpPct < 70
+            ? 'warning'
+            : 'muted') as 'success' | 'warning' | 'muted',
+      },
+    },
+    {
+      label: 'Риски',
+      value: loading ? '—' : String(riskCount),
+      delta: {
+        direction: (riskCount > 0 ? 'down' : 'up') as 'up' | 'down',
+        label: riskCount > 0 ? `${failedJobs} задач, ${peersMismatch} mismatch` : 'в норме',
+        tone: (riskCount > 0 ? 'destructive' : 'success') as 'destructive' | 'success',
+      },
+    },
+  ]
+
+  const progressLabel =
+    deploy.mode === 'revision'
+      ? `Синхронизация ревизий (${deploy.synced}/${deploy.total})`
+      : `Спикеры online (${deploy.synced}/${deploy.total})`
+
+  return (
+    <AnalyticsCardShell
+      title="Состояние платформы"
+      description="Сводка модулей, BGP и фоновых задач"
+      info="Актуальный снимок без исторических трендов. Обновите данные кнопкой «Обновить» на странице."
+      footer={
+        <>
+          <Button
+            variant="outline"
+            className="flex-1"
+            onClick={() => navigate({ to: '/schedule' })}
+          >
+            Расписание
+          </Button>
+          <Button
+            className="flex-1"
+            onClick={() => navigate({ to: '/monitoring', search: { tab: 'system' } })}
+          >
+            Мониторинг
+          </Button>
+        </>
+      }
+    >
+      <AnalyticsKpiRow items={kpis} />
+      <AnalyticsProgress label={progressLabel} value={loading ? 0 : deploy.percent} />
+      <div className="space-y-3">
+        <div className="flex items-center justify-between text-sm">
+          <span className="text-muted-foreground">Недавняя активность</span>
+          {!loading ? (
+            <span className="text-xs text-muted-foreground">{running} активных задач</span>
+          ) : null}
+        </div>
+        {loading ? (
+          <p className="text-sm text-muted-foreground">Загрузка…</p>
+        ) : (
+          <AnalyticsActivityList items={activity} />
+        )}
+      </div>
+    </AnalyticsCardShell>
+  )
+}

apps/web/src/components/analytics/index.ts

@@ -0,0 +1,13 @@
+export { AnalyticsActivityList } from './analytics-activity-list'
+export { AnalyticsCardShell } from './analytics-card-shell'
+export { AnalyticsKpiRow, type AnalyticsKpiItem } from './analytics-kpi-row'
+export { AnalyticsProgress } from './analytics-progress'
+export { AnalyticsSegmentControl } from './analytics-segment-control'
+export { ChartBarStrip } from './chart-bar-strip'
+export { ChartDonutMetric } from './chart-donut-metric'
+export { DashboardNetworkCapacityCard } from './dashboard-network-capacity-card'
+export { DashboardOperationsFlowCard } from './dashboard-operations-flow-card'
+export { DashboardPlatformCard } from './dashboard-platform-card'
+export { MonitoringHealthCard } from './monitoring-health-card'
+export { NetworkOverviewAnalyticsCard } from './network-overview-analytics-card'
+export { OperationsAnalyticsCard } from './operations-analytics-card'

apps/web/src/components/analytics/monitoring-health-card.tsx

@@ -0,0 +1,33 @@
+import { AnalyticsCardShell } from '@/components/analytics/analytics-card-shell'
+import { ChartDonutMetric } from '@/components/analytics/chart-donut-metric'
+import { readinessBreakdown } from '@/lib/metrics'
+import type { ReadyStatus } from '@/queries/monitoring'
+
+export function MonitoringHealthCard({
+  healthOk,
+  ready,
+  loading,
+}: {
+  healthOk: boolean
+  ready: ReadyStatus | null | undefined
+  loading?: boolean
+}) {
+  const slices = readinessBreakdown(ready, healthOk)
+  const total = slices.reduce((sum, slice) => sum + slice.count, 0)
+
+  return (
+    <AnalyticsCardShell
+      title="Доступность системы"
+      description="Health и readiness checks"
+      info="Donut отражает результат GET /v1/health и checks из GET /v1/ready."
+    >
+      {loading ? (
+        <div className="flex h-48 items-center justify-center text-sm text-muted-foreground">
+          Загрузка…
+        </div>
+      ) : (
+        <ChartDonutMetric slices={slices} centerLabel="Checks" centerValue={total} />
+      )}
+    </AnalyticsCardShell>
+  )
+}

apps/web/src/components/analytics/network-overview-analytics-card.tsx

@@ -0,0 +1,66 @@
+import { AnalyticsCardShell } from '@/components/analytics/analytics-card-shell'
+import { AnalyticsKpiRow } from '@/components/analytics/analytics-kpi-row'
+import { ChartDonutMetric } from '@/components/analytics/chart-donut-metric'
+import { peerSessionBreakdown } from '@/lib/metrics'
+import { aggregateNetworkMetrics } from '@/queries/overview'
+import type { PeerRow, SpeakerRow } from '@/types/api'
+
+export function NetworkOverviewAnalyticsCard({
+  peers,
+  speakers,
+  loading,
+}: {
+  peers: PeerRow[]
+  speakers: SpeakerRow[]
+  loading?: boolean
+}) {
+  const net = aggregateNetworkMetrics(peers, speakers)
+  const slices = peerSessionBreakdown(peers)
+  const total = slices.reduce((sum, slice) => sum + slice.count, 0)
+
+  return (
+    <AnalyticsCardShell
+      title="Сводка BGP"
+      description="Established, online и mismatch по live-данным"
+      info="Снимок текущего состояния пиров и спикеров."
+    >
+      <AnalyticsKpiRow
+        items={[
+          {
+            label: 'Пиры Established',
+            value: loading ? '—' : `${net.peersEstablished}/${net.peersEnabled}`,
+            delta: {
+              direction: net.peersMismatch > 0 ? 'down' : 'up',
+              label: net.peersMismatch > 0 ? `${net.peersMismatch} mismatch` : 'сессии в норме',
+              tone: net.peersMismatch > 0 ? 'warning' : 'success',
+            },
+          },
+          {
+            label: 'Спикеры online',
+            value: loading ? '—' : `${net.speakersOnline}/${net.speakersTotal}`,
+            delta: {
+              direction: net.speakersOnline < net.speakersTotal ? 'down' : 'up',
+              label:
+                net.speakersOnline < net.speakersTotal
+                  ? `${net.speakersTotal - net.speakersOnline} offline`
+                  : 'все online',
+              tone: net.speakersOnline < net.speakersTotal ? 'warning' : 'success',
+            },
+          },
+          {
+            label: 'Пиры всего',
+            value: loading ? '—' : String(net.peersTotal),
+            delta: { direction: 'neutral', label: 'в каталоге', tone: 'muted' },
+          },
+        ]}
+      />
+      {loading ? (
+        <div className="flex h-48 items-center justify-center text-sm text-muted-foreground">
+          Загрузка…
+        </div>
+      ) : (
+        <ChartDonutMetric slices={slices} centerLabel="Пиры" centerValue={total} />
+      )}
+    </AnalyticsCardShell>
+  )
+}

apps/web/src/components/analytics/operations-analytics-card.tsx

@@ -0,0 +1,65 @@
+import { AnalyticsCardShell } from '@/components/analytics/analytics-card-shell'
+import { AnalyticsKpiRow } from '@/components/analytics/analytics-kpi-row'
+import { ChartDonutMetric } from '@/components/analytics/chart-donut-metric'
+import { jobStatusBreakdown } from '@/lib/metrics'
+import type { JobRow, RevisionRow } from '@/types/api'
+
+export function OperationsAnalyticsCard({
+  jobs,
+  revisions,
+  loading,
+}: {
+  jobs: JobRow[]
+  revisions: RevisionRow[]
+  loading?: boolean
+}) {
+  const running = jobs.filter((j) => ['running', 'queued'].includes(j.status.toLowerCase())).length
+  const failed = jobs.filter((j) =>
+    ['failed', 'error', 'cancelled'].includes(j.status.toLowerCase()),
+  ).length
+  const slices = jobStatusBreakdown(jobs)
+  const total = slices.reduce((sum, slice) => sum + slice.count, 0)
+
+  return (
+    <AnalyticsCardShell
+      title="Операции и задачи"
+      description="Статистика ревизий и фоновых jobs"
+      info="Данные из GET /v1/jobs и /v1/revisions."
+    >
+      <AnalyticsKpiRow
+        items={[
+          {
+            label: 'Ревизий',
+            value: loading ? '—' : String(revisions.length),
+            delta: { direction: 'neutral', label: 'в выборке', tone: 'muted' },
+          },
+          {
+            label: 'Активных задач',
+            value: loading ? '—' : String(running),
+            delta: {
+              direction: running > 0 ? 'up' : 'neutral',
+              label: running > 0 ? 'выполняются' : 'очередь пуста',
+              tone: (running > 0 ? 'warning' : 'muted') as 'warning' | 'muted',
+            },
+          },
+          {
+            label: 'С ошибкой',
+            value: loading ? '—' : String(failed),
+            delta: {
+              direction: failed > 0 ? 'down' : 'up',
+              label: failed > 0 ? 'требуют внимания' : 'в норме',
+              tone: failed > 0 ? 'destructive' : 'success',
+            },
+          },
+        ]}
+      />
+      {loading ? (
+        <div className="flex h-48 items-center justify-center text-sm text-muted-foreground">
+          Загрузка…
+        </div>
+      ) : (
+        <ChartDonutMetric slices={slices} centerLabel="Задачи" centerValue={total} />
+      )}
+    </AnalyticsCardShell>
+  )
+}

apps/web/src/components/dashboard/dashboard-network-panel.tsx

@@ -0,0 +1,38 @@
+import { aggregateNetworkMetrics } from '@/queries/overview'
+import type { PeerRow, SpeakerRow } from '@/types/api'
+
+function Row({ label, value, variant = 'default' }: { label: string; value: string; variant?: 'default' | 'warning' }) {
+  return (
+    <div className="flex items-center justify-between gap-2 px-1 text-sm">
+      <span className="text-muted-foreground">{label}</span>
+      <span
+        className={
+          variant === 'warning'
+            ? 'font-medium text-warning-foreground tabular-nums'
+            : 'font-medium tabular-nums'
+        }
+      >
+        {value}
+      </span>
+    </div>
+  )
+}
+
+export function DashboardNetworkPanel({
+  peers,
+  speakers,
+}: {
+  peers: PeerRow[]
+  speakers: SpeakerRow[]
+}) {
+  const m = aggregateNetworkMetrics(peers, speakers)
+  return (
+    <div className="flex flex-col gap-2 p-3">
+      <Row label="Пиры Established" value={`${m.peersEstablished} / ${m.peersEnabled}`} />
+      <Row label="Спикеры online" value={`${m.speakersOnline} / ${m.speakersTotal}`} />
+      {m.peersMismatch > 0 ? (
+        <Row label="Mismatches" value={String(m.peersMismatch)} variant="warning" />
+      ) : null}
+    </div>
+  )
+}

apps/web/src/components/dashboard/dashboard-quick-actions.tsx

@@ -0,0 +1,41 @@
+import { Link } from '@tanstack/react-router'
+import { Gauge, Network, Play, Plus, Share2, Tags } from 'lucide-react'
+
+import { Button } from '@evobgp/ui/components/button'
+import { CardFooter } from '@evobgp/ui/components/card'
+
+export function DashboardQuickActions() {
+  return (
+    <CardFooter className="flex flex-wrap gap-2 border-t-0 bg-transparent">
+      <Button variant="outline" size="sm" type="button" render={<Link to="/modules" />}>
+        <Plus className="size-4" />
+        Создать модуль
+      </Button>
+      <Button variant="outline" size="sm" type="button" render={<Link to="/directories" />}>
+        <Tags className="size-4" />
+        Добавить community
+      </Button>
+      <Button variant="outline" size="sm" type="button" render={<Link to="/network" search={{ tab: 'overview' }} />}>
+        <Network className="size-4" />
+        Сеть
+      </Button>
+      <Button variant="outline" size="sm" type="button" render={<Link to="/network" search={{ tab: 'peers' }} />}>
+        <Share2 className="size-4" />
+        Добавить пира
+      </Button>
+      <Button
+        variant="outline"
+        size="sm"
+        type="button"
+        render={<Link to="/operations" search={{ tab: 'revisions' }} />}
+      >
+        <Play className="size-4" />
+        Деплой (Apply)
+      </Button>
+      <Button variant="outline" size="sm" type="button" render={<Link to="/monitoring" search={{ tab: 'system' }} />}>
+        <Gauge className="size-4" />
+        Мониторинг
+      </Button>
+    </CardFooter>
+  )
+}

apps/web/src/components/dashboard/dashboard-recent-jobs-grid.tsx

@@ -0,0 +1,74 @@
+import { ColumnDef, getCoreRowModel, useReactTable } from '@tanstack/react-table'
+import { useMemo } from 'react'
+
+import { DataGridShell } from '@/components/data-grid-shell'
+import { DataGridColumnHeader } from '@/components/reui/data-grid/data-grid-column-header'
+import { DATA_GRID_DENSE_LAYOUT } from '@/lib/data-grid-defaults'
+import type { JobRow } from '@/types/api'
+
+function StatusText({ status }: { status: string }) {
+  const cls =
+    status === 'succeeded'
+      ? 'text-success'
+      : status === 'failed' || status === 'cancelled'
+        ? 'text-destructive'
+        : 'text-muted-foreground'
+  return <span className={`text-xs font-medium ${cls}`}>{status}</span>
+}
+
+export function DashboardRecentJobsGrid({
+  jobs,
+  nameById,
+  isLoading = false,
+}: {
+  jobs: JobRow[]
+  nameById: Map<string, string>
+  isLoading?: boolean
+}) {
+  const data = useMemo(() => jobs.slice(0, 8), [jobs])
+
+  const columns = useMemo<ColumnDef<JobRow>[]>(
+    () => [
+      {
+        accessorKey: 'kind',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Вид" />,
+        cell: ({ row }) => (
+          <div className="min-w-0">
+            <div className="truncate font-mono text-xs text-muted-foreground">{row.original.kind}</div>
+            {row.original.meta?.module_id ? (
+              <div className="truncate text-xs">
+                {nameById.get(String(row.original.meta.module_id)) ?? ''}
+              </div>
+            ) : null}
+          </div>
+        ),
+        meta: { headerTitle: 'Вид' },
+      },
+      {
+        accessorKey: 'status',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Статус" />,
+        cell: ({ row }) => <StatusText status={row.original.status} />,
+        meta: { headerTitle: 'Статус' },
+      },
+    ],
+    [nameById],
+  )
+
+  const table = useReactTable({
+    data,
+    columns,
+    getCoreRowModel: getCoreRowModel(),
+    getRowId: (row) => row.job_id,
+  })
+
+  return (
+    <DataGridShell
+      table={table}
+      recordCount={data.length}
+      isLoading={isLoading}
+      emptyMessage="Нет задач"
+      showPagination={false}
+      tableLayout={DATA_GRID_DENSE_LAYOUT}
+    />
+  )
+}

apps/web/src/components/dashboard/dashboard-recent-revisions-grid.tsx

@@ -0,0 +1,62 @@
+import { ColumnDef, getCoreRowModel, useReactTable } from '@tanstack/react-table'
+import { useMemo } from 'react'
+
+import { DataGridShell } from '@/components/data-grid-shell'
+import { DataGridColumnHeader } from '@/components/reui/data-grid/data-grid-column-header'
+import { DATA_GRID_DENSE_LAYOUT } from '@/lib/data-grid-defaults'
+import type { RevisionRow } from '@/types/api'
+
+export function DashboardRecentRevisionsGrid({
+  revisions,
+  isLoading = false,
+}: {
+  revisions: RevisionRow[]
+  isLoading?: boolean
+}) {
+  const data = useMemo(() => revisions.slice(0, 8), [revisions])
+
+  const columns = useMemo<ColumnDef<RevisionRow>[]>(
+    () => [
+      {
+        id: 'id',
+        accessorFn: (row) => row.id,
+        header: ({ column }) => <DataGridColumnHeader column={column} title="ID" />,
+        cell: ({ row }) => (
+          <span className="truncate font-mono text-xs text-muted-foreground">
+            {row.original.id.slice(0, 10)}…
+          </span>
+        ),
+        meta: { headerTitle: 'ID' },
+      },
+      {
+        accessorKey: 'created_at',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Создана" />,
+        cell: ({ row }) => (
+          <span className="text-xs text-muted-foreground">
+            {new Date(row.original.created_at).toLocaleString('ru-RU')}
+          </span>
+        ),
+        meta: { headerTitle: 'Создана' },
+      },
+    ],
+    [],
+  )
+
+  const table = useReactTable({
+    data,
+    columns,
+    getCoreRowModel: getCoreRowModel(),
+    getRowId: (row) => row.id,
+  })
+
+  return (
+    <DataGridShell
+      table={table}
+      recordCount={data.length}
+      isLoading={isLoading}
+      emptyMessage="Нет ревизий"
+      showPagination={false}
+      tableLayout={DATA_GRID_DENSE_LAYOUT}
+    />
+  )
+}

apps/web/src/components/data-grid-shell.tsx

@@ -0,0 +1,77 @@
+import type { ReactNode } from 'react'
+import type { Table } from '@tanstack/react-table'
+
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '@evobgp/ui/components/card'
+
+import { DataGridPagination } from '@/components/reui/data-grid/data-grid-pagination'
+import { DataGrid, DataGridContainer } from '@/components/reui/data-grid/data-grid'
+import { DataGridTable } from '@/components/reui/data-grid/data-grid-table'
+import {
+  DATA_GRID_PAGINATION_RU,
+  DATA_GRID_TABLE_LAYOUT,
+} from '@/lib/data-grid-defaults'
+
+interface DataGridShellProps<TData extends object> {
+  table: Table<TData>
+  recordCount: number
+  isLoading?: boolean
+  emptyMessage?: ReactNode
+  showPagination?: boolean
+  tableLayout?: typeof DATA_GRID_TABLE_LAYOUT
+  className?: string
+  onRowClick?: (row: TData) => void
+}
+
+export function DataGridShell<TData extends object>({
+  table,
+  recordCount,
+  isLoading = false,
+  emptyMessage,
+  showPagination = true,
+  tableLayout = DATA_GRID_TABLE_LAYOUT,
+  className,
+  onRowClick,
+}: DataGridShellProps<TData>) {
+  return (
+    <DataGrid
+      table={table}
+      recordCount={recordCount}
+      isLoading={isLoading}
+      emptyMessage={emptyMessage}
+      tableLayout={tableLayout}
+      className={className}
+      onRowClick={onRowClick}
+    >
+      <DataGridContainer>
+        <DataGridTable />
+      </DataGridContainer>
+      {showPagination ? <DataGridPagination {...DATA_GRID_PAGINATION_RU} /> : null}
+    </DataGrid>
+  )
+}
+
+interface DataGridCardProps {
+  title?: string
+  description?: string
+  actions?: ReactNode
+  children: ReactNode
+  className?: string
+}
+
+export function DataGridCard({ title, description, actions, children, className }: DataGridCardProps) {
+  const hasHeader = Boolean(title || description || actions)
+  return (
+    <Card className={className ?? 'gap-0'}>
+      {hasHeader ? (
+        <CardHeader className="flex flex-row items-center justify-between border-b py-3">
+          <div className="flex flex-col gap-0.5">
+            {title ? <CardTitle className="text-base">{title}</CardTitle> : null}
+            {description ? <CardDescription>{description}</CardDescription> : null}
+          </div>
+          {actions ? <div className="flex shrink-0 items-center gap-2">{actions}</div> : null}
+        </CardHeader>
+      ) : null}
+      <CardContent className="p-0">{children}</CardContent>
+    </Card>
+  )
+}

apps/web/src/components/directories/directories-communities-grid.tsx

@@ -0,0 +1,58 @@
+import { ColumnDef, useReactTable } from '@tanstack/react-table'
+import { useMemo } from 'react'
+
+import { Badge } from '@evobgp/ui/components/badge'
+
+import { DataGridShell } from '@/components/data-grid-shell'
+import { DataGridColumnHeader } from '@/components/reui/data-grid/data-grid-column-header'
+import { createClientDataGridOptions } from '@/lib/data-grid-defaults'
+import type { BgpCommunity } from '@/types/api'
+
+export function DirectoriesCommunitiesGrid({
+  items,
+  isLoading = false,
+}: {
+  items: BgpCommunity[]
+  isLoading?: boolean
+}) {
+  const columns = useMemo<ColumnDef<BgpCommunity>[]>(
+    () => [
+      {
+        accessorKey: 'title',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Название" />,
+        cell: ({ row }) => <span className="font-medium">{row.original.title}</span>,
+        meta: { headerTitle: 'Название' },
+      },
+      {
+        accessorKey: 'community',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Значение" />,
+        cell: ({ row }) => <span className="font-mono text-xs">{row.original.community}</span>,
+        meta: { headerTitle: 'Значение' },
+      },
+      {
+        id: 'type',
+        enableSorting: false,
+        header: 'Тип',
+        cell: () => <Badge variant="outline">community</Badge>,
+        meta: { headerTitle: 'Тип' },
+      },
+    ],
+    [],
+  )
+
+  const table = useReactTable({
+    data: items,
+    columns,
+    ...createClientDataGridOptions<BgpCommunity>(),
+    getRowId: (row) => row.id,
+  })
+
+  return (
+    <DataGridShell
+      table={table}
+      recordCount={items.length}
+      isLoading={isLoading}
+      emptyMessage="Нет сообществ"
+    />
+  )
+}

apps/web/src/components/directories/directories-doh-grid.tsx

@@ -0,0 +1,59 @@
+import { ColumnDef, useReactTable } from '@tanstack/react-table'
+import { useMemo } from 'react'
+
+import { Badge } from '@evobgp/ui/components/badge'
+
+import { DataGridShell } from '@/components/data-grid-shell'
+import { DataGridColumnHeader } from '@/components/reui/data-grid/data-grid-column-header'
+import { createClientDataGridOptions } from '@/lib/data-grid-defaults'
+import type { DohProfile } from '@/types/api'
+
+export function DirectoriesDohGrid({
+  items,
+  isLoading = false,
+}: {
+  items: DohProfile[]
+  isLoading?: boolean
+}) {
+  const columns = useMemo<ColumnDef<DohProfile>[]>(
+    () => [
+      {
+        id: 'name',
+        accessorFn: (row) => row.name ?? row.url,
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Название" />,
+        cell: ({ row }) => <span className="font-medium">{row.original.name ?? row.original.url}</span>,
+        meta: { headerTitle: 'Название' },
+      },
+      {
+        accessorKey: 'url',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="URL" />,
+        cell: ({ row }) => <span className="font-mono text-xs">{row.original.url}</span>,
+        meta: { headerTitle: 'URL' },
+      },
+      {
+        id: 'default',
+        enableSorting: false,
+        header: 'По умолчанию',
+        cell: () => <Badge variant="outline">—</Badge>,
+        meta: { headerTitle: 'По умолчанию' },
+      },
+    ],
+    [],
+  )
+
+  const table = useReactTable({
+    data: items,
+    columns,
+    ...createClientDataGridOptions<DohProfile>(),
+    getRowId: (row) => row.id,
+  })
+
+  return (
+    <DataGridShell
+      table={table}
+      recordCount={items.length}
+      isLoading={isLoading}
+      emptyMessage="Нет DoH профилей"
+    />
+  )
+}

apps/web/src/components/examples/c-select-4.tsx

@@ -0,0 +1,19 @@
+import { Field } from '@evobgp/ui/components/field'
+
+import { SelectMenu } from '@/components/select-field'
+
+const items = [
+  { label: 'Select an item', value: 'placeholder' as const },
+  ...Array.from({ length: 100 }).map((_, i) => ({
+    label: `Item ${i}`,
+    value: `item-${i}` as const,
+  })),
+]
+
+export function Pattern() {
+  return (
+    <Field className="max-w-xs">
+      <SelectMenu items={items} placeholder="Select an item" />
+    </Field>
+  )
+}

apps/web/src/components/firewall/firewall-clients-grid.tsx

@@ -0,0 +1,191 @@
+import { ColumnDef, useReactTable } from '@tanstack/react-table'
+import { useMemo } from 'react'
+
+import { Button } from '@evobgp/ui/components/button'
+
+import { DataGridShell } from '@/components/data-grid-shell'
+import { ConfirmDialog } from '@/components/confirm-dialog'
+import { StatusBadge } from '@/components/status-badge'
+import { DataGridColumnHeader } from '@/components/reui/data-grid/data-grid-column-header'
+import { createClientDataGridOptions } from '@/lib/data-grid-defaults'
+import type { FirewallClient } from '@/types/api'
+
+function formatPacketCount(value?: number | null): string | null {
+  if (value == null || value <= 0) return null
+  if (value >= 1_000_000) return `${(value / 1_000_000).toFixed(1)}M`
+  if (value >= 1_000) return `${(value / 1_000).toFixed(1)}k`
+  return String(value)
+}
+
+export interface FirewallClientsGridProps {
+  clients: FirewallClient[]
+  isLoading?: boolean
+  onApprove: (id: string) => void
+  onReject: (id: string) => void
+  approvePending?: boolean
+  rejectPending?: boolean
+  emptyTitle?: string
+}
+
+export function FirewallClientsGrid({
+  clients,
+  isLoading = false,
+  onApprove,
+  onReject,
+  approvePending = false,
+  rejectPending = false,
+  emptyTitle = 'Нет клиентов',
+}: FirewallClientsGridProps) {
+  const columns = useMemo<ColumnDef<FirewallClient>[]>(
+    () => [
+      {
+        accessorKey: 'name',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Имя" />,
+        cell: ({ row }) => (
+          <div>
+            <div className="font-medium">{row.original.name}</div>
+            <div className="text-muted-foreground text-xs">
+              {row.original.hostname || row.original.token_prefix}
+            </div>
+          </div>
+        ),
+        meta: { headerTitle: 'Имя' },
+      },
+      {
+        accessorKey: 'status',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Статус" />,
+        cell: ({ row }) => <StatusBadge status={row.original.status} />,
+        meta: { headerTitle: 'Статус' },
+      },
+      {
+        id: 'last_seen_at',
+        accessorFn: (row) => row.last_seen_at ?? '',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Last seen" />,
+        cell: ({ row }) => (
+          <span className="text-xs">{row.original.last_seen_at?.slice(0, 19) ?? '—'}</span>
+        ),
+        sortingFn: (a, b) => {
+          const av = a.original.last_seen_at ?? ''
+          const bv = b.original.last_seen_at ?? ''
+          return av.localeCompare(bv)
+        },
+        meta: { headerTitle: 'Last seen' },
+      },
+      {
+        id: 'apply',
+        enableSorting: false,
+        header: 'Apply',
+        cell: ({ row }) => {
+          const c = row.original
+          return (
+            <span className="text-xs">
+              {c.last_apply_status ?? '—'}
+              {c.last_apply_prefix_count != null ? ` (${c.last_apply_prefix_count})` : ''}
+            </span>
+          )
+        },
+        meta: { headerTitle: 'Apply' },
+      },
+      {
+        id: 'packets',
+        enableSorting: false,
+        header: 'Пакеты',
+        cell: ({ row }) => {
+          const dropped = formatPacketCount(row.original.last_apply_packets_dropped)
+          const accepted = formatPacketCount(row.original.last_apply_packets_accepted)
+          if (!dropped && !accepted) {
+            return <span className="text-muted-foreground text-xs">—</span>
+          }
+          return (
+            <span className="text-muted-foreground text-xs">
+              {dropped ? <span className="text-destructive">↓{dropped}</span> : null}
+              {dropped && accepted ? ' · ' : null}
+              {accepted ? <span className="text-success">↑{accepted}</span> : null}
+            </span>
+          )
+        },
+        meta: { headerTitle: 'Пакеты' },
+      },
+      {
+        id: 'actions',
+        enableSorting: false,
+        header: () => null,
+        cell: ({ row }) => {
+          const c = row.original
+          return (
+            <div className="flex justify-end gap-2">
+              {c.status === 'pending' ? (
+                <>
+                  <Button
+                    size="sm"
+                    variant="outline"
+                    type="button"
+                    disabled={approvePending}
+                    onClick={() => onApprove(c.id)}
+                  >
+                    Одобрить
+                  </Button>
+                  <ConfirmDialog
+                    trigger={
+                      <Button
+                        size="sm"
+                        variant="outline"
+                        type="button"
+                        className="text-destructive"
+                        disabled={rejectPending}
+                      >
+                        Отклонить
+                      </Button>
+                    }
+                    title="Отклонить запрос?"
+                    description={`${c.name}${c.hostname ? ` (${c.hostname})` : ''} — запись будет удалена, токен перестанет работать.`}
+                    confirmLabel="Отклонить"
+                    destructive
+                    onConfirm={() => onReject(c.id)}
+                  />
+                </>
+              ) : null}
+              {c.status === 'approved' ? (
+                <ConfirmDialog
+                  trigger={
+                    <Button
+                      size="sm"
+                      variant="ghost"
+                      type="button"
+                      className="text-destructive"
+                      disabled={rejectPending}
+                    >
+                      Удалить
+                    </Button>
+                  }
+                  title="Удалить клиент?"
+                  description={`${c.name} — запись будет удалена, blocklist и токен перестанут работать.`}
+                  confirmLabel="Удалить"
+                  destructive
+                  onConfirm={() => onReject(c.id)}
+                />
+              ) : null}
+            </div>
+          )
+        },
+      },
+    ],
+    [approvePending, onApprove, onReject, rejectPending],
+  )
+
+  const table = useReactTable({
+    data: clients,
+    columns,
+    ...createClientDataGridOptions<FirewallClient>(),
+    getRowId: (row) => row.id,
+  })
+
+  return (
+    <DataGridShell
+      table={table}
+      recordCount={clients.length}
+      isLoading={isLoading}
+      emptyMessage={emptyTitle}
+    />
+  )
+}

apps/web/src/components/firewall/firewall-rules-grid.tsx

@@ -0,0 +1,118 @@
+import { ColumnDef, useReactTable } from '@tanstack/react-table'
+import { useMemo } from 'react'
+
+import { Button } from '@evobgp/ui/components/button'
+
+import { DataGridShell } from '@/components/data-grid-shell'
+import { ConfirmDialog } from '@/components/confirm-dialog'
+import { StatusBadge } from '@/components/status-badge'
+import { DataGridColumnHeader } from '@/components/reui/data-grid/data-grid-column-header'
+import { createClientDataGridOptions } from '@/lib/data-grid-defaults'
+import { communityLabel } from '@/lib/modules/helpers'
+import type { BgpCommunity, FirewallRule } from '@/types/api'
+
+export interface FirewallRulesGridProps {
+  rules: FirewallRule[]
+  communities: BgpCommunity[]
+  isLoading?: boolean
+  onDelete: (id: string) => void
+  deletePending?: boolean
+  emptyTitle?: string
+}
+
+export function FirewallRulesGrid({
+  rules,
+  communities,
+  isLoading = false,
+  onDelete,
+  deletePending = false,
+  emptyTitle = 'Нет правил — blocklist пуст (default accept).',
+}: FirewallRulesGridProps) {
+  const columns = useMemo<ColumnDef<FirewallRule>[]>(
+    () => [
+      {
+        accessorKey: 'priority',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="#" />,
+        cell: ({ row }) => row.original.priority,
+        meta: { headerTitle: '#' },
+      },
+      {
+        accessorKey: 'action',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Действие" />,
+        cell: ({ row }) => (
+          <StatusBadge status={row.original.action} label={row.original.action} />
+        ),
+        meta: { headerTitle: 'Действие' },
+      },
+      {
+        id: 'community',
+        enableSorting: false,
+        header: 'Community',
+        cell: ({ row }) => (
+          <span className="text-sm">
+            {row.original.community_id
+              ? communityLabel(row.original.community_id, communities)
+              : 'Все'}
+          </span>
+        ),
+        meta: { headerTitle: 'Community' },
+      },
+      {
+        accessorKey: 'comment',
+        enableSorting: false,
+        header: 'Комментарий',
+        cell: ({ row }) => row.original.comment || '—',
+        meta: { headerTitle: 'Комментарий' },
+      },
+      {
+        id: 'actions',
+        enableSorting: false,
+        header: () => null,
+        cell: ({ row }) => {
+          const r = row.original
+          return (
+            <ConfirmDialog
+              trigger={
+                <Button
+                  size="sm"
+                  variant="ghost"
+                  type="button"
+                  className="text-destructive"
+                  disabled={deletePending}
+                >
+                  Удалить
+                </Button>
+              }
+              title="Удалить правило?"
+              description={
+                r.comment
+                  ? `Правило #${r.priority} (${r.action}): ${r.comment}`
+                  : `Правило #${r.priority} (${r.action}) будет удалено.`
+              }
+              confirmLabel="Удалить"
+              destructive
+              onConfirm={() => onDelete(r.id)}
+            />
+          )
+        },
+      },
+    ],
+    [communities, deletePending, onDelete],
+  )
+
+  const table = useReactTable({
+    data: rules,
+    columns,
+    ...createClientDataGridOptions<FirewallRule>(),
+    getRowId: (row) => row.id,
+  })
+
+  return (
+    <DataGridShell
+      table={table}
+      recordCount={rules.length}
+      isLoading={isLoading}
+      emptyMessage={emptyTitle}
+    />
+  )
+}

apps/web/src/components/layout/app-shell.tsx

@@ -9,6 +9,7 @@ import {
   BookText,
   KeyRound,
   ServerCog,
+  Shield,
 } from 'lucide-react'
 
 import {
@@ -69,6 +70,7 @@ const NAV_GROUPS: NavGroup[] = [
     label: 'Операции',
     items: [
       { to: '/operations', label: 'Операции', icon: Cog },
+      { to: '/firewall', label: 'Firewall', icon: Shield },
       { to: '/schedule', label: 'Задачи', icon: ListChecks },
       { to: '/monitoring', label: 'Мониторинг', icon: Activity },
     ],

apps/web/src/components/modules/community-select.tsx

@@ -1,14 +1,8 @@
 import { useMemo } from 'react'
 
-import { Label } from '@evobgp/ui/components/label'
-import {
-  Select,
-  SelectContent,
-  SelectItem,
-  SelectTrigger,
-  SelectValue,
-} from '@evobgp/ui/components/select'
+import { Field, FieldLabel } from '@evobgp/ui/components/field'
 
+import { SelectMenu } from '@/components/select-field'
 import {
   NONE_OPTION,
   communityOptionLabel,
@@ -49,28 +43,27 @@ export function CommunitySelect({
 
   const selectValue = nullable ? nullableSelectValue(value) : (value ?? '')
 
