feat(docker): enable relative path support for Docker bake configurations

- Added `BUILDX_BAKE_FILE_RELATIVE_PATHS` environment variable to CI workflows to support relative paths in Docker bake commands. - Updated `docker-bake.hcl` comments to clarify context resolution from the current working directory. - Revised README documentation to reflect changes in context resolution and usage of the new environment variable.
fix(docker): update base image references to Docker Hub
2026-08-18 18:45:51 +07:00 · 2026-08-18 18:30:22 +07:00 · 2026-08-18 18:22:26 +07:00 · 2026-08-18 18:13:44 +07:00 · 2026-08-18 17:48:41 +07:00 · 2026-08-18 17:00:15 +07:00
65 changed files with 2473 additions and 720 deletions
@@ -28,7 +28,7 @@ alwaysApply: true
 | Библиотека | Context7 ID | Версия в проекте | Когда |
 |------------|-------------|------------------|-------|
 | OpenAPI | `/oai/openapi-specification` | 3.x в `docs/openapi.yaml` | схемы, operationId, problem+json |
-| Redocly CLI | `/redocly/redocly-cli` | CI `@redocly/cli` | lint OpenAPI, `npx @redocly/cli lint` |
+| Redocly CLI | `/redocly/redocly-cli` | CI `@redocly/cli` | lint OpenAPI, `pnpm exec redocly lint` |

 ---

@@ -86,7 +86,7 @@ alwaysApply: true
 ## Dependency Management

 **DEP-01** | MUST | Go-зависимости — через `go get` / `go.mod`; версия Go как в `go.mod` и CI (1.24).
-*Проверка:* `go.mod`, `.gitea/workflows/ci.yaml`.
+*Проверка:* `go.mod`, `.gitea/workflows/quality.yaml`.

 **DEP-02** | NEVER | Vendor-копирование без явного решения в репозитории.
 *Проверка:* review.
@@ -123,10 +123,10 @@ alwaysApply: true
 **TEST-03** | MUST | Новые BIRD-сценарии в `internal/birdfmt/testdata/scenarios/*/bird.conf` + `bird -p`.
 *Проверка:* CI job `bird2`.

-**TEST-04** | MUST | Изменения `apps/web/**` или `packages/ui/**` — локально **`pnpm --filter @evobgp/web run typecheck`, `lint`, `build`** (все три команды, exit 0); CI job `web` в `.gitea/workflows/ci.yaml`.
+**TEST-04** | MUST | Изменения `apps/web/**` или `packages/ui/**` — локально **`pnpm --filter @evobgp/web run typecheck`, `lint`, `build`** (все три команды, exit 0); CI job `web` в `.gitea/workflows/quality.yaml`.
 *Проверка:* CI job `web`; `.cursor/rules/web-shadcn.mdc` WEB-19.

-**TEST-05** | MUST | Изменения OpenAPI — `npx @redocly/cli lint docs/openapi.yaml`.
+**TEST-05** | MUST | Изменения OpenAPI — `pnpm exec redocly lint docs/openapi.yaml`.
 *Проверка:* CI job `openapi`.