+  const select = (
+    <SelectMenu
+      id={id}
+      items={items}
+      value={selectValue}
+      placeholder={placeholder}
+      onValueChange={(v) => {
+        if (!v) return
+        onValueChange(nullable ? fromNullableSelect(v) : v)
+      }}
+    />
+  )
+
+  if (!label) {
+    return select
+  }
+
   return (
-    <div className="flex flex-col gap-1.5">
-      {label ? <Label htmlFor={id}>{label}</Label> : null}
-      <Select
-        items={items}
-        value={selectValue}
-        onValueChange={(v) => {
-          if (!v) return
-          onValueChange(nullable ? fromNullableSelect(v) : v)
-        }}
-      >
-        <SelectTrigger id={id} className="w-full">
-          <SelectValue placeholder={placeholder} />
-        </SelectTrigger>
-        <SelectContent>
-          {items.map((item) => (
-            <SelectItem key={item.value} value={item.value}>
-              {item.label}
-            </SelectItem>
-          ))}
-        </SelectContent>
-      </Select>
-    </div>
+    <Field>
+      <FieldLabel htmlFor={id}>{label}</FieldLabel>
+      {select}
+    </Field>
   )
 }

apps/web/src/components/modules/module-cdn-source-dialog.tsx

@@ -10,13 +10,8 @@ import {
 } from '@evobgp/ui/components/dialog'
 import { Input } from '@evobgp/ui/components/input'
 import { Label } from '@evobgp/ui/components/label'
-import {
-  Select,
-  SelectContent,
-  SelectItem,
-  SelectTrigger,
-  SelectValue,
-} from '@evobgp/ui/components/select'
+
+import { SelectField } from '@/components/select-field'
 import { Button } from '@evobgp/ui/components/button'
 
 import { LoadingButton } from '@/components/loading-button'
@@ -174,25 +169,13 @@ export function ModuleCdnSourceDialog({
               onChange={(e) => setForm((s) => ({ ...s, url: e.target.value }))}
             />
           </div>
-          <div className="flex flex-col gap-1.5">
-            <Label htmlFor="cdn-kind">Тип источника</Label>
-            <Select
-              items={kindItems}
-              value={form.source_kind}
-              onValueChange={(v) => v && setForm((s) => ({ ...s, source_kind: v }))}
-            >
-              <SelectTrigger id="cdn-kind" className="w-full">
-                <SelectValue />
-              </SelectTrigger>
-              <SelectContent>
-                {kindItems.map((item) => (
-                  <SelectItem key={item.value} value={item.value}>
-                    {item.label}
-                  </SelectItem>
-                ))}
-              </SelectContent>
-            </Select>
-          </div>
+          <SelectField
+            id="cdn-kind"
+            label="Тип источника"
+            items={kindItems}
+            value={form.source_kind}
+            onValueChange={(v) => v && setForm((s) => ({ ...s, source_kind: v }))}
+          />
           <div className="flex flex-col gap-1.5">
             <Label htmlFor="cdn-prefix-path">JSON path (prefix_path)</Label>
             <Input

apps/web/src/components/modules/module-entries-grid.tsx

@@ -0,0 +1,251 @@
+import { ColumnDef, useReactTable } from '@tanstack/react-table'
+import { Pencil, Trash2 } from 'lucide-react'
+import { useMemo } from 'react'
+
+import { Button } from '@evobgp/ui/components/button'
+
+import { DataGridShell } from '@/components/data-grid-shell'
+import { DataGridColumnHeader } from '@/components/reui/data-grid/data-grid-column-header'
+import { formatDateTime } from '@/lib/modules/display'
+import { communityLabel } from '@/lib/modules/helpers'
+import { createClientDataGridOptions } from '@/lib/data-grid-defaults'
+import type {
+  AsEntry,
+  BgpCommunity,
+  CdnSource,
+  DomainEntry,
+  IpRangeEntry,
+  ModuleRow,
+} from '@/types/api'
+
+type DeleteTarget =
+  | { kind: 'domain'; entry: DomainEntry }
+  | { kind: 'ip-range'; entry: IpRangeEntry }
+  | { kind: 'cdn'; entry: CdnSource }
+  | { kind: 'as'; entry: AsEntry }
+
+function RowActions({ onEdit, onDelete }: { onEdit: () => void; onDelete: () => void }) {
+  return (
+    <div className="flex justify-end gap-1">
+      <Button variant="ghost" size="icon-sm" type="button" onClick={onEdit} aria-label="Редактировать">
+        <Pencil className="size-3.5" />
+      </Button>
+      <Button
+        variant="ghost"
+        size="icon-sm"
+        type="button"
+        className="text-destructive"
+        onClick={onDelete}
+        aria-label="Удалить"
+      >
+        <Trash2 className="size-3.5" />
+      </Button>
+    </div>
+  )
+}
+
+export function ModuleEntriesGrid({
+  mod,
+  rows,
+  communities,
+  onEdit,
+  onDelete,
+  isLoading = false,
+}: {
+  mod: ModuleRow
+  rows: Record<string, unknown>[]
+  communities: BgpCommunity[]
+  onEdit: (target: DeleteTarget) => void
+  onDelete: (target: DeleteTarget) => void
+  isLoading?: boolean
+}) {
+  const columns = useMemo(() => {
+    if (mod.type === 'DOMAINS') {
+      return [
+        {
+          accessorKey: 'fqdn',
+          header: ({ column }: { column: { id: string } }) => (
+            <DataGridColumnHeader column={column as never} title="FQDN" />
+          ),
+          cell: ({ row }: { row: { original: DomainEntry } }) => (
+            <span className="font-mono text-sm">{row.original.fqdn}</span>
+          ),
+        },
+        {
+          id: 'community',
+          header: 'Community',
+          cell: ({ row }: { row: { original: DomainEntry } }) => (
+            <span className="text-sm text-muted-foreground">
+              {communityLabel(row.original.community_id, communities)}
+            </span>
+          ),
+        },
+        {
+          id: 'actions',
+          enableSorting: false,
+          header: () => null,
+          cell: ({ row }: { row: { original: DomainEntry } }) => (
+            <RowActions
+              onEdit={() => onEdit({ kind: 'domain', entry: row.original })}
+              onDelete={() => onDelete({ kind: 'domain', entry: row.original })}
+            />
+          ),
+        },
+      ] as ColumnDef<DomainEntry>[]
+    }
+
+    if (mod.type === 'IP_RANGES') {
+      return [
+        {
+          accessorKey: 'prefix',
+          header: ({ column }: { column: { id: string } }) => (
+            <DataGridColumnHeader column={column as never} title="Префикс (CIDR)" />
+          ),
+          cell: ({ row }: { row: { original: IpRangeEntry } }) => (
+            <span className="font-mono text-sm">{row.original.prefix}</span>
+          ),
+        },
+        {
+          id: 'community',
+          header: 'Community',
+          cell: ({ row }: { row: { original: IpRangeEntry } }) => (
+            <span className="text-sm text-muted-foreground">
+              {communityLabel(row.original.community_id, communities)}
+            </span>
+          ),
+        },
+        {
+          id: 'actions',
+          enableSorting: false,
+          header: () => null,
+          cell: ({ row }: { row: { original: IpRangeEntry } }) => (
+            <RowActions
+              onEdit={() => onEdit({ kind: 'ip-range', entry: row.original })}
+              onDelete={() => onDelete({ kind: 'ip-range', entry: row.original })}
+            />
+          ),
+        },
+      ] as ColumnDef<IpRangeEntry>[]
+    }
+
+    if (mod.type === 'CDN_CIDRS') {
+      return [
+        {
+          accessorKey: 'url',
+          header: ({ column }: { column: { id: string } }) => (
+            <DataGridColumnHeader column={column as never} title="URL" />
+          ),
+          cell: ({ row }: { row: { original: CdnSource } }) => (
+            <span className="max-w-xs truncate font-mono text-xs">{row.original.url}</span>
+          ),
+        },
+        {
+          accessorKey: 'source_kind',
+          header: 'Тип',
+          cell: ({ row }: { row: { original: CdnSource } }) => (
+            <span className="text-sm">{row.original.source_kind}</span>
+          ),
+        },
+        {
+          id: 'community',
+          header: 'Community',
+          cell: ({ row }: { row: { original: CdnSource } }) => (
+            <span className="text-sm text-muted-foreground">
+              {communityLabel(row.original.community_id, communities)}
+            </span>
+          ),
+        },
+        {
+          id: 'last_refreshed_at',
+          accessorFn: (row: CdnSource) => row.last_refreshed_at ?? '',
+          header: ({ column }: { column: { id: string } }) => (
+            <DataGridColumnHeader column={column as never} title="Обновлено" />
+          ),
+          cell: ({ row }: { row: { original: CdnSource } }) => (
+            <span className="text-xs text-muted-foreground">
+              {formatDateTime(row.original.last_refreshed_at)}
+            </span>
+          ),
+        },
+        {
+          id: 'actions',
+          enableSorting: false,
+          header: () => null,
+          cell: ({ row }: { row: { original: CdnSource } }) => (
+            <RowActions
+              onEdit={() => onEdit({ kind: 'cdn', entry: row.original })}
+              onDelete={() => onDelete({ kind: 'cdn', entry: row.original })}
+            />
+          ),
+        },
+      ] as ColumnDef<CdnSource>[]
+    }
+
+    return [
+      {
+        accessorKey: 'asn',
+        header: ({ column }: { column: { id: string } }) => (
+          <DataGridColumnHeader column={column as never} title="ASN" />
+        ),
+        cell: ({ row }: { row: { original: AsEntry } }) => (
+          <span className="font-mono text-sm">{row.original.asn}</span>
+        ),
+      },
+      {
+        accessorKey: 'asn_name',
+        header: 'Имя',
+        cell: ({ row }: { row: { original: AsEntry } }) => (
+          <span className="text-sm">{row.original.asn_name ?? '—'}</span>
+        ),
+      },
+      {
+        accessorKey: 'prefix_count',
+        header: 'Префиксов',
+        cell: ({ row }: { row: { original: AsEntry } }) => (
+          <span className="font-mono text-sm">{row.original.prefix_count ?? '—'}</span>
+        ),
+      },
+      {
+        id: 'community',
+        header: 'Community',
+        cell: ({ row }: { row: { original: AsEntry } }) => (
+          <span className="text-sm text-muted-foreground">
+            {communityLabel(row.original.community_id, communities)}
+          </span>
+        ),
+      },
+      {
+        id: 'actions',
+        enableSorting: false,
+        header: () => null,
+        cell: ({ row }: { row: { original: AsEntry } }) => (
+          <RowActions
+            onEdit={() => onEdit({ kind: 'as', entry: row.original })}
+            onDelete={() => onDelete({ kind: 'as', entry: row.original })}
+          />
+        ),
+      },
+    ] as ColumnDef<AsEntry>[]
+  }, [communities, mod.type, onDelete, onEdit])
+
+  type RowType = DomainEntry | IpRangeEntry | CdnSource | AsEntry
+  const data = rows as unknown as RowType[]
+
+  const table = useReactTable({
+    data,
+    columns: columns as ColumnDef<RowType>[],
+    ...createClientDataGridOptions<RowType>(),
+    getRowId: (row) => row.id,
+  })
+
+  return (
+    <DataGridShell
+      table={table}
+      recordCount={data.length}
+      isLoading={isLoading}
+      emptyMessage="Нет записей"
+    />
+  )
+}
+
+export type { DeleteTarget as ModuleEntryDeleteTarget }

apps/web/src/components/modules/module-entries-section.tsx

@@ -1,5 +1,5 @@
 import { useState } from 'react'
-import { Pencil, Plus, Trash2 } from 'lucide-react'
+import { Plus } from 'lucide-react'
 import { toast } from 'sonner'
 
 import {
@@ -13,25 +13,16 @@ import {
   AlertDialogTitle,
 } from '@evobgp/ui/components/alert-dialog'
 import { Button } from '@evobgp/ui/components/button'
-import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '@evobgp/ui/components/card'
-import {
-  Table,
-  TableBody,
-  TableCell,
-  TableHead,
-  TableHeader,
-  TableRow,
-} from '@evobgp/ui/components/table'
 
+import { DataGridCard } from '@/components/data-grid-shell'
 import { QueryState } from '@/components/query-state'
 import { TableSkeleton } from '@/components/skeletons'
+import { ModuleEntriesGrid, type ModuleEntryDeleteTarget } from '@/components/modules/module-entries-grid'
 import { ModuleAsEntryDialog } from '@/components/modules/module-as-entry-dialog'
 import { ModuleCdnSourceDialog } from '@/components/modules/module-cdn-source-dialog'
 import { ModuleDomainEntryDialog } from '@/components/modules/module-domain-entry-dialog'
 import { ModuleIpRangeEntryDialog } from '@/components/modules/module-ip-range-entry-dialog'
 import { ApiError, apiMutate } from '@/lib/api-client'
-import { communityLabel } from '@/lib/modules/helpers'
-import { formatDateTime } from '@/lib/modules/display'
 import type {
   AsEntry,
   BgpCommunity,
@@ -53,11 +44,7 @@ interface ModuleEntriesSectionProps {
   onChanged: () => void | Promise<void>
 }
 
-type DeleteTarget =
-  | { kind: 'domain'; entry: DomainEntry }
-  | { kind: 'ip-range'; entry: IpRangeEntry }
-  | { kind: 'cdn'; entry: CdnSource }
-  | { kind: 'as'; entry: AsEntry }
+type DeleteTarget = ModuleEntryDeleteTarget
 
 const CARD_META: Record<
   ModuleRow['type'],
@@ -150,49 +137,45 @@ export function ModuleEntriesSection({
 
   return (
     <>
-      <Card>
-        <CardHeader className="flex flex-col gap-3 border-b py-3 sm:flex-row sm:items-center sm:justify-between">
-          <div className="min-w-0 flex-1">
-            <CardTitle className="text-base">{meta.title}</CardTitle>
-            <CardDescription>{meta.description}</CardDescription>
-          </div>
-          <div className="flex shrink-0 flex-wrap items-center justify-end gap-2 self-start sm:self-auto">
-            <Button size="sm" onClick={openCreate}>
-              <Plus />
-              Добавить
-            </Button>
-          </div>
-        </CardHeader>
-        <CardContent className="p-0">
-          <QueryState
-            data={items}
-            isLoading={isLoading}
-            isError={isError}
-            error={error}
-            empty={items.length === 0}
-            emptyTitle={meta.emptyTitle}
-            emptyDescription={meta.emptyDescription}
-            skeleton={<TableSkeleton rows={5} cols={3} />}
-            onRetry={onRetry}
-          >
-            {(rows) => (
-              <EntriesTable
-                mod={mod}
-                rows={rows}
-                communities={communities}
-                onEdit={(target) => {
-                  if (target.kind === 'domain') setEditDomain(target.entry)
-                  if (target.kind === 'ip-range') setEditIpRange(target.entry)
-                  if (target.kind === 'cdn') setEditCdn(target.entry)
-                  if (target.kind === 'as') setEditAs(target.entry)
-                  setDialogOpen(true)
-                }}
-                onDelete={setDeleteTarget}
-              />
-            )}
-          </QueryState>
-        </CardContent>
-      </Card>
+      <DataGridCard
+        title={meta.title}
+        description={meta.description}
+        actions={
+          <Button size="sm" type="button" onClick={openCreate}>
+            <Plus />
+            Добавить
+          </Button>
+        }
+      >
+        <QueryState
+          data={items}
+          isLoading={isLoading}
+          isError={isError}
+          error={error}
+          empty={items.length === 0}
+          emptyTitle={meta.emptyTitle}
+          emptyDescription={meta.emptyDescription}
+          skeleton={<TableSkeleton rows={5} cols={3} />}
+          onRetry={onRetry}
+        >
+          {(rows) => (
+            <ModuleEntriesGrid
+              mod={mod}
+              rows={rows}
+              communities={communities}
+              isLoading={isLoading}
+              onEdit={(target) => {
+                if (target.kind === 'domain') setEditDomain(target.entry)
+                if (target.kind === 'ip-range') setEditIpRange(target.entry)
+                if (target.kind === 'cdn') setEditCdn(target.entry)
+                if (target.kind === 'as') setEditAs(target.entry)
+                setDialogOpen(true)
+              }}
+              onDelete={setDeleteTarget}
+            />
+          )}
+        </QueryState>
+      </DataGridCard>
 
       {mod.type === 'DOMAINS' ? (
         <ModuleDomainEntryDialog
@@ -270,168 +253,3 @@ function deleteDescription(target: DeleteTarget | null): string {
       return `AS${target.entry.asn}`
   }
 }
-
-function EntriesTable({
-  mod,
-  rows,
-  communities,
-  onEdit,
-  onDelete,
-}: {
-  mod: ModuleRow
-  rows: Record<string, unknown>[]
-  communities: BgpCommunity[]
-  onEdit: (target: DeleteTarget) => void
-  onDelete: (target: DeleteTarget) => void
-}) {
-  if (mod.type === 'DOMAINS') {
-    const entries = rows as unknown as DomainEntry[]
-    return (
-      <Table>
-        <TableHeader>
-          <TableRow>
-            <TableHead>FQDN</TableHead>
-            <TableHead>Community</TableHead>
-            <TableHead className="w-20" />
-          </TableRow>
-        </TableHeader>
-        <TableBody>
-          {entries.map((entry) => (
-            <TableRow key={entry.id}>
-              <TableCell className="font-mono text-sm">{entry.fqdn}</TableCell>
-              <TableCell className="text-sm text-muted-foreground">
-                {communityLabel(entry.community_id, communities)}
-              </TableCell>
-              <TableCell>
-                <RowActions
-                  onEdit={() => onEdit({ kind: 'domain', entry })}
-                  onDelete={() => onDelete({ kind: 'domain', entry })}
-                />
-              </TableCell>
-            </TableRow>
-          ))}
-        </TableBody>
-      </Table>
-    )
-  }
-
-  if (mod.type === 'IP_RANGES') {
-    const entries = rows as unknown as IpRangeEntry[]
-    return (
-      <Table>
-        <TableHeader>
-          <TableRow>
-            <TableHead>Префикс (CIDR)</TableHead>
-            <TableHead>Community</TableHead>
-            <TableHead className="w-20" />
-          </TableRow>
-        </TableHeader>
-        <TableBody>
-          {entries.map((entry) => (
-            <TableRow key={entry.id}>
-              <TableCell className="font-mono text-sm">{entry.prefix}</TableCell>
-              <TableCell className="text-sm text-muted-foreground">
-                {communityLabel(entry.community_id, communities)}
-              </TableCell>
-              <TableCell>
-                <RowActions
-                  onEdit={() => onEdit({ kind: 'ip-range', entry })}
-                  onDelete={() => onDelete({ kind: 'ip-range', entry })}
-                />
-              </TableCell>
-            </TableRow>
-          ))}
-        </TableBody>
-      </Table>
-    )
-  }
-
-  if (mod.type === 'CDN_CIDRS') {
-    const entries = rows as unknown as CdnSource[]
-    return (
-      <Table>
-        <TableHeader>
-          <TableRow>
-            <TableHead>URL</TableHead>
-            <TableHead>Тип</TableHead>
-            <TableHead>Community</TableHead>
-            <TableHead>Обновлено</TableHead>
-            <TableHead className="w-20" />
-          </TableRow>
-        </TableHeader>
-        <TableBody>
-          {entries.map((entry) => (
-            <TableRow key={entry.id}>
-              <TableCell className="max-w-xs truncate font-mono text-xs">{entry.url}</TableCell>
-              <TableCell className="text-sm">{entry.source_kind}</TableCell>
-              <TableCell className="text-sm text-muted-foreground">
-                {communityLabel(entry.community_id, communities)}
-              </TableCell>
-              <TableCell className="text-xs text-muted-foreground">
-                {formatDateTime(entry.last_refreshed_at)}
-              </TableCell>
-              <TableCell>
-                <RowActions
-                  onEdit={() => onEdit({ kind: 'cdn', entry })}
-                  onDelete={() => onDelete({ kind: 'cdn', entry })}
-                />
-              </TableCell>
-            </TableRow>
-          ))}
-        </TableBody>
-      </Table>
-    )
-  }
-
-  const entries = rows as unknown as AsEntry[]
-  return (
-    <Table>
-      <TableHeader>
-        <TableRow>
-          <TableHead>ASN</TableHead>
-          <TableHead>Имя</TableHead>
-          <TableHead>Префиксов</TableHead>
-          <TableHead>Community</TableHead>
-          <TableHead className="w-20" />
-        </TableRow>
-      </TableHeader>
-      <TableBody>
-        {entries.map((entry) => (
-          <TableRow key={entry.id}>
-            <TableCell className="font-mono text-sm">{entry.asn}</TableCell>
-            <TableCell className="text-sm">{entry.asn_name ?? '—'}</TableCell>
-            <TableCell className="font-mono text-sm">{entry.prefix_count ?? '—'}</TableCell>
-            <TableCell className="text-sm text-muted-foreground">
-              {communityLabel(entry.community_id, communities)}
-            </TableCell>
-            <TableCell>
-              <RowActions
-                onEdit={() => onEdit({ kind: 'as', entry })}
-                onDelete={() => onDelete({ kind: 'as', entry })}
-              />
-            </TableCell>
-          </TableRow>
-        ))}
-      </TableBody>
-    </Table>
-  )
-}
-
-function RowActions({ onEdit, onDelete }: { onEdit: () => void; onDelete: () => void }) {
-  return (
-    <div className="flex justify-end gap-1">
-      <Button variant="ghost" size="icon-sm" onClick={onEdit} aria-label="Редактировать">
-        <Pencil className="size-3.5" />
-      </Button>
-      <Button
-        variant="ghost"
-        size="icon-sm"
-        className="text-destructive"
-        onClick={onDelete}
-        aria-label="Удалить"
-      >
-        <Trash2 className="size-3.5" />
-      </Button>
-    </div>
-  )
-}

apps/web/src/components/modules/modules-list-grid.tsx

@@ -0,0 +1,99 @@
+import { ColumnDef, useReactTable } from '@tanstack/react-table'
+import { useNavigate } from '@tanstack/react-router'
+import { Boxes } from 'lucide-react'
+import { useMemo } from 'react'
+
+import { DataGridShell } from '@/components/data-grid-shell'
+import { Badge } from '@/components/reui/badge'
+import { DataGridColumnHeader } from '@/components/reui/data-grid/data-grid-column-header'
+import { TruncatedText } from '@/components/truncated-text'
+import { createClientDataGridOptions } from '@/lib/data-grid-defaults'
+import type { ModuleRow } from '@/types/api'
+
+export function ModulesListGrid({
+  items,
+  isLoading = false,
+}: {
+  items: ModuleRow[]
+  isLoading?: boolean
+}) {
+  const navigate = useNavigate()
+
+  const columns = useMemo<ColumnDef<ModuleRow>[]>(
+    () => [
+      {
+        accessorKey: 'name',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Название" />,
+        cell: ({ row }) => (
+          <div className="flex items-center gap-2">
+            <Boxes className="size-4 text-muted-foreground" />
+            <TruncatedText className="max-w-[280px] font-medium">{row.original.name}</TruncatedText>
+          </div>
+        ),
+        meta: { headerTitle: 'Название' },
+      },
+      {
+        accessorKey: 'type',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Тип" />,
+        cell: ({ row }) => <Badge variant="outline">{row.original.type}</Badge>,
+        meta: { headerTitle: 'Тип' },
+      },
+      {
+        accessorKey: 'priority',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Приоритет" />,
+        cell: ({ row }) => (
+          <span className="font-mono text-sm tabular-nums">{row.original.priority}</span>
+        ),
+        meta: { headerTitle: 'Приоритет' },
+      },
+      {
+        id: 'enabled',
+        accessorFn: (row) => (row.enabled ? 'enabled' : 'disabled'),
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Состояние" />,
+        cell: ({ row }) =>
+          row.original.enabled ? (
+            <Badge variant="success">включён</Badge>
+          ) : (
+            <Badge variant="secondary">выключен</Badge>
+          ),
+        meta: { headerTitle: 'Состояние' },
+      },
+      {
+        id: 'last_refreshed_at',
+        accessorFn: (row) => row.last_refreshed_at ?? '',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Обновлено" />,
+        cell: ({ row }) => (
+          <span className="text-xs text-muted-foreground">
+            {row.original.last_refreshed_at
+              ? new Date(row.original.last_refreshed_at).toLocaleString('ru-RU')
+              : '—'}
+          </span>
+        ),
+        sortingFn: (a, b) => {
+          const av = a.original.last_refreshed_at ?? ''
+          const bv = b.original.last_refreshed_at ?? ''
+          return av.localeCompare(bv)
+        },
+        meta: { headerTitle: 'Обновлено' },
+      },
+    ],
+    [],
+  )
+
+  const table = useReactTable({
+    data: items,
+    columns,
+    ...createClientDataGridOptions<ModuleRow>(),
+    getRowId: (row) => row.id,
+  })
+
+  return (
+    <DataGridShell
+      table={table}
+      recordCount={items.length}
+      isLoading={isLoading}
+      emptyMessage="Нет модулей"
+      onRowClick={(row) => void navigate({ to: '/modules/$moduleId', params: { moduleId: row.id } })}
+    />
+  )
+}

apps/web/src/components/monitoring/monitoring-ready-grid.tsx

@@ -0,0 +1,123 @@
+import { ColumnDef, useReactTable } from '@tanstack/react-table'
+import { Database, HardDrive, HeartPulse, ListTodo, ShieldCheck } from 'lucide-react'
+import { useMemo } from 'react'
+
+import { Badge } from '@evobgp/ui/components/badge'
+
+import { DataGridShell } from '@/components/data-grid-shell'
+import { DataGridColumnHeader } from '@/components/reui/data-grid/data-grid-column-header'
+import { createClientDataGridOptions } from '@/lib/data-grid-defaults'
+import type { ReadyStatus } from '@/queries/monitoring'
+
+const READY_CHECK_ICONS: Record<string, typeof Database> = {
+  postgres: Database,
+  store: HardDrive,
+  jobs: ListTodo,
+}
+
+interface ReadyCheckRow {
+  id: string
+  label: string
+  subtitle?: string
+  icon: typeof Database
+  ok: boolean
+  statusLabel: string
+  variant: 'default' | 'destructive' | 'secondary'
+}
+
+export function MonitoringReadyGrid({
+  health,
+  ready,
+}: {
+  health?: { ok?: boolean; status?: string; error?: string } | null
+  ready: ReadyStatus
+}) {
+  const data = useMemo<ReadyCheckRow[]>(() => {
+    const checks = ready.checks ?? {}
+    const rows: ReadyCheckRow[] = [
+      {
+        id: 'liveness',
+        label: 'Liveness',
+        subtitle: '/v1/health',
+        icon: HeartPulse,
+        ok: health?.ok === true,
+        statusLabel: health?.ok ? 'OK' : 'Ошибка',
+        variant: health?.ok ? 'default' : 'destructive',
+      },
+      {
+        id: 'readiness',
+        label: 'Readiness',
+        subtitle: '/v1/ready',
+        icon: ShieldCheck,
+        ok: ready.status === 'ok',
+        statusLabel: ready.status ?? '—',
+        variant: ready.status === 'ok' ? 'default' : 'secondary',
+      },
+    ]
+    for (const key of Object.keys(checks)) {
+      const value = checks[key]
+      const ok = typeof value === 'boolean' ? value : value?.ok !== false
+      rows.push({
+        id: key,
+        label: key,
+        icon: READY_CHECK_ICONS[key] ?? ListTodo,
+        ok,
+        statusLabel: ok ? 'OK' : 'Ошибка',
+        variant: ok ? 'default' : 'destructive',
+      })
+    }
+    return rows
+  }, [health?.ok, ready.checks, ready.status])
+
+  const columns = useMemo<ColumnDef<ReadyCheckRow>[]>(
+    () => [
+      {
+        accessorKey: 'label',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Проверка" />,
+        cell: ({ row }) => {
+          const Icon = row.original.icon
+          return (
+            <div className="flex items-center gap-2">
+              <Icon className="size-4 shrink-0 text-muted-foreground" />
+              <div>
+                <p className="text-sm font-medium">{row.original.label}</p>
+                {row.original.subtitle ? (
+                  <p className="text-xs text-muted-foreground">{row.original.subtitle}</p>
+                ) : null}
+              </div>
+            </div>
+          )
+        },
+        meta: { headerTitle: 'Проверка' },
+      },
+      {
+        id: 'status',
+        enableSorting: false,
+        header: 'Статус',
+        cell: ({ row }) => (
+          <Badge variant={row.original.variant}>{row.original.statusLabel}</Badge>
+        ),
+        meta: { headerTitle: 'Статус' },
+      },
+    ],
+    [],
+  )
+
+  const table = useReactTable({
+    data,
+    columns,
+    ...createClientDataGridOptions<ReadyCheckRow>({
+      initialState: { pagination: { pageSize: 20 } },
+    }),
+    getRowId: (row) => row.id,
+  })
+
+  return (
+    <DataGridShell
+      table={table}
+      recordCount={data.length}
+      showPagination={false}
+      emptyMessage="Нет проверок"
+    />
+  )
+}

apps/web/src/components/network/network-peers-grid.tsx

@@ -0,0 +1,77 @@
+import { ColumnDef, useReactTable } from '@tanstack/react-table'
+import { useMemo } from 'react'
+
+import { DataGridShell } from '@/components/data-grid-shell'
+import { StatusBadge } from '@/components/status-badge'
+import { Badge } from '@/components/reui/badge'
+import { DataGridColumnHeader } from '@/components/reui/data-grid/data-grid-column-header'
+import { createClientDataGridOptions } from '@/lib/data-grid-defaults'
+import type { PeerRow } from '@/types/api'
+
+export function NetworkPeersGrid({
+  items,
+  isLoading = false,
+}: {
+  items: PeerRow[]
+  isLoading?: boolean
+}) {
+  const columns = useMemo<ColumnDef<PeerRow>[]>(
+    () => [
+      {
+        id: 'name',
+        accessorFn: (row) => row.name ?? row.neighbor,
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Имя" />,
+        cell: ({ row }) => (
+          <span className="font-medium">{row.original.name ?? row.original.neighbor}</span>
+        ),
+        meta: { headerTitle: 'Имя' },
+      },
+      {
+        accessorKey: 'neighbor',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Neighbor" />,
+        cell: ({ row }) => <span className="font-mono text-xs">{row.original.neighbor}</span>,
+        meta: { headerTitle: 'Neighbor' },
+      },
+      {
+        accessorKey: 'remote_asn',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="ASN" />,
+        cell: ({ row }) => (
+          <span className="font-mono text-xs">{row.original.remote_asn ?? '—'}</span>
+        ),
+        meta: { headerTitle: 'ASN' },
+      },
+      {
+        accessorKey: 'session_state',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Состояние" />,
+        cell: ({ row }) => (
+          <div className="flex items-center gap-1">
+            <StatusBadge status={row.original.session_state} />
+            {row.original.session_mismatch ? (
+              <Badge variant="warning" className="ml-1">
+                mismatch
+              </Badge>
+            ) : null}
+          </div>
+        ),
+        meta: { headerTitle: 'Состояние' },
+      },
+    ],
+    [],
+  )
+
+  const table = useReactTable({
+    data: items,
+    columns,
+    ...createClientDataGridOptions<PeerRow>(),
+    getRowId: (row) => row.id,
+  })
+
+  return (
+    <DataGridShell
+      table={table}
+      recordCount={items.length}
+      isLoading={isLoading}
+      emptyMessage="Нет пиров"
+    />
+  )
+}

apps/web/src/components/network/network-speakers-grid.tsx

@@ -0,0 +1,78 @@
+import { ColumnDef, useReactTable } from '@tanstack/react-table'
+import { useMemo } from 'react'
+
+import { DataGridShell } from '@/components/data-grid-shell'
+import { StatusBadge } from '@/components/status-badge'
+import { Badge } from '@/components/reui/badge'
+import { DataGridColumnHeader } from '@/components/reui/data-grid/data-grid-column-header'
+import { createClientDataGridOptions } from '@/lib/data-grid-defaults'
+import type { SpeakerRow } from '@/types/api'
+
+export function NetworkSpeakersGrid({
+  items,
+  isLoading = false,
+}: {
+  items: SpeakerRow[]
+  isLoading?: boolean
+}) {
+  const columns = useMemo<ColumnDef<SpeakerRow>[]>(
+    () => [
+      {
+        accessorKey: 'endpoint',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Endpoint" />,
+        cell: ({ row }) => <span className="font-mono text-xs">{row.original.endpoint}</span>,
+        meta: { headerTitle: 'Endpoint' },
+      },
+      {
+        accessorKey: 'role',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Роль" />,
+        cell: ({ row }) => <Badge variant="outline">{row.original.role}</Badge>,
+        meta: { headerTitle: 'Роль' },
+      },
+      {
+        id: 'agent',
+        enableSorting: false,
+        header: 'Agent',
+        cell: ({ row }) => {
+          const live = row.original.live
+          if (live?.agent_ok === true) return <StatusBadge status="ok" label="online" />
+          if (live?.agent_ok === false) return <StatusBadge status="error" label="offline" />
+          return <Badge variant="outline">—</Badge>
+        },
+        meta: { headerTitle: 'Agent' },
+      },
+      {
+        id: 'bgp',
+        enableSorting: false,
+        header: 'BGP',
+        cell: ({ row }) => {
+          const live = row.original.live
+          if (!live) return '—'
+          return (
+            <span className="text-xs">
+              {live.bgp_established ?? 0} / {live.bgp_sessions_total ?? 0}
+            </span>
+          )
+        },
+        meta: { headerTitle: 'BGP' },
+      },
+    ],
+    [],
+  )
+
+  const table = useReactTable({
+    data: items,
+    columns,
+    ...createClientDataGridOptions<SpeakerRow>(),
+    getRowId: (row) => row.id,
+  })
+
+  return (
+    <DataGridShell
+      table={table}
+      recordCount={items.length}
+      isLoading={isLoading}
+      emptyMessage="Нет спикеров"
+    />
+  )
+}

apps/web/src/components/operations/operations-jobs-grid.tsx

@@ -0,0 +1,131 @@
+import { ColumnDef, useReactTable } from '@tanstack/react-table'
+import { useMutation } from '@tanstack/react-query'
+import { useMemo } from 'react'
+import { toast } from 'sonner'
+
+import { Button } from '@evobgp/ui/components/button'
+
+import { DataGridShell } from '@/components/data-grid-shell'
+import { DataGridColumnHeader } from '@/components/reui/data-grid/data-grid-column-header'
+import { apiMutate } from '@/lib/api-client'
+import { createClientDataGridOptions } from '@/lib/data-grid-defaults'
+import type { JobRow } from '@/types/api'
+import type { QueryClient } from '@tanstack/react-query'
+
+function StatusBadgeColored({ status }: { status: string }) {
+  const cls =
+    status === 'succeeded'
+      ? 'text-success'
+      : status === 'failed' || status === 'cancelled'
+        ? 'text-destructive'
+        : 'text-info'
+  return <span className={`text-sm font-medium ${cls}`}>{status}</span>
+}
+
+export function OperationsJobsGrid({
+  items,
+  nameById,
+  qc,
+  isLoading = false,
+}: {
+  items: JobRow[]
+  nameById: Map<string, string>
+  qc: QueryClient
+  isLoading?: boolean
+}) {
+  const cancelMutation = useMutation({
+    mutationFn: (jobId: string) => apiMutate(`/v1/jobs/${jobId}/cancel`, 'POST', {}),
+    onSuccess: () => {
+      toast.success('Задача отменена')
+      void qc.invalidateQueries({ queryKey: ['operations'] })
+    },
+    onError: (e) => toast.error(e instanceof Error ? e.message : 'Не удалось отменить'),
+  })
+
+  const columns = useMemo<ColumnDef<JobRow>[]>(
+    () => [
+      {
+        accessorKey: 'kind',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Вид" />,
+        cell: ({ row }) => (
+          <div className="flex flex-col gap-0.5">
+            <span className="font-medium">{row.original.kind}</span>
+            {row.original.meta?.module_id ? (
+              <span className="text-xs text-muted-foreground">
+                {nameById.get(String(row.original.meta.module_id)) ??
+                  String(row.original.meta.module_id)}
+              </span>
+            ) : null}
+          </div>
+        ),
+        meta: { headerTitle: 'Вид' },
+      },
+      {
+        accessorKey: 'status',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Статус" />,
+        cell: ({ row }) => <StatusBadgeColored status={row.original.status} />,
+        meta: { headerTitle: 'Статус' },
+      },
+      {
+        id: 'created_at',
+        accessorFn: (row) => row.created_at ?? '',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Создана" />,
+        cell: ({ row }) => (
+          <span className="whitespace-nowrap text-xs text-muted-foreground">
+            {row.original.created_at
+              ? new Date(row.original.created_at).toLocaleString('ru-RU')
+              : '—'}
+          </span>
+        ),
+        meta: { headerTitle: 'Создана' },
+      },
+      {
+        id: 'finished_at',
+        accessorFn: (row) => row.finished_at ?? '',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Завершена" />,
+        cell: ({ row }) => (
+          <span className="whitespace-nowrap text-xs text-muted-foreground">
+            {row.original.finished_at
+              ? new Date(row.original.finished_at).toLocaleString('ru-RU')
+              : '—'}
+          </span>
+        ),
+        meta: { headerTitle: 'Завершена' },
+      },
+      {
+        id: 'actions',
+        enableSorting: false,
+        header: () => null,
+        cell: ({ row }) =>
+          row.original.status === 'running' || row.original.status === 'queued' ? (
+            <Button
+              variant="ghost"
+              size="icon-sm"
+              type="button"
+              className="text-destructive"
+              onClick={() => cancelMutation.mutate(row.original.job_id)}
+            >
+              ✕
+            </Button>
+          ) : null,
+      },
+    ],
+    [cancelMutation, nameById],
+  )
+
+  const table = useReactTable({
+    data: items,
+    columns,
+    ...createClientDataGridOptions<JobRow>(),
+    getRowId: (row) => row.job_id,
+  })
+
+  return (
+    <DataGridShell
+      table={table}
+      recordCount={items.length}
+      isLoading={isLoading}
+      emptyMessage="Нет задач"
+    />
+  )
+}

apps/web/src/components/operations/operations-revisions-grid.tsx

@@ -0,0 +1,105 @@
+import { ColumnDef, useReactTable } from '@tanstack/react-table'
+import { useMutation } from '@tanstack/react-query'
+import { RefreshCw } from 'lucide-react'
+import { useMemo } from 'react'
+import { toast } from 'sonner'
+
+import { Button } from '@evobgp/ui/components/button'
+
+import { DataGridShell } from '@/components/data-grid-shell'
+import { ConfirmDialog } from '@/components/confirm-dialog'
+import { DataGridColumnHeader } from '@/components/reui/data-grid/data-grid-column-header'
+import { apiMutate } from '@/lib/api-client'
+import { createClientDataGridOptions } from '@/lib/data-grid-defaults'
+import type { RevisionRow } from '@/types/api'
+import type { QueryClient } from '@tanstack/react-query'
+
+export function OperationsRevisionsGrid({
+  items,
+  qc,
+  isLoading = false,
+}: {
+  items: RevisionRow[]
+  qc: QueryClient
+  isLoading?: boolean
+}) {
+  const rollbackMutation = useMutation({
+    mutationFn: (id: string) =>
+      apiMutate(`/v1/revisions/${id}/rollback`, 'POST', {}).then(() => id),
+    onSuccess: () => {
+      toast.success('Откат выполнен')
+      void qc.invalidateQueries({ queryKey: ['operations'] })
+    },
+    onError: (e) => toast.error(e instanceof Error ? e.message : 'Не удалось откатить'),
+  })
+
+  const columns = useMemo<ColumnDef<RevisionRow>[]>(
+    () => [
+      {
+        id: 'id',
+        accessorFn: (row) => row.id,
+        header: ({ column }) => <DataGridColumnHeader column={column} title="ID" />,
+        cell: ({ row }) => (
+          <span className="font-mono text-xs">{row.original.id.slice(0, 12)}…</span>
+        ),
+        meta: { headerTitle: 'ID' },
+      },
+      {
+        accessorKey: 'created_at',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Создана" />,
+        cell: ({ row }) => (
+          <span className="text-xs text-muted-foreground">
+            {new Date(row.original.created_at).toLocaleString('ru-RU')}
+          </span>
+        ),
+        meta: { headerTitle: 'Создана' },
+      },
+      {
+        accessorKey: 'materialized_prefix_count',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Префиксов" />,
+        cell: ({ row }) => (
+          <span className="font-mono text-sm tabular-nums">
+            {row.original.materialized_prefix_count}
+          </span>
+        ),
+        meta: { headerTitle: 'Префиксов' },
+      },
+      {
+        id: 'actions',
+        enableSorting: false,
+        header: () => null,
+        cell: ({ row }) => (
+          <ConfirmDialog
+            trigger={
+              <Button variant="ghost" size="icon-sm" type="button" className="text-destructive">
+                <RefreshCw className="size-3.5" />
+              </Button>
+            }
+            title={`Откатиться к ревизии ${row.original.id.slice(0, 8)}…?`}
+            description="Будет создана новая ревизия на основе выбранной. Требуется роль operator."
+            confirmLabel="Откатить"
+            destructive
+            onConfirm={() => rollbackMutation.mutate(row.original.id)}
+          />
+        ),
+      },
+    ],
+    [rollbackMutation],
+  )
+
+  const table = useReactTable({
+    data: items,
+    columns,
+    ...createClientDataGridOptions<RevisionRow>(),
+    getRowId: (row) => row.id,
+  })
+
+  return (
+    <DataGridShell
+      table={table}
+      recordCount={items.length}
+      isLoading={isLoading}
+      emptyMessage="Нет ревизий"
+    />
+  )
+}

apps/web/src/components/reui/data-grid/data-grid-pagination.tsx

@@ -4,12 +4,8 @@ import { useDataGrid } from "@/components/reui/data-grid/data-grid"
 import { cn } from "@evobgp/ui/lib/utils"
 import { Button } from "@evobgp/ui/components/button"
 import {
-  Select,
-  SelectContent,
-  SelectItem,
-  SelectTrigger,
-  SelectValue,
-} from "@evobgp/ui/components/select"
+  SelectMenu,
+} from "@/components/select-field"
 import { Skeleton } from "@evobgp/ui/components/skeleton"
 import { ChevronLeftIcon, ChevronRightIcon } from "lucide-react"
 