 ---
@@ -229,7 +229,7 @@ alwaysApply: true
 ```powershell
 go vet ./...
 go test ./... -race -count=1
-npx @redocly/cli lint docs/openapi.yaml
+pnpm exec redocly lint docs/openapi.yaml
 # web: pnpm --filter @evobgp/web run typecheck; pnpm --filter @evobgp/web run lint; pnpm --filter @evobgp/web run build
 # go fmt/lint: gofmt -w <files>; scripts/lint-go.ps1 (gofmt + vet + golangci-lint)
 # birdfmt: go test ./internal/birdfmt/... -count=1
@@ -0,0 +1,49 @@
+# Build context = repository root (deploy/docker/docker-bake.hcl).
+.git
+.gitea
+.github
+.cursor
+.claude
+.codegraph
+.agents
+memory-bank
+.vscode
+.idea
+
+**/.DS_Store
+**/Thumbs.db
+**/.env
+**/.env.*
+!**/.env.example
+!**/.env.*.example
+
+node_modules
+**/node_modules
+**/dist
+apps/web/src/routeTree.gen.ts
+apps/web/playwright-report
+apps/web/test-results
+
+*.md
+AGENTS.md
+CONTRIBUTING.md
+LICENSE
+docs
+
+.pre-commit-config.yaml
+.golangci.yml
+.releaserc.json
+.commitlintrc.*
+redocly.yaml
+package-lock.json
+
+data
+*.exe
+*.test
+coverage
+.coverage
+*.out
+.release-version
+CHANGELOG.md
+deploy/docker/docker-bake.override.hcl
+deploy/compose/runtime-logs
@@ -1,38 +1,39 @@
 # Gitea Actions

-Workflow: [workflows/ci.yaml](workflows/ci.yaml).
-
-| Job | PR | push в main |
-|-----|-----|-------------|
-| changes, openapi, web, go, bird2 | quality gates | quality gates |
-| commitlint | да | — |
-| **release** | — | semantic-release + docker push (один run) |
+| Workflow | Когда | Что |
+|----------|--------|-----|
+| [workflows/ci.yaml](workflows/ci.yaml) | pull request в main/master | quality gates + commitlint |
+| [workflows/cd.yaml](workflows/cd.yaml) | push в main/master | quality gates + semantic-release + docker push |
+| [workflows/quality.yaml](workflows/quality.yaml) | reusable (`workflow_call`) | changes, openapi, web, go, bird2, commitlint, docker-check |

 Подробнее: [docs/releasing.md](../docs/releasing.md).

 ## CI (quality gates)

-Job **changes** вычисляет флаги по путям в diff. Полный прогон (все узлы openapi / web / go / bird2 в графе): `.gitea/workflows/*`, `scripts/*`, `.golangci.yml`, `.pre-commit-config.yaml`, корневой `package.json` / `.releaserc.json`. Отдельно: `migrations/*`, `docs/openapi.yaml` → `go` / `openapi` и т.д. (см. `ci.yaml`).
+Job **changes** вычисляет флаги по путям в diff. Полный прогон: `.gitea/workflows/*`, `scripts/*`, `.golangci.yml`, `.pre-commit-config.yaml`, корневой `package.json` / `.releaserc.json`. Правки `.cursor/`, `.claude/`, `*.md` (кроме `docs/api.md` / `docs/access.md` / `docs/openapi.yaml`) quality jobs не запускают.

-На **pull request** — **commitlint** (Conventional Commits).
+На **pull request** — **commitlint**. При изменении `deploy/docker/**` — job **docker-check** (`bake --print`, bake без `--push` если есть доступ к registry).

-Runner: `ubuntu-latest`, **bird2** из apt, Docker для job **release**.
+Кэш зависимостей: `actions/cache` с ключом `sha256sum` lockfile (`go.sum` / `pnpm-lock.yaml`). `hashFiles` в Gitea не используем.

-## Release (job в ci.yaml)
+Runner: `ubuntu-latest`, **bird2** из apt, Docker для **docker-check** (PR) и **publish** (CD).

-После успешных quality gates на **push в main** job **release**:
+## CD (job publish)

-1. `npx semantic-release` — тег `vX.Y.Z` на **текущий commit** (без дополнительного commit в main).
+После успешных quality gates на **push в main** job **publish**:
+
+1. `pnpm exec semantic-release` — тег `vX.Y.Z` на **текущий commit** (без дополнительного commit в main).
 2. Gitea Release + `CHANGELOG.md` как attachment (не в git).
-3. `docker buildx bake default --push` с `VERSION=X.Y.Z` — в том же job.
+3. Зеркало base-образов в `evobgp-buildcache:base-*` (`deploy/docker/mirror-base-images.sh`; skip существующих тегов, `linux/amd64`, retry при 429).
+4. `docker buildx bake default --push` с `VERSION=X.Y.Z`, `pull=false`, named builder `evobgp` (`cleanup: false`).

 Если releasable-коммитов нет — semantic-release no-op, образы не публикуются.

-Повтор упавшего **release** (тег уже есть, bake нет): detect берёт `v*` на `HEAD` и всё равно пушит образы. Подробнее: [docs/releasing.md](../docs/releasing.md#перезапуск-упавшего-job-release).
+Повтор упавшего **publish** (тег уже есть, bake нет): detect берёт `v*` на `HEAD` и всё равно пушит образы. Подробнее: [docs/releasing.md](../docs/releasing.md#перезапуск-упавшего-job-publish).

 ### Секреты

-**`ACTIONS_PAT`**: push tags, releases, Container Registry. Fallback: **`gitea.token`**.
+**`ACTIONS_PAT`**: push tags, releases, Container Registry. Для git tag fallback: `github.token`. Push OCI — **только PAT** (у `GITEA_TOKEN` нет права packages).

 ### Теги образов

@@ -46,6 +47,8 @@ git.shx.one/<owner>/<имя>:sha-<full-sha>

 Имена образов: `evobgp-api`, `evobgp-all`, `evobgp-scheduler`, `evobgp-ingest`, `evobgp-render`, `evobgp-deploy`, `evobgp-node`, `evobgp-web`, `evobgp-web-all`, `evobgp-agent`, `evobgp-bird2`.

+Кэш сборки: `evobgp-buildcache:{go,web,birdc}-buildcache` и `evobgp-buildcache:base-*`.
+
 **Удалённый спикер** (compose `deploy/compose/docker-compose.remote-speaker.yaml`): `evobgp-bird2`, `evobgp-agent`, `evobgp-node` (fallback profile); Traefik — внешний `traefik:latest`. CI: `scripts/validate-remote-speaker-compose.sh`.

 Пример:
@@ -0,0 +1,140 @@
+name: CD
+
+on:
+  push:
+    branches: [main, master]
+
+permissions:
+  contents: read
+
+jobs:
+  quality:
+    uses: ./.gitea/workflows/quality.yaml
+    with:
+      is_pull_request: false
+      before_sha: ${{ github.event.before }}
+      head_sha: ${{ github.sha }}
+      allow_registry_login: false
+    secrets:
+      ACTIONS_PAT: ${{ secrets.ACTIONS_PAT }}
+
+  publish:
+    needs: [quality]
+    if: >-
+      always() &&
+      (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master') &&
+      needs.quality.result == 'success'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      packages: write
+      releases: write
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0
+          fetch-tags: true
+          token: ${{ secrets.ACTIONS_PAT || gitea.token }}
+          persist-credentials: true
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: "22"
+      - name: Enable pnpm via corepack
+        run: corepack enable
+      - id: pnpm-hash
+        run: echo "key=$(sha256sum pnpm-lock.yaml | awk '{print $1}')" >> "$GITHUB_OUTPUT"
+      - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+        with:
+          path: ~/.local/share/pnpm/store
+          key: pnpm-${{ runner.os }}-${{ steps.pnpm-hash.outputs.key }}
+          restore-keys: |
+            pnpm-${{ runner.os }}-
+      - name: Install release tooling
+        run: pnpm install --frozen-lockfile
+      - name: Verify releasable commit messages
+        run: pnpm exec node scripts/commit/verify-release-commits.mjs
+      - name: Semantic release
+        run: pnpm exec semantic-release
+        env:
+          GITEA_URL: https://git.shx.one
+          GITEA_TOKEN: ${{ secrets.ACTIONS_PAT || gitea.token }}
+      - name: Detect new release
+        id: rel
+        run: |
+          set -euo pipefail
+          version=""
+          if [ -f .release-version ]; then
+            version="$(tr -d '[:space:]' < .release-version)"
+            echo "New release from semantic-release: $version"
+          else
+            git fetch --tags --force origin || true
+            tag="$(git tag --points-at HEAD --list 'v*.*.*' | sort -V | tail -n1 || true)"
+            if [ -n "${tag:-}" ]; then
+              version="${tag#v}"
+              echo "Reuse existing tag $tag on HEAD (release retry)"
+            fi
+          fi
+          if [ -n "${version:-}" ]; then
+            echo "version=$version" >> "$GITHUB_OUTPUT"
+            echo "released=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "released=false" >> "$GITHUB_OUTPUT"
+            echo "No releasable commits — skipping image publish"
+          fi
+      - name: Set up Docker Buildx
+        if: steps.rel.outputs.released == 'true'
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
+        with:
+          name: evobgp
+          driver: docker-container
+          cleanup: false
+      - name: Prepare image metadata
+        if: steps.rel.outputs.released == 'true'
+        id: meta
+        run: |
+          set -euo pipefail
+          echo "version=${{ steps.rel.outputs.version }}" >> "$GITHUB_OUTPUT"
+          owner_lc="$(echo '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')"
+          echo "owner_lc=$owner_lc" >> "$GITHUB_OUTPUT"
+          short_sha="$(echo '${{ github.sha }}' | cut -c1-7)"
+          echo "short_sha=$short_sha" >> "$GITHUB_OUTPUT"
+          echo "build_time=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"
+      - name: Log in to Gitea Registry
+        if: steps.rel.outputs.released == 'true'
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
+        with:
+          registry: git.shx.one
+          username: ${{ gitea.actor }}
+          password: ${{ secrets.ACTIONS_PAT }}
+      - name: Mirror base images into buildcache
+        if: steps.rel.outputs.released == 'true'
+        env:
+          REGISTRY: git.shx.one/${{ steps.meta.outputs.owner_lc }}
+          MIRROR_ENV_FILE: ${{ runner.temp }}/mirror-base.env
+        run: sh deploy/docker/mirror-base-images.sh
+      - name: Build and push images (bake)
+        if: steps.rel.outputs.released == 'true'
+        env:
+          REGISTRY: git.shx.one/${{ steps.meta.outputs.owner_lc }}
+          IMAGE_TAG: latest
+          VERSION: ${{ steps.meta.outputs.version }}
+          SHORT_SHA: ${{ steps.meta.outputs.short_sha }}
+          SHA_FULL: ${{ github.sha }}
+          BUILD_TIME: ${{ steps.meta.outputs.build_time }}
+          CACHE_REF_GO: git.shx.one/${{ steps.meta.outputs.owner_lc }}/evobgp-buildcache:go-buildcache
+          CACHE_REF_WEB: git.shx.one/${{ steps.meta.outputs.owner_lc }}/evobgp-buildcache:web-buildcache
+          CACHE_REF_BIRDC: git.shx.one/${{ steps.meta.outputs.owner_lc }}/evobgp-buildcache:birdc-buildcache
+          BUILDX_BAKE_ENTITLEMENTS_FS: "0"
+          BUILDX_BAKE_FILE_RELATIVE_PATHS: "1"
+          MIRROR_ENV_FILE: ${{ runner.temp }}/mirror-base.env
+        working-directory: deploy/docker
+        run: |
+          set -euxo pipefail
+          if [ -f "${MIRROR_ENV_FILE}" ]; then
+            set -a
+            # shellcheck disable=SC1090
+            . "${MIRROR_ENV_FILE}"
+            set +a
+          fi
+          docker buildx bake --allow=fs.read="${{ github.workspace }}" \
+            -f docker-bake.hcl default --push
@@ -1,387 +1,23 @@
 name: CI

 on:
-  push:
-    branches: [main, master]
  pull_request:
    branches: [main, master]

+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
 jobs:
-  # ---------------------------------------------------------------------------
-  # Детекция изменений по модулям (флаги → downstream-джобы в графе CI).
-  # Полный прогон (все флаги true): .gitea/workflows/*, scripts/*, .golangci.yml,
-  # .pre-commit-config.yaml — чтобы при правках CI/CD пересобирались все узлы.
-  # ---------------------------------------------------------------------------
-  changes:
-    runs-on: ubuntu-latest
-    outputs:
-      openapi:     ${{ steps.detect.outputs.openapi }}
-      go:          ${{ steps.detect.outputs.go }}
-      web:         ${{ steps.detect.outputs.web }}
-      bird_conf:   ${{ steps.detect.outputs.bird_conf }}
-      docker_go:   ${{ steps.detect.outputs.docker_go }}
-      docker_web:  ${{ steps.detect.outputs.docker_web }}
-      docker_bird: ${{ steps.detect.outputs.docker_bird }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-      - id: detect
-        name: Detect changed paths per module
-        run: |
-          set -euo pipefail
-
-          openapi=false
-          go=false
-          web=false
-          bird_conf=false
-          docker_go=false
-          docker_web=false
-          docker_bird=false
-
-          # Все флаги true → openapi, web, go, bird2 (и release на main) в графе CI.
-          set_all_flags_true() {
-            openapi=true
-            go=true
-            web=true
-            bird_conf=true
-            docker_go=true
-            docker_web=true
-            docker_bird=true
-          }
-
-          write_outputs() {
-            for v in openapi go web bird_conf docker_go docker_web docker_bird; do
-              eval "echo \"\$v=\$$v\"" >> "$GITHUB_OUTPUT"
-            done
-          }
-
-          if [ "${{ github.event_name }}" = "pull_request" ]; then
-            base="${{ github.event.pull_request.base.sha }}"
-            head="${{ github.event.pull_request.head.sha }}"
-            FILES="$(git diff --name-only "$base" "$head")"
-          else
-            before="${{ github.event.before }}"
-            after="${{ github.sha }}"
-            if [ -n "$before" ] && [ "$before" != "0000000000000000000000000000000000000000" ]; then
-              FILES="$(git diff --name-only "$before" "$after")"
-            elif git rev-parse --verify HEAD~1 >/dev/null 2>&1; then
-              FILES="$(git diff --name-only HEAD~1 HEAD)"
-            else
-              set_all_flags_true
-              write_outputs
-              echo "No parent commit — full pipeline (all modules)"
-              exit 0
-            fi
-          fi
-
-          if [ -z "$(printf '%s' "$FILES" | tr -d '[:space:]')" ]; then
-            set_all_flags_true
-            write_outputs
-            echo "Empty diff — full pipeline fallback"
-            exit 0
-          fi
-
-          full_pipeline=false
-
-          while IFS= read -r f || [ -n "${f:-}" ]; do
-            [ -z "${f:-}" ] && continue
-            case "$f" in
-              # CI/CD инфраструктура — все узлы quality gates
-              .gitea/workflows/*|.golangci.yml|.pre-commit-config.yaml|scripts/*)
-                full_pipeline=true
-                ;;
-              docs/openapi.yaml|redocly.yaml)
-                openapi=true
-                ;;
-              docs/api.md|docs/access.md)
-                openapi=true
-                go=true
-                ;;
-              apps/web/README.md|apps/web/components.json|packages/ui/components.json)
-                ;;
-              apps/web/*|packages/ui/*|packages/shared/*)
-                web=true
-                ;;
-              deploy/bird/*)
-                bird_conf=true
-                go=true
-                ;;
-              deploy/compose/*|deploy/docker/*)
-                docker_go=true
-                docker_web=true
-                docker_bird=true
-                go=true
-                ;;
-              go.mod|go.sum|go.work)
-                go=true
-                ;;
-              migrations/*)
-                go=true
-                ;;
-              cmd/*|internal/*|*.go)
-                go=true
-                bird_conf=true
-                ;;
-              docs/*)
-                go=true
-                ;;
-              package.json|package-lock.json|pnpm-lock.yaml|pnpm-workspace.yaml|.releaserc.json)
-                full_pipeline=true
-                ;;
-              *)
-                go=true
-                ;;
-            esac
-          done <<< "$FILES"
-
-          if $full_pipeline; then
-            set_all_flags_true
-          fi
-
-          write_outputs
-
-          echo "Changed files (first 30):"
-          printf '%s\n' "$FILES" | head -n 30
-          echo "--- flags ---"
-          echo "openapi=$openapi go=$go web=$web bird_conf=$bird_conf"
-          echo "docker_go=$docker_go docker_web=$docker_web docker_bird=$docker_bird full_pipeline=$full_pipeline"
-
-  # ---------------------------------------------------------------------------
-  openapi:
-    needs: [changes]
-    if: needs.changes.outputs.openapi == 'true' || needs.changes.outputs.web == 'true'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "22"
-      - name: Enable pnpm via corepack
-        run: corepack enable
-      - name: Lint OpenAPI (Redocly)
-        run: npx --yes @redocly/cli@1 lint docs/openapi.yaml
-      - name: Check OpenAPI→TS codegen is fresh
-        run: |
-          set -euxo pipefail
-          pnpm install --frozen-lockfile
-          chmod +x scripts/check-openapi-gen.sh
-          sh scripts/check-openapi-gen.sh
-
-  # ---------------------------------------------------------------------------
-  web:
-    needs: [changes]
-    if: needs.changes.outputs.web == 'true'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "22"
-      - name: Enable pnpm via corepack
-        run: corepack enable
-      - name: pnpm install, typecheck, lint, test, build
-        run: |
-          set -euxo pipefail
-          pnpm install --frozen-lockfile
-          pnpm --filter @evobgp/web run typecheck
-          pnpm --filter @evobgp/web run lint
-          pnpm --filter @evobgp/web run test
-          pnpm --filter @evobgp/web run build
-
-  # ---------------------------------------------------------------------------
-  go:
-    needs: [changes]
-    if: needs.changes.outputs.go == 'true'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
-        with:
-          go-version: "1.24"
-          cache: true
-          cache-dependency-path: go.sum
-      - name: Vet
-        run: go vet ./...
-      - name: Lint httpapi (ERR-01 / ARCH-01)
-        run: sh scripts/lint-httpapi.sh
-      - name: Check migration pairs (DEP-03)
-        run: sh scripts/check-migrations-pair.sh
-      - name: Validate remote speaker compose
-        run: sh scripts/validate-remote-speaker-compose.sh
-      # go.mod: go 1.24 — бинарник golangci-lint < v1.64.2 (сборка на Go 1.23) не запускается.
-      - name: golangci-lint
-        uses: golangci/golangci-lint-action@v6
-        with:
-          version: v1.64.8
-          install-mode: goinstall
-      - name: Test
-        run: go test ./... -race -count=1
-      - name: Build all commands
-        run: |
-          set -euxo pipefail
-          out="${RUNNER_TEMP}/evobgp-bin"
-          mkdir -p "$out"
-          for d in cmd/*/; do
-            name="$(basename "$d")"
-            go build -o "$out/$name" "./$d"
-          done
-
-  # ---------------------------------------------------------------------------
-  bird2:
-    runs-on: ubuntu-latest
-    needs: [changes, go]
-    if: >-
-      always() &&
-      needs.changes.result == 'success' &&
-      needs.go.result != 'failure' &&
-      (needs.changes.outputs.go == 'true' ||
-       needs.changes.outputs.bird_conf == 'true' ||
-       needs.changes.outputs.docker_bird == 'true' ||
-       needs.changes.outputs.docker_go == 'true')
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install bird2 (репозиторий Ubuntu runner, как в образе evobgp-bird2)
-        run: |
-          set -euxo pipefail
-          if command -v sudo >/dev/null 2>&1; then SUDO=sudo; else SUDO=""; fi
-          $SUDO apt-get update -qq
-          DEBIAN_FRONTEND=noninteractive $SUDO apt-get install -y -qq bird2
-          bird --version
-      - name: bird -p on all scenario bird.conf files
-        env:
-          WORKSPACE: ${{ github.workspace }}
-        run: |
-          set -euxo pipefail
-          WS="${WORKSPACE:-$PWD}"
-          cd "$WS"
-          if [ ! -f internal/birdfmt/testdata/scenarios/minimal/bird.conf ]; then
-            echo "Нет сценариев BIRD в checkout. Проверьте, что internal/birdfmt/testdata/scenarios закоммичен и push в remote."
-            ls -la internal/birdfmt/testdata/ 2>/dev/null || ls -la
-            exit 1
-          fi
-          for conf in internal/birdfmt/testdata/scenarios/*/bird.conf; do
-            echo "==> $conf"
-            bird -c "$WS/$conf" -p
-          done
-
-  # ---------------------------------------------------------------------------
-  commitlint:
-    if: github.event_name == 'pull_request'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "22"
-          cache: npm
-          cache-dependency-path: package-lock.json
-      - name: Lint commit messages
-        run: |
-          set -euxo pipefail
-          npm ci
-          npx commitlint --from "${{ github.event.pull_request.base.sha }}" --to "${{ github.event.pull_request.head.sha }}"
-
-  # ---------------------------------------------------------------------------
-  # Один push в main: semantic-release (тег на текущий commit, без доп. commit) + docker push.
-  # ---------------------------------------------------------------------------
-  release:
-    needs: [changes, openapi, web, go, bird2]
-    if: >-
-      always() &&
-      github.event_name == 'push' &&
-      (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master') &&
-      needs.changes.result == 'success' &&
-      (needs.openapi.result == 'success' || needs.openapi.result == 'skipped') &&
-      (needs.web.result == 'success' || needs.web.result == 'skipped') &&
-      (needs.go.result == 'success' || needs.go.result == 'skipped') &&
-      (needs.bird2.result == 'success' || needs.bird2.result == 'skipped')
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          fetch-tags: true
-          token: ${{ secrets.ACTIONS_PAT || gitea.token }}
-          persist-credentials: true
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "22"
-          cache: npm
-          cache-dependency-path: package-lock.json
-      - name: Install release tooling
-        run: npm ci
-      - name: Verify releasable commit messages
-        run: node scripts/commit/verify-release-commits.mjs
-      - name: Semantic release
-        run: npx semantic-release
-        env:
-          GITEA_URL: https://git.shx.one
-          GITEA_TOKEN: ${{ secrets.ACTIONS_PAT || gitea.token }}
-      - name: Detect new release
-        id: rel
-        run: |
-          set -euo pipefail
-          version=""
-          if [ -f .release-version ]; then
-            version="$(tr -d '[:space:]' < .release-version)"
-            echo "New release from semantic-release: $version"
-          else
-            # Re-run after a failed docker step: tag already exists, successCmd