@@ -152,28 +148,23 @@ function DataGridPagination(props: DataGridPaginationProps): React.JSX.Element {
             <div className="text-muted-foreground text-sm">
               {mergedProps.rowsPerPageLabel}
             </div>
-            <Select
-              items={mergedProps?.sizes?.map((size: number) => ({
-                value: `${size}`,
-                label: `${size}`,
-              }))}
+            <SelectMenu
+              items={
+                mergedProps?.sizes?.map((size: number) => ({
+                  value: `${size}`,
+                  label: `${size}`,
+                })) ?? []
+              }
               value={`${pageSize}`}
+              triggerClassName="w-14"
+              size="sm"
+              side="top"
+              contentClassName="min-w-18"
               onValueChange={(value) => {
-                const newPageSize = Number(value)
-                table.setPageSize(newPageSize)
+                if (!value) return
+                table.setPageSize(Number(value))
               }}
-            >
-              <SelectTrigger className="w-14" size="sm">
-                <SelectValue />
-              </SelectTrigger>
-              <SelectContent side="top" className="min-w-18">
-                {mergedProps?.sizes?.map((size: number) => (
-                  <SelectItem key={size} value={`${size}`}>
-                    {size}
-                  </SelectItem>
-                ))}
-              </SelectContent>
-            </Select>
+            />
           </>
         )}
       </div>

apps/web/src/components/reui/frame.tsx

@@ -0,0 +1,175 @@
+import { cva, type VariantProps } from "class-variance-authority"
+
+import { cn } from "@evobgp/ui/lib/utils"
+
+/**
+ * CSS variable architecture for FramePanel theming:
+ *
+ * The Frame parent sets --frame-panel-bg and --frame-panel-border-color.
+ * FramePanel consumes them directly via bg-(--frame-panel-bg) and
+ * border-(--frame-panel-border-color). This means:
+ *
+ *   - variant="inverse" overrides those vars on Frame → all panels pick it up
+ *   - <FramePanel className="bg-blue-50"> adds a direct utility on the element
+ *     which wins over bg-(--frame-panel-bg) by Tailwind source order — no
+ *     :not() or !important needed
+ */
+const frameVariants = cva(
+  [
+    "relative flex flex-col bg-muted/50 gap-(--frame-gap) px-(--frame-px) py-(--frame-py) rounded-(--frame-radius)",
+    "(--radius-xl)] [--frame-radius:var(--radius-xl)]",
+    "(--radius-none)] (--radius-2xl)] (--radius-lg)] (--radius-none)]",
+    "[--frame-gap:--spacing(0.75)] [--frame-px:--spacing(0.75)] [--frame-py:--spacing(0.75)] [--frame-panel-header-gap:0rem] [--frame-panel-footer-gap:--spacing(1)]",
+    "[--frame-panel-px-adjust:0px] [--frame-panel-py-adjust:0px] [--frame-panel-header-px-adjust:0px] [--frame-panel-header-py-adjust:0px] [--frame-panel-footer-px-adjust:0px] [--frame-panel-footer-py-adjust:0px]",
+    "[--frame-panel-px:calc(var(--frame-panel-px-base)_+_var(--frame-panel-px-adjust))] [--frame-panel-py:calc(var(--frame-panel-py-base)_+_var(--frame-panel-py-adjust))] [--frame-panel-header-px:calc(var(--frame-panel-header-px-base)_+_var(--frame-panel-header-px-adjust))] [--frame-panel-header-py:calc(var(--frame-panel-header-py-base)_+_var(--frame-panel-header-py-adjust))] [--frame-panel-footer-px:calc(var(--frame-panel-footer-px-base)_+_var(--frame-panel-footer-px-adjust))] [--frame-panel-footer-py:calc(var(--frame-panel-footer-py-base)_+_var(--frame-panel-footer-py-adjust))]",
+    "(1)] (1)] (1.25)] (1.5)] (1.5)] (0.5)] (1)] (1)]",
+    // Default panel token values — overridden per-variant below
+    "[--frame-panel-bg:var(--color-card)] [--frame-panel-border-color:var(--color-border)] [--frame-border-color:var(--color-border)]",
+  ],
+  {
+    variants: {
+      variant: {
+        default: "border border-[var(--frame-border-color)] bg-clip-padding",
+        inverse:
+          "[--frame-panel-bg:color-mix(in_oklch,var(--color-muted)_40%,transparent)] border border-[var(--frame-border-color)] bg-background bg-clip-padding",
+        ghost: "",
+      },
+      spacing: {
+        xs: "[--frame-panel-px-base:--spacing(2)] [--frame-panel-py-base:--spacing(2)] [--frame-panel-header-px-base:--spacing(2)] [--frame-panel-header-py-base:--spacing(1)] [--frame-panel-footer-px-base:--spacing(2)] [--frame-panel-footer-py-base:--spacing(1)] (3)] (1)] (3)] (3)]",
+        sm: "[--frame-panel-px-base:--spacing(3)] [--frame-panel-py-base:--spacing(3.5)] [--frame-panel-header-px-base:--spacing(3)] [--frame-panel-header-py-base:--spacing(2.5)] [--frame-panel-footer-px-base:--spacing(3)] [--frame-panel-footer-py-base:--spacing(2.5)] (2)] (2)] (2)]",
+        default:
+          "[--frame-panel-px-base:--spacing(4)] [--frame-panel-py-base:--spacing(4)] [--frame-panel-header-px-base:--spacing(4)] [--frame-panel-header-py-base:--spacing(3)] [--frame-panel-footer-px-base:--spacing(4)] [--frame-panel-footer-py-base:--spacing(3)] (2)] (2)] (2)]",
+        lg: "[--frame-panel-px-base:--spacing(5)] [--frame-panel-py-base:--spacing(5)] [--frame-panel-header-px-base:--spacing(5)] [--frame-panel-header-py-base:--spacing(4)] [--frame-panel-footer-px-base:--spacing(5)] [--frame-panel-footer-py-base:--spacing(4)] (2)] (2)] (2)]",
+      },
+      stacked: {
+        true: [
+          "gap-0 *:has-[+[data-slot=frame-panel]]:rounded-b-none",
+          "*:has-[+[data-slot=frame-panel]]:before:hidden",
+          "*:[[data-slot=frame-panel]+[data-slot=frame-panel]]:rounded-t-none",
+          "*:[[data-slot=frame-panel]+[data-slot=frame-panel]]:border-t-0",
+        ],
+        false: [
+          "data-[spacing=sm]:*:[[data-slot=frame-panel]+[data-slot=frame-panel]]:mt-0.5",
+          "data-[spacing=default]:*:[[data-slot=frame-panel]+[data-slot=frame-panel]]:mt-1",
+          "data-[spacing=lg]:*:[[data-slot=frame-panel]+[data-slot=frame-panel]]:mt-2",
+        ],
+      },
+      dense: {
+        // Positional rules must stay as parent selectors — cannot be expressed via CSS vars
+        true: "p-0 gap-0 border-[var(--frame-border-color)] [&_[data-slot=frame-panel]]:-mx-px [&_[data-slot=frame-panel]]:before:hidden [&_[data-slot=frame-panel]:last-child]:-mb-px [&:not(:has([data-slot=frame-panel-header]))_[data-slot=frame-panel]:is(:first-child)]:-mt-px",
+        false: "",
+      },
+    },
+    defaultVariants: {
+      variant: "default",
+      spacing: "default",
+      stacked: false,
+      dense: false,
+    },
+  }
+)
+
+function Frame({
+  className,
+  variant,
+  spacing,
+  stacked,
+  dense,
+  ...props
+}: React.ComponentProps<"div"> & VariantProps<typeof frameVariants>) {
+  return (
+    <div
+      className={cn(
+        frameVariants({ variant, spacing, stacked, dense }),
+        className
+      )}
+      data-slot="frame"
+      data-spacing={spacing}
+      {...props}
+    />
+  )
+}
+
+function FramePanel({
+  className,
+  fit,
+  ...props
+}: React.ComponentProps<"div"> & { fit?: boolean }) {
+  return (
+    <div
+      className={cn(
+        // bg-(--frame-panel-bg) and border-(--frame-panel-border-color) consume the
+        // CSS vars set by the Frame parent. Any explicit bg-* or border-* class passed
+        // via className overrides these by Tailwind source order - no ! needed.
+        "relative overflow-hidden rounded-(--frame-radius) border border-(--frame-panel-border-color) bg-(--frame-panel-bg) bg-clip-padding shadow-xs",
+        // `fit` sizes the panel to its content; otherwise it grows to fill the frame.
+        !fit && "grow",
+        "before:pointer-events-none before:absolute before:inset-0 before:rounded-[calc(var(--frame-radius)-1px)] before:shadow-black/5",
+        "dark:bg-clip-border dark:before:shadow-white/5",
+        "px-(--frame-panel-px) py-(--frame-panel-py)",
+        className
+      )}
+      data-slot="frame-panel"
+      {...props}
+    />
+  )
+}
+
+function FrameHeader({ className, ...props }: React.ComponentProps<"header">) {
+  return (
+    <header
+      className={cn(
+        "flex flex-col gap-(--frame-panel-header-gap) px-(--frame-panel-header-px) py-(--frame-panel-header-py)",
+        className
+      )}
+      data-slot="frame-panel-header"
+      {...props}
+    />
+  )
+}
+
+function FrameTitle({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      className={cn("text-sm font-semibold", className)}
+      data-slot="frame-panel-title"
+      {...props}
+    />
+  )
+}
+
+function FrameDescription({
+  className,
+  ...props
+}: React.ComponentProps<"div">) {
+  return (
+    <div
+      className={cn("text-muted-foreground text-sm", className)}
+      data-slot="frame-panel-description"
+      {...props}
+    />
+  )
+}
+
+function FrameFooter({ className, ...props }: React.ComponentProps<"footer">) {
+  return (
+    <footer
+      className={cn(
+        "flex flex-col gap-(--frame-panel-footer-gap) px-(--frame-panel-footer-px) py-(--frame-panel-footer-py)",
+        className
+      )}
+      data-slot="frame-panel-footer"
+      {...props}
+    />
+  )
+}
+
+export {
+  Frame,
+  FramePanel,
+  FrameHeader,
+  FrameTitle,
+  FrameDescription,
+  FrameFooter,
+  frameVariants,
+}

apps/web/src/components/schedule/schedule-jobs-grid.tsx

@@ -0,0 +1,100 @@
+import { ColumnDef, useReactTable } from '@tanstack/react-table'
+import { useMemo } from 'react'
+
+import { Badge } from '@evobgp/ui/components/badge'
+
+import { DataGridShell } from '@/components/data-grid-shell'
+import { DataGridColumnHeader } from '@/components/reui/data-grid/data-grid-column-header'
+import { createClientDataGridOptions } from '@/lib/data-grid-defaults'
+import type { JobRow } from '@/types/api'
+
+export function ScheduleJobsGrid({
+  items,
+  isLoading = false,
+}: {
+  items: JobRow[]
+  isLoading?: boolean
+}) {
+  const columns = useMemo<ColumnDef<JobRow>[]>(
+    () => [
+      {
+        accessorKey: 'kind',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Вид" />,
+        cell: ({ row }) => <span className="font-medium">{row.original.kind}</span>,
+        meta: { headerTitle: 'Вид' },
+      },
+      {
+        accessorKey: 'status',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Статус" />,
+        cell: ({ row }) => (
+          <Badge
+            variant={
+              row.original.status === 'succeeded'
+                ? 'default'
+                : row.original.status === 'failed'
+                  ? 'destructive'
+                  : 'secondary'
+            }
+          >
+            {row.original.status}
+          </Badge>
+        ),
+        meta: { headerTitle: 'Статус' },
+      },
+      {
+        id: 'created_at',
+        accessorFn: (row) => row.created_at ?? '',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Создана" />,
+        cell: ({ row }) => (
+          <span className="whitespace-nowrap text-xs text-muted-foreground">
+            {row.original.created_at
+              ? new Date(row.original.created_at).toLocaleString('ru-RU')
+              : '—'}
+          </span>
+        ),
+        meta: { headerTitle: 'Создана' },
+      },
+      {
+        id: 'finished_at',
+        accessorFn: (row) => row.finished_at ?? '',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Завершена" />,
+        cell: ({ row }) => (
+          <span className="whitespace-nowrap text-xs text-muted-foreground">
+            {row.original.finished_at
+              ? new Date(row.original.finished_at).toLocaleString('ru-RU')
+              : '—'}
+          </span>
+        ),
+        meta: { headerTitle: 'Завершена' },
+      },
+      {
+        accessorKey: 'error',
+        enableSorting: false,
+        header: 'Ошибка',
+        cell: ({ row }) => (
+          <span className="max-w-xs truncate text-xs text-destructive">
+            {row.original.error ?? ''}
+          </span>
+        ),
+        meta: { headerTitle: 'Ошибка' },
+      },
+    ],
+    [],
+  )
+
+  const table = useReactTable({
+    data: items,
+    columns,
+    ...createClientDataGridOptions<JobRow>(),
+    getRowId: (row) => row.job_id,
+  })
+
+  return (
+    <DataGridShell
+      table={table}
+      recordCount={items.length}
+      isLoading={isLoading}
+      emptyMessage="Нет задач"
+    />
+  )
+}

apps/web/src/components/schedule/schedule-modules-grid.tsx

@@ -0,0 +1,113 @@
+import { ColumnDef, useReactTable } from '@tanstack/react-table'
+import { RefreshCw } from 'lucide-react'
+import { useMemo } from 'react'
+
+import { Badge } from '@evobgp/ui/components/badge'
+
+import { DataGridShell } from '@/components/data-grid-shell'
+import { LoadingButton } from '@/components/loading-button'
+import { DataGridColumnHeader } from '@/components/reui/data-grid/data-grid-column-header'
+import { createClientDataGridOptions } from '@/lib/data-grid-defaults'
+import type { ModuleRow } from '@/types/api'
+
+export function ScheduleModulesGrid({
+  items,
+  refreshing,
+  onRefresh,
+  isLoading = false,
+}: {
+  items: ModuleRow[]
+  refreshing: Record<string, boolean>
+  onRefresh: (id: string) => void
+  isLoading?: boolean
+}) {
+  const columns = useMemo<ColumnDef<ModuleRow>[]>(
+    () => [
+      {
+        accessorKey: 'name',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Модуль" />,
+        cell: ({ row }) => <span className="font-medium">{row.original.name}</span>,
+        meta: { headerTitle: 'Модуль' },
+      },
+      {
+        accessorKey: 'type',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Тип" />,
+        cell: ({ row }) => <Badge variant="outline">{row.original.type}</Badge>,
+        meta: { headerTitle: 'Тип' },
+      },
+      {
+        id: 'schedule',
+        accessorFn: (row) => row.cron_expr ?? String(row.refresh_interval_sec ?? ''),
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Расписание" />,
+        cell: ({ row }) => (
+          <span className="font-mono text-xs text-muted-foreground">
+            {row.original.cron_expr ??
+              (row.original.refresh_interval_sec ? `${row.original.refresh_interval_sec}s` : '—')}
+          </span>
+        ),
+        meta: { headerTitle: 'Расписание' },
+      },
+      {
+        id: 'last_refreshed_at',
+        accessorFn: (row) => row.last_refreshed_at ?? '',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Обновлено" />,
+        cell: ({ row }) => (
+          <span className="whitespace-nowrap text-xs text-muted-foreground">
+            {row.original.last_refreshed_at
+              ? new Date(row.original.last_refreshed_at).toLocaleString('ru-RU')
+              : '—'}
+          </span>
+        ),
+        meta: { headerTitle: 'Обновлено' },
+      },
+      {
+        id: 'enabled',
+        accessorFn: (row) => (row.enabled ? 'on' : 'off'),
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Статус" />,
+        cell: ({ row }) =>
+          row.original.enabled ? (
+            <Badge variant="default">Вкл</Badge>
+          ) : (
+            <Badge variant="secondary">Выкл</Badge>
+          ),
+        meta: { headerTitle: 'Статус' },
+      },
+      {
+        id: 'actions',
+        enableSorting: false,
+        header: () => null,
+        cell: ({ row }) => (
+          <div className="text-right">
+            <LoadingButton
+              size="sm"
+              variant="secondary"
+              type="button"
+              loading={!!refreshing[row.original.id]}
+              onClick={() => onRefresh(row.original.id)}
+            >
+              <RefreshCw />
+              Обновить
+            </LoadingButton>
+          </div>
+        ),
+      },
+    ],
+    [onRefresh, refreshing],
+  )
+
+  const table = useReactTable({
+    data: items,
+    columns,
+    ...createClientDataGridOptions<ModuleRow>(),
+    getRowId: (row) => row.id,
+  })
+
+  return (
+    <DataGridShell
+      table={table}
+      recordCount={items.length}
+      isLoading={isLoading}
+      emptyMessage="Нет модулей"
+    />
+  )
+}

apps/web/src/components/select-field.tsx

@@ -0,0 +1,100 @@
+import type { ComponentProps, ReactNode } from 'react'
+
+import { Field, FieldDescription, FieldLabel } from '@evobgp/ui/components/field'
+import {
+  Select,
+  SelectContent,
+  SelectGroup,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from '@evobgp/ui/components/select'
+import { cn } from '@evobgp/ui/lib/utils'
+
+export type SelectMenuItem<T extends string = string> = {
+  value: T
+  label: ReactNode
+  disabled?: boolean
+}
+
+type SelectRootProps = ComponentProps<typeof Select>
+
+export interface SelectMenuProps<T extends string = string>
+  extends Omit<SelectRootProps, 'children' | 'onValueChange' | 'value' | 'defaultValue'> {
+  items: ReadonlyArray<SelectMenuItem<T>>
+  value?: T | null
+  defaultValue?: T | null
+  onValueChange?: (value: T | null) => void
+  placeholder?: string
+  id?: string
+  triggerClassName?: string
+  contentClassName?: string
+  size?: 'sm' | 'default'
+  side?: ComponentProps<typeof SelectContent>['side']
+}
+
+/** ReUI c-select-4: `items` на Root, опции в `SelectGroup`. */
+export function SelectMenu<T extends string = string>({
+  items,
+  placeholder,
+  id,
+  triggerClassName,
+  contentClassName,
+  size = 'default',
+  side,
+  value,
+  defaultValue,
+  onValueChange,
+  ...selectProps
+}: SelectMenuProps<T>) {
+  return (
+    <Select
+      items={items}
+      value={value}
+      defaultValue={defaultValue}
+      onValueChange={(next) => onValueChange?.(next as T | null)}
+      {...selectProps}
+    >
+      <SelectTrigger id={id} className={cn('w-full', triggerClassName)} size={size}>
+        <SelectValue placeholder={placeholder} />
+      </SelectTrigger>
+      <SelectContent side={side} className={contentClassName}>
+        <SelectGroup>
+          {items.map((item) => (
+            <SelectItem key={item.value} value={item.value} disabled={item.disabled}>
+              {item.label}
+            </SelectItem>
+          ))}
+        </SelectGroup>
+      </SelectContent>
+    </Select>
+  )
+}
+
+export interface SelectFieldProps<T extends string = string> extends SelectMenuProps<T> {
+  label?: ReactNode
+  description?: ReactNode
+  fieldClassName?: string
+}
+
+export function SelectField<T extends string = string>({
+  label,
+  description,
+  fieldClassName,
+  id,
+  ...menuProps
+}: SelectFieldProps<T>) {
+  return (
+    <Field className={fieldClassName}>
+      {label ? <FieldLabel htmlFor={id}>{label}</FieldLabel> : null}
+      <SelectMenu id={id} {...menuProps} />
+      {description ? (
+        typeof description === 'string' ? (
+          <FieldDescription className="font-mono text-xs">{description}</FieldDescription>
+        ) : (
+          description
+        )
+      ) : null}
+    </Field>
+  )
+}

apps/web/src/components/settings/settings-kv-grid.tsx

@@ -0,0 +1,57 @@
+import { ColumnDef, useReactTable } from '@tanstack/react-table'
+import { useMemo } from 'react'
+
+import { DataGridShell } from '@/components/data-grid-shell'
+import { DataGridColumnHeader } from '@/components/reui/data-grid/data-grid-column-header'
+import { createClientDataGridOptions } from '@/lib/data-grid-defaults'
+
+export interface SettingsKvRow {
+  id: string | number
+  key: string
+  value: string
+}
+
+export function SettingsKvGrid({
+  items,
+  isLoading = false,
+}: {
+  items: SettingsKvRow[]
+  isLoading?: boolean
+}) {
+  const columns = useMemo<ColumnDef<SettingsKvRow>[]>(
+    () => [
+      {
+        accessorKey: 'key',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Ключ" />,
+        cell: ({ row }) => <span className="font-mono text-xs">{row.original.key}</span>,
+        meta: { headerTitle: 'Ключ' },
+      },
+      {
+        accessorKey: 'value',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="Значение" />,
+        cell: ({ row }) => <span className="font-mono text-xs">{row.original.value}</span>,
+        meta: { headerTitle: 'Значение' },
+      },
+    ],
+    [],
+  )
+
+  const table = useReactTable({
+    data: items,
+    columns,
+    ...createClientDataGridOptions<SettingsKvRow>({
+      initialState: { pagination: { pageSize: 25 } },
+    }),
+    getRowId: (row) => String(row.id),
+  })
+
+  return (
+    <DataGridShell
+      table={table}
+      recordCount={items.length}
+      isLoading={isLoading}
+      emptyMessage="Нет дополнительных настроек"
+      showPagination={items.length > 10}
+    />
+  )
+}

apps/web/src/components/skeletons.tsx

@@ -1,6 +1,7 @@
-import { SectionCards } from './section-cards'
-import { Skeleton } from '@evobgp/ui/components/skeleton'
 import { Card, CardContent } from '@evobgp/ui/components/card'
+import { Skeleton } from '@evobgp/ui/components/skeleton'
+
+import { SectionCards } from './section-cards'
 
 export function SectionCardsSkeleton({ count = 4 }: { count?: number }) {
   return (
@@ -14,6 +15,38 @@ export function SectionCardsSkeleton({ count = 4 }: { count?: number }) {
   )
 }
 
+export function AnalyticsDashboardSkeleton() {
+  return (
+    <div className="grid gap-4 lg:grid-cols-3 lg:grid-rows-2">
+      <Card className="gap-0 lg:row-span-2">
+        <CardContent className="space-y-4 p-5">
+          <Skeleton className="h-4 w-40" />
+          <div className="grid gap-4 sm:grid-cols-3">
+            {Array.from({ length: 3 }).map((_, i) => (
+              <Skeleton key={i} className="h-16 w-full" />
+            ))}
+          </div>
+          <Skeleton className="h-2 w-full" />
+          <Skeleton className="h-32 w-full" />
+        </CardContent>
+      </Card>
+      <Card className="gap-0">
+        <CardContent className="space-y-4 p-5">
+          <Skeleton className="h-4 w-32" />
+          <Skeleton className="h-10 w-24" />
+          <Skeleton className="h-36 w-full" />
+        </CardContent>
+      </Card>
+      <Card className="gap-0">
+        <CardContent className="space-y-4 p-5">
+          <Skeleton className="h-4 w-32" />
+          <Skeleton className="h-44 w-full" />
+        </CardContent>
+      </Card>
+    </div>
+  )
+}
+
 export function TableSkeleton({ rows = 6, cols = 4 }: { rows?: number; cols?: number }) {
   return (
     <Card className="gap-0">

apps/web/src/components/status-badge.tsx

@@ -22,6 +22,11 @@ const STATUS_VARIANT: Record<string, BadgeVariant> = {
   stale: 'warning',
   warning: 'warning',
   mismatch: 'warning',
+  pending: 'warning',
+  approved: 'success',
+  revoked: 'destructive',
+  block: 'destructive',
+  accept: 'success',
 }
 
 export function StatusBadge({ status, label }: { status: string; label?: string }) {

apps/web/src/lib/access/api-key-labels.ts

@@ -0,0 +1,19 @@
+import type { ApiKeyRole } from '@/types/api'
+
+export const API_KEY_ROLE_ITEMS: ReadonlyArray<{ value: ApiKeyRole; label: string }> = [
+  { value: 'viewer', label: 'viewer — только чтение' },
+  { value: 'editor', label: 'editor — CRUD без apply' },
+  { value: 'operator', label: 'operator — полный доступ' },
+  { value: 'node', label: 'node — только API ноды' },
+]
+
+export function apiKeyRoleLabel(role: ApiKeyRole): string {
+  return API_KEY_ROLE_ITEMS.find((o) => o.value === role)?.label ?? role
+}
+
+export function formatApiKeyDate(iso: string | null | undefined): string {
+  if (!iso) return '—'
+  const d = new Date(iso)
+  if (Number.isNaN(d.getTime())) return '—'
+  return d.toLocaleString('ru-RU')
+}

apps/web/src/lib/api-client.ts

@@ -11,6 +11,9 @@ import type {
 
 export const TOKEN_STORAGE_KEY = 'evobgp_api_token'
 
+/** Локальный demo-токен (operator) при включённом demo-seed — см. docs/access.md */
+export const DEV_API_TOKEN = 'dev'
+
 export type Problem = {
   type?: string
   title?: string
@@ -18,14 +21,31 @@ export type Problem = {
   detail?: string
 }
 
+/** Убирает пробелы и опциональный префикс Bearer (UI часто вставляет «Bearer dev»). */
+export function normalizeApiToken(raw: string): string {
+  let t = raw.trim()
+  if (/^bearer\s+/i.test(t)) {
+    t = t.replace(/^bearer\s+/i, '').trim()
+  }
+  return t
+}
+
 function getToken(): string | null {
   if (typeof window === 'undefined') return null
-  return window.localStorage.getItem(TOKEN_STORAGE_KEY)
+  const raw = window.localStorage.getItem(TOKEN_STORAGE_KEY)
+  if (!raw) return null
+  const normalized = normalizeApiToken(raw)
+  return normalized || null
 }
 
 export function setToken(token: string | null): void {
   if (typeof window === 'undefined') return
-  if (token) window.localStorage.setItem(TOKEN_STORAGE_KEY, token)
+  if (!token) {
+    window.localStorage.removeItem(TOKEN_STORAGE_KEY)
+    return
+  }
+  const normalized = normalizeApiToken(token)
+  if (normalized) window.localStorage.setItem(TOKEN_STORAGE_KEY, normalized)
   else window.localStorage.removeItem(TOKEN_STORAGE_KEY)
 }
 

apps/web/src/lib/data-grid-defaults.ts

@@ -0,0 +1,44 @@
+import {
+  getCoreRowModel,
+  getPaginationRowModel,
+  getSortedRowModel,
+  type TableOptions,
+} from '@tanstack/react-table'
+
+import type { DataGridProps } from '@/components/reui/data-grid/data-grid'
+
+export const DATA_GRID_TABLE_LAYOUT: NonNullable<DataGridProps<object>['tableLayout']> = {
+  dense: true,
+  headerSticky: true,
+  rowBorder: true,
+}
+
+export const DATA_GRID_PAGINATION_RU = {
+  sizes: [10, 25, 50] as number[],
+  sizesLabel: 'Показать',
+  sizesDescription: 'на странице',
+  info: '{from}–{to} из {count}',
+  rowsPerPageLabel: 'Строк на странице',
+  previousPageLabel: 'Предыдущая страница',
+  nextPageLabel: 'Следующая страница',
+}
+
+export const DATA_GRID_DENSE_LAYOUT: NonNullable<DataGridProps<object>['tableLayout']> = {
+  ...DATA_GRID_TABLE_LAYOUT,
+  dense: true,
+}
+
+export function createClientDataGridOptions<TData extends object>(
+  overrides?: Partial<TableOptions<TData>>,
+): Pick<
+  TableOptions<TData>,
+  'getCoreRowModel' | 'getSortedRowModel' | 'getPaginationRowModel' | 'initialState'
+> {
+  return {
+    getCoreRowModel: getCoreRowModel(),
+    getSortedRowModel: getSortedRowModel(),
+    getPaginationRowModel: getPaginationRowModel(),
+    initialState: { pagination: { pageSize: 10 } },
+    ...overrides,
+  }
+}

apps/web/src/lib/metrics/deployment-progress.ts

@@ -0,0 +1,32 @@
+import type { SpeakerRow } from '@/types/api'
+
+import type { DeploymentProgress } from './types'
+
+export function deploymentProgress(speakers: SpeakerRow[]): DeploymentProgress {
+  if (speakers.length === 0) {
+    return { percent: 0, synced: 0, total: 0, mode: 'online' }
+  }
+
+  const withRevision = speakers.filter(
+    (s) => s.published_revision_id && s.last_applied_revision_id,
+  )
+  if (withRevision.length > 0) {
+    const synced = withRevision.filter(
+      (s) => s.published_revision_id === s.last_applied_revision_id,
+    ).length
+    return {
+      percent: Math.round((synced / withRevision.length) * 100),
+      synced,
+      total: withRevision.length,
+      mode: 'revision',
+    }
+  }
+
+  const online = speakers.filter((s) => s.live?.agent_ok).length
+  return {
+    percent: Math.round((online / speakers.length) * 100),
+    synced: online,
+    total: speakers.length,
+    mode: 'online',
+  }
+}

apps/web/src/lib/metrics/index.ts

@@ -0,0 +1,8 @@
+export * from './types'
+export * from './job-status-breakdown'
+export * from './module-type-breakdown'
+export * from './peer-capacity-bars'
+export * from './deployment-progress'
+export * from './readiness-breakdown'
+export * from './peer-session-breakdown'
+export * from './recent-platform-activity'

apps/web/src/lib/metrics/job-status-breakdown.ts

@@ -0,0 +1,52 @@
+import type { JobRow } from '@/types/api'
+
+import type { BreakdownSlice } from './types'
+
+const STATUS_BUCKETS: { keys: string[]; label: string; color: string }[] = [
+  { keys: ['succeeded', 'success'], label: 'Успешно', color: 'var(--color-chart-2)' },
+  { keys: ['running', 'queued'], label: 'Активные', color: 'var(--color-chart-1)' },
+  { keys: ['failed', 'error', 'cancelled'], label: 'Ошибки', color: 'var(--color-destructive)' },
+]
+
+function bucketForStatus(status: string): string {
+  const s = status.toLowerCase()
+  for (const bucket of STATUS_BUCKETS) {
+    if (bucket.keys.includes(s)) return bucket.label
+  }
+  return 'Прочее'
+}
+
+export function jobStatusBreakdown(jobs: JobRow[]): BreakdownSlice[] {
+  const counts = new Map<string, number>()
+  for (const job of jobs) {
+    const label = bucketForStatus(job.status)
+    counts.set(label, (counts.get(label) ?? 0) + 1)
+  }
+
+  const slices: BreakdownSlice[] = []
+  for (const bucket of STATUS_BUCKETS) {
+    const count = counts.get(bucket.label) ?? 0
+    if (count > 0) {
+      slices.push({
+        key: bucket.label,
+        label: bucket.label,
+        count,
+        color: bucket.color,
+      })
+    }
+  }
+  const other = counts.get('Прочее') ?? 0
+  if (other > 0) {
+    slices.push({
+      key: 'other',
+      label: 'Прочее',
+      count: other,
+      color: 'var(--color-chart-4)',
+    })
+  }
+  return slices
+}
+
+export function jobStatusTotal(jobs: JobRow[]): number {
+  return jobs.length
+}

apps/web/src/lib/metrics/module-type-breakdown.ts

@@ -0,0 +1,26 @@
+import type { ModuleRow, ModuleType } from '@/types/api'
+
+import type { BreakdownSlice } from './types'
+
+const TYPE_META: Record<ModuleType, { label: string; color: string }> = {
+  AS_PREFIXES: { label: 'AS / префиксы', color: 'var(--color-chart-1)' },
+  DOMAINS: { label: 'Домены', color: 'var(--color-chart-2)' },
+  CDN_CIDRS: { label: 'CDN', color: 'var(--color-chart-3)' },
+  IP_RANGES: { label: 'IP-диапазоны', color: 'var(--color-chart-4)' },
+}
+
+export function moduleTypeBreakdown(modules: ModuleRow[]): BreakdownSlice[] {
+  const counts = new Map<ModuleType, number>()
+  for (const mod of modules) {
+    counts.set(mod.type, (counts.get(mod.type) ?? 0) + 1)
+  }
+
+  return (Object.keys(TYPE_META) as ModuleType[])
+    .map((type) => ({
+      key: type,
+      label: TYPE_META[type].label,
+      count: counts.get(type) ?? 0,
+      color: TYPE_META[type].color,
+    }))
+    .filter((slice) => slice.count > 0)
+}

apps/web/src/lib/metrics/peer-capacity-bars.ts

@@ -0,0 +1,42 @@
+import type { PeerRow, SpeakerRow } from '@/types/api'
+
+import type { CapacityBar } from './types'
+
+function peerLabel(peer: PeerRow): string {
+  return peer.name?.trim() || peer.neighbor || peer.id.slice(0, 8)
+}
+
+function speakerLabel(speaker: SpeakerRow): string {
+  return speaker.live?.label?.trim() || speaker.agent_domain || speaker.endpoint || speaker.id.slice(0, 8)
+}
+
+export function peerCapacityBars(peers: PeerRow[], max = 24): CapacityBar[] {
+  return peers
+    .filter((p) => p.enabled !== false)
+    .slice(0, max)
+    .map((peer) => ({
+      id: peer.id,
+      name: peerLabel(peer),
+      value: peer.session_state === 'Established' ? 100 : peer.session_state ? 40 : 10,
+    }))
+}
+
+export function speakerCapacityBars(speakers: SpeakerRow[], max = 24): CapacityBar[] {
+  return speakers.slice(0, max).map((speaker) => {
+    const online = speaker.live?.agent_ok === true
+    const established = speaker.live?.bgp_established ?? 0
+    const total = speaker.live?.bgp_sessions_total ?? 0
+    const ratio = total > 0 ? Math.round((established / total) * 100) : online ? 100 : 15
+    return {
+      id: speaker.id,
+      name: speakerLabel(speaker),
+      value: online ? ratio : 10,
+    }
+  })
+}
+
+export function capacityUtilization(bars: CapacityBar[]): number {
+  if (bars.length === 0) return 0
+  const sum = bars.reduce((acc, bar) => acc + bar.value, 0)
+  return Math.round(sum / bars.length)
+}

apps/web/src/lib/metrics/peer-session-breakdown.ts

@@ -0,0 +1,41 @@
+import type { PeerRow } from '@/types/api'
+
+import type { BreakdownSlice } from './types'
+
+export function peerSessionBreakdown(peers: PeerRow[]): BreakdownSlice[] {
+  const enabled = peers.filter((p) => p.enabled !== false)
+  const established = enabled.filter((p) => p.session_state === 'Established').length
+  const pending = enabled.filter(
+    (p) => p.session_state && p.session_state !== 'Established',
+  ).length
+  const disabled = peers.length - enabled.length
+
+  const slices: BreakdownSlice[] = []
+  if (established > 0) {
+    slices.push({
+      key: 'established',
+      label: 'Established',
+      count: established,
+      color: 'var(--color-chart-2)',
+    })
+  }
+  if (pending > 0) {
+    slices.push({
+      key: 'pending',
+      label: 'Не Established',
+      count: pending,
+      color: 'var(--color-warning)',
+    })
+  }
+  if (disabled > 0) {
+    slices.push({
+      key: 'disabled',
+      label: 'Выключены',
+      count: disabled,
+      color: 'var(--color-chart-4)',
+    })
+  }
+  return slices.length > 0
+    ? slices
+    : [{ key: 'empty', label: 'Нет пиров', count: 1, color: 'var(--color-muted-foreground)' }]
+}

apps/web/src/lib/metrics/readiness-breakdown.ts

@@ -0,0 +1,71 @@
+import type { ReadyStatus } from '@/queries/monitoring'
+
+import type { BreakdownSlice } from './types'
+
+function checkOk(value: boolean | { ok?: boolean; error?: string } | undefined): boolean {
+  if (typeof value === 'boolean') return value
+  if (value && typeof value === 'object') return value.ok === true
+  return false
+}
+
+export function readinessBreakdown(
+  ready: ReadyStatus | null | undefined,
+  healthOk: boolean,
+): BreakdownSlice[] {
+  if (!healthOk) {
+    return [
+      {
+        key: 'health-fail',
+        label: 'API недоступен',
+        count: 1,
+        color: 'var(--color-destructive)',
+      },
+    ]
+  }
+
+  const checks = ready?.checks ?? {}
+  let okCount = 0
+  let failCount = 0
+
+  for (const value of Object.values(checks)) {
+    if (checkOk(value)) okCount += 1
+    else failCount += 1
+  }
+
+  const slices: BreakdownSlice[] = [
+    {
+      key: 'health',
+      label: 'Health OK',
+      count: 1,
+      color: 'var(--color-chart-2)',
+    },
+  ]
+
+  if (okCount > 0) {
+    slices.push({
+      key: 'checks-ok',
+      label: 'Checks OK',
+      count: okCount,
+      color: 'var(--color-chart-1)',
+    })
+  }
+  if (failCount > 0) {
+    slices.push({
+      key: 'checks-fail',
+      label: 'Checks fail',
+      count: failCount,
+      color: 'var(--color-warning)',
+    })
+  }
+
+  if (slices.length === 1 && okCount === 0 && failCount === 0) {
+    slices.push({
+      key: 'ready',
+      label: ready?.status === 'ok' ? 'Ready' : 'Ready pending',
+      count: 1,
+      color: 'var(--color-chart-4)',
+    })
+  }
+
+  return slices
+}

apps/web/src/lib/metrics/recent-platform-activity.ts

@@ -0,0 +1,64 @@
+import type { JobRow, PeerRow, RevisionRow, SpeakerRow } from '@/types/api'
+
+import type { PlatformActivityItem } from './types'
+
+const JOB_KIND_RU: Record<string, string> = {
+  module_refresh: 'Обновление модуля',
+  apply: 'Применение конфигурации',
+  rollback: 'Откат ревизии',
+  bird_reload: 'Перезагрузка BIRD',
+}
+
+function jobMessage(job: JobRow): string {
+  const kind = JOB_KIND_RU[job.kind] ?? job.kind
+  return `${kind} · ${job.status}`
+}
+
+export function recentPlatformActivity(
+  jobs: JobRow[],
+  revisions: RevisionRow[],
+  peers: PeerRow[],
+  speakers: SpeakerRow[],
+  limit = 5,
+): PlatformActivityItem[] {
+  const items: PlatformActivityItem[] = []
+
+  for (const job of jobs.slice(0, 3)) {
+    items.push({
+      id: `job-${job.job_id}`,
+      message: jobMessage(job),
+      status: job.status,
+      kind: 'job',
+    })
+  }
+
+  for (const rev of revisions.slice(0, 2)) {
+    items.push({
+      id: `rev-${rev.id}`,
+      message: `Ревизия ${rev.id.slice(0, 8)}… · ${rev.materialized_prefix_count} префиксов`,
+      status: 'ok',
+      statusLabel: 'Создана',
+      kind: 'revision',
+    })
+  }
+
+  for (const peer of peers.filter((p) => p.session_mismatch).slice(0, 2)) {
+    items.push({
+      id: `peer-${peer.id}`,
+      message: `Mismatch сессии: ${peer.name ?? peer.neighbor}`,
+      status: 'mismatch',
+      kind: 'network',
+    })
+  }
+
+  for (const speaker of speakers.filter((s) => s.live?.bgp_poll_error || s.live?.agent_ok === false).slice(0, 2)) {
+    items.push({
+      id: `speaker-${speaker.id}`,
+      message: `Нода недоступна: ${speaker.live?.label ?? speaker.endpoint}`,
+      status: speaker.live?.agent_ok === false ? 'error' : 'warning',
+      kind: 'network',
+    })
+  }
+
+  return items.slice(0, limit)
+}

apps/web/src/lib/metrics/types.ts

@@ -0,0 +1,28 @@
+export type BreakdownSlice = {
+  key: string
+  label: string
+  count: number
+  color: string
+}
+
+export type CapacityBar = {
+  id: string
+  name: string
+  /** 0–100 utilization */
+  value: number
+}
+
+export type PlatformActivityItem = {
+  id: string
+  message: string
+  status: string
+  statusLabel?: string
+  kind: 'job' | 'revision' | 'network'
+}
+
+export type DeploymentProgress = {
+  percent: number
+  synced: number
+  total: number
+  mode: 'revision' | 'online'
+}

apps/web/src/queries/api-keys.ts

@@ -1,6 +1,8 @@
-import { queryOptions } from '@tanstack/react-query'
-import { apiJSON } from '@/lib/api-client'
-import type { ApiKey, ApiKeysResponse } from '@/types/api'
+import { queryOptions, useMutation, useQueryClient } from '@tanstack/react-query'
+import { toast } from 'sonner'
+
+import { apiJSON, apiMutate } from '@/lib/api-client'
+import type { ApiKey, ApiKeyCreate, ApiKeyCreated, ApiKeysResponse } from '@/types/api'
 
 export const apiKeysKeys = {
   all: ['api-keys'] as const,
@@ -17,3 +19,48 @@ export function apiKeysQueryOptions() {
     staleTime: 60_000,
   })
 }
+
+function invalidateApiKeysList(qc: ReturnType<typeof useQueryClient>) {
+  void qc.invalidateQueries({ queryKey: apiKeysKeys.list() })
+}
+
+export function useCreateApiKeyMutation() {
+  const qc = useQueryClient()
+  return useMutation({
+    mutationFn: (body: ApiKeyCreate) =>
+      apiMutate<ApiKeyCreated>('/v1/api-keys', 'POST', body, { idempotent: false }),
+    onSuccess: () => {
+      toast.success('Ключ создан')
+      invalidateApiKeysList(qc)
+    },
+    onError: (e) => toast.error(e instanceof Error ? e.message : 'Не удалось создать ключ'),
+  })
+}
+
+export function useRevokeApiKeyMutation() {
+  const qc = useQueryClient()
+  return useMutation({
+    mutationFn: (id: string) =>
+      apiMutate(`/v1/api-keys/${id}`, 'DELETE', undefined, { idempotent: false }),
+    onSuccess: () => {
+      toast.success('Ключ отозван')
+      invalidateApiKeysList(qc)
+    },
+    onError: (e) => toast.error(e instanceof Error ? e.message : 'Не удалось отозвать'),
+  })
+}
+
+export function useRotateApiKeyMutation() {
+  const qc = useQueryClient()
+  return useMutation({
+    mutationFn: (id: string) =>
+      apiMutate<ApiKeyCreated>(`/v1/api-keys/${id}/rotate`, 'POST', undefined, {
+        idempotent: false,
+      }),
+    onSuccess: () => {
+      toast.success('Ключ ротирован')
+      invalidateApiKeysList(qc)
+    },
+    onError: (e) => toast.error(e instanceof Error ? e.message : 'Не удалось ротировать'),
+  })
+}

apps/web/src/queries/firewall.ts

@@ -0,0 +1,100 @@
+import { queryOptions, useMutation, useQueryClient } from '@tanstack/react-query'
+import { toast } from 'sonner'
+
+import { apiJSON } from '@/lib/api-client'
+import type {
+  FirewallClient,
+  FirewallClientsResponse,
+  FirewallInstallContext,
+  FirewallRule,
+  FirewallRulesResponse,
+} from '@/types/api'
+
+export const firewallKeys = {
+  all: ['firewall'] as const,
+  clients: () => [...firewallKeys.all, 'clients'] as const,
+  installContext: () => [...firewallKeys.all, 'install-context'] as const,
+  rules: (scope: string, clientId?: string) =>
+    [...firewallKeys.all, 'rules', scope, clientId ?? ''] as const,
+}
+
+export function firewallInstallContextQueryOptions() {
+  return queryOptions<FirewallInstallContext>({
+    queryKey: firewallKeys.installContext(),
+    queryFn: () => apiJSON<FirewallInstallContext>('/v1/firewall/install-context'),
+    staleTime: 60_000,
+    retry: false,
+  })
+}
+
+export function firewallClientsQueryOptions() {
+  return queryOptions<FirewallClientsResponse>({
+    queryKey: firewallKeys.clients(),
+    queryFn: () => apiJSON<FirewallClientsResponse>('/v1/firewall/clients'),
+    staleTime: 15_000,
+  })
+}
+
+export function firewallRulesQueryOptions(scope: 'tenant' | 'client', clientId?: string) {
+  const qs =
+    scope === 'client' && clientId
+      ? `?scope=client&client_id=${encodeURIComponent(clientId)}`
+      : '?scope=tenant'
+  return queryOptions<FirewallRulesResponse>({
+    queryKey: firewallKeys.rules(scope, clientId),
+    queryFn: () => apiJSON<FirewallRulesResponse>(`/v1/firewall/rules${qs}`),
+    staleTime: 15_000,
+  })
+}
+
+export function useApproveFirewallClient() {
+  const qc = useQueryClient()
+  return useMutation({
+    mutationFn: (id: string) =>
+      apiJSON<FirewallClient>(`/v1/firewall/clients/${id}/approve`, { method: 'POST' }),
+    onSuccess: () => {
+      toast.success('Клиент одобрен')
+      void qc.invalidateQueries({ queryKey: firewallKeys.clients() })
+    },
+    onError: (e) => toast.error(e instanceof Error ? e.message : 'Не удалось одобрить'),
+  })
+}
+
+export function useDeleteFirewallClient() {
+  const qc = useQueryClient()
+  return useMutation({
+    mutationFn: (id: string) =>
+      apiJSON<void>(`/v1/firewall/clients/${id}`, { method: 'DELETE' }),
+    onSuccess: () => {
+      toast.success('Клиент удалён')
+      void qc.invalidateQueries({ queryKey: firewallKeys.clients() })
+    },
+    onError: (e) => toast.error(e instanceof Error ? e.message : 'Не удалось удалить'),
+  })
+}
+
+export function useCreateFirewallRule() {
+  const qc = useQueryClient()
+  return useMutation({
+    mutationFn: (body: Record<string, unknown>) =>
+      apiJSON<FirewallRule>('/v1/firewall/rules', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(body),
+      }),
+    onSuccess: () => {
+      void qc.invalidateQueries({ queryKey: firewallKeys.all })
+    },
+  })
+}
+
+export function useDeleteFirewallRule() {
+  const qc = useQueryClient()
+  return useMutation({
+    mutationFn: (id: string) =>
+      apiJSON<void>(`/v1/firewall/rules/${id}`, { method: 'DELETE' }),
+    onSuccess: () => {
+      void qc.invalidateQueries({ queryKey: firewallKeys.all })
+    },
+  })
+}

apps/web/src/queries/overview.ts

@@ -58,7 +58,7 @@ export function overviewRevisionsQueryOptions() {
 export function overviewJobsQueryOptions() {
   return queryOptions<JobsResponse>({
     queryKey: overviewKeys.jobs(),
-    queryFn: () => apiJSON<JobsResponse>('/v1/jobs?limit=10'),
+    queryFn: () => apiJSON<JobsResponse>('/v1/jobs?limit=100'),
     staleTime: 15_000,
   })
 }

apps/web/src/routes/_auth.tsx

@@ -1,10 +1,14 @@
 import { createFileRoute, Outlet, redirect } from '@tanstack/react-router'
 
+import { normalizeApiToken, TOKEN_STORAGE_KEY } from '@/lib/api-client'
+
 export const Route = createFileRoute('/_auth')({
-  beforeLoad: () => {
-    const token =
-      typeof window !== 'undefined' ? window.localStorage.getItem('evobgp_api_token') : null
-    if (!token) {
+  beforeLoad: ({ location }) => {
+    // Настройки доступны без токена — сюда попадают при первом входе (в т.ч. для `dev`).
+    if (location.pathname === '/settings') return
+    const raw =
+      typeof window !== 'undefined' ? window.localStorage.getItem(TOKEN_STORAGE_KEY) : null
+    if (!raw || !normalizeApiToken(raw)) {
       throw redirect({ to: '/settings' })
     }
   },

apps/web/src/routes/_auth/access.tsx

@@ -1,29 +1,18 @@
-import { createFileRoute } from '@tanstack/react-router'
+import { createFileRoute, Link } from '@tanstack/react-router'
 import { useQuery } from '@tanstack/react-query'
+import { Info, KeyRound, RefreshCw, ShieldCheck, ShieldOff } from 'lucide-react'
+import { useMemo } from 'react'
 
-import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '@evobgp/ui/components/card'
+import { Alert, AlertDescription, AlertTitle } from '@evobgp/ui/components/alert'
 import { Button } from '@evobgp/ui/components/button'
-import {
-  Table,
-  TableBody,
-  TableCell,
-  TableHead,
-  TableHeader,
-  TableRow,
-} from '@evobgp/ui/components/table'
-import { RefreshCw } from 'lucide-react'
-import { toast } from 'sonner'
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '@evobgp/ui/components/card'
 
+import { AccessApiKeysCard } from '@/components/access/access-api-keys-card'
 import { PageHeader } from '@/components/page-header'
-import { QueryState } from '@/components/query-state'
-import { ConfirmDialog } from '@/components/confirm-dialog'
+import { SectionCards, type SectionCardItem } from '@/components/section-cards'
+import { SectionCardsSkeleton } from '@/components/skeletons'
 import { authSessionQueryOptions } from '@/queries/auth'
 import { apiKeysQueryOptions } from '@/queries/api-keys'
-import { apiMutate } from '@/lib/api-client'
-import { useMutation } from '@tanstack/react-query'
-import type { ApiKeyCreated } from '@/types/api'
-import { useState } from 'react'
-import { Copy } from 'lucide-react'
 
 export const Route = createFileRoute('/_auth/access')({
   component: AccessComponent,
@@ -39,20 +28,80 @@ function AccessComponent() {
     enabled: isOperator,
   })
 
+  const keys = keysQuery.data ?? []
+  const activeCount = keys.filter((k) => !k.revoked_at).length
+  const revokedCount = keys.filter((k) => k.revoked_at).length
+
+  const refreshing = sessionQuery.isFetching || keysQuery.isFetching
+
+  const kpiItems: SectionCardItem[] = useMemo(
+    () => [
+      {
+        label: 'Всего ключей',
+        value: keys.length,
+        icon: <KeyRound className="size-4" />,
+        hint: 'в tenant',
+      },
+      {
+        label: 'Активных',
+        value: activeCount,
+        icon: <ShieldCheck className="size-4" />,
+        hint: 'не отозваны',
+      },
+      {
+        label: 'Отозванных',
+        value: revokedCount,
+        icon: <ShieldOff className="size-4" />,
+        hint: 'revoked',
+        variant: revokedCount > 0 ? 'warning' : 'default',
+      },
+    ],
+    [keys.length, activeCount, revokedCount],
+  )
+
+  function refetchAll() {
+    void sessionQuery.refetch()
+    if (isOperator) void keysQuery.refetch()
+  }
+
   return (
-    <div className="mx-auto flex max-w-4xl flex-col gap-6">
+    <div className="flex flex-col gap-6">
       <PageHeader
         title="Права доступа"
         description="API-ключи control plane и текущая сессия Bearer-токена."
+        actions={
+          isOperator ? (
+            <Button variant="outline" size="sm" onClick={refetchAll} disabled={refreshing}>
+              <RefreshCw className={refreshing ? 'animate-spin' : ''} />
+              Обновить
+            </Button>
+          ) : undefined
+        }
       />
 
+      <Alert className="border-info/30 bg-info/5">
+        <Info className="text-info" />
+        <AlertTitle>О API-ключах</AlertTitle>
+        <AlertDescription>
+          Роли: <code className="text-xs">viewer</code> (чтение),{' '}
+          <code className="text-xs">editor</code> (CRUD), <code className="text-xs">operator</code>{' '}
+          (apply и настройки), <code className="text-xs">node</code> (API ноды). Полный токен
+          показывается один раз при создании и ротации. Токен браузера — в{' '}
+          <Link to="/settings" className="text-primary underline-offset-4 hover:underline">
+            настройках
+          </Link>
+          ; для локальной разработки с demo-seed подойдёт <code className="text-xs">dev</code>{' '}
+          (роль operator).
+        </AlertDescription>
+      </Alert>
+
       {session ? (
         <Card>
-          <CardHeader>
+          <CardHeader className="border-b py-3">
             <CardTitle className="text-base">Текущая сессия</CardTitle>
             <CardDescription>Tenant и роль ключа, с которым открыта панель.</CardDescription>
           </CardHeader>
-          <CardContent className="grid gap-3 text-sm sm:grid-cols-2">
+          <CardContent className="grid gap-3 p-4 text-sm sm:grid-cols-2">
             <div>
               <p className="text-muted-foreground">Tenant</p>
               <p className="break-all font-mono text-xs">{session.tenant_id}</p>
@@ -63,183 +112,46 @@ function AccessComponent() {
             </div>
           </CardContent>
         </Card>
-      ) : null}
+      ) : (
+        <Card>
+          <CardContent className="py-6 text-sm text-muted-foreground">
+            Не удалось определить сессию. Укажите токен в{' '}
+            <Link to="/settings" className="text-primary underline-offset-4 hover:underline">
+              настройках
+            </Link>{' '}
+            (для dev-окружения — <code className="text-xs">dev</code> при включённом demo-seed).
+            {sessionQuery.isError && sessionQuery.error instanceof Error ? (
+              <span className="mt-2 block text-destructive">{sessionQuery.error.message}</span>
+            ) : null}
+          </CardContent>
+        </Card>
+      )}
 
       {isOperator ? (
-        <ApiKeysCard
-          items={keysQuery.data ?? []}
-          isLoading={keysQuery.isLoading}
-          isError={keysQuery.isError}
-          error={keysQuery.error}
-          onRetry={() => keysQuery.refetch()}
-        />
+        <>
+          {keysQuery.isLoading ? (
+            <SectionCardsSkeleton count={3} />
+          ) : (
+            <SectionCards items={kpiItems} />
+          )}
+          <AccessApiKeysCard
+            items={keys}
+            isLoading={keysQuery.isLoading}
+            isError={keysQuery.isError}
+            error={keysQuery.error}
+            onRetry={() => keysQuery.refetch()}
+          />
+        </>
       ) : session ? (
         <Card>
           <CardContent className="py-6 text-sm text-muted-foreground">
             Управление API-ключами доступно только роли <strong>operator</strong>. Текущая роль:{' '}
-            <span className="font-mono">{session.role}</span>.
+            <span className="font-mono">{session.role}</span>. Для выдачи ключей войдите с
+            operator-ключом или создайте ключ через API / переменную{' '}
+            <code className="text-xs">EVOBGP_API_KEYS</code>.
           </CardContent>
         </Card>
       ) : null}
     </div>
   )
 }
-
-function ApiKeysCard({
-  items,
-  isLoading,
-  isError,
-  error,
-  onRetry,
-}: {
-  items: import('@/types/api').ApiKey[]
-  isLoading: boolean
-  isError: boolean
-  error: unknown
-  onRetry: () => void
-}) {
-  const [revealedToken, setRevealedToken] = useState<string | null>(null)
-
-  const revoke = useMutation({
-    mutationFn: (id: string) =>
-      apiMutate(`/v1/api-keys/${id}`, 'DELETE', undefined, { idempotent: false }),
-    onSuccess: () => toast.success('Ключ отозван'),
-    onError: (e) => toast.error(e instanceof Error ? e.message : 'Не удалось отозвать'),
-  })
-
-  const rotate = useMutation({
-    mutationFn: (id: string) =>
-      apiMutate<ApiKeyCreated>(`/v1/api-keys/${id}/rotate`, 'POST', undefined, {
-        idempotent: false,
-      }),
-    onSuccess: (created) => {
-      toast.success('Ключ ротирован')
-      setRevealedToken(created.token)
-    },
-    onError: (e) => toast.error(e instanceof Error ? e.message : 'Не удалось ротировать'),
-  })
-
-  async function copyToken() {
-    if (!revealedToken) return
-    try {
-      await navigator.clipboard.writeText(revealedToken)
-      toast.success('Скопировано')
-    } catch {
-      toast.error('Не удалось скопировать')
-    }
-  }
-
-  return (
-    <Card>
-      <CardHeader className="flex flex-col gap-3 border-b py-3 sm:flex-row sm:items-center sm:justify-between">
-        <div className="min-w-0 flex-1">
-          <CardTitle className="text-base">API-ключи</CardTitle>
-          <CardDescription>
-            Управление ключами tenant. Полный токен показывается только при создании и ротации.
-          </CardDescription>
-        </div>
-        <Button size="sm" variant="outline" onClick={onRetry} disabled={isLoading}>
-          <RefreshCw className={isLoading ? 'animate-spin' : ''} />
-          Обновить
-        </Button>
-      </CardHeader>
-      <CardContent className="p-0">
-        <QueryState
-          data={items}
-          isLoading={isLoading}
-          isError={isError}
-          error={error}
-          empty={items.length === 0}
-          emptyTitle="Нет ключей"
-          emptyDescription="Ключи можно создать через API."
-          onRetry={onRetry}
-        >
-          {(data) => (
-            <Table>
-              <TableHeader>
-                <TableRow>
-                  <TableHead>Имя</TableHead>
-                  <TableHead>Роль</TableHead>
-                  <TableHead>Префикс</TableHead>
-                  <TableHead>Статус</TableHead>
-                  <TableHead className="w-24" />
-                </TableRow>
-              </TableHeader>
-              <TableBody>
-                {data.map((k) => (
-                  <TableRow key={k.id}>
-                    <TableCell className="font-medium">{k.name}</TableCell>
-                    <TableCell className="font-mono text-sm">{k.role}</TableCell>
-                    <TableCell className="font-mono text-xs text-muted-foreground">{k.prefix}…</TableCell>
-                    <TableCell>
-                      {k.revoked_at ? (
-                        <span className="text-sm text-destructive">отозван</span>
-                      ) : (
-                        <span className="text-sm text-muted-foreground">активен</span>
-                      )}
-                    </TableCell>
-                    <TableCell>
-                      <div className="flex gap-1">
-                        <ConfirmDialog
-                          trigger={
-                            <Button
-                              variant="ghost"
-                              size="icon-sm"
-                              title="Ротировать"
-                              disabled={!!k.revoked_at}
-                            >
-                              <RefreshCw className="size-3.5" />
-                            </Button>
-                          }
-                          title="Ротировать ключ?"
-                          description="Старый токен перестанет работать сразу."
-                          confirmLabel="Ротировать"
-                          onConfirm={() => rotate.mutate(k.id)}
-                        />
-                        <ConfirmDialog
-                          trigger={
-                            <Button
-                              variant="ghost"
-                              size="icon-sm"
-                              className="text-destructive"
-                              disabled={!!k.revoked_at}
-                              title="Отозвать"
-                            >
-                              <Copy className="size-3.5" />
-                            </Button>
-                          }
-                          title="Отозвать API-ключ?"
-                          description={`${k.name} (${k.prefix}…)`}
-                          confirmLabel="Отозвать"
-                          destructive
-                          onConfirm={() => revoke.mutate(k.id)}
-                        />
-                      </div>
-                    </TableCell>
-                  </TableRow>
-                ))}
-              </TableBody>
-            </Table>
-          )}
-        </QueryState>
-      </CardContent>
-
-      {revealedToken ? (
-        <div className="flex flex-col gap-3 border-t p-4">
-          <div className="text-sm font-medium">Новый токен (сохраните сейчас):</div>
-          <div className="break-all rounded-md border bg-muted/40 p-3 font-mono text-xs">
-            {revealedToken}
-          </div>
-          <div className="flex gap-2">
-            <Button variant="outline" size="sm" onClick={copyToken}>
-              <Copy /> Копировать
-            </Button>
-            <Button size="sm" onClick={() => setRevealedToken(null)}>
-              Готово
-            </Button>
-          </div>
-        </div>
-      ) : null}
-    </Card>
-  )
-}

apps/web/src/routes/_auth/dashboard.tsx

@@ -1,36 +1,31 @@
 import { createFileRoute } from '@tanstack/react-router'
 import { useQueries } from '@tanstack/react-query'
-import {
-  Boxes,
-  CheckCircle,
-  Clock,
-  GitBranch,
-  Info,
-  Network,
-  Play,
-  Plus,
-  Radio,
-  RefreshCw,
-  Activity,
-  Share2,
-  Tags,
-  Gauge,
-  XCircle,
-} from 'lucide-react'
-import { Link } from '@tanstack/react-router'
+import { CheckCircle, Info, RefreshCw, XCircle } from 'lucide-react'
 import { useState } from 'react'
 
 import { Alert, AlertDescription, AlertTitle } from '@evobgp/ui/components/alert'
 import { Button } from '@evobgp/ui/components/button'
-import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '@evobgp/ui/components/card'
+import {
+  Card,
+  CardDescription,
+  CardHeader,
+  CardTitle,
+} from '@evobgp/ui/components/card'
 import { Skeleton } from '@evobgp/ui/components/skeleton'
 
+import {
+  DashboardNetworkCapacityCard,
+  DashboardOperationsFlowCard,
+  DashboardPlatformCard,
+} from '@/components/analytics'
+import { DataGridCard } from '@/components/data-grid-shell'
+import { DashboardQuickActions } from '@/components/dashboard/dashboard-quick-actions'
+import { DashboardRecentJobsGrid } from '@/components/dashboard/dashboard-recent-jobs-grid'
+import { DashboardRecentRevisionsGrid } from '@/components/dashboard/dashboard-recent-revisions-grid'
 import { PageHeader } from '@/components/page-header'
-import { SectionCards, type SectionCardItem } from '@/components/section-cards'
-import { SectionCardsSkeleton } from '@/components/skeletons'
+import { AnalyticsDashboardSkeleton } from '@/components/skeletons'
 
 import {
-  aggregateNetworkMetrics,
   moduleNameById,
   overviewHealthQueryOptions,
   overviewJobsQueryOptions,
@@ -38,7 +33,6 @@ import {
   overviewPeersQueryOptions,
   overviewRevisionsQueryOptions,
   overviewSpeakersQueryOptions,
-  runningJobCount,
 } from '@/queries/overview'
 
 export const Route = createFileRoute('/_auth/dashboard')({
@@ -78,60 +72,13 @@ function DashboardComponent() {
   const speakers = speakersQ.data?.items ?? []
   const revisions = revisionsQ.data?.items ?? []
   const jobs = jobsQ.data?.items ?? []
-  const modulesHasMore = modulesQ.data?.has_more ?? false
-  const peersHasMore = peersQ.data?.has_more ?? false
-  const speakersHasMore = speakersQ.data?.has_more ?? false
-  const revisionsHasMore = revisionsQ.data?.has_more ?? false
-
-  const net = aggregateNetworkMetrics(peers, speakers)
-  const running = runningJobCount(jobs)
   const nameById = moduleNameById(modules)
 
-  const countBadge = (n: number, hasMore: boolean, suffix: string) => (hasMore ? '200+' : suffix)
-
-  const items: SectionCardItem[] = [
-    {
-      label: 'Модули',
-      value: initialLoading ? '—' : String(modules.length),
-      icon: <Boxes className="size-4" />,
-      hint: countBadge(modules.length, modulesHasMore, 'AS, CDN, домены, IP'),
-      onClick: () => window.location.assign('/modules'),
-    },
-    {
-      label: 'Пиры',
-      value: initialLoading ? '—' : `${net.peersEstablished}/${net.peersEnabled}`,
-      icon: <GitBranch className="size-4" />,
-      hint: countBadge(peers.length, peersHasMore, 'Established / включённых'),
-      badge: net.peersMismatch > 0 ? `mismatch ${net.peersMismatch}` : undefined,
-      variant: net.peersMismatch > 0 ? 'warning' : 'default',
-      onClick: () => window.location.assign('/network?tab=peers'),
-    },
-    {
-      label: 'Спикеры',
-      value: initialLoading ? '—' : `${net.speakersOnline}/${net.speakersTotal}`,
-      icon: <Radio className="size-4" />,
-      hint: countBadge(speakers.length, speakersHasMore, 'online / всего'),
-      variant: net.speakersOnline < net.speakersTotal ? 'warning' : 'default',
-      onClick: () => window.location.assign('/network?tab=overview'),
-    },
-    {
-      label: 'Ревизии',
-      value: initialLoading ? '—' : String(revisions.length),
-      icon: <Activity className="size-4" />,
-      hint: countBadge(revisions.length, revisionsHasMore, 'configs'),
-      onClick: () => window.location.assign('/operations'),
-    },
-    {
-      label: 'Активных задач',
-      value: initialLoading ? '—' : String(running),
-      icon: <Clock className="size-4" />,
-      hint: 'queued и running',
-      onClick: () => window.location.assign('/operations?tab=jobs'),
-    },
-  ]
+  const activityLoading =
+    refreshing && jobs.length === 0 && revisions.length === 0
 
   return (
-    <div className="flex flex-col gap-6">
+    <div className="flex flex-col gap-5">
       <PageHeader
         title="Обзор"
         description={
@@ -162,45 +109,56 @@ function DashboardComponent() {
         loadError={modulesQ.isError || peersQ.isError ? 'Некоторые данные не загружены' : null}
       />
 
-      {initialLoading ? <SectionCardsSkeleton count={5} /> : <SectionCards items={items} />}
+      {initialLoading ? (
+        <AnalyticsDashboardSkeleton />
+      ) : (
+        <div className="grid gap-4 lg:grid-cols-3 lg:grid-rows-2">
+          <div className="lg:row-span-2">
+            <DashboardPlatformCard
+              modules={modules}
+              peers={peers}
+              speakers={speakers}
+              jobs={jobs}
+              revisions={revisions}
+            />
+          </div>
+          <DashboardNetworkCapacityCard peers={peers} speakers={speakers} jobs={jobs} />
+          <DashboardOperationsFlowCard jobs={jobs} modules={modules} />
+        </div>
+      )}
 
-      <div className="grid gap-4 lg:grid-cols-3">
-        <RecentJobsCard jobs={jobs} nameById={nameById} loading={refreshing} />
-        <RecentRevisionsCard revisions={revisions} loading={refreshing} />
-        <NetworkStatusCard peers={peers} speakers={speakers} loading={refreshing} />
+      <div className="grid gap-4 lg:grid-cols-2">
+        <DataGridCard
+          title="Недавние задачи"
+          description="Последние фоновые операции"
+          className="h-full"
+        >
+          {activityLoading ? (
+            <Skeleton className="m-3 h-24 w-auto" />
+          ) : (
+            <DashboardRecentJobsGrid jobs={jobs.slice(0, 10)} nameById={nameById} isLoading={refreshing} />
+          )}
+        </DataGridCard>
+
+        <DataGridCard
+          title="Последние ревизии"
+          description="История конфигураций"
+          className="h-full"
+        >
+          {activityLoading ? (
+            <Skeleton className="m-3 h-24 w-auto" />
+          ) : (
+            <DashboardRecentRevisionsGrid revisions={revisions} isLoading={refreshing} />
+          )}
+        </DataGridCard>
       </div>
 