-            # did not write .release-version (semantic-release is a no-op).
-            git fetch --tags --force origin || true
-            tag="$(git tag --points-at HEAD --list 'v*.*.*' | sort -V | tail -n1 || true)"
-            if [ -n "${tag:-}" ]; then
-              version="${tag#v}"
-              echo "Reuse existing tag $tag on HEAD (release retry)"
-            fi
-          fi
-          if [ -n "${version:-}" ]; then
-            echo "version=$version" >> "$GITHUB_OUTPUT"
-            echo "released=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "released=false" >> "$GITHUB_OUTPUT"
-            echo "No releasable commits — skipping image publish"
-          fi
-      - name: Set up Docker Buildx
-        if: steps.rel.outputs.released == 'true'
-        uses: docker/setup-buildx-action@v3
-      - name: Prepare image metadata
-        if: steps.rel.outputs.released == 'true'
-        id: meta
-        run: |
-          set -euo pipefail
-          echo "version=${{ steps.rel.outputs.version }}" >> "$GITHUB_OUTPUT"
-          owner_lc="$(echo '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')"
-          echo "owner_lc=$owner_lc" >> "$GITHUB_OUTPUT"
-          short_sha="$(echo '${{ github.sha }}' | cut -c1-7)"
-          echo "short_sha=$short_sha" >> "$GITHUB_OUTPUT"
-          echo "build_time=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"
-      - name: Log in to Gitea Registry
-        if: steps.rel.outputs.released == 'true'
-        uses: docker/login-action@v3
-        with:
-          registry: git.shx.one
-          username: ${{ gitea.actor }}
-          password: ${{ secrets.ACTIONS_PAT || gitea.token }}
-      - name: Build and push images (bake)
-        if: steps.rel.outputs.released == 'true'
-        env:
-          REGISTRY: git.shx.one/${{ steps.meta.outputs.owner_lc }}
-          IMAGE_TAG: latest
-          VERSION: ${{ steps.meta.outputs.version }}
-          SHORT_SHA: ${{ steps.meta.outputs.short_sha }}
-          SHA_FULL: ${{ github.sha }}
-          BUILD_TIME: ${{ steps.meta.outputs.build_time }}
-          CACHE_REF_GO: git.shx.one/${{ steps.meta.outputs.owner_lc }}/evobgp-buildcache:go-buildcache
-          CACHE_REF_WEB: git.shx.one/${{ steps.meta.outputs.owner_lc }}/evobgp-buildcache:web-buildcache
-          BUILDX_BAKE_ENTITLEMENTS_FS: "0"
-        run: |
-          set -euxo pipefail
-          cd "${{ github.workspace }}/deploy/docker"
-          sh write-bake-override.sh
-          docker buildx bake --allow=fs.read="${{ github.workspace }}" \
-            -f docker-bake.hcl -f docker-bake.override.hcl default --push
-
+  quality:
+    uses: ./.gitea/workflows/quality.yaml
+    with:
+      is_pull_request: true
+      base_sha: ${{ github.event.pull_request.base.sha }}
+      head_sha: ${{ github.event.pull_request.head.sha }}
+      allow_registry_login: ${{ github.event.pull_request.head.repo.full_name == github.repository }}
+    secrets:
+      ACTIONS_PAT: ${{ secrets.ACTIONS_PAT }}
@@ -0,0 +1,386 @@
+# Quality gates (reusable). Callers: ci.yaml (PR), cd.yaml (push main).
+name: quality
+
+on:
+  workflow_call:
+    inputs:
+      is_pull_request:
+        type: boolean
+        required: true
+      base_sha:
+        type: string
+        required: false
+        default: ""
+      head_sha:
+        type: string
+        required: false
+        default: ""
+      before_sha:
+        type: string
+        required: false
+        default: ""
+      allow_registry_login:
+        type: boolean
+        required: false
+        default: false
+    secrets:
+      ACTIONS_PAT:
+        required: false
+
+permissions:
+  contents: read
+
+jobs:
+  changes:
+    runs-on: ubuntu-latest
+    outputs:
+      openapi:     ${{ steps.detect.outputs.openapi }}
+      go:          ${{ steps.detect.outputs.go }}
+      web:         ${{ steps.detect.outputs.web }}
+      bird_conf:   ${{ steps.detect.outputs.bird_conf }}
+      docker_go:   ${{ steps.detect.outputs.docker_go }}
+      docker_web:  ${{ steps.detect.outputs.docker_web }}
+      docker_bird: ${{ steps.detect.outputs.docker_bird }}
+    steps:
+      - if: ${{ inputs.is_pull_request }}
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0
+      - if: ${{ inputs.is_pull_request == false }}
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 2
+      - id: detect
+        name: Detect changed paths per module
+        env:
+          IS_PR: ${{ inputs.is_pull_request }}
+          BASE_SHA: ${{ inputs.base_sha }}
+          HEAD_SHA: ${{ inputs.head_sha }}
+          BEFORE_SHA: ${{ inputs.before_sha }}
+        run: |
+          set -euo pipefail
+
+          openapi=false
+          go=false
+          web=false
+          bird_conf=false
+          docker_go=false
+          docker_web=false
+          docker_bird=false
+
+          set_all_flags_true() {
+            openapi=true
+            go=true
+            web=true
+            bird_conf=true
+            docker_go=true
+            docker_web=true
+            docker_bird=true
+          }
+
+          write_outputs() {
+            for v in openapi go web bird_conf docker_go docker_web docker_bird; do
+              eval "echo \"\$v=\$$v\"" >> "$GITHUB_OUTPUT"
+            done
+          }
+
+          if [ "$IS_PR" = "true" ]; then
+            FILES="$(git diff --name-only "$BASE_SHA" "$HEAD_SHA")"
+          else
+            after="${HEAD_SHA:-$(git rev-parse HEAD)}"
+            before="$BEFORE_SHA"
+            if [ -n "$before" ] && [ "$before" != "0000000000000000000000000000000000000000" ]; then
+              FILES="$(git diff --name-only "$before" "$after")"
+            elif git rev-parse --verify HEAD~1 >/dev/null 2>&1; then
+              FILES="$(git diff --name-only HEAD~1 HEAD)"
+            else
+              set_all_flags_true
+              write_outputs
+              echo "No parent commit — full pipeline (all modules)"
+              exit 0
+            fi
+          fi
+
+          if [ -z "$(printf '%s' "$FILES" | tr -d '[:space:]')" ]; then
+            set_all_flags_true
+            write_outputs
+            echo "Empty diff — full pipeline fallback"
+            exit 0
+          fi
+
+          full_pipeline=false
+
+          while IFS= read -r f || [ -n "${f:-}" ]; do
+            [ -z "${f:-}" ] && continue
+            case "$f" in
+              .gitea/workflows/*|.golangci.yml|.pre-commit-config.yaml|scripts/*)
+                full_pipeline=true
+                ;;
+              docs/openapi.yaml|redocly.yaml)
+                openapi=true
+                ;;
+              docs/api.md|docs/access.md)
+                openapi=true
+                go=true
+                ;;
+              .cursor/*|.claude/*|.codegraph/*|memory-bank/*)
+                ;;
+              *.md|AGENTS.md)
+                ;;
+              apps/web/README.md|apps/web/components.json|packages/ui/components.json)
+                ;;
+              apps/web/*|packages/ui/*|packages/shared/*)
+                web=true
+                ;;
+              deploy/bird/*)
+                bird_conf=true
+                go=true
+                ;;
+              deploy/compose/*|deploy/docker/*|.dockerignore)
+                docker_go=true
+                docker_web=true
+                docker_bird=true
+                go=true
+                ;;
+              go.mod|go.sum|go.work)
+                go=true
+                ;;
+              migrations/*)
+                go=true
+                ;;
+              cmd/*|internal/*|*.go)
+                go=true
+                bird_conf=true
+                ;;
+              docs/*)
+                ;;
+              package.json|package-lock.json|pnpm-lock.yaml|pnpm-workspace.yaml|.releaserc.json)
+                full_pipeline=true
+                ;;
+              *)
+                ;;
+            esac
+          done <<< "$FILES"
+
+          if $full_pipeline; then
+            set_all_flags_true
+          fi
+
+          write_outputs
+
+          echo "Changed files (first 30):"
+          printf '%s\n' "$FILES" | head -n 30
+          echo "--- flags ---"
+          echo "openapi=$openapi go=$go web=$web bird_conf=$bird_conf"
+          echo "docker_go=$docker_go docker_web=$docker_web docker_bird=$docker_bird full_pipeline=$full_pipeline"
+
+  openapi:
+    needs: [changes]
+    if: needs.changes.outputs.openapi == 'true' || needs.changes.outputs.web == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: "22"
+      - name: Enable pnpm via corepack
+        run: corepack enable
+      - id: pnpm-hash
+        run: echo "key=$(sha256sum pnpm-lock.yaml | awk '{print $1}')" >> "$GITHUB_OUTPUT"
+      - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+        with:
+          path: ~/.local/share/pnpm/store
+          key: pnpm-${{ runner.os }}-${{ steps.pnpm-hash.outputs.key }}
+          restore-keys: |
+            pnpm-${{ runner.os }}-
+      - name: pnpm install, Redocly, codegen check
+        run: |
+          set -euxo pipefail
+          pnpm install --frozen-lockfile
+          pnpm exec redocly lint docs/openapi.yaml
+          chmod +x scripts/check-openapi-gen.sh
+          sh scripts/check-openapi-gen.sh
+
+  web:
+    needs: [changes]
+    if: needs.changes.outputs.web == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: "22"
+      - name: Enable pnpm via corepack
+        run: corepack enable
+      - id: pnpm-hash
+        run: echo "key=$(sha256sum pnpm-lock.yaml | awk '{print $1}')" >> "$GITHUB_OUTPUT"
+      - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+        with:
+          path: ~/.local/share/pnpm/store
+          key: pnpm-${{ runner.os }}-${{ steps.pnpm-hash.outputs.key }}
+          restore-keys: |
+            pnpm-${{ runner.os }}-
+      - name: pnpm install, typecheck, lint, test, build
+        run: |
+          set -euxo pipefail
+          pnpm install --frozen-lockfile
+          pnpm --filter @evobgp/web run typecheck
+          pnpm --filter @evobgp/web run lint
+          pnpm --filter @evobgp/web run test
+          pnpm --filter @evobgp/web run build
+
+  go:
+    needs: [changes]
+    if: needs.changes.outputs.go == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+        with:
+          go-version: "1.24"
+          cache: false
+      - id: go-hash
+        run: echo "key=$(sha256sum go.sum | awk '{print $1}')" >> "$GITHUB_OUTPUT"
+      - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+        with:
+          path: |
+            ~/go/pkg/mod
+            ~/.cache/go-build
+          key: go-${{ runner.os }}-${{ steps.go-hash.outputs.key }}
+          restore-keys: |
+            go-${{ runner.os }}-
+      - name: Vet
+        run: go vet ./...
+      - name: Lint httpapi (ERR-01 / ARCH-01)
+        run: sh scripts/lint-httpapi.sh
+      - name: Check migration pairs (DEP-03)
+        run: sh scripts/check-migrations-pair.sh
+      - name: Validate remote speaker compose
+        run: sh scripts/validate-remote-speaker-compose.sh
+      - name: golangci-lint
+        uses: golangci/golangci-lint-action@55c2c1448f86e01eaae002a5a3a9624417608d84 # v6.5.2
+        with:
+          version: v1.64.8
+          skip-cache: true
+      - name: Test
+        run: go test ./... -race -count=1
+      - name: Build all commands
+        run: |
+          set -euxo pipefail
+          out="${RUNNER_TEMP}/evobgp-bin"
+          mkdir -p "$out"
+          for d in cmd/*/; do
+            name="$(basename "$d")"
+            go build -o "$out/$name" "./$d"
+          done
+
+  bird2:
+    runs-on: ubuntu-latest
+    needs: [changes, go]
+    if: >-
+      always() &&
+      needs.changes.result == 'success' &&
+      needs.go.result != 'failure' &&
+      (needs.changes.outputs.go == 'true' ||
+       needs.changes.outputs.bird_conf == 'true' ||
+       needs.changes.outputs.docker_bird == 'true' ||
+       needs.changes.outputs.docker_go == 'true')
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Install bird2 (репозиторий Ubuntu runner, как в образе evobgp-bird2)
+        run: |
+          set -euxo pipefail
+          if command -v sudo >/dev/null 2>&1; then SUDO=sudo; else SUDO=""; fi
+          $SUDO apt-get update -qq
+          DEBIAN_FRONTEND=noninteractive $SUDO apt-get install -y -qq bird2
+          bird --version
+      - name: bird -p on all scenario bird.conf files
+        env:
+          WORKSPACE: ${{ github.workspace }}
+        run: |
+          set -euxo pipefail
+          WS="${WORKSPACE:-$PWD}"
+          cd "$WS"
+          if [ ! -f internal/birdfmt/testdata/scenarios/minimal/bird.conf ]; then
+            echo "Нет сценариев BIRD в checkout. Проверьте, что internal/birdfmt/testdata/scenarios закоммичен и push в remote."
+            ls -la internal/birdfmt/testdata/ 2>/dev/null || ls -la
+            exit 1
+          fi
+          for conf in internal/birdfmt/testdata/scenarios/*/bird.conf; do
+            echo "==> $conf"
+            bird -c "$WS/$conf" -p
+          done
+
+  commitlint:
+    if: inputs.is_pull_request
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: "22"
+      - name: Enable pnpm via corepack
+        run: corepack enable
+      - id: pnpm-hash
+        run: echo "key=$(sha256sum pnpm-lock.yaml | awk '{print $1}')" >> "$GITHUB_OUTPUT"
+      - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+        with:
+          path: ~/.local/share/pnpm/store
+          key: pnpm-${{ runner.os }}-${{ steps.pnpm-hash.outputs.key }}
+          restore-keys: |
+            pnpm-${{ runner.os }}-
+      - name: Lint commit messages
+        env:
+          BASE_SHA: ${{ inputs.base_sha }}
+          HEAD_SHA: ${{ inputs.head_sha }}
+        run: |
+          set -euxo pipefail
+          pnpm install --frozen-lockfile
+          pnpm exec commitlint --from "$BASE_SHA" --to "$HEAD_SHA"
+
+  docker-check:
+    needs: [changes]
+    if: >-
+      inputs.is_pull_request &&
+      (needs.changes.outputs.docker_go == 'true' ||
+       needs.changes.outputs.docker_web == 'true' ||
+       needs.changes.outputs.docker_bird == 'true')
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
+        with:
+          name: evobgp
+          driver: docker-container
+          cleanup: false
+      - name: Log in to Gitea Registry
+        if: inputs.allow_registry_login
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
+        with:
+          registry: git.shx.one
+          username: ${{ gitea.actor }}
+          password: ${{ secrets.ACTIONS_PAT }}
+      - name: bake --print
+        working-directory: deploy/docker
+        env:
+          BUILDX_BAKE_ENTITLEMENTS_FS: "0"
+          BUILDX_BAKE_FILE_RELATIVE_PATHS: "1"
+        run: docker buildx bake --allow=fs.read="${{ github.workspace }}" -f docker-bake.hcl --print default
+      - name: bake (no push)
+        if: inputs.allow_registry_login
+        working-directory: deploy/docker
+        env:
+          BUILDX_BAKE_ENTITLEMENTS_FS: "0"
+          BUILDX_BAKE_FILE_RELATIVE_PATHS: "1"
+          CACHE_REF_GO: git.shx.one/${{ github.repository_owner }}/evobgp-buildcache:go-buildcache
+          CACHE_REF_WEB: git.shx.one/${{ github.repository_owner }}/evobgp-buildcache:web-buildcache
+          CACHE_REF_BIRDC: git.shx.one/${{ github.repository_owner }}/evobgp-buildcache:birdc-buildcache
+        run: |
+          set -euxo pipefail
+          owner_lc="$(echo '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')"
+          export CACHE_REF_GO="git.shx.one/${owner_lc}/evobgp-buildcache:go-buildcache"
+          export CACHE_REF_WEB="git.shx.one/${owner_lc}/evobgp-buildcache:web-buildcache"
+          export CACHE_REF_BIRDC="git.shx.one/${owner_lc}/evobgp-buildcache:birdc-buildcache"
+          docker buildx bake --allow=fs.read="${{ github.workspace }}" -f docker-bake.hcl default
@@ -50,6 +50,6 @@ docker compose --profile reference up -d

 - [docs/releasing.md](docs/releasing.md) — пайплайн, commit conventions, секреты CI
 - API: `GET /version` и `GET /v1/version` (поле `version`)
- Docker-образы: теги `latest`, `vX.Y.Z`, `X.Y.Z` — в **том же CI run**, что и релиз (job `release`)
+- Docker-образы: теги `latest`, `vX.Y.Z`, `X.Y.Z` — в **том же CD run**, что и релиз (job `publish`)

 Лицензия и условия использования — по политике владельца репозитория.
@@ -27,10 +27,10 @@ export function MonitoringHealthCard({
  return (
    <DonutBreakdownCard
      title="Доступность системы"
-      description="GET /v1/health · GET /v1/ready"
+      description="Проверки живучести и готовности"
      slices={slices}
      centerLabel="Проверки"
-      badge={healthOk ? 'API OK' : undefined}
+      badge={healthOk ? 'API в норме' : undefined}
    />
  )
 }
@@ -40,15 +40,15 @@ export function NetworkOverviewAnalyticsCard({
      />
      <SegmentedProgressCard
        title="Спикеры"
-        description="Доступность live-агентов"
+        description="Доступность агентов"
        primary={{
          value: `${net.speakersOnline}/${net.speakersTotal}`,
-          label: 'Online',
+          label: 'В сети',
          percent: speakersPct,
        }}
        secondary={{
          value: net.speakersTotal - net.speakersOnline,
-          label: 'Offline',
+          label: 'Не в сети',
          percent: 100 - speakersPct,
        }}
        footer={`Пиры установлены: ${net.peersEstablished}/${net.peersEnabled}`}
@@ -100,7 +100,7 @@ function buildKpis({
          variant={network.speakersOnline === network.speakersTotal ? 'success-light' : 'warning-light'}
          size="sm"
        >
-          {loading ? '…' : 'онлайн'}
+          {loading ? '…' : 'в сети'}
        </Badge>
      ),
    },
@@ -40,7 +40,7 @@ function buildMetrics({
    {
      id: 'bgp',
      title: 'BGP готовность',
-      label: 'Established / включённые',
+      label: 'Установлено / включено',
      value: loading || network.peersEnabled === 0 ? '—' : `${bgpPct}%`,
      delta: loading ? '…' : bgpPct >= 90 ? 'стабильно' : 'внимание',
      deltaVariant: bgpPct >= 90 ? 'success-light' : bgpPct >= 50 ? 'warning-light' : 'destructive-light',
@@ -62,13 +62,13 @@ function buildMetrics({
    {
      id: 'speakers',
      title: 'Спикеры',
-      label: 'Online / всего',
+      label: 'В сети / всего',
      value: loading ? '—' : `${network.speakersOnline}/${network.speakersTotal}`,
      delta:
        loading || network.speakersTotal === 0
          ? '…'
          : network.speakersOnline === network.speakersTotal
-            ? 'все online'
+            ? 'все в сети'
            : 'частично',
      deltaVariant:
        network.speakersOnline === network.speakersTotal ? 'success-light' : 'warning-light',
@@ -7,7 +7,7 @@ const ACTIONS: QuickActionItem[] = [
  {
    id: 'lookup',
    title: 'Проверка IP/домена',
-    description: 'Проверка IP в списках и BGP-сообществах.',
+    description: 'Проверка IP в списках и BGP community.',
    to: '/lookup',
    icon: <Search aria-hidden />,
    iconClassName: 'text-primary',
@@ -22,8 +22,8 @@ const ACTIONS: QuickActionItem[] = [
  },
  {
    id: 'communities',
-    title: 'BGP-сообщества',
-    description: 'Справочник BGP-сообществ для политик экспорта.',
+    title: 'BGP community',
+    description: 'Справочник BGP community для политик экспорта.',
    to: '/directories',
    icon: <Tags aria-hidden />,
    iconClassName: 'text-info',
@@ -71,7 +71,7 @@ export function CommunityFormDialog({
    <FormDrawer
      open={open}
      onOpenChange={onOpenChange}
-      title={editTarget ? 'Редактировать сообщество' : 'Новое сообщество BGP'}
+      title={editTarget ? 'Редактировать community' : 'Новое BGP community'}
      description="Тег для префиксов в фильтрах BIRD"
      className="sm:max-w-sm"
      footer={
@@ -73,10 +73,10 @@ export function DirectoriesCommunitiesGrid({
      table={table}
      recordCount={filteredCount}
      isLoading={isLoading}
-      emptyMessage="Нет сообществ"
+      emptyMessage="Нет community"
      searchValue={globalFilter}
      onSearchChange={setGlobalFilter}
-      searchPlaceholder="Поиск сообществ…"
+      searchPlaceholder="Поиск community…"
    />
  )
 }
@@ -70,7 +70,7 @@ export function DohProfileFormDialog({
    if (timeoutMs.trim() !== '') {
      const ms = Number(timeoutMs)
      if (!Number.isFinite(ms) || !Number.isInteger(ms) || ms <= 0) {
-        toast.error('Timeout должен быть целым числом > 0')
+        toast.error('Таймаут должен быть целым числом больше 0')
        return
      }
      timeout = ms
@@ -136,7 +136,7 @@ export function DohProfileFormDialog({
        />
      </div>
      <div className="flex flex-col gap-2">
-        <Label htmlFor="doh-timeout">Timeout, мс (опционально)</Label>
+        <Label htmlFor="doh-timeout">Таймаут, мс (необязательно)</Label>
        <Input
          id="doh-timeout"
          type="number"
@@ -71,7 +71,7 @@ const NAV_GROUPS: NavGroup[] = [
        to: '/dashboard',
        label: 'Панель',
        icon: LayoutDashboard,
-        description: 'KPI, модули и активность',
+        description: 'Метрики, модули и активность',
      },
    ],
  },
@@ -81,15 +81,15 @@ const NAV_GROUPS: NavGroup[] = [
      { to: '/modules', label: 'Модули', icon: Boxes, description: 'Списки префиксов и AS' },
      { to: '/lookup', label: 'Проверка', icon: Search, description: 'IP/домен в списках и community' },
      { to: '/network', label: 'Сеть', icon: Network, description: 'BGP-пиры и спикеры', search: { tab: 'overview' } },
-      { to: '/directories', label: 'Справочники', icon: BookText, description: 'Communities и DoH' },
+      { to: '/directories', label: 'Справочники', icon: BookText, description: 'BGP community и DoH' },
    ],
  },
  {
    label: 'Операции',
    items: [
-      { to: '/operations', label: 'Операции', icon: Cog, description: 'Ревизии и apply', search: { tab: 'revisions' } },
-      { to: '/schedule', label: 'Задачи', icon: ListChecks, description: 'Расписание refresh' },