-      <Card>
+      <Card className="gap-0">
         <CardHeader className="border-b py-3">
           <CardTitle className="text-base">Быстрые действия</CardTitle>
           <CardDescription>Частые переходы к настройке и деплою</CardDescription>
         </CardHeader>
-        <CardContent className="flex flex-wrap gap-2 p-4">
-          <Button variant="outline" size="sm" render={<Link to="/modules" />}>
-            <Plus className="size-4" />
-            Создать модуль
-          </Button>
-          <Button variant="outline" size="sm" onClick={() => (window.location.href = '/directories')}>
-            <Tags className="size-4" />
-            Добавить community
-          </Button>
-          <Button variant="outline" size="sm" onClick={() => (window.location.href = '/network?tab=overview')}>
-            <Network className="size-4" />
-            Сеть
-          </Button>
-          <Button variant="outline" size="sm" onClick={() => (window.location.href = '/network?tab=peers')}>
-            <Share2 className="size-4" />
-            Добавить пира
-          </Button>
-          <Button variant="outline" size="sm" onClick={() => (window.location.href = '/operations')}>
-            <Play className="size-4" />
-            Деплой (Apply)
-          </Button>
-          <Button variant="outline" size="sm" onClick={() => (window.location.href = '/monitoring')}>
-            <Gauge className="size-4" />
-            Мониторинг
-          </Button>
-        </CardContent>
+        <DashboardQuickActions />
       </Card>
     </div>
   )
@@ -255,146 +213,3 @@ function HealthAlert({
     </Alert>
   )
 }
-
-function RecentJobsCard({
-  jobs,
-  nameById,
-  loading,
-}: {
-  jobs: import('@/types/api').JobRow[]
-  nameById: Map<string, string>
-  loading: boolean
-}) {
-  return (
-    <Card>
-      <CardHeader className="border-b py-3">
-        <CardTitle className="text-base">Недавние задачи</CardTitle>
-        <CardDescription>Последние фоновые операции</CardDescription>
-      </CardHeader>
-      <CardContent className="p-3">
-        {loading && jobs.length === 0 ? (
-          <Skeleton className="h-24 w-full" />
-        ) : jobs.length === 0 ? (
-          <p className="px-2 py-6 text-center text-sm text-muted-foreground">Нет задач</p>
-        ) : (
-          <ul className="flex flex-col gap-1">
-            {jobs.slice(0, 8).map((j) => (
-              <li
-                key={j.job_id}
-                className="flex items-center justify-between gap-2 rounded px-2 py-1 text-sm hover:bg-muted/40"
-              >
-                <span className="flex min-w-0 flex-col gap-0.5">
-                  <span className="truncate font-mono text-xs text-muted-foreground">{j.kind}</span>
-                  <span className="truncate text-xs">
-                    {j.meta?.module_id ? nameById.get(String(j.meta.module_id)) ?? '' : ''}
-                  </span>
-                </span>
-                <span
-                  className={
-                    j.status === 'succeeded'
-                      ? 'text-xs text-success'
-                      : j.status === 'failed'
-                        ? 'text-xs text-destructive'
-                        : 'text-xs text-muted-foreground'
-                  }
-                >
-                  {j.status}
-                </span>
-              </li>
-            ))}
-          </ul>
-        )}
-      </CardContent>
-    </Card>
-  )
-}
-
-function RecentRevisionsCard({
-  revisions,
-  loading,
-}: {
-  revisions: import('@/types/api').RevisionRow[]
-  loading: boolean
-}) {
-  return (
-    <Card>
-      <CardHeader className="border-b py-3">
-        <CardTitle className="text-base">Последние ревизии</CardTitle>
-        <CardDescription>История конфигураций</CardDescription>
-      </CardHeader>
-      <CardContent className="p-3">
-        {loading && revisions.length === 0 ? (
-          <Skeleton className="h-24 w-full" />
-        ) : revisions.length === 0 ? (
-          <p className="px-2 py-6 text-center text-sm text-muted-foreground">Нет ревизий</p>
-        ) : (
-          <ul className="flex flex-col gap-1">
-            {revisions.slice(0, 8).map((r) => (
-              <li
-                key={r.id}
-                className="flex items-center justify-between gap-2 rounded px-2 py-1 text-sm hover:bg-muted/40"
-              >
-                <span className="truncate font-mono text-xs text-muted-foreground">{r.id.slice(0, 10)}…</span>
-                <span className="text-xs text-muted-foreground">
-                  {new Date(r.created_at).toLocaleString('ru-RU')}
-                </span>
-              </li>
-            ))}
-          </ul>
-        )}
-      </CardContent>
-    </Card>
-  )
-}
-
-function NetworkStatusCard({
-  peers,
-  speakers,
-  loading,
-}: {
-  peers: import('@/types/api').PeerRow[]
-  speakers: import('@/types/api').SpeakerRow[]
-  loading: boolean
-}) {
-  const m = aggregateNetworkMetrics(peers, speakers)
-  return (
-    <Card>
-      <CardHeader className="border-b py-3">
-        <CardTitle className="text-base">Состояние сети</CardTitle>
-        <CardDescription>BGP-сессии и спикеры</CardDescription>
-      </CardHeader>
-      <CardContent className="p-3">
-        {loading && peers.length === 0 && speakers.length === 0 ? (
-          <Skeleton className="h-24 w-full" />
-        ) : (
-          <div className="flex flex-col gap-2 px-1 py-1 text-sm">
-            <Row label="Пиры Established" value={`${m.peersEstablished} / ${m.peersEnabled}`} />
-            <Row label="Спикеры online" value={`${m.speakersOnline} / ${m.speakersTotal}`} />
-            {m.peersMismatch > 0 ? (
-              <Row label="Mismatches" value={String(m.peersMismatch)} variant="warning" />
-            ) : null}
-          </div>
-        )}
-      </CardContent>
-    </Card>
-  )
-}
-
-function Row({
-  label,
-  value,
-  variant = 'default',
-}: {
-  label: string
-  value: string
-  variant?: 'default' | 'warning'
-}) {
-  return (
-    <div className="flex items-center justify-between gap-2">
-      <span className="text-muted-foreground">{label}</span>
-      <span className={variant === 'warning' ? 'font-medium text-warning-foreground' : 'font-medium tabular-nums'}>
-        {value}
-      </span>
-    </div>
-  )
-}

apps/web/src/routes/_auth/directories.tsx

@@ -3,19 +3,12 @@ import { useQuery } from '@tanstack/react-query'
 import { BookText, Globe, Info, RefreshCw, Tags } from 'lucide-react'
 
 import { Alert, AlertDescription, AlertTitle } from '@evobgp/ui/components/alert'
-import { Badge } from '@evobgp/ui/components/badge'
 import { Button } from '@evobgp/ui/components/button'
-import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '@evobgp/ui/components/card'
 import { Tabs, TabsContent, TabsList, TabsTrigger } from '@evobgp/ui/components/tabs'
-import {
-  Table,
-  TableBody,
-  TableCell,
-  TableHead,
-  TableHeader,
-  TableRow,
-} from '@evobgp/ui/components/table'
 
+import { DataGridCard } from '@/components/data-grid-shell'
+import { DirectoriesCommunitiesGrid } from '@/components/directories/directories-communities-grid'
+import { DirectoriesDohGrid } from '@/components/directories/directories-doh-grid'
 import { PageHeader } from '@/components/page-header'
 import { QueryState } from '@/components/query-state'
 import { SectionCards, type SectionCardItem } from '@/components/section-cards'
@@ -94,91 +87,50 @@ function DirectoriesComponent() {
         </TabsList>
 
         <TabsContent value="communities" className="mt-4">
-          <Card>
-            <CardHeader className="border-b py-3">
-              <CardTitle className="text-base">Сообщества BGP</CardTitle>
-              <CardDescription>Теги для префиксов в фильтрах BIRD</CardDescription>
-            </CardHeader>
-            <CardContent className="p-0">
-              <QueryState
-                data={communities}
-                isLoading={communitiesQ.isLoading}
-                isError={communitiesQ.isError}
-                error={communitiesQ.error}
-                empty={communities.length === 0}
-                emptyTitle="Нет сообществ"
-                skeleton={<TableSkeleton rows={4} cols={3} />}
-                onRetry={() => communitiesQ.refetch()}
-              >
-                {(items) => (
-                  <Table>
-                    <TableHeader>
-                      <TableRow>
-                        <TableHead>Название</TableHead>
-                        <TableHead>Значение</TableHead>
-                        <TableHead>Тип</TableHead>
-                      </TableRow>
-                    </TableHeader>
-                    <TableBody>
-                      {items.map((c) => (
-                        <TableRow key={c.id}>
-                          <TableCell className="font-medium">{c.title}</TableCell>
-                          <TableCell className="font-mono text-xs">{c.community}</TableCell>
-                          <TableCell>
-                            <Badge variant="outline">community</Badge>
-                          </TableCell>
-                        </TableRow>
-                      ))}
-                    </TableBody>
-                  </Table>
-                )}
-              </QueryState>
-            </CardContent>
-          </Card>
+          <DataGridCard
+            title="Сообщества BGP"
+            description="Теги для префиксов в фильтрах BIRD"
+          >
+            <QueryState
+              data={communities}
+              isLoading={communitiesQ.isLoading}
+              isError={communitiesQ.isError}
+              error={communitiesQ.error}
+              empty={communities.length === 0}
+              emptyTitle="Нет сообществ"
+              skeleton={<TableSkeleton rows={4} cols={3} />}
+              onRetry={() => communitiesQ.refetch()}
+            >
+              {(items) => (
+                <DirectoriesCommunitiesGrid
+                  items={items}
+                  isLoading={communitiesQ.isFetching && !communitiesQ.isLoading}
+                />
+              )}
+            </QueryState>
+          </DataGridCard>
         </TabsContent>
 
         <TabsContent value="doh" className="mt-4">
-          <Card>
-            <CardHeader className="border-b py-3">
-              <CardTitle className="text-base">DoH профили</CardTitle>
-              <CardDescription>Резолверы DNS-over-HTTPS для доменных модулей</CardDescription>
-            </CardHeader>
-            <CardContent className="p-0">
-              <QueryState
-                data={dohProfiles}
-                isLoading={dohQ.isLoading}
-                isError={dohQ.isError}
-                error={dohQ.error}
-                empty={dohProfiles.length === 0}
-                emptyTitle="Нет DoH профилей"
-                skeleton={<TableSkeleton rows={4} cols={3} />}
-                onRetry={() => dohQ.refetch()}
-              >
-                {(items) => (
-                  <Table>
-                    <TableHeader>
-                      <TableRow>
-                        <TableHead>Название</TableHead>
-                        <TableHead>URL</TableHead>
-                        <TableHead>По умолчанию</TableHead>
-                      </TableRow>
-                    </TableHeader>
-                    <TableBody>
-                      {items.map((p) => (
-                        <TableRow key={p.id}>
-                          <TableCell className="font-medium">{p.name ?? p.url}</TableCell>
-                          <TableCell className="font-mono text-xs">{p.url}</TableCell>
-                          <TableCell>
-                            <Badge variant="outline">—</Badge>
-                          </TableCell>
-                        </TableRow>
-                      ))}
-                    </TableBody>
-                  </Table>
-                )}
-              </QueryState>
-            </CardContent>
-          </Card>
+          <DataGridCard title="DoH профили" description="Резолверы DNS-over-HTTPS для доменных модулей">
+            <QueryState
+              data={dohProfiles}
+              isLoading={dohQ.isLoading}
+              isError={dohQ.isError}
+              error={dohQ.error}
+              empty={dohProfiles.length === 0}
+              emptyTitle="Нет DoH профилей"
+              skeleton={<TableSkeleton rows={4} cols={3} />}
+              onRetry={() => dohQ.refetch()}
+            >
+              {(items) => (
+                <DirectoriesDohGrid
+                  items={items}
+                  isLoading={dohQ.isFetching && !dohQ.isLoading}
+                />
+              )}
+            </QueryState>
+          </DataGridCard>
         </TabsContent>
       </Tabs>
     </div>

apps/web/src/routes/_auth/firewall.tsx

@@ -0,0 +1,309 @@
+import { createFileRoute } from '@tanstack/react-router'
+import { useQuery } from '@tanstack/react-query'
+import { Copy, Info, RefreshCw, Shield } from 'lucide-react'
+import { useEffect, useMemo, useState } from 'react'
+import { toast } from 'sonner'
+
+import { Alert, AlertDescription, AlertTitle } from '@evobgp/ui/components/alert'
+import { Button } from '@evobgp/ui/components/button'
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '@evobgp/ui/components/card'
+import { Input } from '@evobgp/ui/components/input'
+import { Label } from '@evobgp/ui/components/label'
+import { Tabs, TabsContent, TabsList, TabsTrigger } from '@evobgp/ui/components/tabs'
+
+import { FirewallClientsGrid } from '@/components/firewall/firewall-clients-grid'
+import { FirewallRulesGrid } from '@/components/firewall/firewall-rules-grid'
+import { PageHeader } from '@/components/page-header'
+import { CommunitySelect } from '@/components/modules/community-select'
+import { QueryState } from '@/components/query-state'
+import { TableSkeleton } from '@/components/skeletons'
+import { directoriesCommunitiesQueryOptions } from '@/queries/directories'
+import {
+  firewallClientsQueryOptions,
+  firewallInstallContextQueryOptions,
+  firewallRulesQueryOptions,
+  useApproveFirewallClient,
+  useCreateFirewallRule,
+  useDeleteFirewallClient,
+  useDeleteFirewallRule,
+} from '@/queries/firewall'
+
+function httpsOrigin(origin: string): string {
+  try {
+    const u = new URL(origin)
+    u.protocol = 'https:'
+    return u.origin
+  } catch {
+    return origin.replace(/^http:/i, 'https:')
+  }
+}
+
+export const Route = createFileRoute('/_auth/firewall')({
+  component: FirewallPage,
+})
+
+function FirewallPage() {
+  const installCtxQ = useQuery(firewallInstallContextQueryOptions())
+  const communitiesQ = useQuery(directoriesCommunitiesQueryOptions())
+  const clientsQ = useQuery(firewallClientsQueryOptions())
+  const rulesQ = useQuery(firewallRulesQueryOptions('tenant'))
+  const approve = useApproveFirewallClient()
+  const deleteClient = useDeleteFirewallClient()
+  const createRule = useCreateFirewallRule()
+  const deleteRule = useDeleteFirewallRule()
+
+  const installCtx = installCtxQ.data
+
+  const [clientName, setClientName] = useState('web-01')
+  const [cpUrl, setCpUrl] = useState(() =>
+    typeof window !== 'undefined' ? httpsOrigin(window.location.origin) : 'https://api.example.com',
+  )
+  const [seed, setSeed] = useState('')
+
+  useEffect(() => {
+    if (installCtx?.suggested_cp_url) {
+      setCpUrl(httpsOrigin(installCtx.suggested_cp_url))
+    }
+    if (installCtx?.bundle_seed) {
+      setSeed(installCtx.bundle_seed)
+    }
+  }, [installCtx?.bundle_seed, installCtx?.suggested_cp_url])
+  const [ruleAction, setRuleAction] = useState<'block' | 'accept'>('block')
+  const [ruleCommunityId, setRuleCommunityId] = useState<string | null>(null)
+  const [ruleComment, setRuleComment] = useState('')
+
+  const communities = communitiesQ.data?.items ?? []
+
+  const { activeClients, pending } = useMemo(() => {
+    const all = clientsQ.data?.items ?? []
+    return {
+      activeClients: all.filter((c) => c.status !== 'revoked'),
+      pending: all.filter((c) => c.status === 'pending'),
+    }
+  }, [clientsQ.data?.items])
+  const rules = rulesQ.data?.items ?? []
+
+  const installCmd = useMemo(() => {
+    const s = seed.trim() || '<bundle_seed_hex>'
+    return `curl -fsSL ${cpUrl.replace(/\/$/, '')}/v1/firewall/install.sh | \\
+  EVOBGP_CP_URL=${cpUrl.replace(/\/$/, '')} \\
+  EVOBGP_SEED=${s} \\
+  EVOBGP_CLIENT_NAME="${clientName}" \\
+  bash`
+  }, [clientName, cpUrl, seed])
+
+  async function copyInstall() {
+    if (!seed.trim()) {
+      toast.error(
+        installCtx?.bundle_seed_configured === false
+          ? 'На CP не задан EVOBGP_BUNDLE_SEED_HEX'
+          : 'Bundle seed недоступен (нужна роль operator)',
+      )
+      return
+    }
+    try {
+      await navigator.clipboard.writeText(installCmd)
+      toast.success('Команда скопирована')
+    } catch {
+      toast.error('Не удалось скопировать')
+    }
+  }
+
+  return (
+    <div className="flex flex-col gap-6">
+      <PageHeader
+        title="Firewall blocklist"
+        description="Linux-серверы: синхронизация CIDR по policy block/accept"
+        actions={
+          <Button
+            variant="outline"
+            size="sm"
+            onClick={() => {
+              void clientsQ.refetch()
+              void rulesQ.refetch()
+            }}
+            disabled={clientsQ.isFetching}
+          >
+            <RefreshCw className={clientsQ.isFetching ? 'animate-spin' : ''} />
+            Обновить
+          </Button>
+        }
+      />
+
+      <Alert className="border-info/30 bg-info/5">
+        <Info className="text-info" />
+        <AlertTitle>Политика</AlertTitle>
+        <AlertDescription>
+          Правила сопоставляются с <strong>BGP community</strong> префиксов опубликованной revision.{' '}
+          <strong>block</strong> добавляет префиксы community в kernel; <strong>accept</strong> — не блокирует.
+          Community «Все» — правило для любого community. Default без совпадений — accept.
+        </AlertDescription>
+      </Alert>
+
+      <Card>
+        <CardHeader>
+          <CardTitle className="flex items-center gap-2">
+            <Shield className="size-5" />
+            Установка на сервер
+          </CardTitle>
+          <CardDescription>One-liner для root на целевом Linux (bash, curl). После enroll — approve в «Запросы».</CardDescription>
+        </CardHeader>
+        <CardContent className="flex flex-col gap-4">
+          <div className="grid gap-4 sm:grid-cols-3">
+            <div className="space-y-2">
+              <Label htmlFor="fw-name">Имя сервера</Label>
+              <Input id="fw-name" value={clientName} onChange={(e) => setClientName(e.target.value)} />
+            </div>
+            <div className="space-y-2">
+              <Label htmlFor="fw-url">URL API</Label>
+              <Input id="fw-url" value={cpUrl} onChange={(e) => setCpUrl(e.target.value)} />
+            </div>
+            <div className="space-y-2">
+              <Label htmlFor="fw-seed">Bundle seed</Label>
+              <Input
+                id="fw-seed"
+                type="password"
+                readOnly
+                placeholder="EVOBGP_BUNDLE_SEED_HEX"
+                value={seed}
+                className="font-mono text-xs"
+              />
+              <p className="text-muted-foreground text-xs">
+                {installCtxQ.isLoading
+                  ? 'Загрузка из control plane…'
+                  : installCtx?.bundle_seed_configured
+                    ? 'Из переменной EVOBGP_BUNDLE_SEED_HEX на CP (docker compose / .env)'
+                    : 'На CP не задан EVOBGP_BUNDLE_SEED_HEX — enroll невозможен'}
+              </p>
+            </div>
+          </div>
+          <pre className="overflow-x-auto rounded-md border bg-muted/40 p-3 text-xs">{installCmd}</pre>
+          <Button variant="outline" size="sm" className="w-fit" onClick={copyInstall}>
+            <Copy />
+            Копировать команду
+          </Button>
+        </CardContent>
+      </Card>
+
+      <Tabs defaultValue="clients">
+        <TabsList>
+          <TabsTrigger value="clients">Клиенты ({activeClients.length})</TabsTrigger>
+          <TabsTrigger value="rules">Правила ({rules.length})</TabsTrigger>
+          <TabsTrigger value="requests">Запросы ({pending.length})</TabsTrigger>
+        </TabsList>
+
+        <TabsContent value="clients" className="mt-4">
+          <QueryState
+            data={clientsQ.data}
+            isLoading={clientsQ.isLoading}
+            isError={clientsQ.isError}
+            error={clientsQ.error}
+            onRetry={() => void clientsQ.refetch()}
+            skeleton={<TableSkeleton rows={5} cols={6} />}
+          >
+            {() => (
+              <FirewallClientsGrid
+                clients={activeClients}
+                isLoading={clientsQ.isFetching && !clientsQ.isLoading}
+                onApprove={(id) => approve.mutate(id)}
+                onReject={(id) => deleteClient.mutate(id)}
+                approvePending={approve.isPending}
+                rejectPending={deleteClient.isPending}
+              />
+            )}
+          </QueryState>
+        </TabsContent>
+
+        <TabsContent value="rules" className="mt-4 space-y-4">
+          <div className="flex flex-wrap items-end gap-3">
+            <div className="space-y-1">
+              <Label>Действие</Label>
+              <select
+                className="border-input bg-background h-9 rounded-md border px-2 text-sm"
+                value={ruleAction}
+                onChange={(e) => setRuleAction(e.target.value as 'block' | 'accept')}
+              >
+                <option value="block">block</option>
+                <option value="accept">accept</option>
+              </select>
+            </div>
+            <CommunitySelect
+              id="fw-rule-community"
+              label="Community"
+              value={ruleCommunityId}
+              onValueChange={setRuleCommunityId}
+              communities={communities}
+              nullable
+              placeholder="Все communities"
+            />
+            <div className="space-y-1">
+              <Label htmlFor="fw-rule-comment">Комментарий</Label>
+              <Input
+                id="fw-rule-comment"
+                className="max-w-xs"
+                placeholder="Комментарий"
+                value={ruleComment}
+                onChange={(e) => setRuleComment(e.target.value)}
+              />
+            </div>
+            <Button
+              size="sm"
+              className="mb-0.5"
+              onClick={() =>
+                createRule.mutate({
+                  scope: 'tenant',
+                  action: ruleAction,
+                  community_id: ruleCommunityId,
+                  comment: ruleComment,
+                })
+              }
+            >
+              Добавить правило
+            </Button>
+          </div>
+          <QueryState
+            data={rulesQ.data}
+            isLoading={rulesQ.isLoading}
+            isError={rulesQ.isError}
+            error={rulesQ.error}
+            onRetry={() => void rulesQ.refetch()}
+            skeleton={<TableSkeleton rows={5} cols={5} />}
+          >
+            {() => (
+              <FirewallRulesGrid
+                rules={rules}
+                communities={communities}
+                isLoading={rulesQ.isFetching && !rulesQ.isLoading}
+                onDelete={(id) => deleteRule.mutate(id)}
+                deletePending={deleteRule.isPending}
+              />
+            )}
+          </QueryState>
+        </TabsContent>
+
+        <TabsContent value="requests" className="mt-4">
+          <QueryState
+            data={clientsQ.data}
+            isLoading={clientsQ.isLoading}
+            isError={clientsQ.isError}
+            error={clientsQ.error}
+            onRetry={() => void clientsQ.refetch()}
+            skeleton={<TableSkeleton rows={3} cols={6} />}
+          >
+            {() => (
+              <FirewallClientsGrid
+                clients={pending}
+                isLoading={clientsQ.isFetching && !clientsQ.isLoading}
+                onApprove={(id) => approve.mutate(id)}
+                onReject={(id) => deleteClient.mutate(id)}
+                approvePending={approve.isPending}
+                rejectPending={deleteClient.isPending}
+                emptyTitle="Нет pending-запросов"
+              />
+            )}
+          </QueryState>
+        </TabsContent>
+      </Tabs>
+    </div>
+  )
+}

apps/web/src/routes/_auth/modules/index.tsx

@@ -1,25 +1,15 @@
 import { Link, createFileRoute } from '@tanstack/react-router'
 import { useQuery } from '@tanstack/react-query'
-import { Boxes, Plus, RefreshCw } from 'lucide-react'
+import { Plus, RefreshCw } from 'lucide-react'
 
 import { Button } from '@evobgp/ui/components/button'
-import { Card, CardContent, CardHeader, CardTitle } from '@evobgp/ui/components/card'
-import {
-  Table,
-  TableBody,
-  TableCell,
-  TableHead,
-  TableHeader,
-  TableRow,
-} from '@evobgp/ui/components/table'
-import { Badge } from '@/components/reui/badge'
 
+import { DataGridCard } from '@/components/data-grid-shell'
+import { ModulesListGrid } from '@/components/modules/modules-list-grid'
 import { PageHeader } from '@/components/page-header'
 import { QueryState } from '@/components/query-state'
 import { TableSkeleton } from '@/components/skeletons'
-import { TruncatedText } from '@/components/truncated-text'
 import { modulesListQueryOptions } from '@/queries/modules'
-import type { ModuleRow } from '@/types/api'
 
 export const Route = createFileRoute('/_auth/modules/')({
   component: ModulesListComponent,
@@ -48,76 +38,34 @@ function ModulesListComponent() {
         }
       />
 
-      <Card>
-        <CardHeader className="flex flex-row items-center justify-between border-b py-3">
-          <CardTitle className="text-base">Все модули</CardTitle>
+      <DataGridCard
+        title="Все модули"
+        actions={
           <Button size="sm" render={<Link to="/modules/new" />}>
             <Plus />
             Создать
           </Button>
-        </CardHeader>
-        <CardContent className="p-0">
-          <QueryState
-            data={query.data?.items}
-            isLoading={query.isLoading}
-            isError={query.isError}
-            error={query.error}
-            empty={query.data?.items?.length === 0}
-            emptyTitle="Нет модулей"
-            emptyDescription="Создайте первый модуль (AS, CDN, домены, IP)."
-            skeleton={<TableSkeleton rows={6} cols={5} />}
-            onRetry={() => query.refetch()}
-          >
-            {(items) => <ModulesTable items={items} />}
-          </QueryState>
-        </CardContent>
-      </Card>
+        }
+      >
+        <QueryState
+          data={query.data?.items}
+          isLoading={query.isLoading}
+          isError={query.isError}
+          error={query.error}
+          empty={query.data?.items?.length === 0}
+          emptyTitle="Нет модулей"
+          emptyDescription="Создайте первый модуль (AS, CDN, домены, IP)."
+          skeleton={<TableSkeleton rows={6} cols={5} />}
+          onRetry={() => query.refetch()}
+        >
+          {(items) => (
+            <ModulesListGrid
+              items={items}
+              isLoading={query.isFetching && !query.isLoading}
+            />
+          )}
+        </QueryState>
+      </DataGridCard>
     </div>
   )
 }
-
-function ModulesTable({ items }: { items: ModuleRow[] }) {
-  return (
-    <Table>
-      <TableHeader>
-        <TableRow>
-          <TableHead>Название</TableHead>
-          <TableHead>Тип</TableHead>
-          <TableHead>Приоритет</TableHead>
-          <TableHead>Состояние</TableHead>
-          <TableHead>Обновлено</TableHead>
-        </TableRow>
-      </TableHeader>
-      <TableBody>
-        {items.map((m) => (
-          <TableRow
-            key={m.id}
-            className="cursor-pointer hover:bg-muted/40"
-            onClick={() => (window.location.href = `/modules/${m.id}`)}
-          >
-            <TableCell className="font-medium">
-              <div className="flex items-center gap-2">
-                <Boxes className="size-4 text-muted-foreground" />
-                <TruncatedText className="max-w-[280px]">{m.name}</TruncatedText>
-              </div>
-            </TableCell>
-            <TableCell>
-              <Badge variant="outline">{m.type}</Badge>
-            </TableCell>
-            <TableCell className="font-mono text-sm tabular-nums">{m.priority}</TableCell>
-            <TableCell>
-              {m.enabled ? (
-                <Badge variant="success">включён</Badge>
-              ) : (
-                <Badge variant="secondary">выключен</Badge>
-              )}
-            </TableCell>
-            <TableCell className="text-xs text-muted-foreground">
-              {m.last_refreshed_at ? new Date(m.last_refreshed_at).toLocaleString('ru-RU') : '—'}
-            </TableCell>
-          </TableRow>
-        ))}
-      </TableBody>
-    </Table>
-  )
-}

apps/web/src/routes/_auth/monitoring.tsx

@@ -1,6 +1,6 @@
 import { createFileRoute, useSearch } from '@tanstack/react-router'
 import { useQuery } from '@tanstack/react-query'
-import { Activity, AlertTriangle, Bird, Database, Gauge, HardDrive, HeartPulse, Info, ListTodo, RefreshCw, ShieldCheck } from 'lucide-react'
+import { Activity, AlertTriangle, Bird, Database, HeartPulse, Info, ListTodo, RefreshCw } from 'lucide-react'
 
 import { Alert, AlertDescription, AlertTitle } from '@evobgp/ui/components/alert'
 import { Badge } from '@evobgp/ui/components/badge'
@@ -8,19 +8,15 @@ import { Button } from '@evobgp/ui/components/button'
 import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '@evobgp/ui/components/card'
 import { Separator } from '@evobgp/ui/components/separator'
 import { Tabs, TabsContent, TabsList, TabsTrigger } from '@evobgp/ui/components/tabs'
-import {
-  Table,
-  TableBody,
-  TableCell,
-  TableHead,
-  TableHeader,
-  TableRow,
-} from '@evobgp/ui/components/table'
 
+import {
+  DashboardOperationsFlowCard,
+  MonitoringHealthCard,
+} from '@/components/analytics'
+import { MonitoringReadyGrid } from '@/components/monitoring/monitoring-ready-grid'
 import { PageHeader } from '@/components/page-header'
 import { QueryState } from '@/components/query-state'
-import { SectionCards, type SectionCardItem } from '@/components/section-cards'
-import { SectionCardsSkeleton } from '@/components/skeletons'
+import { AnalyticsDashboardSkeleton } from '@/components/skeletons'
 
 import {
   monitoringHealthQueryOptions,
@@ -31,6 +27,7 @@ import {
 } from '@/queries/monitoring'
 import { networkBirdQueryOptions } from '@/queries/network'
 import { operationsJobsQueryOptions } from '@/queries/operations'
+import { overviewModulesQueryOptions } from '@/queries/overview'
 
 export const Route = createFileRoute('/_auth/monitoring')({
   component: MonitoringComponent,
@@ -49,53 +46,25 @@ function MonitoringComponent() {
   const versionQ = useQuery(monitoringVersionQueryOptions())
   const birdQ = useQuery(networkBirdQueryOptions())
   const jobsQ = useQuery(operationsJobsQueryOptions())
+  const modulesQ = useQuery(overviewModulesQueryOptions())
 
   const refreshing =
     healthQ.isFetching ||
     readyQ.isFetching ||
     versionQ.isFetching ||
     birdQ.isFetching ||
-    jobsQ.isFetching
+    jobsQ.isFetching ||
+    modulesQ.isFetching
 
   const jobs = jobsQ.data?.items ?? []
-  const running = jobs.filter((j) => j.status === 'running' || j.status === 'queued').length
+  const modules = modulesQ.data?.items ?? []
   const failed = jobs.filter((j) =>
     ['failed', 'error', 'cancelled'].includes(j.status.toLowerCase()),
   ).length
 
   const versionText = formatVersion(versionQ.data)
-
-  const items: SectionCardItem[] = [
-    {
-      label: 'Общий статус',
-      value: overallStatusLabel({ health: healthQ.data, ready: readyQ.data, jobsFailed: failed }),
-      icon: <Gauge className="size-4" />,
-      hint: overallHint({ health: healthQ.data, jobsFailed: failed }),
-    },
-    {
-      label: 'BGP сессии',
-      value: birdQ.data
-        ? `${birdQ.data.bgp_established}/${birdQ.data.bgp_sessions_total}`
-        : '—',
-      icon: <Bird className="size-4" />,
-      hint: birdQ.data?.birdc_configured
-        ? 'Established / total на API-хосте'
-        : 'birdc не настроен',
-    },
-    {
-      label: 'Задачи',
-      value: running,
-      icon: <Activity className="size-4" />,
-      hint: `активных из ${jobs.length}`,
-      variant: failed > 0 ? 'warning' : 'default',
-    },
-    {
-      label: 'Версия',
-      value: versionText,
-      icon: <Gauge className="size-4" />,
-      hint: versionQ.data?.git_sha ?? versionQ.data?.build_time ?? 'GET /v1/version',
-    },
-  ]
+  const analyticsLoading =
+    (healthQ.isLoading || readyQ.isLoading || jobsQ.isLoading) && jobs.length === 0
 
   function refetchAll() {
     void healthQ.refetch()
@@ -103,6 +72,7 @@ function MonitoringComponent() {
     void versionQ.refetch()
     void birdQ.refetch()
     void jobsQ.refetch()
+    void modulesQ.refetch()
   }
 
   const failedJobs = jobs
@@ -130,7 +100,29 @@ function MonitoringComponent() {
         </TabsList>
 
         <TabsContent value="system" className="mt-4 flex flex-col gap-6">
-          {refreshing ? <SectionCardsSkeleton count={4} /> : <SectionCards items={items} />}
+          {analyticsLoading ? (
+            <AnalyticsDashboardSkeleton />
+          ) : (
+            <div className="grid gap-4 lg:grid-cols-2">
+              <MonitoringHealthCard
+                healthOk={healthQ.data?.ok ?? false}
+                ready={readyQ.data}
+                loading={healthQ.isLoading || readyQ.isLoading}
+              />
+              <DashboardOperationsFlowCard jobs={jobs} modules={modules} loading={jobsQ.isLoading} />
+            </div>
+          )}
+
+          <Alert className="border-muted bg-muted/30">
+            <Info className="size-4" />
+            <AlertTitle className="text-sm">
+              Версия API: {versionText}
+              {versionQ.data?.git_sha ? ` · ${versionQ.data.git_sha.slice(0, 8)}` : ''}
+            </AlertTitle>
+            <AlertDescription className="text-xs">
+              {overallHint({ health: healthQ.data, jobsFailed: failed })}
+            </AlertDescription>
+          </Alert>
 
           <div className="grid gap-4 lg:grid-cols-2">
             <Card>
@@ -147,7 +139,7 @@ function MonitoringComponent() {
                   skeleton={<div className="h-40" />}
                   onRetry={() => readyQ.refetch()}
                 >
-                  {(ready) => <ReadyTable health={healthQ.data} ready={ready} />}
+                  {(ready) => <MonitoringReadyGrid health={healthQ.data} ready={ready} />}
                 </QueryState>
               </CardContent>
             </Card>
@@ -186,7 +178,7 @@ function MonitoringComponent() {
               </CardHeader>
               <CardContent className="space-y-4">
                 <div className="flex flex-wrap gap-4 text-sm">
-                  <Metric label="Активных" value={running} />
+                  <Metric label="Активных" value={jobs.filter((j) => j.status === 'running' || j.status === 'queued').length} />
                   <Metric
                     label="С ошибками"
                     value={failed}
@@ -329,97 +321,12 @@ interface OverallInput {
   jobsFailed: number
 }
 
-function overallStatusLabel(input: OverallInput): string {
-  if (!input.health?.ok) return 'Ошибка'
-  if (input.jobsFailed > 0) return 'Внимание'
-  if (input.ready?.status && input.ready.status !== 'ok') return 'Внимание'
-  return 'В норме'
-}
-
 function overallHint(input: OverallInput): string {
   if (!input.health?.ok) return 'API недоступен или возвращает ошибку'
   if (input.jobsFailed > 0) return `Есть провальные задачи (${input.jobsFailed})`
   return 'Все системы работают в штатном режиме'
 }
 
-function ReadyTable({
-  health,
-  ready,
-}: {
-  health?: { ok?: boolean; status?: string; error?: string } | null
-  ready: ReadyStatus
-}) {
-  const checks = ready.checks ?? {}
-  const iconByKey: Record<string, typeof Database> = {
-    postgres: Database,
-    store: HardDrive,
-    jobs: ListTodo,
-  }
-  return (
-    <Table>
-      <TableHeader>
-        <TableRow>
-          <TableHead className="w-[55%]">Проверка</TableHead>
-          <TableHead>Статус</TableHead>
-        </TableRow>
-      </TableHeader>
-      <TableBody>
-        <TableRow>
-          <TableCell>
-            <div className="flex items-center gap-2">
-              <HeartPulse className="size-4 shrink-0 text-muted-foreground" />
-              <div>
-                <p className="text-sm font-medium">Liveness</p>
-                <p className="text-xs text-muted-foreground">/v1/health</p>
-              </div>
-            </div>
-          </TableCell>
-          <TableCell>
-            <Badge variant={health?.ok ? 'default' : 'destructive'}>
-              {health?.ok ? 'OK' : 'Ошибка'}
-            </Badge>
-          </TableCell>
-        </TableRow>
-        <TableRow>
-          <TableCell>
-            <div className="flex items-center gap-2">
-              <ShieldCheck className="size-4 shrink-0 text-muted-foreground" />
-              <div>
-                <p className="text-sm font-medium">Readiness</p>
-                <p className="text-xs text-muted-foreground">/v1/ready</p>
-              </div>
-            </div>
-          </TableCell>
-          <TableCell>
-            <Badge variant={ready.status === 'ok' ? 'default' : 'secondary'}>
-              {ready.status ?? '—'}
-            </Badge>
-          </TableCell>
-        </TableRow>
-        {Object.entries(checks).map(([key, value]) => {
-          const ok = typeof value === 'boolean' ? value : value?.ok !== false
-          const Icon = iconByKey[key] ?? ListTodo
-          return (
-            <TableRow key={key}>
-              <TableCell>
-                <div className="flex items-center gap-2">
-                  <Icon className="size-4 shrink-0 text-muted-foreground" />
-                  <div>
-                    <p className="text-sm font-medium">{key}</p>
-                  </div>
-                </div>
-              </TableCell>
-              <TableCell>
-                <Badge variant={ok ? 'default' : 'destructive'}>{ok ? 'OK' : 'Ошибка'}</Badge>
-              </TableCell>
-            </TableRow>
-          )
-        })}
-      </TableBody>
-    </Table>
-  )
-}
-
 function BirdSummary({ bird }: { bird: import('@/types/api').BirdStatus }) {
   if (!bird.birdc_configured) {
     return (

apps/web/src/routes/_auth/network.tsx

@@ -5,22 +5,19 @@ import { Button } from '@evobgp/ui/components/button'
 import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '@evobgp/ui/components/card'
 import { Info, RefreshCw } from 'lucide-react'
 import { Tabs, TabsContent, TabsList, TabsTrigger } from '@evobgp/ui/components/tabs'
-import {
-  Table,
-  TableBody,
-  TableCell,
-  TableHead,
-  TableHeader,
-  TableRow,
-} from '@evobgp/ui/components/table'
-import { Badge } from '@/components/reui/badge'
-import { StatusBadge } from '@/components/status-badge'
 
+import {
+  DashboardNetworkCapacityCard,
+  NetworkOverviewAnalyticsCard,
+} from '@/components/analytics'
+import { DataGridCard } from '@/components/data-grid-shell'
+import { NetworkPeersGrid } from '@/components/network/network-peers-grid'
+import { NetworkSpeakersGrid } from '@/components/network/network-speakers-grid'
 import { PageHeader } from '@/components/page-header'
 import { QueryState } from '@/components/query-state'
 import { TableSkeleton } from '@/components/skeletons'
 import { networkBirdQueryOptions, networkPeersQueryOptions, networkSpeakersQueryOptions } from '@/queries/network'
-import { aggregateNetworkMetrics } from '@/queries/overview'
+import { overviewJobsQueryOptions } from '@/queries/overview'
 
 export const Route = createFileRoute('/_auth/network')({
   component: NetworkComponent,
@@ -36,11 +33,13 @@ function NetworkComponent() {
   const peersQ = useQuery({ ...networkPeersQueryOptions(), refetchInterval: 30_000 })
   const speakersQ = useQuery({ ...networkSpeakersQueryOptions(), refetchInterval: 30_000 })
   const birdQ = useQuery({ ...networkBirdQueryOptions(), refetchInterval: 30_000 })
+  const jobsQ = useQuery(overviewJobsQueryOptions())
 
   const refreshing = peersQ.isFetching || speakersQ.isFetching
   const peers = peersQ.data?.items ?? []
   const speakers = speakersQ.data?.items ?? []
-  const net = aggregateNetworkMetrics(peers, speakers)
+  const jobs = jobsQ.data?.items ?? []
+  const overviewLoading = peersQ.isLoading || speakersQ.isLoading
 
   function refetchAll() {
     void peersQ.refetch()
@@ -78,84 +77,81 @@ function NetworkComponent() {
         </TabsList>
 
         <TabsContent value="overview" className="mt-4">
-          <div className="grid gap-4 md:grid-cols-2">
-            <Card>
-              <CardHeader className="border-b py-3">
-                <CardTitle className="text-base">Сводка сети</CardTitle>
-              </CardHeader>
-              <CardContent className="grid grid-cols-2 gap-3 p-4 text-sm">
-                <Field label="Пиры всего" value={String(net.peersTotal)} />
-                <Field label="Established" value={`${net.peersEstablished} / ${net.peersEnabled}`} />
-                <Field label="Спикеры всего" value={String(net.speakersTotal)} />
-                <Field label="Online" value={`${net.speakersOnline} / ${net.speakersTotal}`} />
-                {net.peersMismatch > 0 ? (
-                  <Field label="Mismatches" value={String(net.peersMismatch)} />
-                ) : null}
-              </CardContent>
-            </Card>
-            <Card>
-              <CardHeader className="border-b py-3">
-                <CardTitle className="text-base">BIRD (control plane)</CardTitle>
-                <CardDescription>Статус birdc на хосте API</CardDescription>
-              </CardHeader>
-              <CardContent className="p-4">
-                <QueryState
-                  data={birdQ.data}
-                  isLoading={birdQ.isLoading}
-                  isError={birdQ.isError}
-                  error={birdQ.error}
-                  skeleton={<TableSkeleton rows={3} cols={2} />}
-                  onRetry={() => birdQ.refetch()}
-                >
-                  {(bird) => <BirdSummary bird={bird} />}
-                </QueryState>
-              </CardContent>
-            </Card>
+          <div className="grid gap-4 lg:grid-cols-2">
+            <NetworkOverviewAnalyticsCard
+              peers={peers}
+              speakers={speakers}
+              loading={overviewLoading}
+            />
+            <DashboardNetworkCapacityCard
+              peers={peers}
+              speakers={speakers}
+              jobs={jobs}
+              loading={overviewLoading}
+            />
           </div>
+          <Card className="mt-4">
+            <CardHeader className="border-b py-3">
+              <CardTitle className="text-base">BIRD (control plane)</CardTitle>
+              <CardDescription>Статус birdc на хосте API</CardDescription>
+            </CardHeader>
+            <CardContent className="p-4">
+              <QueryState
+                data={birdQ.data}
+                isLoading={birdQ.isLoading}
+                isError={birdQ.isError}
+                error={birdQ.error}
+                skeleton={<TableSkeleton rows={3} cols={2} />}
+                onRetry={() => birdQ.refetch()}
+              >
+                {(bird) => <BirdSummary bird={bird} />}
+              </QueryState>
+            </CardContent>
+          </Card>
         </TabsContent>
 
         <TabsContent value="peers" className="mt-4">
-          <Card>
-            <CardHeader className="border-b py-3">
-              <CardTitle className="text-base">Пиры</CardTitle>
-            </CardHeader>
-            <CardContent className="p-0">
-              <QueryState
-                data={peers}
-                isLoading={peersQ.isLoading}
-                isError={peersQ.isError}
-                error={peersQ.error}
-                empty={peers.length === 0}
-                emptyTitle="Нет пиров"
-                skeleton={<TableSkeleton rows={6} cols={4} />}
-                onRetry={() => peersQ.refetch()}
-              >
-                {(items) => <PeersTable items={items} />}
-              </QueryState>
-            </CardContent>
-          </Card>
+          <DataGridCard title="Пиры">
+            <QueryState
+              data={peers}
+              isLoading={peersQ.isLoading}
+              isError={peersQ.isError}
+              error={peersQ.error}
+              empty={peers.length === 0}
+              emptyTitle="Нет пиров"
+              skeleton={<TableSkeleton rows={6} cols={4} />}
+              onRetry={() => peersQ.refetch()}
+            >
+              {(items) => (
+                <NetworkPeersGrid
+                  items={items}
+                  isLoading={peersQ.isFetching && !peersQ.isLoading}
+                />
+              )}
+            </QueryState>
+          </DataGridCard>
         </TabsContent>
 
         <TabsContent value="speakers" className="mt-4">
-          <Card>
-            <CardHeader className="border-b py-3">
-              <CardTitle className="text-base">Спикеры</CardTitle>
-            </CardHeader>
-            <CardContent className="p-0">
-              <QueryState
-                data={speakers}
-                isLoading={speakersQ.isLoading}
-                isError={speakersQ.isError}
-                error={speakersQ.error}
-                empty={speakers.length === 0}
-                emptyTitle="Нет спикеров"
-                skeleton={<TableSkeleton rows={6} cols={4} />}
-                onRetry={() => speakersQ.refetch()}
-              >
-                {(items) => <SpeakersTable items={items} />}
-              </QueryState>
-            </CardContent>
-          </Card>
+          <DataGridCard title="Спикеры">
+            <QueryState
+              data={speakers}
+              isLoading={speakersQ.isLoading}
+              isError={speakersQ.isError}
+              error={speakersQ.error}
+              empty={speakers.length === 0}
+              emptyTitle="Нет спикеров"
+              skeleton={<TableSkeleton rows={6} cols={4} />}
+              onRetry={() => speakersQ.refetch()}
+            >
+              {(items) => (
+                <NetworkSpeakersGrid
+                  items={items}
+                  isLoading={speakersQ.isFetching && !speakersQ.isLoading}
+                />
+              )}
+            </QueryState>
+          </DataGridCard>
         </TabsContent>
 
         <TabsContent value="control-plane" className="mt-4">
@@ -196,78 +192,3 @@ function BirdSummary({ bird }: { bird: import('@/types/api').BirdStatus }) {
     </div>
   )
 }
-
-function PeersTable({ items }: { items: import('@/types/api').PeerRow[] }) {
-  return (
-    <Table>
-      <TableHeader>
-        <TableRow>
-          <TableHead>Имя</TableHead>
-          <TableHead>Neighbor</TableHead>
-          <TableHead>ASN</TableHead>
-          <TableHead>Состояние</TableHead>
-        </TableRow>
-      </TableHeader>
-      <TableBody>
-        {items.map((p) => (
-          <TableRow key={p.id}>
-            <TableCell className="font-medium">{p.name ?? p.neighbor}</TableCell>
-            <TableCell className="font-mono text-xs">{p.neighbor}</TableCell>
-            <TableCell className="font-mono text-xs">{p.remote_asn ?? '—'}</TableCell>
-            <TableCell>
-              <StatusBadge status={p.session_state} />
-              {p.session_mismatch ? (
-                <Badge variant="warning" className="ml-1">
-                  mismatch
-                </Badge>
-              ) : null}
-            </TableCell>
-          </TableRow>
-        ))}
-      </TableBody>
-    </Table>
-  )
-}
-
-function SpeakersTable({ items }: { items: import('@/types/api').SpeakerRow[] }) {
-  return (
-    <Table>
-      <TableHeader>
-        <TableRow>
-          <TableHead>Endpoint</TableHead>
-          <TableHead>Роль</TableHead>
-          <TableHead>Agent</TableHead>
-          <TableHead>BGP</TableHead>
-        </TableRow>
-      </TableHeader>
-      <TableBody>
-        {items.map((s) => (
-          <TableRow key={s.id}>
-            <TableCell className="font-mono text-xs">{s.endpoint}</TableCell>
-            <TableCell>
-              <Badge variant="outline">{s.role}</Badge>
-            </TableCell>
-            <TableCell>
-              {s.live?.agent_ok === true ? (
-                <StatusBadge status="ok" label="online" />
-              ) : s.live?.agent_ok === false ? (
-                <StatusBadge status="error" label="offline" />
-              ) : (
-                <Badge variant="outline">—</Badge>
-              )}
-            </TableCell>
-            <TableCell>
-              {s.live ? (
-                <span className="text-xs">
-                  {s.live.bgp_established ?? 0} / {s.live.bgp_sessions_total ?? 0}
-                </span>
-              ) : (
-                '—'
-              )}
-            </TableCell>
-          </TableRow>
-        ))}
-      </TableBody>
-    </Table>
-  )
-}

apps/web/src/routes/_auth/operations.tsx

@@ -1,39 +1,26 @@
 import { createFileRoute, useSearch } from '@tanstack/react-router'
 import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query'
-import { AlertTriangle, Clock, Activity, Info, RefreshCw } from 'lucide-react'
+import { Info, RefreshCw } from 'lucide-react'
 import { toast } from 'sonner'
 import { useState, useMemo } from 'react'
 
 import { Alert, AlertDescription, AlertTitle } from '@evobgp/ui/components/alert'
 import { Button } from '@evobgp/ui/components/button'
 import { Card, CardContent, CardHeader, CardTitle } from '@evobgp/ui/components/card'
-import {
-  Select,
-  SelectContent,
-  SelectItem,
-  SelectTrigger,
-  SelectValue,
-} from '@evobgp/ui/components/select'
 import { Tabs, TabsContent, TabsList, TabsTrigger } from '@evobgp/ui/components/tabs'
-import {
-  Table,
-  TableBody,
-  TableCell,
-  TableHead,
-  TableHeader,
-  TableRow,
-} from '@evobgp/ui/components/table'
 
+import { OperationsAnalyticsCard } from '@/components/analytics'
+import { DataGridCard } from '@/components/data-grid-shell'
+import { SelectMenu } from '@/components/select-field'
+import { OperationsJobsGrid } from '@/components/operations/operations-jobs-grid'
+import { OperationsRevisionsGrid } from '@/components/operations/operations-revisions-grid'
 import { PageHeader } from '@/components/page-header'
 import { QueryState } from '@/components/query-state'
-import { SectionCards, type SectionCardItem } from '@/components/section-cards'
-import { SectionCardsSkeleton } from '@/components/skeletons'
 import { ConfirmDialog } from '@/components/confirm-dialog'
 
 import { operationsJobsQueryOptions, operationsRevisionsQueryOptions, operationsDiffQueryOptions } from '@/queries/operations'
 import { moduleNameById, overviewModulesQueryOptions } from '@/queries/overview'
 import { apiMutate, waitForJob } from '@/lib/api-client'
-import type { JobRow } from '@/types/api'
 
 export const Route = createFileRoute('/_auth/operations')({
   component: OperationsComponent,
@@ -58,32 +45,6 @@ function OperationsComponent() {
   const nameById = moduleNameById(modulesQ.data?.items ?? [])
 
   const refreshing = revisionsQ.isFetching || jobsQ.isFetching
-  const running = jobs.filter((j) => j.status === 'running' || j.status === 'queued').length
-  const failed = jobs.filter(
-    (j) => ['failed', 'error', 'cancelled'].includes(j.status.toLowerCase()),
-  ).length
-
-  const items: SectionCardItem[] = [
-    {
-      label: 'Ревизий',
-      value: revisions.length,
-      icon: <Activity className="size-4" />,
-      hint: 'история конфигов',
-    },
-    {
-      label: 'Активных задач',
-      value: running,
-      icon: <Clock className="size-4" />,
-      hint: 'queued и running',
-    },
-    {
-      label: 'Задач с ошибкой',
-      value: failed,
-      icon: <AlertTriangle className="size-4" />,
-      hint: failed > 0 ? 'требуют внимания' : 'критичных сбоев нет',
-      variant: failed > 0 ? 'warning' : 'default',
-    },
-  ]
 
   function refetchAll() {
     void revisionsQ.refetch()
@@ -167,7 +128,11 @@ function OperationsComponent() {
         />
       </div>
 
-      {revisionsQ.isLoading ? <SectionCardsSkeleton count={3} /> : <SectionCards items={items} />}
+      {revisionsQ.isLoading ? (
+        <OperationsAnalyticsCard jobs={[]} revisions={[]} loading />
+      ) : (
+        <OperationsAnalyticsCard jobs={jobs} revisions={revisions} />
+      )}
 
       <Tabs defaultValue={search.tab}>
         <TabsList>
@@ -177,24 +142,25 @@ function OperationsComponent() {
         </TabsList>
 
         <TabsContent value="revisions" className="mt-4">
-          <Card>
-            <CardHeader className="border-b py-3">
-              <CardTitle className="text-base">История ревизий</CardTitle>
-            </CardHeader>
-            <CardContent className="p-0">
-              <QueryState
-                data={revisions}
-                isLoading={revisionsQ.isLoading}
-                isError={revisionsQ.isError}
-                error={revisionsQ.error}
-                empty={revisions.length === 0}
-                emptyTitle="Нет ревизий"
-                onRetry={() => revisionsQ.refetch()}
-              >
-                {(items) => <RevisionsTable items={items} qc={qc} />}
-              </QueryState>
-            </CardContent>
-          </Card>
+          <DataGridCard title="История ревизий">
+            <QueryState
+              data={revisions}
+              isLoading={revisionsQ.isLoading}
+              isError={revisionsQ.isError}
+              error={revisionsQ.error}
+              empty={revisions.length === 0}
+              emptyTitle="Нет ревизий"
+              onRetry={() => revisionsQ.refetch()}
+            >
+              {(items) => (
+                <OperationsRevisionsGrid
+                  items={items}
+                  qc={qc}
+                  isLoading={revisionsQ.isFetching && !revisionsQ.isLoading}
+                />
+              )}
+            </QueryState>
+          </DataGridCard>
         </TabsContent>
 
         <TabsContent value="diff" className="mt-4">
@@ -202,168 +168,32 @@ function OperationsComponent() {
         </TabsContent>
 
         <TabsContent value="jobs" className="mt-4">
-          <Card>
-            <CardHeader className="border-b py-3">
-              <CardTitle className="text-base">Задачи</CardTitle>
-            </CardHeader>
-            <CardContent className="p-0">
-              <QueryState
-                data={jobs}
-                isLoading={jobsQ.isLoading}
-                isError={jobsQ.isError}
-                error={jobsQ.error}
-                empty={jobs.length === 0}
-                emptyTitle="Нет задач"
-                onRetry={() => jobsQ.refetch()}
-              >
-                {(items) => <JobsTable items={items} nameById={nameById} qc={qc} />}
-              </QueryState>
-            </CardContent>
-          </Card>
+          <DataGridCard title="Задачи">
+            <QueryState
+              data={jobs}
+              isLoading={jobsQ.isLoading}
+              isError={jobsQ.isError}
+              error={jobsQ.error}
+              empty={jobs.length === 0}
+              emptyTitle="Нет задач"
+              onRetry={() => jobsQ.refetch()}
+            >
+              {(items) => (
+                <OperationsJobsGrid
+                  items={items}
+                  nameById={nameById}
+                  qc={qc}
+                  isLoading={jobsQ.isFetching && !jobsQ.isLoading}
+                />
+              )}
+            </QueryState>
+          </DataGridCard>
         </TabsContent>
       </Tabs>
     </div>
   )
 }
 
-function RevisionsTable({
-  items,
-  qc,
-}: {
-  items: import('@/types/api').RevisionRow[]
-  qc: import('@tanstack/react-query').QueryClient
-}) {
-  const rollbackMutation = useMutation({
-    mutationFn: (id: string) =>
-      apiMutate(`/v1/revisions/${id}/rollback`, 'POST', {}).then(() => id),
-    onSuccess: () => {
-      toast.success('Откат выполнен')
-      void qc.invalidateQueries({ queryKey: ['operations'] })
-    },
-    onError: (e) => toast.error(e instanceof Error ? e.message : 'Не удалось откатить'),
-  })
-
-  return (
-    <Table>
-      <TableHeader>
-        <TableRow>
-          <TableHead>ID</TableHead>
-          <TableHead>Создана</TableHead>
-          <TableHead>Префиксов</TableHead>
-          <TableHead className="w-24" />
-        </TableRow>
-      </TableHeader>
-      <TableBody>
-        {items.map((r) => (
-          <TableRow key={r.id}>
-            <TableCell className="font-mono text-xs">{r.id.slice(0, 12)}…</TableCell>
-            <TableCell className="text-xs text-muted-foreground">
-              {new Date(r.created_at).toLocaleString('ru-RU')}
-            </TableCell>
-            <TableCell className="font-mono text-sm tabular-nums">
-              {r.materialized_prefix_count}
-            </TableCell>
-            <TableCell>
-              <ConfirmDialog
-                trigger={
-                  <Button variant="ghost" size="icon-sm" className="text-destructive">
-                    <RefreshCw className="size-3.5" />
-                  </Button>
-                }
-                title={`Откатиться к ревизии ${r.id.slice(0, 8)}…?`}
-                description="Будет создана новая ревизия на основе выбранной. Требуется роль operator."
-                confirmLabel="Откатить"
-                destructive
-                onConfirm={() => rollbackMutation.mutate(r.id)}
-              />
-            </TableCell>
-          </TableRow>
-        ))}
-      </TableBody>
-    </Table>
-  )
-}
-
-function JobsTable({
-  items,
-  nameById,
-  qc,
-}: {
-  items: JobRow[]
-  nameById: Map<string, string>
-  qc: import('@tanstack/react-query').QueryClient
-}) {
-  const cancelMutation = useMutation({
-    mutationFn: (jobId: string) => apiMutate(`/v1/jobs/${jobId}/cancel`, 'POST', {}),
-    onSuccess: () => {
-      toast.success('Задача отменена')
-      void qc.invalidateQueries({ queryKey: ['operations'] })
-    },
-    onError: (e) => toast.error(e instanceof Error ? e.message : 'Не удалось отменить'),
-  })
-
-  return (
-    <Table>
-      <TableHeader>
-        <TableRow>
-          <TableHead>Вид</TableHead>
-          <TableHead>Статус</TableHead>
-          <TableHead>Создана</TableHead>
-          <TableHead>Завершена</TableHead>
-          <TableHead className="w-20" />
-        </TableRow>
-      </TableHeader>
-      <TableBody>
-        {items.map((j) => (
-          <TableRow key={j.job_id}>
-            <TableCell className="font-medium">
-              <div className="flex flex-col gap-0.5">
-                <span>{j.kind}</span>
-                {j.meta?.module_id ? (
-                  <span className="text-xs text-muted-foreground">
-                    {nameById.get(String(j.meta.module_id)) ?? String(j.meta.module_id)}
-                  </span>
-                ) : null}
-              </div>
-            </TableCell>
-            <TableCell>
-              <StatusBadgeColored status={j.status} />
-            </TableCell>
-            <TableCell className="whitespace-nowrap text-xs text-muted-foreground">
-              {j.created_at ? new Date(j.created_at).toLocaleString('ru-RU') : '—'}
-            </TableCell>
-            <TableCell className="whitespace-nowrap text-xs text-muted-foreground">
-              {j.finished_at ? new Date(j.finished_at).toLocaleString('ru-RU') : '—'}
-            </TableCell>
-            <TableCell>
-              {j.status === 'running' || j.status === 'queued' ? (
-                <Button
-                  variant="ghost"
-                  size="icon-sm"
-                  className="text-destructive"
-                  onClick={() => cancelMutation.mutate(j.job_id)}
-                >
-                  ✕
-                </Button>
-              ) : null}
-            </TableCell>
-          </TableRow>
-        ))}
-      </TableBody>
-    </Table>
-  )
-}
-
-function StatusBadgeColored({ status }: { status: string }) {
-  const cls =
-    status === 'succeeded'
-      ? 'text-success'
-      : status === 'failed' || status === 'cancelled'
-        ? 'text-destructive'
-        : 'text-info'
-  return <span className={`text-sm font-medium ${cls}`}>{status}</span>
-}
-
 function DiffTab({ revisions }: { revisions: import('@/types/api').RevisionRow[] }) {
   const [a, setA] = useState('')
   const [b, setB] = useState('')
@@ -386,33 +216,21 @@ function DiffTab({ revisions }: { revisions: import('@/types/api').RevisionRow[]
         <div className="flex flex-wrap items-end gap-3">
           <div className="flex w-full max-w-xs flex-col gap-1">
             <span className="text-xs text-muted-foreground">Ревизия A</span>
-            <Select items={revisionItems} value={a} onValueChange={(v) => v && setA(v)}>
-              <SelectTrigger>
-                <SelectValue placeholder="Выберите" />
-              </SelectTrigger>
-              <SelectContent>
-                {revisions.map((r) => (
-                  <SelectItem key={r.id} value={r.id}>
-                    {r.id.slice(0, 12)}…
-                  </SelectItem>
-                ))}
-              </SelectContent>
-            </Select>
+            <SelectMenu
+              items={revisionItems}
+              value={a}
+              placeholder="Выберите"
+              onValueChange={(v) => v && setA(v)}
+            />
           </div>
           <div className="flex w-full max-w-xs flex-col gap-1">
             <span className="text-xs text-muted-foreground">Ревизия B</span>
-            <Select items={revisionItems} value={b} onValueChange={(v) => v && setB(v)}>
-              <SelectTrigger>
-                <SelectValue placeholder="Выберите" />
-              </SelectTrigger>
-              <SelectContent>
-                {revisions.map((r) => (
-                  <SelectItem key={r.id} value={r.id}>
-                    {r.id.slice(0, 12)}…
-                  </SelectItem>
-                ))}
-              </SelectContent>
-            </Select>
+            <SelectMenu
+              items={revisionItems}
+              value={b}
+              placeholder="Выберите"
+              onValueChange={(v) => v && setB(v)}
+            />
           </div>
           <Button onClick={() => diffQ.refetch()} disabled={!a || !b || diffQ.isFetching}>
             Сравнить

apps/web/src/routes/_auth/schedule.tsx

@@ -5,24 +5,16 @@ import { toast } from 'sonner'
 import { useState } from 'react'
 
 import { Alert, AlertDescription, AlertTitle } from '@evobgp/ui/components/alert'
-import { Badge } from '@evobgp/ui/components/badge'
 import { Button } from '@evobgp/ui/components/button'
-import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '@evobgp/ui/components/card'
 import { Tabs, TabsContent, TabsList, TabsTrigger } from '@evobgp/ui/components/tabs'
-import {
-  Table,
-  TableBody,
-  TableCell,
-  TableHead,
-  TableHeader,
-  TableRow,
-} from '@evobgp/ui/components/table'
 
+import { DataGridCard } from '@/components/data-grid-shell'
+import { ScheduleJobsGrid } from '@/components/schedule/schedule-jobs-grid'
+import { ScheduleModulesGrid } from '@/components/schedule/schedule-modules-grid'
 import { PageHeader } from '@/components/page-header'
 import { QueryState } from '@/components/query-state'
 import { SectionCards, type SectionCardItem } from '@/components/section-cards'
 import { SectionCardsSkeleton } from '@/components/skeletons'
-import { LoadingButton } from '@/components/loading-button'
 
 import { operationsJobsQueryOptions } from '@/queries/operations'
 import { modulesListQueryOptions } from '@/queries/modules'
@@ -108,82 +100,33 @@ function ScheduleComponent() {
 
       {loading ? <SectionCardsSkeleton count={3} /> : <SectionCards items={items} />}
 
-      <Card>
-        <CardHeader>
-          <CardTitle className="text-base">Модули</CardTitle>
-          <CardDescription>Расписание обновления и ручной запуск ingest</CardDescription>
-        </CardHeader>
-        <CardContent className="p-0">
-          <QueryState
-            data={modules}
-            isLoading={modulesQ.isLoading}
-            isError={modulesQ.isError}
-            error={modulesQ.error}
-            empty={modules.length === 0}
-            emptyTitle="Нет модулей"
-            onRetry={() => modulesQ.refetch()}
-          >
-            {(items) => (
-              <Table>
-                <TableHeader>
-                  <TableRow>
-                    <TableHead>Модуль</TableHead>
-                    <TableHead>Тип</TableHead>
-                    <TableHead>Расписание</TableHead>
-                    <TableHead>Обновлено</TableHead>
-                    <TableHead>Статус</TableHead>
-                    <TableHead className="w-32 text-right" />
-                  </TableRow>
-                </TableHeader>
-                <TableBody>
-                  {items.map((m) => (
-                    <TableRow key={m.id}>
-                      <TableCell className="font-medium">{m.name}</TableCell>
-                      <TableCell>
-                        <Badge variant="outline">{m.type}</Badge>
-                      </TableCell>
-                      <TableCell className="font-mono text-xs text-muted-foreground">
-                        {m.cron_expr ?? (m.refresh_interval_sec ? `${m.refresh_interval_sec}s` : '—')}
-                      </TableCell>
-                      <TableCell className="whitespace-nowrap text-xs text-muted-foreground">
-                        {m.last_refreshed_at ? new Date(m.last_refreshed_at).toLocaleString('ru-RU') : '—'}
-                      </TableCell>
-                      <TableCell>
-                        {m.enabled ? (
-                          <Badge variant="default">Вкл</Badge>
-                        ) : (
-                          <Badge variant="secondary">Выкл</Badge>
-                        )}
-                      </TableCell>
-                      <TableCell className="text-right">
-                        <LoadingButton
-                          size="sm"
-                          variant="secondary"
-                          loading={!!refreshing[m.id]}
-                          onClick={() => refreshMutation.mutate(m.id)}
-                        >
-                          <RefreshCw />
-                          Обновить
-                        </LoadingButton>
-                      </TableCell>
-                    </TableRow>
-                  ))}
-                </TableBody>
-              </Table>
-            )}
-          </QueryState>
-        </CardContent>
-      </Card>
+      <DataGridCard
+        title="Модули"
+        description="Расписание обновления и ручной запуск ingest"
+      >
+        <QueryState
+          data={modules}
+          isLoading={modulesQ.isLoading}
+          isError={modulesQ.isError}
+          error={modulesQ.error}
+          empty={modules.length === 0}
+          emptyTitle="Нет модулей"
+          onRetry={() => modulesQ.refetch()}
+        >
+          {(items) => (
+            <ScheduleModulesGrid
+              items={items}
+              refreshing={refreshing}
+              onRefresh={(id) => refreshMutation.mutate(id)}
+              isLoading={modulesQ.isFetching && !modulesQ.isLoading}
+            />
+          )}
+        </QueryState>
+      </DataGridCard>
 
-      <Card>
-        <CardHeader>
-          <CardTitle className="text-base">Задачи</CardTitle>
-          <CardDescription>Последние задачи из API</CardDescription>
-        </CardHeader>
-        <CardContent className="p-0">
-          <JobsTabs jobs={jobs} loading={jobsQ.isLoading} />
-        </CardContent>
-      </Card>
+      <DataGridCard title="Задачи" description="Последние задачи из API">
+        <JobsTabs jobs={jobs} loading={jobsQ.isLoading} />
+      </DataGridCard>
     </div>
   )
 }
@@ -196,68 +139,20 @@ function JobsTabs({ jobs, loading }: { jobs: JobRow[]; loading: boolean }) {
 
   return (
     <Tabs defaultValue="all">
-      <TabsList>
+      <TabsList className="m-3 mb-0">
         <TabsTrigger value="all">Все ({jobs.length})</TabsTrigger>
         <TabsTrigger value="refresh">Обновление ({refresh.length})</TabsTrigger>
         <TabsTrigger value="failed">С ошибкой ({failed.length})</TabsTrigger>
       </TabsList>
       <TabsContent value="all" className="mt-0">
-        <JobsTable items={jobs} loading={loading} />
+        <ScheduleJobsGrid items={jobs} isLoading={loading} />
       </TabsContent>
       <TabsContent value="refresh" className="mt-0">
-        <JobsTable items={refresh} loading={loading} />
+        <ScheduleJobsGrid items={refresh} isLoading={loading} />
       </TabsContent>
       <TabsContent value="failed" className="mt-0">
-        <JobsTable items={failed} loading={loading} />
+        <ScheduleJobsGrid items={failed} isLoading={loading} />
       </TabsContent>
     </Tabs>
   )
 }
-
-function JobsTable({ items, loading }: { items: JobRow[]; loading: boolean }) {
-  if (loading) return <div className="p-6 text-center text-sm text-muted-foreground">Загрузка…</div>
-  if (items.length === 0)
-    return <div className="p-6 text-center text-sm text-muted-foreground">Нет задач</div>
-  return (
-    <Table>
-      <TableHeader>
-        <TableRow>
-          <TableHead>Вид</TableHead>
-          <TableHead>Статус</TableHead>
-          <TableHead>Создана</TableHead>
-          <TableHead>Завершена</TableHead>
-          <TableHead>Ошибка</TableHead>
-        </TableRow>
-      </TableHeader>
-      <TableBody>
-        {items.map((j) => (
-          <TableRow key={j.job_id}>
-            <TableCell className="font-medium">{j.kind}</TableCell>
-            <TableCell>
-              <Badge
-                variant={
-                  j.status === 'succeeded'
-                    ? 'default'
-                    : j.status === 'failed'
-                      ? 'destructive'
-                      : 'secondary'
-                }
-              >
-                {j.status}
-              </Badge>
-            </TableCell>
-            <TableCell className="whitespace-nowrap text-xs text-muted-foreground">
-              {j.created_at ? new Date(j.created_at).toLocaleString('ru-RU') : '—'}
-            </TableCell>
-            <TableCell className="whitespace-nowrap text-xs text-muted-foreground">
-              {j.finished_at ? new Date(j.finished_at).toLocaleString('ru-RU') : '—'}
-            </TableCell>
-            <TableCell className="max-w-xs truncate text-xs text-destructive">
-              {j.error ?? ''}
-            </TableCell>
-          </TableRow>
-        ))}
-      </TableBody>
-    </Table>
-  )
-}

apps/web/src/routes/_auth/settings.tsx

@@ -1,23 +1,19 @@
-import { createFileRoute } from '@tanstack/react-router'
-import { useQuery } from '@tanstack/react-query'
+import { createFileRoute, useNavigate } from '@tanstack/react-router'
+import { useQuery, useQueryClient } from '@tanstack/react-query'
 
+import { Alert, AlertDescription, AlertTitle } from '@evobgp/ui/components/alert'
+import { Button } from '@evobgp/ui/components/button'
 import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '@evobgp/ui/components/card'
 import { Input } from '@evobgp/ui/components/input'
 import { Label } from '@evobgp/ui/components/label'
-import {
-  Select,
-  SelectContent,
-  SelectItem,
-  SelectTrigger,
-  SelectValue,
-} from '@evobgp/ui/components/select'
 
 import { PageHeader } from '@/components/page-header'
 import { LoadingButton } from '@/components/loading-button'
-import { setToken, TOKEN_STORAGE_KEY } from '@/lib/api-client'
-import { authSessionQueryOptions } from '@/queries/auth'
+import { SelectField } from '@/components/select-field'
+import { DEV_API_TOKEN, normalizeApiToken, setToken, TOKEN_STORAGE_KEY } from '@/lib/api-client'
+import { authKeys, authSessionQueryOptions } from '@/queries/auth'
 import { toast } from 'sonner'
-import { Save } from 'lucide-react'
+import { Info, Save } from 'lucide-react'
 import { useTheme } from 'next-themes'
 import { useEffect, useState } from 'react'
 
@@ -32,7 +28,14 @@ const THEME_SELECT_ITEMS = [
 ] as const
 
 function SettingsComponent() {
-  const { data: session } = useQuery(authSessionQueryOptions())
+  const navigate = useNavigate()
+  const qc = useQueryClient()
+  const { data: session, isError: sessionError, error: sessionQueryError } = useQuery({
+    ...authSessionQueryOptions(),
+    enabled: Boolean(
+      typeof window !== 'undefined' && window.localStorage.getItem(TOKEN_STORAGE_KEY)?.trim(),
+    ),
+  })
   const { theme, setTheme } = useTheme()
   const [token, setTokenValue] = useState('')
 
@@ -41,10 +44,23 @@ function SettingsComponent() {
     setTokenValue(t)
   }, [])
 
-  function saveTokenHandler() {
-    const t = token.trim()
-    setToken(t || null)
+  async function applyToken(raw: string) {
+    const normalized = normalizeApiToken(raw)
+    setToken(normalized || null)
+    setTokenValue(normalized)
+    await qc.invalidateQueries({ queryKey: authKeys.all })
     toast.success('Токен сохранён')
+    if (normalized) {
+      void navigate({ to: '/dashboard' })
+    }
+  }
+
+  function saveTokenHandler() {
+    void applyToken(token)
+  }
+
+  function useDevToken() {
+    void applyToken(DEV_API_TOKEN)
   }
 
   return (
@@ -54,11 +70,21 @@ function SettingsComponent() {
         description="Параметры интерфейса и подключения браузера к API."
       />
 
+      <Alert className="border-info/30 bg-info/5">
+        <Info className="text-info" />
+        <AlertTitle>Локальная разработка</AlertTitle>
+        <AlertDescription>
+          При включённом demo-seed API принимает токен <code className="text-xs">dev</code> (роль{' '}
+          <code className="text-xs">operator</code>). Вводите только значение токена, без префикса{' '}
+          <code className="text-xs">Bearer</code> — он добавляется автоматически.
+        </AlertDescription>
+      </Alert>
+
       <Card>
         <CardHeader>
           <CardTitle>Подключение к API</CardTitle>
           <CardDescription>
-            Bearer-токен хранится только в этом браузере (localStorage). Управление ключами tenant — в
+            Токен хранится только в этом браузере (localStorage). Управление ключами tenant — в
             разделе «Права доступа».
           </CardDescription>
         </CardHeader>
@@ -71,19 +97,33 @@ function SettingsComponent() {
               autoComplete="off"
               value={token}
               onChange={(e) => setTokenValue(e.target.value)}
-              placeholder="Bearer …"
+              placeholder="dev или API-ключ"
             />
           </div>
-          <LoadingButton onClick={saveTokenHandler}>
-            <Save />
-            Сохранить токен
-          </LoadingButton>
+          <div className="flex flex-wrap gap-2">
+            <LoadingButton onClick={saveTokenHandler}>
+              <Save />
+              Сохранить токен
+            </LoadingButton>
+            <Button type="button" variant="outline" onClick={useDevToken}>
+              Использовать dev
+            </Button>
+          </div>
           {session ? (
             <p className="text-xs text-muted-foreground">
               Активная сессия: tenant <code className="font-mono">{session.tenant_id}</code>, роль{' '}
               <code className="font-mono">{session.role}</code>.
             </p>
           ) : null}
+          {sessionError ? (
+            <p className="text-xs text-destructive">
+              {sessionQueryError instanceof Error
+                ? sessionQueryError.message
+                : 'Не удалось проверить сессию'}
+              . Для токена <code className="font-mono">dev</code> нужен demo-seed (
+              <code className="text-xs">EVOBGP_SEED_DEMO</code> ≠ 0) и запущенный API.
+            </p>
+          ) : null}
         </CardContent>
       </Card>
 
@@ -95,21 +135,15 @@ function SettingsComponent() {
           </CardDescription>
         </CardHeader>
         <CardContent className="flex flex-col gap-2">
-          <Label htmlFor="theme-select">Тема</Label>
-          <Select
+          <SelectField
+            id="theme-select"
+            label="Тема"
             items={[...THEME_SELECT_ITEMS]}
             value={theme ?? 'system'}
+            placeholder="Выберите тему"
+            triggerClassName="max-w-xs"
             onValueChange={(v) => v && setTheme(v)}
-          >
-            <SelectTrigger id="theme-select" className="w-full max-w-xs">
-              <SelectValue placeholder="Выберите тему" />
-            </SelectTrigger>
-            <SelectContent>
-              <SelectItem value="light">Светлая</SelectItem>
-              <SelectItem value="dark">Тёмная</SelectItem>
-              <SelectItem value="system">Как в системе</SelectItem>
-            </SelectContent>
-          </Select>
+          />
         </CardContent>
       </Card>
     </div>

apps/web/src/routes/_auth/tenant-settings.tsx

@@ -8,23 +8,12 @@ import { Alert, AlertDescription, AlertTitle } from '@evobgp/ui/components/alert
 import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '@evobgp/ui/components/card'
 import { Input } from '@evobgp/ui/components/input'
 import { Label } from '@evobgp/ui/components/label'
-import {
-  Select,
-  SelectContent,
-  SelectItem,
-  SelectTrigger,
-  SelectValue,
-} from '@evobgp/ui/components/select'
 import { Tabs, TabsContent, TabsList, TabsTrigger } from '@evobgp/ui/components/tabs'
-import {
-  Table,
-  TableBody,
-  TableCell,
-  TableHead,
-  TableHeader,
-  TableRow,
-} from '@evobgp/ui/components/table'
 