-      { to: '/monitoring', label: 'Мониторинг', icon: Activity, description: 'Health и BIRD', search: { tab: 'system' } },
+      { to: '/operations', label: 'Операции', icon: Cog, description: 'Ревизии и применение', search: { tab: 'revisions' } },
+      { to: '/schedule', label: 'Задачи', icon: ListChecks, description: 'Расписание обновления' },
+      { to: '/monitoring', label: 'Мониторинг', icon: Activity, description: 'Состояние системы и BIRD', search: { tab: 'system' } },
    ],
  },
  {
@@ -94,8 +94,8 @@ export function SystemMonitorPopover() {
    () => [
      {
        id: 'api',
-        label: 'API health',
-        value: healthOk ? 'OK' : '—',
+        label: 'Состояние API',
+        value: healthOk ? 'норма' : '—',
        unit: '',
        percent: healthOk ? 100 : 0,
        icon: <HeartPulse aria-hidden />,
@@ -14,8 +14,8 @@ import { normalizeCdnSourceKind } from '@/lib/modules/helpers'
 import type { BgpCommunity, CdnPreviewResponse, CdnSource, CdnSourceCreate } from '@/types/api'

 const CDN_KIND_ITEMS = [
-  { value: 'plaintext', label: 'plaintext' },
-  { value: 'json', label: 'json' },
+  { value: 'plaintext', label: 'Текст' },
+  { value: 'json', label: 'JSON' },
 ] as const

 interface ModuleCdnSourceDialogProps {
@@ -160,7 +160,7 @@ export function ModuleEditDialog({
        <div className="grid min-w-0 flex-1 gap-1 pr-2">
          <Label htmlFor="mod-enabled">Включён</Label>
          <p className="text-xs text-muted-foreground">
-            Выключенный модуль не участвует в refresh и apply.
+            Выключенный модуль не участвует в обновлении и применении.
          </p>
        </div>
        <Checkbox
@@ -10,6 +10,7 @@ import { DataGridSection } from '@/components/data-grid-shell'
 import { DataGridColumnHeader } from '@/components/reui/data-grid/data-grid-column-header'
 import { formatDateTime } from '@/lib/modules/display'
 import { communityLabel } from '@/lib/modules/helpers'
+import { cdnSourceKindRu } from '@/lib/ui-labels'
 import { useClientDataGrid } from '@/hooks/use-client-data-grid'
 import type {
  AsEntry,
@@ -145,7 +146,7 @@ export function ModuleEntriesGrid({
          accessorKey: 'source_kind',
          header: 'Тип',
          cell: ({ row }: { row: { original: CdnSource } }) => (
-            <CategoryBadge>{row.original.source_kind}</CategoryBadge>
+            <CategoryBadge>{cdnSourceKindRu(row.original.source_kind)}</CategoryBadge>
          ),
        },
        {
@@ -35,7 +35,7 @@ import type { PeerDiscoveryRow, SpeakerRow } from '@/types/api'
 function speakerLabel(s: SpeakerRow): string {
  if (s.role === 'master') {
    const host = s.agent_domain ?? s.endpoint
-    return host ? `CP · ${host}` : 'CP (master)'
+    return host ? `Плоскость · ${host}` : 'Плоскость управления'
  }
  return s.agent_domain ?? s.endpoint ?? `${s.id.slice(0, 8)}…`
 }
@@ -51,7 +51,7 @@ const filterFields: FilterFieldConfig[] = [
    icon: <SearchIcon className="size-3.5" aria-hidden />,
    type: 'text',
    className: 'w-48',
-    placeholder: 'IP или Neighbor ID…',
+    placeholder: 'IP или ID соседа…',
  },
 ]

@@ -94,7 +94,7 @@ export function NetworkDiscoveredPeersCard({
        id: 'neighbor_id',
        accessorFn: (row) => row.neighbor_id || row.neighbor,
        header: ({ column }) => (
-          <DataGridColumnHeader column={column} title="Neighbor ID" />
+          <DataGridColumnHeader column={column} title="ID соседа" />
        ),
        cell: ({ row }) => (
          <DataGridPrimaryCell
@@ -103,7 +103,7 @@ export function NetworkDiscoveredPeersCard({
            accent="mono"
          />
        ),
-        meta: { headerTitle: 'Neighbor ID' },
+        meta: { headerTitle: 'ID соседа' },
      },
      {
        accessorKey: 'remote_asn',
@@ -212,7 +212,7 @@ export function NetworkDiscoveredPeersCard({
        title="Одобрить пира"
        description={
          approveTarget
-            ? `Neighbor ID ${approveTarget.neighbor_id || '—'} · ${approveTarget.neighbor} AS${approveTarget.remote_asn ?? '?'}`
+            ? `ID соседа ${approveTarget.neighbor_id || '—'} · ${approveTarget.neighbor} AS${approveTarget.remote_asn ?? '?'}`
            : undefined
        }
        className="sm:max-w-sm"
@@ -55,7 +55,7 @@ export function NetworkKpi({
          }
          size="sm"
        >
-          {loading ? '…' : 'онлайн'}
+          {loading ? '…' : 'в сети'}
        </Badge>
      ),
      to: '/network',
@@ -39,11 +39,11 @@ const PEER_TABS = [

 const SESSION_STATE_OPTIONS = [
  { value: 'Established', label: 'Установлена' },
-  { value: 'Idle', label: 'Idle' },
-  { value: 'Active', label: 'Active' },
-  { value: 'Connect', label: 'Connect' },
-  { value: 'OpenSent', label: 'OpenSent' },
-  { value: 'OpenConfirm', label: 'OpenConfirm' },
+  { value: 'Idle', label: 'Простой' },
+  { value: 'Active', label: 'Поиск' },
+  { value: 'Connect', label: 'Соединение' },
+  { value: 'OpenSent', label: 'Open отправлен' },
+  { value: 'OpenConfirm', label: 'Open подтверждён' },
 ]

 function createDefaultPeerFilters(): Filter[] {
@@ -31,14 +31,14 @@ function speakerDeleteLabel(s: SpeakerRow): string {

 const SPEAKER_TABS = [
  { id: 'all', label: 'Все' },
-  { id: 'online', label: 'Online' },
-  { id: 'offline', label: 'Offline' },
+  { id: 'online', label: 'В сети' },
+  { id: 'offline', label: 'Не в сети' },
 ]

 const ROLE_OPTIONS = [
-  { value: 'primary', label: 'primary' },
-  { value: 'secondary', label: 'secondary' },
-  { value: 'speaker', label: 'speaker' },
+  { value: 'primary', label: 'Основной' },
+  { value: 'secondary', label: 'Резервный' },
+  { value: 'speaker', label: 'Спикер' },
 ]

 function createDefaultSpeakerFilters(): Filter[] {
@@ -52,7 +52,7 @@ const speakerFilterFields: FilterFieldConfig[] = [
    icon: <SearchIcon className="size-3.5" aria-hidden />,
    type: 'text',
    className: 'w-52',
-    placeholder: 'endpoint…',
+    placeholder: 'Адрес агента…',
  },
  {
    key: 'role',
@@ -128,7 +128,7 @@ export function NetworkSpeakersCard({
    <>
      <ResourcePage
        title="Спикеры"
-        description="BIRD-агенты на нодах tenant"
+        description="BIRD-агенты на нодах арендатора"
        tabs={SPEAKER_TABS}
        tabFilter={speakerTabFilter}
        filterFields={speakerFilterFields}
@@ -5,7 +5,7 @@ import { DataGridPrimaryCell } from '@/components/data-grid-cell'
 import { StatusBadge } from '@/components/status-badge'
 import { Badge } from '@/components/reui/badge'
 import { DataGridColumnHeader } from '@/components/reui/data-grid/data-grid-column-header'
-import { speakerOnlineLabel } from '@/lib/ui-labels'
+import { speakerOnlineLabel, speakerRoleRu } from '@/lib/ui-labels'
 import type { SpeakerRow } from '@/types/api'

 export const speakerColumns: ColumnDef<SpeakerRow, unknown>[] = [
@@ -20,7 +20,7 @@ export const speakerColumns: ColumnDef<SpeakerRow, unknown>[] = [
  {
    accessorKey: 'role',
    header: ({ column }) => <DataGridColumnHeader column={column} title="Роль" />,
-    cell: ({ row }) => <CategoryBadge>{row.original.role}</CategoryBadge>,
+    cell: ({ row }) => <CategoryBadge>{speakerRoleRu(row.original.role)}</CategoryBadge>,
    meta: { headerTitle: 'Роль' },
  },
  {
@@ -22,7 +22,7 @@ interface PeerFormDialogProps {
 function speakerLabel(s: SpeakerRow): string {
  if (s.role === 'master') {
    const host = s.agent_domain ?? s.endpoint
-    return host ? `CP · ${host}` : 'CP (master)'
+    return host ? `Плоскость · ${host}` : 'Плоскость управления'
  }
  return s.agent_domain ?? s.endpoint ?? `${s.id.slice(0, 8)}…`
 }
@@ -74,7 +74,7 @@ export function SpeakerFormDialog({ open, onOpenChange }: SpeakerFormDialogProps
    const ep =
      endpoint.trim() || (agentDomain.trim() ? `https://${agentDomain.trim()}` : '')
    if (!ep) {
-      toast.error('Укажите endpoint или agent domain')
+      toast.error('Укажите конечную точку или домен агента')
      return
    }
    const body: BgpSpeakerCreate = {
@@ -95,7 +95,7 @@ export function SpeakerFormDialog({ open, onOpenChange }: SpeakerFormDialogProps
      open={open}
      onOpenChange={onOpenChange}
      title="Новый спикер"
-      description="BIRD-агент на ноде реплики или control plane"
+      description="BIRD-агент на ноде реплики или плоскости управления"
      className="sm:max-w-md"
      footer={
        <>
@@ -122,7 +122,7 @@ export function SpeakerFormDialog({ open, onOpenChange }: SpeakerFormDialogProps
        label="Роль"
        items={[
          { value: 'replica', label: 'Реплика' },
-          { value: 'master', label: 'Мастер (CP)' },
+          { value: 'master', label: 'Мастер (плоскость)' },
        ]}
        value={role}
        onValueChange={(v) => setRole(v ?? 'replica')}
@@ -146,7 +146,7 @@ export function SpeakerFormDialog({ open, onOpenChange }: SpeakerFormDialogProps
        />
      </div>
      <div className="flex flex-col gap-2">
-        <Label htmlFor="speaker-bgp-source">BGP source IPv4</Label>
+        <Label htmlFor="speaker-bgp-source">Исходный IPv4 BGP</Label>
        <Input
          id="speaker-bgp-source"
          placeholder="203.0.113.10"
@@ -77,7 +77,7 @@ export function OperationsRevisionsGrid({
              </Button>
            }
            title={`Откатиться к ревизии ${row.original.id.slice(0, 8)}…?`}
-            description="Будет создана новая ревизия на основе выбранной. Требуется роль operator."
+            description="Будет создана новая ревизия на основе выбранной. Требуется роль оператора."
            confirmLabel="Откатить"
            destructive
            onConfirm={() => rollbackMutation.mutate(row.original.id)}
@@ -61,7 +61,7 @@ function DataGridColumnFilter<TData, TValue>({
                <div className="hidden space-x-1 lg:flex">
                  {selectedValues.size > 2 ? (
                    <Badge variant="secondary" className="px-1 font-normal">
-                      {selectedValues.size} selected
+                      {selectedValues.size} выбрано
                    </Badge>
                  ) : (
                    options
@@ -94,7 +94,7 @@ function DataGridColumnFilter<TData, TValue>({
        <div className="max-h-[300px] overflow-y-auto">
          {filteredOptions.length === 0 ? (
            <div className="text-muted-foreground py-6 text-center text-sm">
-              No results found.
+              Ничего не найдено.
            </div>
          ) : (
            <div className="p-1">
@@ -170,7 +170,7 @@ function DataGridColumnFilter<TData, TValue>({
                  }}
                  className="hover:bg-accent hover:text-accent-foreground focus:bg-accent focus:text-accent-foreground rounded-md relative flex cursor-pointer items-center justify-center px-2 py-1.5 text-sm outline-hidden select-none"
                >
-                  Clear filters
+                  Сбросить фильтры
                </div>
              </div>
            </>
@@ -39,11 +39,11 @@ function DataGridPagination(props: DataGridPaginationProps): React.JSX.Element {
    sizes: [5, 10, 25, 50, 100],
    sizesSkeleton: <Skeleton className="h-8 w-44" />,
    moreLimit: 5,
-    info: "{from} - {to} of {count}",
+    info: "{from}–{to} из {count}",
    infoSkeleton: <Skeleton className="h-8 w-60" />,
-    rowsPerPageLabel: "Rows per page",
-    previousPageLabel: "Go to previous page",
-    nextPageLabel: "Go to next page",
+    rowsPerPageLabel: "Строк на странице",
+    previousPageLabel: "Предыдущая страница",
+    nextPageLabel: "Следующая страница",
    ellipsisText: "...",
  }

@@ -73,7 +73,7 @@ function DataGridTableDndRowHandle({ className }: { className?: string }) {
          "size-7 cursor-grab opacity-70 hover:bg-transparent hover:opacity-100 active:cursor-grabbing",
          className
        )}
-        aria-label="Drag to reorder row"
+        aria-label="Перетащить строку"
        disabled
      >
        <GripHorizontalIcon aria-hidden="true" />
@@ -89,7 +89,7 @@ function DataGridTableDndRowHandle({ className }: { className?: string }) {
        "size-7 cursor-grab opacity-70 hover:bg-transparent hover:opacity-100 active:cursor-grabbing",
        className
      )}
-      aria-label="Drag to reorder row"
+      aria-label="Перетащить строку"
      {...context.attributes}
      {...context.listeners}
    >
@@ -105,7 +105,7 @@ function DataGridTableDndHeader<TData>({
            className={`-ms-2 size-6 ${isDragging ? "cursor-grabbing" : "cursor-grab active:cursor-grabbing"}`}
            {...attributes}
            {...listeners}
-            aria-label="Drag to reorder"
+            aria-label="Перетащить для изменения порядка"
          >
            <GripVerticalIcon className="opacity-60 hover:opacity-100" aria-hidden="true" />
          </Button>
@@ -397,9 +397,9 @@ function DataGridTableVirtual<TData>({

  const isVirtualizationEnabled = virtualizerOptions?.enabled !== false
  const loadingMoreMessage =
-    props.fetchingMoreMessage || props.loadingMessage || "Loading..."
+    props.fetchingMoreMessage || props.loadingMessage || "Загрузка…"
  const allRowsLoadedMessage =
-    props.allRowsLoadedMessage || "All records loaded"
+    props.allRowsLoadedMessage || "Все записи загружены"

  const handleViewportRef = useCallback((node: HTMLDivElement | null) => {
    setViewportElements({
@@ -1241,7 +1241,7 @@ function DataGridTableEmpty() {
        colSpan={Math.max(visibleColumnCount, 1)}
        className="text-muted-foreground py-6 text-center text-sm"
      >
-        {props.emptyMessage || "No data available"}
+        {props.emptyMessage || "Нет данных"}
      </td>
    </tr>
  )
@@ -1254,7 +1254,7 @@ function DataGridTableLoader() {
    <div className="absolute top-1/2 left-1/2 -translate-x-1/2 -translate-y-1/2">
      <div className="text-muted-foreground bg-card rounded-lg flex items-center gap-2 border px-4 py-2 text-sm leading-none font-medium">
        <Spinner className="size-5 opacity-60" />
-        {props.loadingMessage || "Loading..."}
+        {props.loadingMessage || "Загрузка…"}
      </div>
    </div>
  )
@@ -1266,7 +1266,7 @@ function DataGridTableRowPin<TData>({ row }: { row: Row<TData> }) {
  return (
    <button
      type="button"
-      aria-label={isPinned ? "Unpin row" : "Pin row"}
+      aria-label={isPinned ? "Открепить строку" : "Закрепить строку"}
      onClick={() => {
        if (isPinned) {
          row.pin(false)
@@ -1322,7 +1322,7 @@ function DataGridTableRowSelect<TData>({ row }: { row: Row<TData> }) {
      <Checkbox
        checked={row.getIsSelected()}
        onCheckedChange={(value) => row.toggleSelected(!!value)}
-        aria-label="Select row"
+        aria-label="Выбрать строку"
        className="align-[inherit]"
      />
    </>
@@ -1341,7 +1341,7 @@ function DataGridTableRowSelectAll() {
      indeterminate={isSomeSelected && !isAllSelected}
      disabled={isLoading || recordCount === 0}
      onCheckedChange={(value) => table.toggleAllPageRowsSelected(!!value)}
-      aria-label="Select all"
+      aria-label="Выбрать все"
      className="align-[inherit]"
    />
  )
@@ -1408,7 +1408,7 @@ function DataGridTableBodyRows<TData>({ table }: { table: Table<TData> }) {
                d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"
              ></path>
            </svg>
-            {props.loadingMessage || "Loading..."}
+            {props.loadingMessage || "Загрузка…"}
          </div>
        </td>
      </tr>
@@ -123,75 +123,70 @@ export interface FilterI18nConfig {

 // Default English i18n configuration
 export const DEFAULT_I18N: FilterI18nConfig = {
-  // UI Labels
-  addFilter: "Filter",
-  searchFields: "Filter...",
-  noFieldsFound: "No filters found.",
-  noResultsFound: "No results found.",
-  select: "Select...",
-  true: "True",
-  false: "False",
-  min: "Min",
-  max: "Max",
-  to: "to",
-  typeAndPressEnter: "Type and press Enter to add tag",
-  selected: "selected",
-  selectedCount: "selected",
+  addFilter: "Фильтр",
+  searchFields: "Фильтр…",
+  noFieldsFound: "Поля не найдены.",
+  noResultsFound: "Ничего не найдено.",
+  select: "Выбрать…",
+  true: "Да",
+  false: "Нет",
+  min: "Мин.",
+  max: "Макс.",
+  to: "—",
+  typeAndPressEnter: "Введите и нажмите Enter",
+  selected: "выбрано",
+  selectedCount: "выбрано",
  percent: "%",
  defaultCurrency: "$",
  defaultColor: "#000000",
-  addFilterTitle: "Add filter",
+  addFilterTitle: "Добавить фильтр",

-  // Operators
  operators: {
-    is: "is",
-    isNot: "is not",
-    isAnyOf: "is any of",
-    isNotAnyOf: "is not any of",
-    includesAll: "includes all",
-    excludesAll: "excludes all",
-    before: "before",
-    after: "after",
-    between: "between",
-    notBetween: "not between",
-    contains: "contains",
-    notContains: "does not contain",
-    startsWith: "starts with",
-    endsWith: "ends with",
-    isExactly: "is exactly",
-    equals: "equals",
-    notEquals: "not equals",
-    greaterThan: "greater than",
-    lessThan: "less than",
-    overlaps: "overlaps",
-    includes: "includes",
-    excludes: "excludes",
-    includesAllOf: "includes all of",
-    includesAnyOf: "includes any of",
-    empty: "is empty",
-    notEmpty: "is not empty",
+    is: "равно",
+    isNot: "не равно",
+    isAnyOf: "любое из",
+    isNotAnyOf: "кроме",
+    includesAll: "включает все",
+    excludesAll: "исключает все",
+    before: "до",
+    after: "после",
+    between: "между",
+    notBetween: "вне диапазона",
+    contains: "содержит",
+    notContains: "не содержит",
+    startsWith: "начинается с",
+    endsWith: "заканчивается на",
+    isExactly: "точно",
+    equals: "равно",
+    notEquals: "не равно",
+    greaterThan: "больше",
+    lessThan: "меньше",
+    overlaps: "пересекается",
+    includes: "включает",
+    excludes: "исключает",
+    includesAllOf: "включает все",
+    includesAnyOf: "включает любое",
+    empty: "пусто",
+    notEmpty: "не пусто",
  },

-  // Placeholders
  placeholders: {
-    enterField: (fieldType: string) => `Enter ${fieldType}...`,
-    selectField: "Select...",
-    searchField: (fieldName: string) => `Search ${fieldName.toLowerCase()}...`,
-    enterKey: "Enter key...",
-    enterValue: "Enter value...",
+    enterField: (fieldType: string) => `Введите ${fieldType}…`,
+    selectField: "Выбрать…",
+    searchField: (fieldName: string) => `Поиск ${fieldName.toLowerCase()}…`,
+    enterKey: "Введите ключ…",
+    enterValue: "Введите значение…",
  },

-  // Helper functions
  helpers: {
    formatOperator: (operator: string) => operator.replace(/_/g, " "),
  },

-  // Validation
  validation: {
-    invalidEmail: "Invalid email format",
-    invalidUrl: "Invalid URL format",
-    invalidTel: "Invalid phone format",
-    invalid: "Invalid input format",
+    invalidEmail: "Некорректный email",
+    invalidUrl: "Некорректный URL",
+    invalidTel: "Некорректный телефон",
+    invalid: "Некорректное значение",
  },
 }

@@ -107,7 +107,7 @@ export function ScheduleAgendaPanel({
  return (
    <PanelCard
      title="Календарь задач"
-      description="Задачи refresh и apply по дням"
+      description="Задачи обновления и применения по дням"
      contentClassName={cn(panelCardContentFlushClassName, 'p-0')}
    >
      <div className="flex flex-col lg:flex-row">
@@ -43,7 +43,7 @@ export function ScheduleModulesGrid({
        cell: ({ row }) => (
          <span className="font-mono text-xs text-muted-foreground">
            {row.original.cron_expr ??
-              (row.original.refresh_interval_sec ? `${row.original.refresh_interval_sec}s` : '—')}
+              (row.original.refresh_interval_sec ? `${row.original.refresh_interval_sec} с` : '—')}
          </span>
        ),
        meta: { headerTitle: 'Расписание' },
@@ -90,16 +90,16 @@ export function AppearanceSettingsTab() {
      </SettingsCard>

      <SettingsCard
-        title="Дашборд"
+        title="Обзор"
        description="Блоки на экране «Обзор»"
      >
        <SettingsFieldGroup
          legend="Быстрые действия"
-          description="Показывать KPI-like плитки быстрых переходов под метриками."
+          description="Показывать плитки быстрых переходов под метриками."
        >
          <SettingRow
            title="Быстрые действия"
-            description="Блок с частыми переходами (модули, сеть, деплой) на дашборде."
+            description="Блок с частыми переходами (модули, сеть, деплой) на экране «Обзор»."
            last
          >
            <Switch
@@ -31,8 +31,8 @@ const RUNTIME_LOGS_ENABLED_ITEMS = [
 ] as const

 const RUNTIME_LOGS_MODE_ITEMS = [
-  { value: 'truncate', label: 'обнулить (truncate)' },
-  { value: 'delete', label: 'удалить файл (delete)' },
+  { value: 'truncate', label: 'Обнулить файл' },
+  { value: 'delete', label: 'Удалить файл' },
 ] as const

 const BIRD_LABELS: Record<BirdSettingKey, string> = {
@@ -40,12 +40,12 @@ const BIRD_LABELS: Record<BirdSettingKey, string> = {
  bird_local_ipv4: 'Локальный IPv4',
  bird_local_ipv6: 'Локальный IPv6',
  bird_local_asn: 'Локальный ASN',
-  bird_bgp_source_ipv4: 'BGP source IPv4',
-  bird_bgp_source_ipv6: 'BGP source IPv6',
+  bird_bgp_source_ipv4: 'Исходный IPv4 BGP',
+  bird_bgp_source_ipv6: 'Исходный IPv6 BGP',
  peer_discovery_enabled: 'Автообнаружение пиров',
-  peer_discovery_ranges_v4: 'Discovery CIDR IPv4',
-  peer_discovery_ranges_v6: 'Discovery CIDR IPv6',
-  peer_discovery_require_external: 'Только external ASN',
+  peer_discovery_ranges_v4: 'CIDR автообнаружения IPv4',
+  peer_discovery_ranges_v6: 'CIDR автообнаружения IPv6',
+  peer_discovery_require_external: 'Только внешние ASN',
 }

 const BIRD_BOOL_ITEMS = [
@@ -55,10 +55,10 @@ const BIRD_BOOL_ITEMS = [

 const BIRD_HINTS: Partial<Record<BirdSettingKey, string>> = {
  peer_discovery_enabled:
-    'Dynamic neighbor range в BIRD (карантин import/export none). Требует CIDR.',
+    'Динамический диапазон соседей в BIRD (карантин import/export none). Нужны CIDR.',
  peer_discovery_ranges_v4: 'Через запятую или пробел, напр. 198.51.100.0/24 203.0.113.0/24',
  peer_discovery_ranges_v6: 'Опционально, напр. 2001:db8::/32',
-  peer_discovery_require_external: 'neighbor range … external (любой чужой ASN)',