+import { SelectField } from '@/components/select-field'
+
+
+import { SettingsKvGrid } from '@/components/settings/settings-kv-grid'
 import { PageHeader } from '@/components/page-header'
 import { QueryState } from '@/components/query-state'
 import { LoadingButton } from '@/components/loading-button'
@@ -35,6 +24,7 @@ import {
   RUNTIME_LOGS_SETTING_KEYS,
   buildPayload,
   partitionSettings,
+  settingsKeys,
   settingsQueryOptions,
   type BirdSettingKey,
 } from '@/queries/settings'
@@ -93,7 +83,7 @@ function TenantSettingsComponent() {
       apiMutate('/v1/settings', 'PATCH', payload),
     onSuccess: () => {
       toast.success('Параметры сохранены')
-      void qc.invalidateQueries({ queryKey: ['settings'] })
+      void qc.invalidateQueries({ queryKey: settingsKeys.all })
     },
     onError: (e) => toast.error(e instanceof Error ? e.message : 'Не удалось сохранить'),
   })
@@ -249,31 +239,20 @@ function TenantSettingsComponent() {
               >
                 {() => (
                   <div className="grid gap-4 md:grid-cols-2">
-                    <div className="flex flex-col gap-1.5">
-                      <Label>Авто-очистка включена</Label>
-                      <Select
-                        items={[...RUNTIME_LOGS_ENABLED_ITEMS]}
-                        value={runtimeLogsForm.runtime_logs_auto_enabled ?? 'false'}
-                        onValueChange={(v) =>
-                          v &&
-                          setRuntimeLogsForm((s) => ({
-                            ...s,
-                            runtime_logs_auto_enabled: v,
-                          }))
-                        }
-                      >
-                        <SelectTrigger>
-                          <SelectValue placeholder="Выберите" />
-                        </SelectTrigger>
-                        <SelectContent>
-                          <SelectItem value="true">Вкл</SelectItem>
-                          <SelectItem value="false">Выкл</SelectItem>
-                        </SelectContent>
-                      </Select>
-                      <p className="font-mono text-xs text-muted-foreground">
-                        runtime_logs_auto_enabled
-                      </p>
-                    </div>
+                    <SelectField
+                      label="Авто-очистка включена"
+                      items={[...RUNTIME_LOGS_ENABLED_ITEMS]}
+                      value={runtimeLogsForm.runtime_logs_auto_enabled ?? 'false'}
+                      placeholder="Выберите"
+                      description="runtime_logs_auto_enabled"
+                      onValueChange={(v) =>
+                        v &&
+                        setRuntimeLogsForm((s) => ({
+                          ...s,
+                          runtime_logs_auto_enabled: v,
+                        }))
+                      }
+                    />
                     <div className="flex flex-col gap-1.5">
                       <Label htmlFor="runtime_logs_max_file_mb">Макс. размер файла (MB)</Label>
                       <Input
@@ -307,31 +286,20 @@ function TenantSettingsComponent() {
                         runtime_logs_auto_schedule
                       </p>
                     </div>
-                    <div className="flex flex-col gap-1.5">
-                      <Label>Режим очистки</Label>
-                      <Select
-                        items={[...RUNTIME_LOGS_MODE_ITEMS]}
-                        value={runtimeLogsForm.runtime_logs_auto_mode ?? ''}
-                        onValueChange={(v) =>
-                          v &&
-                          setRuntimeLogsForm((s) => ({
-                            ...s,
-                            runtime_logs_auto_mode: v,
-                          }))
-                        }
-                      >
-                        <SelectTrigger>
-                          <SelectValue placeholder="Выберите" />
-                        </SelectTrigger>
-                        <SelectContent>
-                          <SelectItem value="truncate">truncate — обнулить</SelectItem>
-                          <SelectItem value="delete">delete — удалить файл</SelectItem>
-                        </SelectContent>
-                      </Select>
-                      <p className="font-mono text-xs text-muted-foreground">
-                        runtime_logs_auto_mode
-                      </p>
-                    </div>
+                    <SelectField
+                      label="Режим очистки"
+                      items={[...RUNTIME_LOGS_MODE_ITEMS]}
+                      value={runtimeLogsForm.runtime_logs_auto_mode ?? ''}
+                      placeholder="Выберите"
+                      description="runtime_logs_auto_mode"
+                      onValueChange={(v) =>
+                        v &&
+                        setRuntimeLogsForm((s) => ({
+                          ...s,
+                          runtime_logs_auto_mode: v,
+                        }))
+                      }
+                    />
                     <div className="md:col-span-2">
                       <LoadingButton onClick={saveRuntimeLogs} loading={patchMutation.isPending}>
                         <Save />
@@ -365,22 +333,10 @@ function TenantSettingsComponent() {
                 onRetry={() => settingsQ.refetch()}
               >
                 {(items) => (
-                  <Table>
-                    <TableHeader>
-                      <TableRow>
-                        <TableHead>Ключ</TableHead>
-                        <TableHead>Значение</TableHead>
-                      </TableRow>
-                    </TableHeader>
-                    <TableBody>
-                      {items.map((row) => (
-                        <TableRow key={row.id}>
-                          <TableCell className="font-mono text-xs">{row.key}</TableCell>
-                          <TableCell className="font-mono text-xs">{row.value}</TableCell>
-                        </TableRow>
-                      ))}
-                    </TableBody>
-                  </Table>
+                  <SettingsKvGrid
+                    items={items}
+                    isLoading={settingsQ.isFetching && !settingsQ.isLoading}
+                  />
                 )}
               </QueryState>
             </CardContent>

apps/web/src/types/api.ts

@@ -343,3 +343,42 @@ export type ApiKeyCreated = ApiKey & { token: string }
 export type AsyncJobAccepted = {
   job_id: string
 }
+
+// ---- Firewall blocklist ----
+export type FirewallClient = {
+  id: string
+  name: string
+  hostname?: string
+  token_prefix: string
+  status: 'pending' | 'approved' | 'revoked'
+  last_seen_at?: string | null
+  last_seen_at_source?: string
+  last_apply_at?: string | null
+  last_apply_status?: string
+  last_apply_prefix_count?: number
+  last_apply_packets_dropped?: number
+  last_apply_packets_accepted?: number
+  last_apply_source?: string
+  client_version?: string
+  created_at: string
+}
+
+export type FirewallClientsResponse = { items: FirewallClient[] }
+
+export type FirewallRule = {
+  id: string
+  client_id?: string | null
+  priority: number
+  action: 'block' | 'accept'
+  community_id?: string | null
+  comment?: string
+}
+
+export type FirewallRulesResponse = { items: FirewallRule[] }
+
+export type FirewallInstallContext = {
+  bundle_seed: string
+  bundle_seed_configured: boolean
+  suggested_cp_url: string
+  install_sh_url: string
+}

deploy/compose/docker-compose.production.example.yaml

@@ -159,10 +159,18 @@ services:
         condition: service_started
     labels:
       - traefik.enable=true
+      # Публичные firewall-эндпоинты — без WEBUI_IP_WHITELIST (установка с произвольных серверов).
+      - traefik.http.routers.evobgp-firewall-public.rule=Host(`${WEBUI_DOMAIN}`) && (Path(`/v1/firewall/install.sh`) || Path(`/v1/firewall/sync-script`) || PathPrefix(`/v1/firewall/enroll`))
+      - traefik.http.routers.evobgp-firewall-public.entrypoints=websecure
+      - traefik.http.routers.evobgp-firewall-public.tls=true
+      - traefik.http.routers.evobgp-firewall-public.tls.certresolver=letsencrypt
+      - traefik.http.routers.evobgp-firewall-public.priority=100
+      - traefik.http.routers.evobgp-firewall-public.service=evobgp-web
       - traefik.http.routers.evobgp-web.rule=Host(`${WEBUI_DOMAIN}`)
       - traefik.http.routers.evobgp-web.entrypoints=websecure
       - traefik.http.routers.evobgp-web.tls=true
       - traefik.http.routers.evobgp-web.tls.certresolver=letsencrypt
+      - traefik.http.routers.evobgp-web.priority=10
       - traefik.http.routers.evobgp-web.middlewares=webui-ipwhitelist@docker
       - traefik.http.middlewares.webui-ipwhitelist.ipallowlist.sourcerange=${WEBUI_IP_WHITELIST}
       - traefik.http.services.evobgp-web.loadbalancer.server.port=80

deploy/compose/docker-compose.yaml

@@ -247,10 +247,18 @@ services:
       - evobgp-all
     labels:
       - traefik.enable=true
+      # Публичные firewall-эндпоинты — без WEBUI_IP_WHITELIST (установка с произвольных серверов).
+      - traefik.http.routers.evobgp-firewall-public.rule=Host(`${WEBUI_DOMAIN}`) && (Path(`/v1/firewall/install.sh`) || Path(`/v1/firewall/sync-script`) || PathPrefix(`/v1/firewall/enroll`))
+      - traefik.http.routers.evobgp-firewall-public.entrypoints=websecure
+      - traefik.http.routers.evobgp-firewall-public.tls=true
+      - traefik.http.routers.evobgp-firewall-public.tls.certresolver=letsencrypt
+      - traefik.http.routers.evobgp-firewall-public.priority=100
+      - traefik.http.routers.evobgp-firewall-public.service=evobgp-web
       - traefik.http.routers.evobgp-web.rule=Host(`${WEBUI_DOMAIN}`)
       - traefik.http.routers.evobgp-web.entrypoints=websecure
       - traefik.http.routers.evobgp-web.tls=true
       - traefik.http.routers.evobgp-web.tls.certresolver=letsencrypt
+      - traefik.http.routers.evobgp-web.priority=10
       - traefik.http.routers.evobgp-web.middlewares=webui-ipwhitelist@docker
       - traefik.http.middlewares.webui-ipwhitelist.ipallowlist.sourcerange=${WEBUI_IP_WHITELIST}
       - traefik.http.services.evobgp-web.loadbalancer.server.port=80

deploy/compose/stack.microvps-full.yaml

@@ -162,10 +162,18 @@ services:
         condition: service_started
     labels:
       - traefik.enable=true
+      # Публичные firewall-эндпоинты — без WEBUI_IP_WHITELIST (установка с произвольных серверов).
+      - traefik.http.routers.evobgp-firewall-public.rule=Host(`${WEBUI_DOMAIN}`) && (Path(`/v1/firewall/install.sh`) || Path(`/v1/firewall/sync-script`) || PathPrefix(`/v1/firewall/enroll`))
+      - traefik.http.routers.evobgp-firewall-public.entrypoints=websecure
+      - traefik.http.routers.evobgp-firewall-public.tls=true
+      - traefik.http.routers.evobgp-firewall-public.tls.certresolver=letsencrypt
+      - traefik.http.routers.evobgp-firewall-public.priority=100
+      - traefik.http.routers.evobgp-firewall-public.service=evobgp-web
       - traefik.http.routers.evobgp-web.rule=Host(`${WEBUI_DOMAIN}`)
       - traefik.http.routers.evobgp-web.entrypoints=websecure
       - traefik.http.routers.evobgp-web.tls=true
       - traefik.http.routers.evobgp-web.tls.certresolver=letsencrypt
+      - traefik.http.routers.evobgp-web.priority=10
       - traefik.http.routers.evobgp-web.middlewares=webui-ipwhitelist@docker
       - traefik.http.middlewares.webui-ipwhitelist.ipallowlist.sourcerange=${WEBUI_IP_WHITELIST}
       - traefik.http.services.evobgp-web.loadbalancer.server.port=80

deploy/docker/evobgp-web/nginx.conf

@@ -17,7 +17,7 @@ server {
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto;
     }
 
     location = /metrics {

deploy/docker/gobinary/Dockerfile

@@ -58,6 +58,8 @@ RUN apt-get update \
 FROM runtime-base AS runtime
 ARG BIN=evobgp-api
 COPY --from=build-all /out/${BIN} /usr/local/bin/evobgp
+COPY scripts/firewall /opt/evobgp/scripts/firewall
+ENV EVOBGP_FIREWALL_SCRIPTS=/opt/evobgp/scripts/firewall
 EXPOSE 8080
 ENTRYPOINT ["/usr/local/bin/evobgp"]
 

docs/access.md

@@ -43,6 +43,7 @@ opkey|01ARZ3NDEKTSV4RRFFQ69G5FAV|operator,nodekey|01ARZ3NDEKTSV4RRFFQ69G5FAV|nod
 | `editor` | 2 | Чтение + создание/изменение CRUD (модули, записи, peers и т.д.), без опасных операций уровня оператора. |
 | `operator` | 3 | Полный операторский доступ: apply, rollback, настройки, отмена задач и т.п. (как задано в handlers). |
 | `node` | отдельная | Только API для реплики: latest revision, скачивание бандла, enroll. Роль **`node` запрещена** для обычного CRUD — ответ `403 Forbidden`. |
+| `firewall` | отдельная | Только data-plane firewall-клиента: `GET /v1/firewall/blocklist`, `POST /v1/firewall/apply-report`, `POST /v1/firewall/heartbeat`. Токен в таблице `firewall_client`, не в `api_key`. См. [firewall.md](firewall.md). |
 
 Обратное ограничение: для эндпоинтов ноды требуется именно роль **`node`**; остальные роли получают отказ.
 
@@ -50,6 +51,8 @@ opkey|01ARZ3NDEKTSV4RRFFQ69G5FAV|operator,nodekey|01ARZ3NDEKTSV4RRFFQ69G5FAV|nod
 
 Если в store доступен демо-tenant (`DemoIDs`, обычно `EVOBGP_SEED_DEMO` не равен `0`), заголовок **`Authorization: Bearer dev`** даёт роль **`operator`** для этого tenant. **Не зависит** от `EVOBGP_DEV_INSECURE`.
 
+Без demo-tenant токен `dev` может быть задан в `EVOBGP_API_KEYS` (break-glass).
+
 **Запрещено** в продакшене: не оставляйте demo-seed с известным токеном `dev` на боевых данных. Переменная `EVOBGP_DEV_INSECURE` в текущей версии **не влияет** на аутентификацию (оставлена в compose для совместимости; не включайте в production — см. SEC-02 в инженерных правилах).
 
 ### PostgreSQL monitoring и maintenance (control plane)

docs/architecture.md

@@ -41,7 +41,8 @@
 | `broker` | Опциональный `EVOBGP_BROKER_URL` для будущей шины; сейчас задачи только in-process (`jobs.Registry`), пакет лишь логирует факт настройки URL. |
 | `pipeline` | Ingest+render в одном шаге для `module_refresh`: выборка префиксов (CDN/AS/IP/пустые DOMAINS), `CreateRenderRevision`, превью BIRD через `birdfmt`. |
 | `nodedispatch` | Panel→Node HTTP wake-up (`POST /v1/agent/sync`) после `deploy_apply`. |
-| `agentserver` | HTTP API на реплике (`serve`): sync + health для Traefik. |
+| `agentserver` | HTTP API на реплике (`serve`): sync + health для Traefik; опционально firewall failover (`/v1/firewall/*`). |
+| `firewall` | Вычисление policy block/accept → плоский CIDR blocklist. |
 
 ## Удалённые спикеры
 

docs/firewall.md

@@ -0,0 +1,52 @@
+# Firewall blocklist
+
+Подсистема синхронизации blocklist на произвольные Linux-серверы через bash-скрипт и HTTP API.
+
+## Авторизация
+
+1. **Enroll** — `POST /v1/firewall/enroll` с заголовком `X-EvoBGP-Seed` (значение `EVOBGP_BUNDLE_SEED_HEX` на CP). Клиент генерирует токен `evobgp_fw_*` локально.
+2. **Approve** — operator в Web UI (`/firewall` → Запросы).
+3. **Sync** — `GET /v1/firewall/blocklist` с `Authorization: Bearer <client_token>`.
+
+## Политика block/accept
+
+- **`block`** — добавить префиксы выбранного BGP community в kernel blocklist.
+- **`accept`** — не блокировать префиксы этого community.
+- **Community** — правило применяется к префиксам с этим `community_id` в опубликованной revision; пустое значение («Все») — ко всем communities.
+- **Default** — accept (пустой blocklist без явных `block`).
+
+Порядок: сначала per-server overrides клиента, затем tenant-default. Для каждого community берётся первое подходящее правило по приоритету.
+
+Справочник communities: Web UI → Справочники, или модули с привязкой community к префиксам.
+
+## Установка на сервер
+
+Публичные URL (без API-ключа, вне `WEBUI_IP_WHITELIST` Traefik): `GET /v1/firewall/install.sh`, `GET /v1/firewall/sync-script`, `POST /v1/firewall/enroll`. Всегда **HTTPS**.
+
+Требуется миграция **`000027_firewall`** в PostgreSQL (применяется при старте API с актуальным бинарём). Если enroll отвечает `503` / `database schema outdated` — перезапустите `evobgp-api` / `evobgp-all` после деплоя новой версии.
+
+```bash
+curl -fsSL https://<api>/v1/firewall/install.sh | \
+  EVOBGP_CP_URL=https://<api> \
+  EVOBGP_SEED=<bundle_seed_hex> \
+  EVOBGP_CLIENT_NAME="web-01" \
+  bash
+```
+
+Файлы: `/etc/evobgp/firewall.conf`, `/usr/local/sbin/evobgp-firewall.sh`, systemd timer `evobgp-firewall.timer`.
+
+После **approve** в UI выполните на сервере (или дождитесь timer):
+
+```bash
+sudo rm -f /var/lib/evobgp-firewall/last_hash
+sudo /usr/local/sbin/evobgp-firewall.sh
+sudo nft list table inet evobgp_blocklist
+```
+
+Для парсинга JSON нужен `jq` или `python3` (install.sh ставит `jq` на Debian/Ubuntu при отсутствии).
+
+## Failover через speaker
+
+При `EVOBGP_FIREWALL_FAILOVER_ENABLED=1` на speaker-agent CP реплицирует состояние через `POST /v1/agent/firewall-replicate`. Клиенты используют тот же DNS-домен.
+
+См. также [access.md](access.md), [remote-speakers.md](remote-speakers.md).

docs/openapi.yaml

@@ -58,6 +58,8 @@ tags:
       Файловые runtime-логи Docker-сервисов (каталог EVOBGP_RUNTIME_LOGS_DIR).
       Доступно только в процессе evobgp-all с примонтированным volume; иначе 503.
       Просмотр — viewer+; очистка — operator+ (синхронно, с audit).
+  - name: Firewall
+    description: Linux firewall blocklist clients, policy rules (block/accept), and data-plane sync.
 
 security:
   - bearerAuth: []
@@ -1579,6 +1581,92 @@ components:
           type: string
           format: date-time
 
+    FirewallClient:
+      type: object
+      properties:
+        id:
+          $ref: "#/components/schemas/ResourceId"
+        name:
+          type: string
+        hostname:
+          type: string
+        token_prefix:
+          type: string
+        status:
+          type: string
+          enum: [pending, approved, revoked]
+        last_seen_at:
+          type: string
+          format: date-time
+        last_apply_at:
+          type: string
+          format: date-time
+        last_apply_status:
+          type: string
+        last_apply_prefix_count:
+          type: integer
+        last_apply_packets_dropped:
+          type: integer
+          format: int64
+          description: Cumulative packets dropped by blocklist rule (from client kernel counter).
+        last_apply_packets_accepted:
+          type: integer
+          format: int64
+          description: Cumulative packets accepted past blocklist chain (nft counter accept rule).
+        client_version:
+          type: string
+
+    FirewallInstallContext:
+      type: object
+      description: Контекст для one-liner установки firewall-клиента (только operator).
+      properties:
+        bundle_seed:
+          type: string
+          description: Значение EVOBGP_BUNDLE_SEED_HEX на control plane.
+        bundle_seed_configured:
+          type: boolean
+        suggested_cp_url:
+          type: string
+          format: uri
+        install_sh_url:
+          type: string
+          format: uri
+
+    FirewallRule:
+      type: object
+      properties:
+        id:
+          $ref: "#/components/schemas/ResourceId"
+        client_id:
+          $ref: "#/components/schemas/ResourceId"
+          nullable: true
+        priority:
+          type: integer
+        action:
+          type: string
+          enum: [block, accept]
+        community_id:
+          $ref: "#/components/schemas/ResourceId"
+          nullable: true
+        comment:
+          type: string
+
+    FirewallBlocklist:
+      type: object
+      properties:
+        client_id:
+          $ref: "#/components/schemas/ResourceId"
+        revision_id:
+          $ref: "#/components/schemas/ResourceId"
+        prefixes:
+          type: array
+          items:
+            type: string
+        total:
+          type: integer
+        hash:
+          type: string
+
 paths:
   /v1/health:
     get:
@@ -4299,3 +4387,201 @@ paths:
           $ref: "#/components/responses/Forbidden"
         default:
           $ref: "#/components/responses/DefaultProblem"
+
+  /v1/firewall/install-context:
+    get:
+      tags: [Firewall]
+      summary: Install context for firewall one-liner (operator)
+      operationId: getFirewallInstallContext
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/FirewallInstallContext"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        default:
+          $ref: "#/components/responses/DefaultProblem"
+
+  /v1/firewall/enroll:
+    post:
+      tags: [Firewall]
+      summary: Enroll firewall client (public, X-EvoBGP-Seed)
+      security: []
+      operationId: firewallEnroll
+      parameters:
+        - name: X-EvoBGP-Seed
+          in: header
+          required: true
+          schema:
+            type: string
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [name, client_token]
+              properties:
+                name:
+                  type: string
+                hostname:
+                  type: string
+                client_token:
+                  type: string
+                client_version:
+                  type: string
+      responses:
+        "201":
+          description: Client created (pending).
+        default:
+          $ref: "#/components/responses/DefaultProblem"
+
+  /v1/firewall/clients:
+    get:
+      tags: [Firewall]
+      summary: List firewall clients
+      operationId: listFirewallClients
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  items:
+                    type: array
+                    items:
+                      $ref: "#/components/schemas/FirewallClient"
+        default:
+          $ref: "#/components/responses/DefaultProblem"
+
+  /v1/firewall/clients/{id}/approve:
+    post:
+      tags: [Firewall]
+      summary: Approve pending client
+      operationId: approveFirewallClient
+      parameters:
+        - name: id
+          in: path
+          required: true
+          schema:
+            $ref: "#/components/schemas/ResourceId"
+      responses:
+        "200":
+          description: Approved
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/FirewallClient"
+        default:
+          $ref: "#/components/responses/DefaultProblem"
+
+  /v1/firewall/clients/{id}/revoke:
+    post:
+      tags: [Firewall]
+      summary: Reject pending or revoke approved client
+      operationId: revokeFirewallClient
+      parameters:
+        - name: id
+          in: path
+          required: true
+          schema:
+            $ref: "#/components/schemas/ResourceId"
+      responses:
+        "200":
+          description: Revoked
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  status:
+                    type: string
+                    enum: [revoked]
+        default:
+          $ref: "#/components/responses/DefaultProblem"
+
+  /v1/firewall/rules:
+    get:
+      tags: [Firewall]
+      summary: List firewall rules
+      operationId: listFirewallRules
+      parameters:
+        - name: scope
+          in: query
+          schema:
+            type: string
+            enum: [tenant, client]
+        - name: client_id
+          in: query
+          schema:
+            $ref: "#/components/schemas/ResourceId"
+      responses:
+        "200":
+          description: OK
+        default:
+          $ref: "#/components/responses/DefaultProblem"
+    post:
+      tags: [Firewall]
+      summary: Create firewall rule
+      operationId: createFirewallRule
+      responses:
+        "201":
+          description: Created
+        default:
+          $ref: "#/components/responses/DefaultProblem"
+
+  /v1/firewall/blocklist:
+    get:
+      tags: [Firewall]
+      summary: Get evaluated blocklist (firewall client token)
+      operationId: getFirewallBlocklist
+      responses:
+        "200":
+          description: Blocklist
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/FirewallBlocklist"
+        default:
+          $ref: "#/components/responses/DefaultProblem"
+
+  /v1/firewall/apply-report:
+    post:
+      tags: [Firewall]
+      summary: Report last apply status
+      operationId: firewallApplyReport
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                status:
+                  type: string
+                error:
+                  type: string
+                prefix_count:
+                  type: integer
+                ip_count:
+                  type: integer
+                packets_dropped:
+                  type: integer
+                  format: int64
+                packets_accepted:
+                  type: integer
+                  format: int64
+                kernel_method:
+                  type: string
+                source:
+                  type: string
+      responses:
+        "200":
+          description: OK
+        default:
+          $ref: "#/components/responses/DefaultProblem"

docs/quickstart.md

@@ -153,6 +153,7 @@ docker compose --env-file .env --env-file .env.web-sec --profile microvps-full u
 - `http://<WEBUI_DOMAIN>` должен редиректить на `https://<WEBUI_DOMAIN>`;
 - с IP из `WEBUI_IP_WHITELIST` UI доступен по HTTPS;
 - с неразрешенного IP Traefik вернет `403`.
+- исключение: `GET /v1/firewall/install.sh`, `GET /v1/firewall/sync-script`, `POST /v1/firewall/enroll` — публичные, без whitelist (см. [firewall.md](firewall.md)).
 
 Health API: `http://<IP>:8080/v1/health`.
 

docs/remote-speakers.md

@@ -114,5 +114,7 @@ Tenant `/v1/settings` (`bird_bgp_source_ipv4`) — fallback для master / ес
 | `EVOBGP_NODE_DISPATCH_ENABLED=1` | CP |
 | `EVOBGP_AGENT_SECRET` | реплика |
 | `EVOBGP_NODE_TOKEN` | реплика |
+| `EVOBGP_FIREWALL_FAILOVER_ENABLED=1` | реплика (опционально: отдавать `/v1/firewall/blocklist` при недоступности CP) |
+| `EVOBGP_FIREWALL_STATE_FILE` | реплика (default `/var/lib/evobgp-agent/firewall-state.json`) |
 | `EVOBGP_BUNDLE_PUBKEY_BASE64` | реплика |
 | `PANEL_IP_WHITELIST` | Traefik на реплике |

internal/agentserver/firewall.go

@@ -0,0 +1,256 @@
+package agentserver
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"io"
+	"log"
+	"net/http"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+	"sync"
+	"time"
+
+	"evobgp/internal/authkey"
+	"evobgp/internal/firewall"
+)
+
+type firewallReplicatePayload struct {
+	TenantID            string                `json:"tenant_id"`
+	RevisionID          string                `json:"revision_id"`
+	GeneratedAt         string                `json:"generated_at"`
+	UpdatedAt           string                `json:"updated_at"`
+	ClientsByHash       map[string]clientMeta `json:"clients_by_hash"`
+	Rules               []firewallRuleJSON    `json:"rules"`
+	PrefixesByCommunity map[string][]string   `json:"prefixes_by_community"`
+}
+
+type clientMeta struct {
+	ClientID string `json:"client_id"`
+	Name     string `json:"name"`
+}
+
+type firewallRuleJSON struct {
+	ClientID    *string `json:"client_id"`
+	Priority    int     `json:"priority"`
+	Action      string  `json:"action"`
+	CommunityID *string `json:"community_id"`
+}
+
+type firewallAgent struct {
+	mu        sync.RWMutex
+	stateFile string
+	cpURL     string
+	enabled   bool
+	state     firewallReplicatePayload
+}
+
+func newFirewallAgent(cfg Config) *firewallAgent {
+	enabled := strings.TrimSpace(os.Getenv("EVOBGP_FIREWALL_FAILOVER_ENABLED")) == "1"
+	stateFile := envOr("EVOBGP_FIREWALL_STATE_FILE", "/var/lib/evobgp-agent/firewall-state.json")
+	fa := &firewallAgent{
+		stateFile: stateFile,
+		cpURL:     strings.TrimSpace(cfg.ControlPlaneURL),
+		enabled:   enabled,
+	}
+	if enabled {
+		_ = fa.load()
+	}
+	return fa
+}
+
+func (s *Server) handleFirewallReplicate(w http.ResponseWriter, r *http.Request) {
+	if !s.authorize(r) {
+		writeProblem(w, http.StatusUnauthorized, "missing or invalid Authorization")
+		return
+	}
+	var raw struct {
+		TenantID    string `json:"tenant_id"`
+		RevisionID  string `json:"revision_id"`
+		GeneratedAt string `json:"generated_at"`
+		Clients     []struct {
+			TokenHashHex string `json:"token_hash_hex"`
+			ClientID     string `json:"client_id"`
+			Name         string `json:"name"`
+		} `json:"clients"`
+		Rules               []firewallRuleJSON  `json:"rules"`
+		PrefixesByCommunity map[string][]string `json:"prefixes_by_community"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&raw); err != nil {
+		writeProblem(w, http.StatusBadRequest, "invalid JSON body")
+		return
+	}
+	byHash := make(map[string]clientMeta, len(raw.Clients))
+	for _, c := range raw.Clients {
+		byHash[strings.ToLower(c.TokenHashHex)] = clientMeta{ClientID: c.ClientID, Name: c.Name}
+	}
+	payload := firewallReplicatePayload{
+		TenantID:            raw.TenantID,
+		RevisionID:          raw.RevisionID,
+		GeneratedAt:         raw.GeneratedAt,
+		UpdatedAt:           time.Now().UTC().Format(time.RFC3339),
+		ClientsByHash:       byHash,
+		Rules:               raw.Rules,
+		PrefixesByCommunity: raw.PrefixesByCommunity,
+	}
+	s.firewall.mu.Lock()
+	s.firewall.state = payload
+	s.firewall.mu.Unlock()
+	if err := s.firewall.save(); err != nil {
+		log.Printf("agentserver: firewall state save: %v", err)
+	}
+	writeJSON(w, http.StatusOK, map[string]any{
+		"ok":            true,
+		"clients_count": len(byHash),
+		"rules_count":   len(raw.Rules),
+		"prefix_count":  len(raw.PrefixesByCommunity),
+	})
+}
+
+func (fa *firewallAgent) handleBlocklist(w http.ResponseWriter, r *http.Request) {
+	token := bearerToken(r)
+	if token == "" {
+		writeProblem(w, http.StatusUnauthorized, "missing bearer token")
+		return
+	}
+	hash := hex.EncodeToString(authkey.HashToken(token))
+	fa.mu.RLock()
+	st := fa.state
+	meta, ok := st.ClientsByHash[hash]
+	fa.mu.RUnlock()
+	if !ok {
+		writeProblem(w, http.StatusUnauthorized, "unknown firewall client")
+		return
+	}
+	rules := make([]firewall.Rule, 0, len(st.Rules))
+	for _, r := range st.Rules {
+		rules = append(rules, firewall.Rule{
+			ClientID:    r.ClientID,
+			Priority:    r.Priority,
+			Action:      r.Action,
+			CommunityID: r.CommunityID,
+		})
+	}
+	prefixes := firewall.Evaluate(meta.ClientID, rules, st.PrefixesByCommunity)
+	updatedAt, _ := time.Parse(time.RFC3339, st.UpdatedAt)
+	age := int(time.Since(updatedAt).Seconds())
+	if updatedAt.IsZero() {
+		age = 0
+	}
+	w.Header().Set("X-EvoBGP-Source", "speaker")
+	w.Header().Set("X-EvoBGP-Revision-ID", st.RevisionID)
+	w.Header().Set("X-EvoBGP-Generated-At", st.GeneratedAt)
+	w.Header().Set("X-EvoBGP-Rules-Version", firewall.RulesVersionHash(rules))
+	if age > 3600 {
+		w.Header().Set("X-EvoBGP-Stale", "true")
+	}
+	if age > 0 {
+		w.Header().Set("Age", strconvItoa(age))
+	}
+	resp := map[string]any{
+		"client_id":             meta.ClientID,
+		"revision_id":           st.RevisionID,
+		"generated_at":          st.GeneratedAt,
+		"source":                "speaker",
+		"rules_applied":         len(rules),
+		"communities_evaluated": len(st.PrefixesByCommunity),
+		"prefixes":              prefixes,
+		"total":                 len(prefixes),
+		"hash":                  prefixHash(prefixes),
+	}
+	if strings.Contains(r.Header.Get("Accept"), "text/plain") {
+		w.Header().Set("Content-Type", "text/plain; charset=utf-8")
+		for _, p := range prefixes {
+			_, _ = w.Write([]byte(p + "\n"))
+		}
+		return
+	}
+	writeJSON(w, http.StatusOK, resp)
+}
+
+func (fa *firewallAgent) handleApplyReportForward(w http.ResponseWriter, r *http.Request) {
+	body, _ := io.ReadAll(r.Body)
+	forwarded := false
+	if fa.cpURL != "" {
+		req, err := http.NewRequestWithContext(r.Context(), http.MethodPost, strings.TrimSuffix(fa.cpURL, "/")+"/v1/firewall/apply-report", strings.NewReader(string(body)))
+		if err == nil {
+			req.Header.Set("Authorization", r.Header.Get("Authorization"))
+			req.Header.Set("Content-Type", "application/json")
+			resp, err := http.DefaultClient.Do(req)
+			if err == nil {
+				forwarded = resp.StatusCode >= 200 && resp.StatusCode < 300
+				_ = resp.Body.Close()
+			}
+		}
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"ok": true, "forwarded": forwarded})
+}
+
+func (fa *firewallAgent) load() error {
+	b, err := os.ReadFile(fa.stateFile)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil
+		}
+		return err
+	}
+	var st firewallReplicatePayload
+	if err := json.Unmarshal(b, &st); err != nil {
+		return err
+	}
+	fa.mu.Lock()
+	fa.state = st
+	fa.mu.Unlock()
+	return nil
+}
+
+func (fa *firewallAgent) save() error {
+	fa.mu.RLock()
+	b, err := json.MarshalIndent(fa.state, "", "  ")
+	fa.mu.RUnlock()
+	if err != nil {
+		return err
+	}
+	dir := filepath.Dir(fa.stateFile)
+	if err := os.MkdirAll(dir, 0o755); err != nil {
+		return err
+	}
+	tmp := fa.stateFile + ".tmp"
+	if err := os.WriteFile(tmp, b, 0o600); err != nil {
+		return err
+	}
+	return os.Rename(tmp, fa.stateFile)
+}
+
+func bearerToken(r *http.Request) string {
+	h := r.Header.Get("Authorization")
+	const p = "Bearer "
+	if !strings.HasPrefix(h, p) {
+		return ""
+	}
+	return strings.TrimSpace(h[len(p):])
+}
+
+func prefixHash(prefixes []string) string {
+	cp := append([]string(nil), prefixes...)
+	sort.Strings(cp)
+	sum := sha256.Sum256([]byte(strings.Join(cp, "\n")))
+	return "sha256:" + hex.EncodeToString(sum[:])
+}
+
+func strconvItoa(n int) string {
+	if n == 0 {
+		return "0"
+	}
+	var b [20]byte
+	i := len(b)
+	for n > 0 {
+		i--
+		b[i] = byte('0' + n%10)
+		n /= 10
+	}
+	return string(b[i:])
+}

internal/agentserver/server.go

@@ -36,16 +36,22 @@ type Config struct {
 
 // Server serves Panel→Node internal API (Remnawave-style wake-up).
 type Server struct {
-	cfg Config
-	mux *http.ServeMux
+	cfg      Config
+	mux      *http.ServeMux
+	firewall *firewallAgent
 }
 
 // New builds an agent HTTP server.
 func New(cfg Config) *Server {
-	s := &Server{cfg: cfg, mux: http.NewServeMux()}
+	s := &Server{cfg: cfg, mux: http.NewServeMux(), firewall: newFirewallAgent(cfg)}
 	s.mux.HandleFunc("GET /v1/agent/health", s.handleHealth)
 	s.mux.HandleFunc("GET /v1/agent/bird/protocols", s.handleBirdProtocols)
 	s.mux.HandleFunc("POST /v1/agent/sync", s.handleSync)
+	if s.firewall.enabled {
+		s.mux.HandleFunc("GET /v1/firewall/blocklist", s.firewall.handleBlocklist)
+		s.mux.HandleFunc("POST /v1/firewall/apply-report", s.firewall.handleApplyReportForward)
+		s.mux.HandleFunc("POST /v1/agent/firewall-replicate", s.handleFirewallReplicate)
+	}
 	return s
 }
 

internal/firewall/policy.go

@@ -0,0 +1,127 @@
+// Package firewall evaluates block/accept policy rules into CIDR blocklists.
+package firewall
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"sort"
+	"strconv"
+	"strings"
+)
+
+// Rule is one ordered firewall policy rule for evaluation.
+type Rule struct {
+	ClientID    *string
+	Priority    int
+	Action      string // "block" | "accept"
+	CommunityID *string
+}
+
+// Evaluate returns a deduplicated flat CIDR list to block in the kernel.
+// communityPrefixes maps community ID to prefixes; key "" holds prefixes without community.
+// Default when no rule matches: accept (do not block).
+func Evaluate(clientID string, rules []Rule, communityPrefixes map[string][]string) []string {
+	ordered := mergeRules(clientID, rules)
+	if len(communityPrefixes) == 0 {
+		return nil
+	}
+	keys := make([]string, 0, len(communityPrefixes))
+	for k := range communityPrefixes {
+		keys = append(keys, k)
+	}
+	sort.Strings(keys)
+
+	var out []string
+	seen := make(map[string]struct{})
+	for _, commKey := range keys {
+		if !shouldBlockCommunity(commKey, ordered) {
+			continue
+		}
+		for _, p := range communityPrefixes[commKey] {
+			p = strings.TrimSpace(p)
+			if p == "" {
+				continue
+			}
+			if _, ok := seen[p]; ok {
+				continue
+			}
+			seen[p] = struct{}{}
+			out = append(out, p)
+		}
+	}
+	return out
+}
+
+func mergeRules(clientID string, rules []Rule) []Rule {
+	var clientRules, tenantRules []Rule
+	for _, r := range rules {
+		if r.ClientID != nil && strings.TrimSpace(*r.ClientID) == clientID {
+			clientRules = append(clientRules, r)
+			continue
+		}
+		if r.ClientID == nil {
+			tenantRules = append(tenantRules, r)
+		}
+	}
+	sort.Slice(clientRules, func(i, j int) bool { return clientRules[i].Priority < clientRules[j].Priority })
+	sort.Slice(tenantRules, func(i, j int) bool { return tenantRules[i].Priority < tenantRules[j].Priority })
+	out := make([]Rule, 0, len(clientRules)+len(tenantRules))
+	out = append(out, clientRules...)
+	out = append(out, tenantRules...)
+	return out
+}
+
+func shouldBlockCommunity(communityKey string, ordered []Rule) bool {
+	for _, r := range ordered {
+		if r.CommunityID == nil || strings.TrimSpace(*r.CommunityID) == communityKey {
+			return strings.EqualFold(strings.TrimSpace(r.Action), "block")
+		}
+	}
+	return false
+}
+
+// RulesVersionHash returns a stable fingerprint of rules for cache headers.
+func RulesVersionHash(rules []Rule) string {
+	if len(rules) == 0 {
+		return "sha256:empty"
+	}
+	cp := append([]Rule(nil), rules...)
+	sort.Slice(cp, func(i, j int) bool {
+		a, b := cp[i], cp[j]
+		ac, bc := "", ""
+		if a.ClientID != nil {
+			ac = *a.ClientID
+		}
+		if b.ClientID != nil {
+			bc = *b.ClientID
+		}
+		if ac != bc {
+			return ac < bc
+		}
+		if a.Priority != b.Priority {
+			return a.Priority < b.Priority
+		}
+		return a.Action < b.Action
+	})
+	var b strings.Builder
+	for _, r := range cp {
+		cid := "*"
+		if r.CommunityID != nil {
+			cid = *r.CommunityID
+		}
+		cl := "tenant"
+		if r.ClientID != nil {
+			cl = *r.ClientID
+		}
+		b.WriteString(cl)
+		b.WriteByte('|')
+		b.WriteString(r.Action)
+		b.WriteByte('|')
+		b.WriteString(cid)
+		b.WriteByte('|')
+		b.WriteString(strconv.Itoa(r.Priority))
+		b.WriteByte(';')
+	}
+	sum := sha256.Sum256([]byte(b.String()))
+	return "sha256:" + hex.EncodeToString(sum[:])
+}

internal/firewall/policy_test.go

@@ -0,0 +1,75 @@
+package firewall
+
+import (
+	"testing"
+)
+
+func TestEvaluate_emptyRules(t *testing.T) {
+	prefixes := map[string][]string{"c1": {"1.2.3.0/24"}}
+	got := Evaluate("client1", nil, prefixes)
+	if len(got) != 0 {
+		t.Fatalf("expected empty blocklist, got %v", got)
+	}
+}
+
+func TestEvaluate_onlyAccept(t *testing.T) {
+	wild := (*string)(nil)
+	rules := []Rule{{Priority: 1, Action: "accept", CommunityID: wild}}
+	prefixes := map[string][]string{"c1": {"1.2.3.0/24"}}
+	got := Evaluate("client1", rules, prefixes)
+	if len(got) != 0 {
+		t.Fatalf("accept alone must not block, got %v", got)
+	}
+}
+
+func TestEvaluate_explicitBlock(t *testing.T) {
+	cid := "c1"
+	rules := []Rule{{Priority: 1, Action: "block", CommunityID: &cid}}
+	prefixes := map[string][]string{"c1": {"1.2.3.0/24", "5.6.7.8/32"}, "c2": {"9.9.9.9/32"}}
+	got := Evaluate("client1", rules, prefixes)
+	if len(got) != 2 {
+		t.Fatalf("expected 2 prefixes, got %v", got)
+	}
+}
+
+func TestEvaluate_clientOverrideAccept(t *testing.T) {
+	wild := (*string)(nil)
+	cTrusted := "trusted"
+	clientID := "srv1"
+	rules := []Rule{
+		{Priority: 1, Action: "block", CommunityID: wild},
+		{ClientID: &clientID, Priority: 1, Action: "accept", CommunityID: &cTrusted},
+	}
+	prefixes := map[string][]string{
+		"trusted": {"1.1.1.0/24"},
+		"bad":     {"2.2.2.0/24"},
+	}
+	got := Evaluate(clientID, rules, prefixes)
+	if len(got) != 1 || got[0] != "2.2.2.0/24" {
+		t.Fatalf("expected only bad community, got %v", got)
+	}
+}
+
+func TestEvaluate_clientOverrideWins(t *testing.T) {
+	cid := "c1"
+	clientID := "srv1"
+	rules := []Rule{
+		{Priority: 1, Action: "accept", CommunityID: &cid},
+		{ClientID: &clientID, Priority: 1, Action: "block", CommunityID: &cid},
+	}
+	prefixes := map[string][]string{"c1": {"1.2.3.0/24"}}
+	got := Evaluate(clientID, rules, prefixes)
+	if len(got) != 1 {
+		t.Fatalf("client override should block, got %v", got)
+	}
+}
+
+func TestEvaluate_noCommunityKey(t *testing.T) {
+	empty := ""
+	rules := []Rule{{Priority: 1, Action: "block", CommunityID: &empty}}
+	prefixes := map[string][]string{"": {"10.0.0.0/8"}}
+	got := Evaluate("c", rules, prefixes)
+	if len(got) != 1 {
+		t.Fatalf("expected prefix without community, got %v", got)
+	}
+}

internal/firewallscripts/embed.go

@@ -0,0 +1,10 @@
+// Package firewallscripts embeds bash installers served by GET /v1/firewall/install.sh.
+// Источник правды — scripts/firewall/; при изменении скопируйте файлы сюда или запустите:
+//
+//	go generate ./internal/firewallscripts/...
+package firewallscripts
+
+import "embed"
+
+//go:embed install.sh evobgp-firewall.sh uninstall.sh
+var FS embed.FS

internal/firewallscripts/evobgp-firewall.sh

@@ -0,0 +1,365 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+CONF_FILE=/etc/evobgp/firewall.conf
+LOG_FILE=/var/log/evobgp-firewall.log
+STATE_DIR=/var/lib/evobgp-firewall
+HASH_FILE="${STATE_DIR}/last_hash"
+PREFIX_FILE="${STATE_DIR}/last_prefixes.txt"
+
+log() { echo "$(date -u +%Y-%m-%dT%H:%M:%SZ) $*" | tee -a "$LOG_FILE"; }
+
+if [[ ! -f "$CONF_FILE" ]]; then
+  log "missing $CONF_FILE"
+  exit 1
+fi
+# shellcheck disable=SC1090
+source "$CONF_FILE"
+
+: "${EVOBGP_CP_URL:?}"
+: "${CLIENT_TOKEN:?}"
+CLIENT_TOKEN="${CLIENT_TOKEN//$'\r'/}"
+CLIENT_TOKEN="${CLIENT_TOKEN//$'\n'/}"
+
+mkdir -p "$STATE_DIR"
+BACKEND="${KERNEL_BACKEND:-auto}"
+
+curl_get_blocklist_file() {
+  local url="$1"
+  local dest="$2"
+  local code
+  code=$(curl -sS -o "$dest" -w "%{http_code}" \
+    -H "Authorization: Bearer ${CLIENT_TOKEN}" \
+    -H "Accept: application/json" \
+    "${url}/v1/firewall/blocklist") || return 1
+  if [[ "$code" == "403" ]]; then
+    log "pending approval"
+    return 2
+  fi
+  if [[ "$code" != "200" ]]; then
+    log "blocklist HTTP $code from $url"
+    return 1
+  fi
+  return 0
+}
+
+try_fetch_blocklist() {
+  local urls=()
+  if [[ -n "${EVOBGP_FAILOVER_URLS:-}" ]]; then
+    IFS=',' read -r -a urls <<<"$EVOBGP_FAILOVER_URLS"
+  else
+    urls=("${EVOBGP_CP_URL%/}")
+  fi
+  local u
+  for u in "${urls[@]}"; do
+    u="${u// /}"
+    u="${u%/}"
+    local rc=0
+    curl_get_blocklist_file "$u" "$PREFIX_FILE" || rc=$?
+    if [[ "$rc" == 2 ]]; then
+      exit 0
+    fi
+    if [[ "$rc" == 0 ]]; then
+      CP_HIT="$u"
+      return 0
+    fi
+  done
+  return 1
+}
+
+parse_blocklist_file() {
+  local f="$1"
+  if [[ ! -s "$f" ]]; then
+    log "blocklist file empty: $f"
+    return 1
+  fi
+  if command -v jq >/dev/null 2>&1; then
+    HASH=$(jq -r '.hash // empty' "$f")
+    TOTAL=$(jq -r '.total // 0' "$f")
+    mapfile -t PREFIXES < <(jq -r '.prefixes[]? // empty' "$f")
+    return 0
+  fi
+  if command -v python3 >/dev/null 2>&1; then
+    local parsed
+    parsed=$(python3 - "$f" <<'PY'
+import json, sys
+with open(sys.argv[1], encoding="utf-8") as fh:
+    data = json.load(fh)
+print(data.get("hash") or "")
+print(data.get("total") or 0)
+for p in data.get("prefixes") or []:
+    if p:
+        print(p)
+PY
+    )
+    HASH=$(echo "$parsed" | sed -n '1p')
+    TOTAL=$(echo "$parsed" | sed -n '2p')
+    mapfile -t PREFIXES < <(echo "$parsed" | sed -n '3,$p')
+    return 0
+  fi
+  HASH=$(grep -o '"hash"[[:space:]]*:[[:space:]]*"[^"]*"' "$f" | head -1 | sed 's/.*"\(sha256:[^"]*\)".*/\1/')
+  TOTAL=$(grep -o '"total"[[:space:]]*:[[:space:]]*[0-9]*' "$f" | head -1 | grep -o '[0-9]*$' || true)
+  mapfile -t PREFIXES < <(grep -oE '"[0-9]+(\.[0-9]+){3}/[0-9]+"' "$f" | tr -d '"' || true)
+  return 0
+}
+
+nft_join_elements() {
+  local out="" p
+  for p in "$@"; do
+    if [[ -n "$out" ]]; then
+      out+=", "
+    fi
+    out+="$p"
+  done
+  printf '%s' "$out"
+}
+
+nft_add_v4_chunk() {
+  local table=$1 name=$2
+  shift 2
+  local joined
+  joined=$(nft_join_elements "$@")
+  if nft add element "$table" "$name" v4 "{ ${joined} }" 2>>"$LOG_FILE"; then
+    return 0
+  fi
+  log "nft batch add failed (chunk=$#), retrying one-by-one"
+  local p ok=0
+  for p in "$@"; do
+    if nft add element "$table" "$name" v4 "{ $p }" 2>>"$LOG_FILE"; then
+      ok=$((ok + 1))
+    fi
+  done
+  [[ "$ok" -gt 0 ]]
+}
+
+if ! try_fetch_blocklist; then
+  log "all endpoints failed"
+  exit 1
+fi
+
+HASH=""
+TOTAL=0
+PREFIXES=()
+parse_blocklist_file "$PREFIX_FILE"
+log "blocklist bytes=$(wc -c <"$PREFIX_FILE" | tr -d ' ') parsed=${#PREFIXES[@]} api_total=${TOTAL:-0}"
+
+if [[ -z "${TOTAL// }" ]]; then
+  TOTAL=${#PREFIXES[@]}
+fi
+
+PACKETS_DROPPED=0
+PACKETS_ACCEPTED=0
+KERNEL_METHOD=""
+APPLIED_V4=0
+
+count_ipv4_prefixes() {
+  local n=0 p
+  for p in "${PREFIXES[@]}"; do
+    [[ "$p" == *:* ]] && continue
+    n=$((n + 1))
+  done
+  APPLIED_V4=$n
+}
+
+nft_rule_packets() {
+  local line=$1
+  if [[ "$line" =~ counter[[:space:]]+packets[[:space:]]+([0-9]+) ]]; then
+    echo "${BASH_REMATCH[1]}"
+  else
+    echo 0
+  fi
+}
+
+ensure_nft_counters() {
+  local table=inet name=evobgp_blocklist
+  nft list chain "$table" "$name" input >/dev/null 2>&1 || return 0
+  local drop_line
+  drop_line=$(nft -a list chain "$table" "$name" input 2>/dev/null | grep 'ip saddr @v4' | grep drop | head -1 || true)
+  if [[ -n "$drop_line" && "$drop_line" != *counter* ]]; then
+    local handle
+    handle=$(echo "$drop_line" | sed -n 's/.*# handle \([0-9]\+\).*/\1/p')
+    if [[ -n "$handle" ]]; then
+      nft delete rule "$table" "$name" input handle "$handle" 2>>"$LOG_FILE" || true
+      drop_line=""
+    fi
+  fi
+  if [[ -z "$drop_line" ]]; then
+    nft add rule "$table" "$name" input ip saddr @v4 counter drop
+  fi
+  if ! nft list chain "$table" "$name" input 2>/dev/null | grep -qE '[[:space:]]counter[[:space:]]+accept'; then
+    nft add rule "$table" "$name" input counter accept
+  fi
+}
+
+collect_nft_packet_stats() {
+  PACKETS_DROPPED=0
+  PACKETS_ACCEPTED=0
+  local line pkts
+  while IFS= read -r line; do
+    if [[ "$line" == *"ip saddr @v4"* && "$line" == *drop* ]]; then
+      pkts=$(nft_rule_packets "$line")
+      [[ -n "$pkts" ]] && PACKETS_DROPPED=$pkts
+    elif [[ "$line" == *counter* && "$line" == *accept* && "$line" != *@v4* ]]; then
+      pkts=$(nft_rule_packets "$line")
+      [[ -n "$pkts" ]] && PACKETS_ACCEPTED=$pkts
+    fi
+  done < <(nft list chain inet evobgp_blocklist input 2>/dev/null || true)
+}
+
+collect_ipset_packet_stats() {
+  PACKETS_DROPPED=0
+  PACKETS_ACCEPTED=0
+  local pkts
+  pkts=$(iptables -L INPUT -v -n -x 2>/dev/null | awk '/match-set evobgp_blocklist_v4/ {print $1; exit}')
+  [[ "$pkts" =~ ^[0-9]+$ ]] && PACKETS_DROPPED=$pkts
+}
+
+collect_packet_stats() {
+  case "${KERNEL_METHOD:-$BACKEND}" in
+    nft)
+      ensure_nft_counters
+      collect_nft_packet_stats
+      ;;
+    ipset)
+      collect_ipset_packet_stats
+      ;;
+    iptables)
+      PACKETS_DROPPED=$(iptables -L INPUT -v -n -x 2>/dev/null | awk '/DROP/ {s+=$1} END {print s+0}')
+      PACKETS_ACCEPTED=0
+      ;;
+    *)
+      if command -v nft >/dev/null 2>&1 && nft list chain inet evobgp_blocklist input >/dev/null 2>&1; then
+        KERNEL_METHOD=nft
+        ensure_nft_counters
+        collect_nft_packet_stats
+      elif iptables -L INPUT -v -n -x 2>/dev/null | grep -q 'evobgp_blocklist_v4'; then
+        KERNEL_METHOD=ipset
+        collect_ipset_packet_stats
+      fi
+      ;;
+  esac
+}
+
+send_client_reports() {
+  collect_packet_stats
+  local km="${KERNEL_METHOD:-$BACKEND}"
+  local report
+  report=$(printf '{"status":"ok","prefix_count":%s,"ip_count":%s,"packets_dropped":%s,"packets_accepted":%s,"source":"cp","kernel_method":"%s"}' \
+    "${TOTAL:-0}" "${APPLIED_V4:-0}" "${PACKETS_DROPPED:-0}" "${PACKETS_ACCEPTED:-0}" "$km")
+  curl -fsS -X POST "${EVOBGP_CP_URL%/}/v1/firewall/apply-report" \
+    -H "Authorization: Bearer ${CLIENT_TOKEN}" \
+    -H "Content-Type: application/json" \
+    -d "$report" >/dev/null 2>&1 || true
+  curl -fsS -X POST "${EVOBGP_CP_URL%/}/v1/firewall/heartbeat" \
+    -H "Authorization: Bearer ${CLIENT_TOKEN}" \
+    -H "Content-Type: application/json" \
+    -d '{"source":"cp"}' >/dev/null 2>&1 || true
+}
+
+if [[ -f "$HASH_FILE" && "$(tr -d '\r\n' <"$HASH_FILE")" == "$HASH" && -n "$HASH" ]]; then
+  count_ipv4_prefixes
+  log "unchanged hash $HASH — skip kernel apply (ipv4=${APPLIED_V4})"
+  send_client_reports
+  exit 0
+fi
+
+apply_nft() {
+  local table=inet
+  local name=evobgp_blocklist
+  local v4=()
+  local p
+  for p in "${PREFIXES[@]}"; do
+    [[ "$p" == *:* ]] && continue
+    v4+=("$p")
+  done
+
+  nft list table "$table" "$name" >/dev/null 2>&1 || nft add table "$table" "$name"
+  nft list set "$table" "$name" v4 >/dev/null 2>&1 || \
+    nft add set "$table" "$name" v4 '{ type ipv4_addr; flags interval; }'
+  nft flush set "$table" "$name" v4
+
+  if ((${#v4[@]})); then
+    local batch=()
+    local chunk=64
+    for p in "${v4[@]}"; do
+      batch+=("$p")
+      if ((${#batch[@]} >= chunk)); then
+        nft_add_v4_chunk "$table" "$name" "${batch[@]}" || log "nft chunk add partial failure"
+        batch=()
+      fi
+    done
+    if ((${#batch[@]})); then
+      nft_add_v4_chunk "$table" "$name" "${batch[@]}" || log "nft tail chunk add partial failure"
+    fi
+  fi
+
+  nft list chain "$table" "$name" input >/dev/null 2>&1 || {
+    nft add chain "$table" "$name" input '{ type filter hook input priority 0; policy accept; }'
+    nft add rule "$table" "$name" input ip saddr @v4 counter drop
+    nft add rule "$table" "$name" input counter accept
+  }
+  ensure_nft_counters
+  KERNEL_METHOD=nft
+  APPLIED_V4=${#v4[@]}
+}
+
+apply_ipset() {
+  local set=evobgp_blocklist_v4
+  local n=0
+  ipset list "$set" >/dev/null 2>&1 || ipset create "$set" hash:net family inet hashsize 4096 maxelem 1048576
+  ipset flush "$set"
+  local p
+  for p in "${PREFIXES[@]}"; do
+    [[ "$p" == *:* ]] && continue
+    ipset add "$set" "$p" -exist
+    n=$((n + 1))
+  done
+  iptables -C INPUT -m set --match-set "$set" src -j DROP 2>/dev/null || \
+    iptables -I INPUT -m set --match-set "$set" src -j DROP
+  KERNEL_METHOD=ipset
+  APPLIED_V4=$n
+}
+
+apply_iptables_only() {
+  iptables -D INPUT -m comment --comment evobgp-block -j DROP 2>/dev/null || true
+  local n=0
+  local p
+  for p in "${PREFIXES[@]}"; do
+    [[ "$p" == *:* ]] && continue
+    iptables -C INPUT -s "$p" -j DROP 2>/dev/null || iptables -A INPUT -s "$p" -j DROP
+    n=$((n + 1))
+  done
+  KERNEL_METHOD=iptables
+  APPLIED_V4=$n
+}
+
+clear_block() {
+  case "$BACKEND" in
+    nft) nft delete table inet evobgp_blocklist 2>/dev/null || true ;;
+    ipset)
+      ipset destroy evobgp_blocklist_v4 2>/dev/null || true
+      iptables -D INPUT -m set --match-set evobgp_blocklist_v4 src -j DROP 2>/dev/null || true
+      ;;
+    iptables) iptables -S INPUT | grep -i evobgp | sed 's/^-A /-D /' | while read -r line; do iptables $line 2>/dev/null || true; done ;;
+  esac
+  APPLIED_V4=0
+  KERNEL_METHOD="${BACKEND:-auto}"
+}
+
+APPLIED_V4=0
+KERNEL_METHOD=""
+if [[ "${TOTAL:-0}" == "0" || ${#PREFIXES[@]} -eq 0 ]]; then
+  clear_block
+  log "cleared blocklist (api total=${TOTAL:-0}) backend=$BACKEND"
+else
+  case "$BACKEND" in
+    nft|auto) if command -v nft >/dev/null 2>&1; then apply_nft; else apply_ipset; fi ;;
+    ipset) apply_ipset ;;
+    iptables) apply_iptables_only ;;
+    *) apply_ipset ;;
+  esac
+  log "applied api_total=${TOTAL} ipv4_in_kernel=${APPLIED_V4} from ${CP_HIT:-$EVOBGP_CP_URL} backend=$BACKEND hash=${HASH:-empty}"
+fi
+
+echo "$HASH" >"$HASH_FILE"
+send_client_reports

internal/firewallscripts/install.sh

@@ -0,0 +1,129 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [[ "${EUID:-$(id -u)}" -ne 0 ]]; then
+  echo "evobgp-firewall install: run as root" >&2
+  exit 1
+fi
+
+for cmd in curl bash; do
+  command -v "$cmd" >/dev/null 2>&1 || { echo "missing $cmd" >&2; exit 1; }
+done
+
+if ! command -v jq >/dev/null 2>&1 && ! command -v python3 >/dev/null 2>&1; then
+  if command -v apt-get >/dev/null 2>&1; then
+    apt-get update -qq && apt-get install -y -qq jq
+  fi
+fi
+if ! command -v jq >/dev/null 2>&1 && ! command -v python3 >/dev/null 2>&1; then
+  echo "evobgp-firewall install: install jq or python3 for blocklist JSON parsing" >&2
+  exit 1
+fi
+
+: "${EVOBGP_CP_URL:?EVOBGP_CP_URL required}"
+: "${EVOBGP_SEED:?EVOBGP_SEED required}"
+: "${EVOBGP_CLIENT_NAME:?EVOBGP_CLIENT_NAME required}"
+
+CONF_DIR=/etc/evobgp
+CONF_FILE="${CONF_DIR}/firewall.conf"
+SYNC_SCRIPT=/usr/local/sbin/evobgp-firewall.sh
+
+if [[ -f "$CONF_FILE" && "${EVOBGP_INSTALL_FORCE:-}" != "1" ]]; then
+  echo "Already installed ($CONF_FILE). Set EVOBGP_INSTALL_FORCE=1 to reinstall." >&2
+  exit 1
+fi
+
+gen_token() {
+  if command -v openssl >/dev/null 2>&1; then
+    echo -n "evobgp_fw_$(openssl rand -base64 32 | tr '+/' '-_' | tr -d '=')"
+  else
+    echo -n "evobgp_fw_$(head -c 32 /dev/urandom | base64 | tr '+/' '-_' | tr -d '=\n')"
+  fi
+}
+
+CLIENT_TOKEN="$(gen_token)"
+HOSTNAME="$(hostname -f 2>/dev/null || hostname)"
+CP_URL="${EVOBGP_CP_URL%/}"
+
+ENROLL_BODY=$(printf '{"name":"%s","hostname":"%s","client_token":"%s","client_version":"install.sh/1"}' \
+  "$EVOBGP_CLIENT_NAME" "$HOSTNAME" "$CLIENT_TOKEN")
+
+ENROLL_TMP=$(mktemp)
+trap 'rm -f "$ENROLL_TMP"' EXIT
+ENROLL_CODE=$(curl -sS -o "$ENROLL_TMP" -w "%{http_code}" -X POST "${CP_URL}/v1/firewall/enroll" \
+  -H "Content-Type: application/json" \
+  -H "X-EvoBGP-Seed: ${EVOBGP_SEED}" \
+  -d "$ENROLL_BODY")
+if [[ "$ENROLL_CODE" != "201" ]]; then
+  echo "evobgp-firewall enroll failed: HTTP ${ENROLL_CODE} from ${CP_URL}/v1/firewall/enroll" >&2
+  cat "$ENROLL_TMP" >&2
+  exit 1
+fi
+RESP=$(cat "$ENROLL_TMP")
+
+CLIENT_ID=""
+if command -v jq >/dev/null 2>&1; then
+  CLIENT_ID=$(echo "$RESP" | jq -r '.client_id')
+else
+  CLIENT_ID=$(echo "$RESP" | sed -n 's/.*"client_id"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p')
+fi
+
+mkdir -p "$CONF_DIR"
+chmod 700 "$CONF_DIR"
+cat >"$CONF_FILE" <<EOF
+EVOBGP_CP_URL=${CP_URL}
+CLIENT_ID=${CLIENT_ID}
+CLIENT_TOKEN=${CLIENT_TOKEN}
+CLIENT_NAME=${EVOBGP_CLIENT_NAME}
+KERNEL_BACKEND=auto
+EOF
+chmod 600 "$CONF_FILE"
+
+curl -fsSL "${CP_URL}/v1/firewall/sync-script" -o "$SYNC_SCRIPT"
+chmod 755 "$SYNC_SCRIPT"
+
+if command -v nft >/dev/null 2>&1; then
+  BACKEND=nft
+elif command -v ipset >/dev/null 2>&1 && command -v iptables >/dev/null 2>&1; then
+  BACKEND=ipset
+elif command -v iptables >/dev/null 2>&1; then
+  BACKEND=iptables
+else
+  echo "no supported firewall backend (nft/ipset/iptables)" >&2
+  exit 1
+fi
+sed -i "s/^KERNEL_BACKEND=.*/KERNEL_BACKEND=${BACKEND}/" "$CONF_FILE" 2>/dev/null || \
+  echo "KERNEL_BACKEND=${BACKEND}" >>"$CONF_FILE"
+
+INTERVAL="${EVOBGP_SYNC_INTERVAL:-5min}"
+if command -v systemctl >/dev/null 2>&1; then
+  cat >/etc/systemd/system/evobgp-firewall.service <<'UNIT'
+[Unit]
+Description=EvoBGP firewall blocklist sync
+After=network-online.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/sbin/evobgp-firewall.sh
+UNIT
+  cat >/etc/systemd/system/evobgp-firewall.timer <<UNIT
+[Unit]
+Description=EvoBGP firewall sync timer
+
+[Timer]
+OnBootSec=2min
+OnUnitActiveSec=${INTERVAL}
+Unit=evobgp-firewall.service
+
+[Install]
+WantedBy=timers.target
+UNIT
+  systemctl daemon-reload
+  systemctl enable --now evobgp-firewall.timer
+  echo "Tip: after UI approve, run: rm -f /var/lib/evobgp-firewall/last_hash && ${SYNC_SCRIPT}"
+else
+  echo "*/5 * * * * root ${SYNC_SCRIPT}" >/etc/cron.d/evobgp-firewall
+fi
+
+echo "Client ID: ${CLIENT_ID}"
+echo "Status: pending — approve in EvoBGP UI → Firewall → Запросы"

internal/firewallscripts/sync_test.go

@@ -0,0 +1,34 @@
+package firewallscripts
+
+import (
+	"bytes"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestScriptsMatchRepoSource(t *testing.T) {
+	root := filepath.Join("..", "..", "scripts", "firewall")
+	for _, name := range []string{"install.sh", "evobgp-firewall.sh", "uninstall.sh"} {
+		embedded, err := FS.ReadFile(name)
+		if err != nil {
+			t.Fatalf("embedded %s: %v", name, err)
+		}
+		source, err := os.ReadFile(filepath.Join(root, name))
+		if err != nil {
+			t.Skipf("source %s not found (cwd=%s): %v", name, mustWd(t), err)
+		}
+		if !bytes.Equal(embedded, source) {
+			t.Fatalf("%s drift: copy scripts/firewall/%s to internal/firewallscripts/", name, name)
+		}
+	}
+}
+
+func mustWd(t *testing.T) string {
+	t.Helper()
+	wd, err := os.Getwd()
+	if err != nil {
+		t.Fatal(err)
+	}
+	return wd
+}

internal/firewallscripts/uninstall.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+systemctl disable --now evobgp-firewall.timer 2>/dev/null || true
+rm -f /etc/cron.d/evobgp-firewall
+rm -f /etc/systemd/system/evobgp-firewall.service /etc/systemd/system/evobgp-firewall.timer
+systemctl daemon-reload 2>/dev/null || true
+
+nft delete table inet evobgp_blocklist 2>/dev/null || true
+ipset destroy evobgp_blocklist_v4 2>/dev/null || true
+iptables -D INPUT -m set --match-set evobgp_blocklist_v4 src -j DROP 2>/dev/null || true
+
+rm -f /usr/local/sbin/evobgp-firewall.sh /usr/local/sbin/evobgp-firewall-uninstall.sh
+rm -rf /var/lib/evobgp-firewall
+if [[ "${EVOBGP_UNINSTALL_REMOVE_CONF:-}" == "1" ]]; then
+  rm -f /etc/evobgp/firewall.conf
+fi
+
+echo "evobgp-firewall uninstalled"

internal/httpapi/auth.go

@@ -4,6 +4,8 @@ import (
 	"context"
 	"net/http"
 	"strings"
+
+	"evobgp/internal/authkey"
 )
 
 type ctxKey int
@@ -63,27 +65,51 @@ func (s *Server) authMiddleware(next http.Handler) http.Handler {
 			return
 		}
 		raw := strings.TrimSpace(strings.TrimPrefix(h, p))
-		if raw == "dev" {
-			if a, ok := s.devAuth(); ok {
-				r = r.WithContext(context.WithValue(r.Context(), authCtxKey, a))
-				next.ServeHTTP(w, r)
-				return
-			}
-		}
-		matched, ok := s.keyResolver.Lookup(raw)
+		a, ok := s.resolveAuth(raw)
 		if !ok {
 			writeProblem(w, http.StatusUnauthorized, "Unauthorized", "unknown api key")
 			return
 		}
-		a := Auth{TenantID: matched.tenantID, Role: matched.role, Token: raw, APIKeyID: matched.keyID}
-		if matched.keyID != "" {
-			go func(id string) { _ = s.store.TouchAPIKeyLastUsed(id) }(matched.keyID)
+		if a.APIKeyID != "" {
+			go func(id string) { _ = s.store.TouchAPIKeyLastUsed(id) }(a.APIKeyID)
 		}
 		r = r.WithContext(context.WithValue(r.Context(), authCtxKey, a))
 		next.ServeHTTP(w, r)
 	})
 }
 
+func authFromKeyRecord(raw string, rec apiKeyRecord) Auth {
+	return Auth{TenantID: rec.tenantID, Role: rec.role, Token: raw, APIKeyID: rec.keyID}
+}
+
+// resolveAuth maps a bearer token to tenant identity.
+// For the literal token "dev", the demo shortcut (devAuth) takes precedence when demo-seed
+// is available; env/DB mapping is used only when demo tenant is absent.
+func (s *Server) resolveAuth(raw string) (Auth, bool) {
+	if raw == "dev" {
+		if a, ok := s.devAuth(); ok {
+			return a, true
+		}
+		if rec, ok := s.keyResolver.Lookup(raw); ok {
+			return authFromKeyRecord(raw, rec), true
+		}
+		return Auth{}, false
+	}
+	rec, ok := s.keyResolver.Lookup(raw)
+	if !ok {
+		if s.firewallResolver != nil {
+			if fw, ok := s.firewallResolver.Lookup(raw); ok {
+				return Auth{TenantID: fw.tenantID, Role: "firewall", Token: raw, APIKeyID: fw.clientID}, true
+			}
+		}
+		if client, err := s.store.LookupFirewallClientByTokenHash(authkey.HashToken(raw)); err == nil {
+			return Auth{TenantID: client.TenantID, Role: "firewall", Token: raw, APIKeyID: client.ID}, true
+		}
+		return Auth{}, false
+	}
+	return authFromKeyRecord(raw, rec), true
+}
+
 func (s *Server) devAuth() (Auth, bool) {
 	tid, _, _, _, _ := s.store.DemoIDs()
 	if tid == "" {
@@ -118,6 +144,14 @@ func (s *Server) requireAtLeast(w http.ResponseWriter, a Auth, need string) bool
 	return true
 }
 
+func (s *Server) requireFirewall(w http.ResponseWriter, a Auth) bool {
+	if strings.ToLower(a.Role) != "firewall" {
+		writeProblem(w, http.StatusForbidden, "Forbidden", "firewall client role required")
+		return false
+	}
+	return true
+}
+
 func (s *Server) requireNode(w http.ResponseWriter, a Auth) bool {
 	if strings.ToLower(a.Role) != "node" {
 		writeProblem(w, http.StatusForbidden, "Forbidden", "node role required")

internal/httpapi/auth_dev_settings_test.go

@@ -0,0 +1,101 @@
+package httpapi
+
+import (
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+func TestBearerDevGetSettings(t *testing.T) {
+	srv, err := New(Options{SeedDemo: true, BundleSeedHex: testBundleSeed})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer srv.Close()
+
+	ts := httptest.NewServer(srv.Handler())
+	defer ts.Close()
+
+	req, _ := http.NewRequest(http.MethodGet, ts.URL+"/v1/settings", nil)
+	req.Header.Set("Authorization", "Bearer dev")
+	resp, err := ts.Client().Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+	if resp.StatusCode != http.StatusOK {
+		b, _ := io.ReadAll(resp.Body)
+		t.Fatalf("status=%d body=%s", resp.StatusCode, b)
+	}
+}
+
+func TestBearerDevPrefersDemoTenantOverEnvKey(t *testing.T) {
+	srv, err := New(Options{SeedDemo: true, BundleSeedHex: testBundleSeed})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer srv.Close()
+
+	demoTenant, _, _, _, _ := srv.Store().DemoIDs()
+	otherTenant := "00000000-0000-4000-8000-000000000001"
+	mustSetTestAPIKeys(t, srv, "dev|"+otherTenant+"|operator")
+
+	ts := httptest.NewServer(srv.Handler())
+	defer ts.Close()
+
+	req, _ := http.NewRequest(http.MethodGet, ts.URL+"/v1/auth/session", nil)
+	req.Header.Set("Authorization", "Bearer dev")
+	resp, err := ts.Client().Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+	if resp.StatusCode != http.StatusOK {
+		b, _ := io.ReadAll(resp.Body)
+		t.Fatalf("session status=%d body=%s", resp.StatusCode, b)
+	}
+	var body map[string]any
+	if err := json.NewDecoder(resp.Body).Decode(&body); err != nil {
+		t.Fatal(err)
+	}
+	got, _ := body["tenant_id"].(string)
+	if got != demoTenant {
+		t.Fatalf("tenant_id=%q want demo tenant %q (env=%q)", got, demoTenant, otherTenant)
+	}
+}
+
+func TestBearerDevFallsBackToEnvKeyWithoutDemo(t *testing.T) {
+	srv, err := New(Options{SeedDemo: false, BundleSeedHex: testBundleSeed})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer srv.Close()
+
+	otherTenant := "00000000-0000-4000-8000-000000000001"
+	mustSetTestAPIKeys(t, srv, "dev|"+otherTenant+"|operator")
+
+	ts := httptest.NewServer(srv.Handler())
+	defer ts.Close()
+
+	req, _ := http.NewRequest(http.MethodGet, ts.URL+"/v1/auth/session", nil)
+	req.Header.Set("Authorization", "Bearer dev")
+	resp, err := ts.Client().Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+	if resp.StatusCode != http.StatusOK {
+		b, _ := io.ReadAll(resp.Body)
+		t.Fatalf("session status=%d body=%s", resp.StatusCode, b)
+	}
+	var body map[string]any
+	if err := json.NewDecoder(resp.Body).Decode(&body); err != nil {
+		t.Fatal(err)
+	}
+	got, _ := body["tenant_id"].(string)
+	if got != otherTenant {
+		t.Fatalf("tenant_id=%q want env key tenant %q", got, otherTenant)
+	}
+}