+  peer_discovery_require_external: 'Диапазон соседей с внешним (любым чужим) ASN',
 }

 export function BirdSettingsTab() {
@@ -103,8 +103,8 @@ export function BirdSettingsTab() {
  return (
    <div className="flex flex-col gap-6">
      <SettingsCard
-        title="BIRD control plane"
-        description="Глобальные параметры BIRD для pipeline refresh/apply. Сохранение — роль operator."
+        title="Плоскость управления BIRD"
+        description="Глобальные параметры BIRD для обновления модулей и применения конфигурации. Сохранение доступно оператору."
        footer={
          <LoadingButton onClick={saveBird} loading={patchMutation.isPending}>
            <Save />
@@ -184,11 +184,11 @@ export function BirdSettingsTab() {
        >
          {() => (
            <SettingsFieldGroup
-              legend="Retention"
+              legend="Хранение"
              description="Срок хранения ревизий в минутах."
            >
              <SettingsSettingField
-                title="Retention"
+                title="Срок хранения"
                description="Сколько минут хранить ревизии конфигурации."
                labelFor="revision_retention_minutes"
                stacked
@@ -63,7 +63,7 @@ export function ConnectionSettingsTab({ tokenRequired }: { tokenRequired: boolea

      <SettingsCard
        title="Подключение к API"
-        description="Токен хранится только в этом браузере (localStorage)"
+        description="Токен хранится только в этом браузере"
        footer={
          <div className="flex w-full min-w-0 flex-wrap justify-end gap-2">
            <Button type="button" variant="outline" onClick={useDevToken}>
@@ -84,7 +84,7 @@ export function ConnectionSettingsTab({ tokenRequired }: { tokenRequired: boolea
            title="Токен для запросов"
            description={
              <>
-                Ключ для заголовка Authorization. Управление ключами tenant — в разделе{' '}
+                Ключ для заголовка Authorization. Управление ключами арендатора — в разделе{' '}
                <Link to="/access" className="text-primary underline-offset-4 hover:underline">
                  Права доступа
                </Link>
@@ -93,7 +93,7 @@ export function ConnectionSettingsTab({ tokenRequired }: { tokenRequired: boolea
            }
            titleAddon={
              <Badge variant="outline" size="sm">
-                localStorage
+                браузер
              </Badge>
            }
            labelFor="settings-token"
@@ -28,25 +28,25 @@ const ADMIN_SECTIONS = [
    title: 'Параметры арендатора',
    description: 'BIRD, ревизии, файловые логи и дополнительные ключи /v1/settings.',
    icon: <SlidersHorizontalIcon aria-hidden="true" />,
-    badge: { label: 'operator', variant: 'warning-light' as const },
+    badge: { label: 'оператор', variant: 'warning-light' as const },
  },
  {
    id: 'access',
    to: '/access' as const,
    search: undefined,
    title: 'Права доступа',
-    description: 'API-ключи tenant, роли и управление доступом.',
+    description: 'API-ключи арендатора, роли и управление доступом.',
    icon: <KeyRoundIcon aria-hidden="true" />,
-    badge: { label: 'operator', variant: 'warning-light' as const },
+    badge: { label: 'оператор', variant: 'warning-light' as const },
  },
  {
    id: 'monitoring',
    to: '/monitoring' as const,
    search: undefined,
    title: 'Мониторинг',
-    description: 'Метрики, состояние jobs и observability control plane.',
+    description: 'Метрики, состояние задач и наблюдаемость плоскости управления.',
    icon: <ActivityIcon aria-hidden="true" />,
-    badge: { label: 'viewer+', variant: 'info-light' as const },
+    badge: { label: 'просмотр+', variant: 'info-light' as const },
  },
 ] as const

@@ -54,8 +54,8 @@ export function SectionsSettingsTab() {
  return (
    <div className="flex flex-col gap-6">
      <SettingsCard
-        title="Разделы control plane"
-        description="Параметры tenant и операции — отдельно от настроек браузера"
+        title="Разделы плоскости управления"
+        description="Параметры арендатора и операции — отдельно от настроек браузера"
      >
        <ItemGroup className="gap-0">
          {ADMIN_SECTIONS.map((section, index) => (
@@ -36,7 +36,7 @@ export function SessionSettingsTab() {

  return (
    <div className="flex flex-col gap-6">
-      <SettingsCard title="Текущая сессия" description="Проверка токена через GET /v1/auth/session">
+      <SettingsCard title="Текущая сессия" description="Проверка токена через API сессии">
        <QueryState
          data={sessionQ.data}
          isLoading={sessionQ.isLoading && hasStoredToken}
@@ -65,7 +65,7 @@ export function SessionSettingsTab() {
                    </Badge>
                  </ItemTitle>
                  <ItemDescription className="leading-5">
-                    Tenant:{' '}
+                    Арендатор:{' '}
                    <code className="text-foreground font-mono text-xs break-all">
                      {session.tenant_id}
                    </code>
@@ -84,7 +84,7 @@ export function SessionSettingsTab() {
        >
          <SettingRow
            title="Роль"
-            description="Определяет доступ к операциям control plane и CRUD."
+            description="Определяет доступ к операциям плоскости управления и изменению данных."
            titleAddon={
              sessionQ.data ? (
                <Badge variant="info-light" size="sm">
@@ -101,7 +101,7 @@ export function SessionSettingsTab() {
          >
            {sessionQ.data ? (
              <p className="text-muted-foreground text-sm break-words">
-                Ключ с ролью <strong>{sessionQ.data.role}</strong> в tenant{' '}
+                Ключ с ролью <strong>{ROLE_LABELS[sessionQ.data.role] ?? sessionQ.data.role}</strong> у арендатора{' '}
                <code className="font-mono text-xs break-all">{sessionQ.data.tenant_id}</code>.
              </p>
            ) : (
@@ -4,7 +4,7 @@ import { apiKeyRoleRu } from '@/lib/ui-labels'

 export const API_KEY_ROLE_ITEMS: ReadonlyArray<{ value: ApiKeyRole; label: string }> = [
  { value: 'viewer', label: `${apiKeyRoleRu('viewer')} — только чтение` },
-  { value: 'editor', label: `${apiKeyRoleRu('editor')} — CRUD без применения` },
+  { value: 'editor', label: `${apiKeyRoleRu('editor')} — изменение данных без применения` },
  { value: 'operator', label: `${apiKeyRoleRu('operator')} — полный доступ` },
  { value: 'node', label: `${apiKeyRoleRu('node')} — только API ноды` },
 ]
@@ -38,7 +38,7 @@ describe('isReadyCheckOk', () => {

 describe('readyCheckStatusLabel', () => {
  it('labels memory and failures', () => {
-    expect(readyCheckStatusLabel('memory', true)).toBe('Memory')
+    expect(readyCheckStatusLabel('memory', true)).toBe('В памяти')
    expect(readyCheckStatusLabel('ok', true)).toBe('В норме')
    expect(readyCheckStatusLabel('unavailable', false)).toBe('Недоступно')
  })
@@ -54,7 +54,7 @@ export function readyCheckStatusLabel(value: ReadyCheckValue, ok: boolean): stri
  }
  if (typeof value === 'string') {
    const n = value.trim().toLowerCase()
-    if (n === 'memory') return 'Memory'
+    if (n === 'memory') return 'В памяти'
    if (n === 'ok' || n === 'ready' || n === 'healthy' || n === 'true') return 'В норме'
    if (n) return value
  }
@@ -61,18 +61,45 @@ const JOB_STATUS_RU: Record<string, string> = {
  paused: 'Приостановлен',
  disabled: 'Выключен',
  archived: 'В архиве',
-  block: 'block',
-  accept: 'accept',
+  block: 'Блокировать',
+  accept: 'Принимать',
 }

 export function jobStatusRu(status: string): string {
  return JOB_STATUS_RU[status.toLowerCase()] ?? status
 }

+const BGP_SESSION_STATE_RU: Record<string, string> = {
+  Idle: 'Простой',
+  Connect: 'Соединение',
+  Active: 'Поиск',
+  OpenSent: 'Open отправлен',
+  OpenConfirm: 'Open подтверждён',
+  Established: 'Установлена',
+}
+
 export function bgpSessionStateRu(state: string | null | undefined): string {
  if (!state) return '—'
-  if (state === 'Established') return 'Установлена'
-  return state
+  return BGP_SESSION_STATE_RU[state] ?? state
+}
+
+export function speakerRoleRu(role: string | null | undefined): string {
+  switch (role) {
+    case 'master':
+      return 'Основной'
+    case 'primary':
+      return 'Основной'
+    case 'secondary':
+      return 'Резервный'
+    case 'speaker':
+      return 'Спикер'
+    default:
+      return role?.trim() || '—'
+  }
+}
+
+export function cdnSourceKindRu(kind: string): string {
+  return kind === 'json' ? 'JSON' : 'Текст'
 }

 export function speakerOnlineLabel(agentOk: boolean | undefined): string {
@@ -41,11 +41,11 @@ export function useCreateCommunityMutation() {
    mutationFn: (body: BgpCommunityCreate) =>
      apiMutate<BgpCommunity>('/v1/communities', 'POST', body, { idempotent: false }),
    onSuccess: () => {
-      toast.success('Сообщество создано')
+      toast.success('Community создано')
      void qc.invalidateQueries({ queryKey: directoriesKeys.communities() })
    },
    onError: (e) =>
-      toast.error(e instanceof Error ? e.message : 'Не удалось создать сообщество'),
+      toast.error(e instanceof Error ? e.message : 'Не удалось создать community'),
  })
 }

@@ -55,11 +55,11 @@ export function useUpdateCommunityMutation() {
    mutationFn: ({ id, body }: { id: string; body: BgpCommunityPatch }) =>
      apiMutate<BgpCommunity>(`/v1/communities/${id}`, 'PATCH', body, { idempotent: false }),
    onSuccess: () => {
-      toast.success('Сообщество обновлено')
+      toast.success('Community обновлено')
      void qc.invalidateQueries({ queryKey: directoriesKeys.communities() })
    },
    onError: (e) =>
-      toast.error(e instanceof Error ? e.message : 'Не удалось обновить сообщество'),
+      toast.error(e instanceof Error ? e.message : 'Не удалось обновить community'),
  })
 }

@@ -52,7 +52,7 @@ function AccessComponent() {
        icon: <KeyRound className="size-4" />,
        footer: (
          <Badge variant="primary-light" size="sm">
-            в tenant
+            в арендаторе
          </Badge>
        ),
      },
@@ -89,16 +89,16 @@ function AccessComponent() {
  }

  const sessionKindLabel =
-    session?.kind === 'jwt' ? 'Portal JWT' : session?.kind === 'apikey' ? 'API-ключ' : null
+    session?.kind === 'jwt' ? 'JWT портала' : session?.kind === 'apikey' ? 'API-ключ' : null

  const sessionAccessLabel = (() => {
    if (!session) return null
    if (session.kind === 'jwt' || session.is_admin || (session.permissions?.length ?? 0) > 0) {
-      if (session.is_admin) return 'admin (portal)'
+      if (session.is_admin) return 'Администратор (портал)'
      if (sessionCanManageApiKeys(session)) return 'bgp:access:admin'
      return session.permissions?.length
        ? session.permissions.slice(0, 3).join(', ')
-        : 'без access:admin'
+        : 'без права access:admin'
    }
    return session.role || '—'
  })()
@@ -107,7 +107,7 @@ function AccessComponent() {
    <div className="flex min-w-0 flex-col gap-6">
      <PageHeader
        title="Права доступа"
-        description="API-ключи control plane и текущая сессия Bearer-токена."
+        description="API-ключи плоскости управления и текущая сессия."
        actions={
          canManageKeys ? (
            <Button variant="outline" size="sm" onClick={refetchAll} disabled={refreshing}>
@@ -121,7 +121,7 @@ function AccessComponent() {
      {session ? (
        <SettingsCard
          title="Текущая сессия"
-          description="Tenant и права текущего Bearer (API-ключ или portal JWT)."
+          description="Арендатор и права текущей сессии (API-ключ или JWT портала)."
        >
          <ItemGroup className="gap-0">
            <Item className="min-h-0 min-w-0 items-start gap-4 px-5 py-3.5">
@@ -141,7 +141,7 @@ function AccessComponent() {
                </div>
                <ItemDescription className="flex min-w-0 flex-col gap-1 leading-5">
                  <span className="break-all">
-                    Tenant:{' '}
+                    Арендатор:{' '}
                    <code className="text-foreground font-mono text-xs">{session.tenant_id}</code>
                  </span>
                  <span className="break-words">Доступ: {sessionAccessLabel}</span>
@@ -188,8 +188,8 @@ function AccessComponent() {
      ) : session ? (
        <SettingsCard title="API-ключи">
          <p className="text-muted-foreground px-5 py-4 text-sm break-words">
-            Управление API-ключами доступно роли <strong>operator</strong> (API-ключ) или portal JWT
-            с <strong>is_admin</strong> / правом <code className="text-xs">bgp:access:admin</code>.
+            Управление API-ключами доступно роли <strong>оператор</strong> (API-ключ) или JWT портала
+            с правом администратора / <code className="text-xs">bgp:access:admin</code>.
            Текущий доступ: <span className="font-mono">{sessionAccessLabel}</span>.
          </p>
        </SettingsCard>
@@ -45,7 +45,7 @@ function DirectoriesComponent() {

  const items: KpiStatItem[] = [
    {
-      label: 'Сообщества BGP',
+      label: 'BGP community',
      value: communities.length,
      icon: <Tags className="size-4" />,
      footer: (
@@ -70,7 +70,7 @@ function DirectoriesComponent() {
      icon: <BookText className="size-4" />,
      footer: (
        <Badge variant="outline" size="sm">
-          все модули tenant
+          все модули арендатора
        </Badge>
      ),
    },
@@ -114,7 +114,7 @@ function DirectoriesComponent() {
    <div className="flex flex-col gap-6">
      <PageHeader
        title="Справочники"
-        description="Сообщества BGP и DoH-профили для резолвинга доменов"
+        description="BGP community и DoH-профили для резолвинга доменов"
        actions={
          <Button
            variant="outline"
@@ -136,13 +136,13 @@ function DirectoriesComponent() {
      <BadgeTabs
        defaultValue="communities"
        items={[
-          { value: 'communities', label: 'Сообщества BGP', count: communities.length },
+          { value: 'communities', label: 'BGP community', count: communities.length },
          { value: 'doh', label: 'DoH профили', count: dohProfiles.length, badgeVariant: 'info-light' },
        ]}
      >
        <TabsContent value="communities" className="mt-0">
          <FrameDataGrid
-            title="Сообщества BGP"
+            title="BGP community"
            description="Теги для префиксов в фильтрах BIRD"
            actions={addCommunityButton}
          >
@@ -152,7 +152,7 @@ function DirectoriesComponent() {
              isError={communitiesQ.isError}
              error={communitiesQ.error}
              empty={communities.length === 0}
-              emptyTitle="Нет сообществ"
+              emptyTitle="Нет community"
              emptyAction={addCommunityButton}
              skeleton={<TableSkeleton rows={4} cols={3} />}
              onRetry={() => communitiesQ.refetch()}
@@ -127,7 +127,7 @@ function MonitoringComponent() {
          <div className="grid items-stretch gap-2 md:gap-3 lg:grid-cols-2">
            <FrameDataGrid
              title="Доступность и готовность"
-              description="GET /v1/health · GET /v1/ready"
+              description="Проверки живучести и готовности (/v1/health, /v1/ready)"
            >
              <QueryState
                data={readyQ.data}
@@ -148,7 +148,7 @@ function MonitoringComponent() {
                  BGP на API-хосте
                </span>
              }
-              description="GET /v1/bird/status"
+              description="Статус BIRD на хосте API"
              className="h-full"
              contentClassName="px-5 py-4"
            >
@@ -169,7 +169,7 @@ function MonitoringComponent() {
            <div className="flex flex-col gap-2 md:gap-3">
              <SegmentedProgressCard
                title="Задачи"
-                description="Последние 100 задач · GET /v1/jobs"
+                description="Последние 100 задач"
                primary={{
                  value: jobs.filter((j) => j.status === 'running' || j.status === 'queued').length,
                  label: 'Активных',
@@ -230,11 +230,10 @@ function MonitoringComponent() {
                </li>
                <li>
                  <span className="font-medium text-foreground">Готовность не «Готов».</span> Сначала{' '}
-                  <code className="text-xs">postgres</code>, затем <code className="text-xs">store</code>{' '}
-                  и <code className="text-xs">jobs</code> в проверках.
+                  <code className="text-xs">PostgreSQL</code>, затем хранилище и очередь задач в проверках.
                </li>
                <li>
-                  <span className="font-medium text-foreground">Низкий ratio BGP.</span> Проверьте{' '}
+                  <span className="font-medium text-foreground">Низкая доля установленных BGP-сессий.</span> Проверьте{' '}
                  <code className="text-xs">/v1/bird/status</code>, затем состояние пиров в Сети.
                </li>
                <li>
@@ -250,7 +249,7 @@ function MonitoringComponent() {
          <IllustratedEmptyState
            icon={Database}
            title="PostgreSQL"
-            description="Статус соединения и пул отображаются в readiness-проверке на вкладке «Система» (check postgres)."
+            description="Состояние соединения и пула видно в проверке готовности на вкладке «Система»."
          />
        </TabsContent>

@@ -258,7 +257,7 @@ function MonitoringComponent() {
          <IllustratedEmptyState
            icon={FileText}
            title="Файловые логи"
-            description="Логи API и pipeline настраиваются переменной EVOBGP_LOG_* и управляются в Настройках BIRD."
+            description="Логи API и конвейера задаются переменной EVOBGP_LOG_* и управляются в Настройках BIRD."
          />
        </TabsContent>
      </BadgeTabs>
@@ -2,29 +2,38 @@

 ## CI (Gitea Actions)

-Сборка образов — **`docker buildx bake`** (`deploy/docker/docker-bake.hcl`), не отдельные `docker build`.
+Сборка образов — **`docker buildx bake`** ([docker-bake.hcl](docker-bake.hcl)), не отдельные `docker build`.

-**Publish:** push в `main` после quality gates — job **release** в [.gitea/workflows/ci.yaml](../.gitea/workflows/ci.yaml): semantic-release + bake с `VERSION` из релиза.
+**Publish:** push в `main` после quality gates — workflow [CD](../../.gitea/workflows/cd.yaml) job **publish**: semantic-release + зеркало base-образов + bake с `VERSION` из релиза.

-Локально BuildKit также кэширует `/go/pkg/mod` и `~/.cache/go-build` через `RUN --mount=type=cache`.
+Bake читает переменные из **окружения** (`REGISTRY`, `IMAGE_TAG`, `CACHE_REF_*`, `BASE_*`). Скрипт [write-bake-override.sh](write-bake-override.sh) — опциональный helper для локальной отладки.

-| Было | Стало |
-|------|--------|
-| 8× `go mod download` + 8× `go build` (разные BIN) | 1× download + 1× компиляция всех `cmd/*` |
-| 2× сборка BIRD из исходников (api, all) | 1× stage `birdc`, копируется в runtime |
-| 2× `npm ci` (web, web-all) | 1× `web-deps` + 1× `web-build` + два nginx-образа (общий артефакт) |
-| 8 runner'ов с checkout/login | 1 job `docker-go`, 1 job `docker-web` |
+BuildKit кэширует `/go/pkg/mod`, `~/.cache/go-build` и pnpm store через `RUN --mount=type=cache`. На CI mounts живут, пока named builder `evobgp` не удаляют (`cleanup: false`).

-Кэш registry (переменные bake):
+### Слои и runtime

- `git.shx.one/<owner>/evobgp-buildcache:go-buildcache` — **запись** только из target `go-build-all`
- `git.shx.one/<owner>/evobgp-buildcache:web-buildcache` — **запись** только из target `web-build`
+| Образ | Runtime base | Заметка |
+|-------|----------------|---------|
+| scheduler, ingest, render, deploy, node | `gcr.io/distroless/static-debian12:nonroot` | static Go (`CGO_ENABLED=0`), без shell |
+| api, all | `debian:bookworm-slim` + `birdc` | только клиент birdc, без демона `bird` |
+| agent | тот же Ubuntu+bird2, что bird2 | общие слои с `evobgp-bird2` |
+| bird2 | Ubuntu Noble + пакет bird2 | |
+| web, web-all | `nginx:1.27-alpine` | `worker_processes 1` |

-Остальные bake-target’ы только `cache-from` (чтение). Параллельный `cache-to` в один ref ломает manifest в registry (`content descriptor … not found`).
+Сборка Go: `golang:1.24-alpine`. Context режется корневым [.dockerignore](../../.dockerignore).

-Локально BuildKit также кэширует `/go/pkg/mod` и `~/.cache/go-build` через `RUN --mount=type=cache`.
+### Кэш registry

-Если CI падает на «not found» после смены схемы кэша — один раз удалите теги `evobgp-buildcache:go-buildcache` и `:web-buildcache` в registry и пересоберите.
+- `git.shx.one/<owner>/evobgp-buildcache:go-buildcache` — **запись** только из `go-build-all`
+- `git.shx.one/<owner>/evobgp-buildcache:web-buildcache` — **запись** только из `web-build`
+- `git.shx.one/<owner>/evobgp-buildcache:birdc-buildcache` — **запись** только из `go-birdc`
+- `git.shx.one/<owner>/evobgp-buildcache:base-*` — зеркало FROM с **Docker Hub** (`docker.io/library/…`; distroless — `gcr.io`). Только `linux/amd64`; skip если тег уже в Gitea. Неуспешный copy не валит CD — bake берёт Docker Hub FROM для этой базы.
+
+`pull = false` в bake: не перекачивать FROM, если слой уже в builder. Не запускайте `docker system prune -a` на runner.
+
+Параллельный `cache-to` в один ref ломает manifest (`content descriptor … not found`).
+
+Если CI падает на «not found» после смены схемы кэша — один раз удалите теги `evobgp-buildcache:*` в registry и пересоберите.

 ## Локальная сборка

@@ -37,20 +46,24 @@ export IMAGE_TAG=latest
 export SHORT_SHA=$(git rev-parse --short HEAD)
 export VERSION=dev
 export BUILD_TIME=
-sh write-bake-override.sh
-docker buildx bake --allow=fs.read=../.. -f docker-bake.hcl -f docker-bake.override.hcl go-images
-docker buildx bake --allow=fs.read=../.. -f docker-bake.hcl -f docker-bake.override.hcl web-images
+docker buildx bake --allow=fs.read=../.. -f docker-bake.hcl go-images
+docker buildx bake --allow=fs.read=../.. -f docker-bake.hcl web-images
 ```

-В `docker-bake.hcl`: `context = "../.."` (корень репо), `dockerfile = "deploy/docker/…"` (путь от корня репо). **CI:** `write-bake-override.sh` + `--allow=fs.read=$GITHUB_WORKSPACE` в `.gitea/workflows/ci.yaml`.
+Проверка манифеста без сборки:

-Один образ (legacy):
+```bash
+docker buildx bake --allow=fs.read=../.. -f docker-bake.hcl --print default
+```
+
+В `docker-bake.hcl`: `context = "../.."` резолвится **от cwd** (каталог `deploy/docker/`). `dockerfile` — путь от этого context (корень репо). Из корня репо не вызывать bake с `-f deploy/docker/docker-bake.hcl`: получится `lstat ../../deploy`. Можно задать `BUILDX_BAKE_FILE_RELATIVE_PATHS=1`.
+
+Один образ (legacy, target `build-all`):

 ```bash
 docker build -f deploy/docker/gobinary/Dockerfile \
  --target build-all \
-  --build-arg BIN=evobgp-api \
-  -t evobgp-api:local .
+  -t evobgp-build-all:local .
 ```

-Runtime-образы в bake ожидают stage `build-all` (через bake contexts), не отдельный `--build-arg BIN` на старый target `build`.
+Runtime-образы в bake ожидают stage `build-all` (через bake contexts).
@@ -1,10 +1,17 @@
+# syntax=docker/dockerfile:1.7
 # BIRD из репозитория Ubuntu (Noble 24.04 LTS) — актуальнее пакета Debian bookworm.
-# Сборка из корня репозитория: docker build -f deploy/docker/bird2/Dockerfile .
-# Зеркало ECR Public вместо прямого pull с Docker Hub.
-FROM public.ecr.aws/docker/library/ubuntu:noble
-RUN apt-get update \
-	&& apt-get install -y --no-install-recommends bird2 \
-	&& rm -rf /var/lib/apt/lists/*
+# Stage bird2-base общий с evobgp-agent (одинаковые слои на speaker-VPS).
+ARG BASE_UBUNTU=docker.io/library/ubuntu:noble
+
+FROM ${BASE_UBUNTU} AS bird2-base
+RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
+    --mount=type=cache,target=/var/lib/apt,sharing=locked \
+    rm -f /etc/apt/apt.conf.d/docker-clean \
+    && apt-get update \
+    && apt-get install -y --no-install-recommends bird2 ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+FROM bird2-base AS bird2
 COPY deploy/bird/bird.conf /etc/bird/bird.conf
 RUN mkdir -p /etc/bird/bird.d
 EXPOSE 179
@@ -1,7 +1,7 @@
 # Единая сборка образов EvoBGP (buildx bake: -f deploy/docker/docker-bake.hcl).
-# context = "../.." — корень репозитория (относительно этого файла).
-# dockerfile — путь от корня репозитория (относительно context).
-# Переменные: REGISTRY, IMAGE_TAG, CACHE_REF_GO, CACHE_REF_WEB
+# context = "../.." — корень репо. Bake резолвит context от cwd (не от HCL),
+# поэтому вызов из deploy/docker/ либо BUILDX_BAKE_FILE_RELATIVE_PATHS=1.
+# Переменные Bake читаются из окружения (см. docs.docker.com/build/bake/variables/).

 variable "REGISTRY" {
  default = "git.shx.one/evobgp"
@@ -35,14 +35,40 @@ variable "CACHE_REF_WEB" {
  default = ""
 }

+variable "CACHE_REF_BIRDC" {
+  default = ""
+}
+
+variable "BASE_GOLANG" {
+  default = "docker.io/library/golang:1.24-alpine"
+}
+
+variable "BASE_DEBIAN" {
+  default = "docker.io/library/debian:bookworm-slim"
+}
+
+variable "BASE_DISTROLESS" {
+  default = "gcr.io/distroless/static-debian12:nonroot"
+}
+
+variable "BASE_NODE" {
+  default = "docker.io/library/node:22-alpine"
+}
+
+variable "BASE_NGINX" {
+  default = "docker.io/library/nginx:1.27-alpine"
+}
+
+variable "BASE_UBUNTU" {
+  default = "docker.io/library/ubuntu:noble"
+}
+
 function "go-cache-from" {
  params = []
  result = notequal("", CACHE_REF_GO) ? ["type=registry,ref=${CACHE_REF_GO}"] : []
 }

-# Экспорт кэша — только go-build-all / web-build (один writer на ref).
-# Несколько target с cache-to в один ref и mode=max дают гонку в registry
-# (content descriptor not found при параллельном bake).
+# Экспорт кэша — один writer на ref (параллельный cache-to в один ref ломает manifest).
 function "go-cache-to-export" {
  params = []
  result = notequal("", CACHE_REF_GO) ? ["type=registry,ref=${CACHE_REF_GO},mode=max"] : []
@@ -58,6 +84,16 @@ function "web-cache-to-export" {
  result = notequal("", CACHE_REF_WEB) ? ["type=registry,ref=${CACHE_REF_WEB},mode=max"] : []
 }

+function "birdc-cache-from" {
+  params = []
+  result = notequal("", CACHE_REF_BIRDC) ? ["type=registry,ref=${CACHE_REF_BIRDC}"] : []
+}
+
+function "birdc-cache-to-export" {
+  params = []
+  result = notequal("", CACHE_REF_BIRDC) ? ["type=registry,ref=${CACHE_REF_BIRDC},mode=max"] : []
+}
+
 group "default" {
  targets = ["go-images", "web-images", "evobgp-bird2"]
 }
@@ -75,26 +111,38 @@ group "go-images" {
  ]
 }

-# web-deps / web-build — только зависимости (contexts), без tags; при --push в группе не указывать.
 group "web-images" {
  targets = ["evobgp-web", "evobgp-web-all"]
 }

+target "_common" {
+  platforms = ["linux/amd64"]
+  pull      = false
+}
+
+target "_go-bases" {
+  args = {
+    BASE_GOLANG     = BASE_GOLANG
+    BASE_DEBIAN     = BASE_DEBIAN
+    BASE_DISTROLESS = BASE_DISTROLESS
+  }
+}
+
 # --- Go: go mod download → все cmd/* → birdc (один раз) → runtime-образы ---

 target "go-deps" {
+  inherits   = ["_common", "_go-bases"]
  context    = "../.."
  dockerfile = "deploy/docker/gobinary/Dockerfile"
  target     = "deps"
-  platforms  = ["linux/amd64"]
  cache-from = go-cache-from()
 }

 target "go-build-all" {
+  inherits   = ["_common", "_go-bases"]
  context    = "../.."
  dockerfile = "deploy/docker/gobinary/Dockerfile"
  target     = "build-all"
-  platforms  = ["linux/amd64"]
  args = {
    VERSION    = VERSION
    GIT_SHA    = notequal("", SHA_FULL) ? SHA_FULL : SHORT_SHA
@@ -108,18 +156,19 @@ target "go-build-all" {
 }

 target "go-birdc" {
+  inherits   = ["_common", "_go-bases"]
  context    = "../.."
  dockerfile = "deploy/docker/gobinary/Dockerfile"
  target     = "birdc"
-  platforms  = ["linux/amd64"]
-  cache-from = go-cache-from()
+  cache-from = birdc-cache-from()
+  cache-to   = birdc-cache-to-export()
 }

 target "_go-runtime" {
+  inherits   = ["_common", "_go-bases"]
  context    = "../.."
  dockerfile = "deploy/docker/gobinary/Dockerfile"
  target     = "runtime"
-  platforms  = ["linux/amd64"]
  contexts = {
    build-all = "target:go-build-all"
  }
@@ -127,15 +176,15 @@ target "_go-runtime" {
 }

 target "_go-runtime-birdc" {
+  inherits   = ["_common", "_go-bases"]
  context    = "../.."
  dockerfile = "deploy/docker/gobinary/Dockerfile"
  target     = "runtime-birdc"
-  platforms  = ["linux/amd64"]
  contexts = {
    build-all = "target:go-build-all"
    birdc     = "target:go-birdc"
  }
-  cache-from = go-cache-from()
+  cache-from = concat(go-cache-from(), birdc-cache-from())
 }

 function "image-tags" {
@@ -198,32 +247,51 @@ target "evobgp-node" {
  tags     = image-tags("evobgp-node")
 }

+target "evobgp-bird2-base" {
+  inherits   = ["_common"]
+  context    = "../.."
+  dockerfile = "deploy/docker/bird2/Dockerfile"
+  target     = "bird2-base"
+  args = {
+    BASE_UBUNTU = BASE_UBUNTU
+  }
+}
+
 target "evobgp-agent" {
+  inherits   = ["_common"]
  context    = "../.."
  dockerfile = "deploy/docker/evobgp-agent/Dockerfile"
-  platforms  = ["linux/amd64"]
  contexts = {
-    build-all = "target:go-build-all"
+    build-all  = "target:go-build-all"
+    bird2-base = "target:evobgp-bird2-base"
  }
  cache-from = go-cache-from()
  tags       = image-tags("evobgp-agent")
 }

-# --- Web: npm ci (кэш) → build → nginx ---
+# --- Web ---

 target "web-deps" {
+  inherits   = ["_common"]
  context    = "../.."
  dockerfile = "deploy/docker/evobgp-web/Dockerfile"
  target     = "deps"
-  platforms  = ["linux/amd64"]
+  args = {
+    BASE_NODE  = BASE_NODE
+    BASE_NGINX = BASE_NGINX
+  }
  cache-from = web-cache-from()
 }

 target "web-build" {
+  inherits   = ["_common"]
  context    = "../.."
  dockerfile = "deploy/docker/evobgp-web/Dockerfile"
  target     = "build"
-  platforms  = ["linux/amd64"]
+  args = {
+    BASE_NODE  = BASE_NODE
+    BASE_NGINX = BASE_NGINX
+  }
  contexts = {
    deps = "target:web-deps"
  }
@@ -232,34 +300,49 @@ target "web-build" {
 }

 target "evobgp-web" {
+  inherits   = ["_common"]
  context    = "../.."
  dockerfile = "deploy/docker/evobgp-web/Dockerfile"
  target     = "web"
-  platforms  = ["linux/amd64"]
  contexts = {
    web-artifacts = "target:web-build"
  }
-  args       = { EVOBGP_UPSTREAM = "evobgp-api" }
+  args = {
+    EVOBGP_UPSTREAM = "evobgp-api"
+    BASE_NODE       = BASE_NODE
+    BASE_NGINX      = BASE_NGINX
+  }
  cache-from = web-cache-from()
  tags       = image-tags("evobgp-web")
 }

 target "evobgp-web-all" {
+  inherits   = ["_common"]
  context    = "../.."
  dockerfile = "deploy/docker/evobgp-web/Dockerfile"
  target     = "web"
-  platforms  = ["linux/amd64"]
  contexts = {
    web-artifacts = "target:web-build"
  }
-  args       = { EVOBGP_UPSTREAM = "evobgp-all" }
+  args = {
+    EVOBGP_UPSTREAM = "evobgp-all"
+    BASE_NODE       = BASE_NODE
+    BASE_NGINX      = BASE_NGINX
+  }
  cache-from = web-cache-from()
  tags       = image-tags("evobgp-web-all")
 }

 target "evobgp-bird2" {
+  inherits   = ["_common"]
  context    = "../.."
  dockerfile = "deploy/docker/bird2/Dockerfile"
-  platforms  = ["linux/amd64"]
-  tags       = image-tags("evobgp-bird2")
+  target     = "bird2"
+  args = {
+    BASE_UBUNTU = BASE_UBUNTU
+  }
+  contexts = {
+    bird2-base = "target:evobgp-bird2-base"
+  }
+  tags = image-tags("evobgp-bird2")
 }
@@ -1,9 +1,6 @@
 # syntax=docker/dockerfile:1.7
-# Агент: бинарь из общего build-all (docker-bake.hcl → contexts.build-all), bird2 из apt.
-FROM public.ecr.aws/docker/library/ubuntu:noble
-RUN apt-get update \
-    && apt-get install -y --no-install-recommends bird2 ca-certificates \
-    && rm -rf /var/lib/apt/lists/*
+# Агент: бинарь из bake context build-all, runtime = тот же bird2-base, что evobgp-bird2.
+FROM bird2-base
 ARG BIN=evobgp-agent
 COPY --from=build-all /out/${BIN} /usr/local/bin/evobgp-agent
 WORKDIR /etc/bird
@@ -1,9 +1,10 @@
 # syntax=docker/dockerfile:1.7
 # React + Vite статическая панель EvoBGP + nginx.
 # Финальный stage `web` ожидает bake-контекст web-artifacts (= target:web-build).
-# Сборка ведётся из корня репозитория (context = "../.." в docker-bake.hcl).
+ARG BASE_NODE=docker.io/library/node:22-alpine
+ARG BASE_NGINX=docker.io/library/nginx:1.27-alpine

-FROM public.ecr.aws/docker/library/node:22-alpine AS deps
+FROM ${BASE_NODE} AS deps
 WORKDIR /repo
 RUN corepack enable && corepack prepare [email protected] --activate
 COPY pnpm-workspace.yaml pnpm-lock.yaml package.json ./
@@ -16,11 +17,13 @@ FROM deps AS build
 COPY tsconfig.base.json ./
 COPY apps/web/ ./apps/web/
 COPY packages/ui/ ./packages/ui/
-RUN pnpm --filter @evobgp/web run build
+RUN --mount=type=cache,target=/root/.local/share/pnpm/store,sharing=locked \
+    pnpm --filter @evobgp/web run build

-FROM public.ecr.aws/docker/library/nginx:1.27-alpine AS web
+FROM ${BASE_NGINX} AS web
 ARG EVOBGP_UPSTREAM=evobgp-api
 COPY deploy/docker/evobgp-web/nginx.conf /tmp/nginx-default.conf
 RUN sed -e "s/evobgp-api/${EVOBGP_UPSTREAM}/g" /tmp/nginx-default.conf > /etc/nginx/conf.d/default.conf \
-    && rm -f /tmp/nginx-default.conf
+    && rm -f /tmp/nginx-default.conf \
+    && sed -i 's/^[[:space:]]*worker_processes[[:space:]]*auto;/worker_processes 1;/' /etc/nginx/nginx.conf
 COPY --from=web-artifacts /repo/apps/web/dist /usr/share/nginx/html
@@ -4,6 +4,7 @@ server {
    root /usr/share/nginx/html;
    gzip on;
    gzip_types text/css application/javascript application/json image/svg+xml;
+    gzip_min_length 256;

    # Docker embedded DNS: без resolver nginx кэширует IP upstream при старте —
    # после recreate evobgp-all остаётся 502 (connection refused на старый IP).
@@ -1,19 +1,23 @@
 # syntax=docker/dockerfile:1.7
 # Универсальная сборка бинарей cmd/* (ARG BIN) или всех сразу (target build-all).
-# INSTALL_BIRDC=1 — birdc из stage birdc (собирается один раз, переиспользуется api/all).
+# Воркеры (runtime): distroless static. api/all (runtime-birdc): debian-slim + birdc.
 # CI: docker buildx bake -f deploy/docker/docker-bake.hcl
-FROM public.ecr.aws/docker/library/golang:1.24-bookworm AS deps
+ARG BASE_GOLANG=docker.io/library/golang:1.24-alpine
+ARG BASE_DEBIAN=docker.io/library/debian:bookworm-slim
+ARG BASE_DISTROLESS=gcr.io/distroless/static-debian12:nonroot
+
+FROM ${BASE_GOLANG} AS deps
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN --mount=type=cache,target=/go/pkg/mod,sharing=locked \
    go mod download

 FROM deps AS build-all
-COPY . .
 ARG VERSION=dev
 ARG GIT_SHA=unknown
 ARG BUILD_TIME=
-RUN --mount=type=cache,target=/go/pkg/mod,sharing=locked \
+RUN --mount=type=bind,target=. \
+    --mount=type=cache,target=/go/pkg/mod,sharing=locked \
    --mount=type=cache,target=/root/.cache/go-build,sharing=locked \
    set -eux; \
    mkdir -p /out; \
@@ -29,12 +33,12 @@ RUN --mount=type=cache,target=/go/pkg/mod,sharing=locked \

 # Один бинарь (локальная сборка); в CI — build-all + runtime.
 FROM deps AS build
-COPY . .
 ARG BIN=evobgp-api
 ARG VERSION=dev
 ARG GIT_SHA=unknown
 ARG BUILD_TIME=
-RUN --mount=type=cache,target=/go/pkg/mod,sharing=locked \
+RUN --mount=type=bind,target=. \
+    --mount=type=cache,target=/go/pkg/mod,sharing=locked \
    --mount=type=cache,target=/root/.cache/go-build,sharing=locked \
    CGO_ENABLED=0 go build -trimpath \
      -ldflags="-s -w \
@@ -43,29 +47,33 @@ RUN --mount=type=cache,target=/go/pkg/mod,sharing=locked \
        -X evobgp/internal/version.BuildTime=${BUILD_TIME}" \
      -o /out/evobgp "./cmd/${BIN}"

-FROM public.ecr.aws/docker/library/debian:bookworm-slim AS birdc
+FROM ${BASE_DEBIAN} AS birdc
 ARG BIRD_VERSION=2.14
 COPY deploy/docker/bird/bird-from-source.sh /tmp/bird-from-source.sh
-RUN chmod +x /tmp/bird-from-source.sh \
+RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
+    --mount=type=cache,target=/var/lib/apt,sharing=locked \
+    rm -f /etc/apt/apt.conf.d/docker-clean \
+    && chmod +x /tmp/bird-from-source.sh \
    && BIRD_VERSION="${BIRD_VERSION}" /tmp/bird-from-source.sh \
    && rm -f /tmp/bird-from-source.sh

-FROM public.ecr.aws/docker/library/debian:bookworm-slim AS runtime-base
-RUN apt-get update \
-    && apt-get install -y --no-install-recommends ca-certificates \
-    && rm -rf /var/lib/apt/lists/*
-
-FROM runtime-base AS runtime
+# scheduler / ingest / render / deploy / node — static Go, без shell.
+FROM ${BASE_DISTROLESS} AS runtime
 ARG BIN=evobgp-api
 COPY --from=build-all /out/${BIN} /usr/local/bin/evobgp
-COPY scripts/firewall /opt/evobgp/scripts/firewall
-ENV EVOBGP_FIREWALL_SCRIPTS=/opt/evobgp/scripts/firewall
 EXPOSE 8080
 ENTRYPOINT ["/usr/local/bin/evobgp"]

-FROM runtime AS runtime-birdc
-# birdc: динамическая линковка readline + ncurses (debian bookworm).
-RUN apt-get update \
-    && apt-get install -y --no-install-recommends libreadline8 libncurses6 \
+# api / all — birdc (readline + ncurses). Только клиент birdc, без демона bird.
+FROM ${BASE_DEBIAN} AS runtime-birdc
+RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
+    --mount=type=cache,target=/var/lib/apt,sharing=locked \
+    rm -f /etc/apt/apt.conf.d/docker-clean \
+    && apt-get update \
+    && apt-get install -y --no-install-recommends ca-certificates libreadline8 libncurses6 \
    && rm -rf /var/lib/apt/lists/*
-COPY --from=birdc /usr/local/sbin/bird /usr/local/sbin/birdc /usr/local/sbin/
+ARG BIN=evobgp-api
+COPY --from=build-all /out/${BIN} /usr/local/bin/evobgp
+COPY --from=birdc /usr/local/sbin/birdc /usr/local/sbin/birdc
+EXPOSE 8080
+ENTRYPOINT ["/usr/local/bin/evobgp"]
@@ -0,0 +1,82 @@
+#!/usr/bin/env sh
+# Copy-by-digest зеркало базовых образов в Gitea Container Registry (без rebuild).
+# Требует: docker login в REGISTRY host, docker buildx.
+# REGISTRY=git.shx.one/<owner>  (без суффикса /evobgp-buildcache)
+#
+# Источник library-образов — Docker Hub (docker.io), не public.ecr.aws (429 Too Many Requests).
+# Если тег уже есть в Gitea — skip (без повторного pull).
+# Копируем только linux/amd64 — bake platforms совпадает, multi-arch индекс не нужен.
+# Шаг CD не должен падать: неуспешный copy оставляет bake на Docker Hub FROM для этой базы.
+set -eu
+REGISTRY="${REGISTRY:?REGISTRY required (git.shx.one/<owner>)}"
+CACHE_REPO="${REGISTRY}/evobgp-buildcache"
+ENV_FILE="${MIRROR_ENV_FILE:-}"
+PLATFORM="${MIRROR_PLATFORM:-linux/amd64}"
+RETRIES="${MIRROR_RETRIES:-4}"
+
+tmp="$(mktemp)"
+cleanup() { rm -f "$tmp"; }
+trap cleanup EXIT
+
+dest_exists() {
+  docker buildx imagetools inspect "$1" >/dev/null 2>&1
+}
+
+copy_retry() {
+  src="$1"
+  dest="$2"
+  n=0
+  while [ "$n" -lt "$RETRIES" ]; do
+    n=$((n + 1))
+    if docker buildx imagetools create --platform "$PLATFORM" --tag "$dest" "$src"; then
+      return 0
+    fi
+    delay=$((n * 25))
+    echo "mirror retry ${n}/${RETRIES}, sleep ${delay}s: ${dest}"
+    sleep "$delay"
+  done
+  return 1
+}
+
+mirror() {
+  src="$1"
+  tag="$2"
+  var="$3"
+  dest="${CACHE_REPO}:${tag}"
+  if dest_exists "$dest"; then
+    echo "skip (already in registry): ${dest}"
+    printf '%s=%s\n' "$var" "$dest" >>"$tmp"
+    return 0
+  fi
+  echo "mirror ${src} -> ${dest} (${PLATFORM})"
+  if copy_retry "$src" "$dest"; then
+    printf '%s=%s\n' "$var" "$dest" >>"$tmp"
+    return 0
+  fi
+  echo "warn: ${dest} not mirrored — bake uses Docker Hub FROM for ${var}"
+  return 0
+}
+
+mirror "docker.io/library/golang:1.24-alpine" "base-golang-1.24-alpine" BASE_GOLANG
+sleep 8
+mirror "docker.io/library/debian:bookworm-slim" "base-debian-bookworm-slim" BASE_DEBIAN
+sleep 8
+mirror "docker.io/library/node:22-alpine" "base-node-22-alpine" BASE_NODE
+sleep 8
+mirror "docker.io/library/nginx:1.27-alpine" "base-nginx-1.27-alpine" BASE_NGINX
+sleep 8
+mirror "docker.io/library/ubuntu:noble" "base-ubuntu-noble" BASE_UBUNTU
+sleep 8
+mirror "gcr.io/distroless/static-debian12:nonroot" "base-distroless-static-debian12-nonroot" BASE_DISTROLESS
+
+echo "----- mirrored BASE_* -----"
+cat "$tmp"
+if [ -n "$ENV_FILE" ]; then
+  env_dir="$(dirname "$ENV_FILE")"
+  if [ -d "$env_dir" ]; then
+    cp "$tmp" "$ENV_FILE"
+    echo "wrote ${ENV_FILE}"
+  else
+    echo "warn: MIRROR_ENV_FILE dir missing (${env_dir}) — skip write"
+  fi
+fi
@@ -1,5 +1,6 @@
 #!/usr/bin/env sh
-# Writes docker-bake.override.hcl for CI (buildx without --var support).
+# Optional helper for local bake when env-based Bake variables are inconvenient.
+# CI задаёт те же имена переменных в окружении и вызывает bake без этого файла.
 set -eu
 OUT="${1:-docker-bake.override.hcl}"
 REGISTRY="${REGISTRY:?REGISTRY required}"
@@ -10,30 +11,29 @@ VERSION="${VERSION:-dev}"
 BUILD_TIME="${BUILD_TIME:-}"
 CACHE_REF_GO="${CACHE_REF_GO:-}"
 CACHE_REF_WEB="${CACHE_REF_WEB:-}"
+CACHE_REF_BIRDC="${CACHE_REF_BIRDC:-}"
+BASE_GOLANG="${BASE_GOLANG:-}"
+BASE_DEBIAN="${BASE_DEBIAN:-}"
+BASE_DISTROLESS="${BASE_DISTROLESS:-}"
+BASE_NODE="${BASE_NODE:-}"
+BASE_NGINX="${BASE_NGINX:-}"
+BASE_UBUNTU="${BASE_UBUNTU:-}"
 cat >"$OUT" <<EOF
 # Generated by deploy/docker/write-bake-override.sh — do not commit.
-variable "REGISTRY" {
-  default = "${REGISTRY}"
-}
-variable "IMAGE_TAG" {
-  default = "${IMAGE_TAG}"
-}
-variable "SHORT_SHA" {
-  default = "${SHORT_SHA}"
-}
-variable "SHA_FULL" {
-  default = "${SHA_FULL}"
-}
-variable "VERSION" {
-  default = "${VERSION}"
-}
-variable "BUILD_TIME" {
-  default = "${BUILD_TIME}"
-}
-variable "CACHE_REF_GO" {
-  default = "${CACHE_REF_GO}"
-}
-variable "CACHE_REF_WEB" {
-  default = "${CACHE_REF_WEB}"
-}
+variable "REGISTRY" { default = "${REGISTRY}" }
+variable "IMAGE_TAG" { default = "${IMAGE_TAG}" }
+variable "SHORT_SHA" { default = "${SHORT_SHA}" }
+variable "SHA_FULL" { default = "${SHA_FULL}" }
+variable "VERSION" { default = "${VERSION}" }
+variable "BUILD_TIME" { default = "${BUILD_TIME}" }
+variable "CACHE_REF_GO" { default = "${CACHE_REF_GO}" }
+variable "CACHE_REF_WEB" { default = "${CACHE_REF_WEB}" }
+variable "CACHE_REF_BIRDC" { default = "${CACHE_REF_BIRDC}" }
 EOF
+# BASE_* — только если заданы (иначе bake берёт default из docker-bake.hcl).
+if [ -n "$BASE_GOLANG" ]; then printf 'variable "BASE_GOLANG" { default = "%s" }\n' "$BASE_GOLANG" >>"$OUT"; fi
+if [ -n "$BASE_DEBIAN" ]; then printf 'variable "BASE_DEBIAN" { default = "%s" }\n' "$BASE_DEBIAN" >>"$OUT"; fi
+if [ -n "$BASE_DISTROLESS" ]; then printf 'variable "BASE_DISTROLESS" { default = "%s" }\n' "$BASE_DISTROLESS" >>"$OUT"; fi
+if [ -n "$BASE_NODE" ]; then printf 'variable "BASE_NODE" { default = "%s" }\n' "$BASE_NODE" >>"$OUT"; fi
+if [ -n "$BASE_NGINX" ]; then printf 'variable "BASE_NGINX" { default = "%s" }\n' "$BASE_NGINX" >>"$OUT"; fi
+if [ -n "$BASE_UBUNTU" ]; then printf 'variable "BASE_UBUNTU" { default = "%s" }\n' "$BASE_UBUNTU" >>"$OUT"; fi
@@ -11,7 +11,7 @@

 ## Готовые образы без сборки (Container Registry Gitea)

-После успешного CI (push в `main` или `master`) образы публикуются в **Container Registry** вашего Gitea. В workflow зафиксирован хост реестра **`git.shx.one`**; имя владельца в пути образа — **в нижнем регистре**, как у `github.repository_owner` в CI (например, пользователь `Denozord` → префикс `denozord`).
+После успешного **CD** (push в `main` или `master`, job **publish**) образы публикуются в **Container Registry** вашего Gitea. В workflow зафиксирован хост реестра **`git.shx.one`**; имя владельца в пути образа — **в нижнем регистре**, как у `github.repository_owner` в CI (например, пользователь `Denozord` → префикс `denozord`).

 ### Шаблон имени и теги

@@ -23,21 +23,22 @@ EvoBGP использует [Conventional Commits](https://www.conventionalcommi

 Подробные правила сообщений коммитов: [.cursor/rules/conventional-commits.mdc](../.cursor/rules/conventional-commits.mdc).

-## CI-пайплайн (один push в main)
+## CI-пайплайн (push в main)

 ```text
 push/merge в main
-  → CI: openapi, web, go, bird2 (параллельно)
-  → job release (в том же workflow, после quality gates):
+  → workflow CD: quality (openapi, web, go, bird2)
+  → job publish:
       → semantic-release: git tag vX.Y.Z на текущий commit (без доп. commit)
       → Gitea Release + CHANGELOG.md как attachment
-       → docker buildx bake с VERSION=X.Y.Z
+       → зеркало base-образов в evobgp-buildcache:base-*
+       → docker buildx bake с VERSION=X.Y.Z (pull=false, named builder evobgp)
       → образы: latest, vX.Y.Z, X.Y.Z, sha-*, короткий SHA
 ```

-Pull request: только quality gates + commitlint; релиз и образы **не** публикуются.
+Pull request: workflow **CI** — quality gates + commitlint; релиз и образы **не** публикуются.

-Workflow: [.gitea/workflows/ci.yaml](../.gitea/workflows/ci.yaml) (job **release**).
+Workflows: [.gitea/workflows/ci.yaml](../.gitea/workflows/ci.yaml), [.gitea/workflows/cd.yaml](../.gitea/workflows/cd.yaml), reusable [.gitea/workflows/quality.yaml](../.gitea/workflows/quality.yaml).

 Конфиг semantic-release: [.releaserc.json](../.releaserc.json) — без `@semantic-release/git` (CHANGELOG не коммитится в репозиторий).

@@ -51,7 +52,7 @@ Workflow: [.gitea/workflows/ci.yaml](../.gitea/workflows/ci.yaml) (job **release
 | releases | Gitea Release + notes |
 | packages (Container Registry) | push образов |

-Fallback: **`gitea.token`** (нужны права на releases и packages).
+Fallback для **git tag**: `github.token`, если PAT недоступен. Push образов в Container Registry — **только `ACTIONS_PAT`** (у job token Gitea нет права packages).

 ## Источник правды для версии в runtime

@@ -75,15 +76,15 @@ Web UI показывает версию из API (footer sidebar, страни

 Правило: **один scope** из таблицы в [.cursor/rules/conventional-commits.mdc](../.cursor/rules/conventional-commits.mdc) (`web`, `httpapi`, `api`, …).

-На push в `main` job **release** запускает `scripts/commit/verify-release-commits.mjs` — в логе будут предупреждения о непарсящихся коммитах.
+На push в `main` job **publish** запускает `scripts/commit/verify-release-commits.mjs` — в логе будут предупреждения о непарсящихся коммитах.

 Если релиз «не создался», а CI зелёный: смотрите лог release — часто `No releasable commits`. Исправление: новый коммит с корректным заголовком (например `refactor(web): …`).

-## Перезапуск упавшего job release
+## Перезапуск упавшего job publish

-semantic-release пишет `.release-version` только в `successCmd` при **новом** релизе. Если тег `vX.Y.Z` уже создан, а `docker buildx bake` упал, повторный run того же SHA делает semantic-release no-op (файла нет). Job **release** тогда берёт версию из git-тега на `HEAD` и публикует образы.
+semantic-release пишет `.release-version` только в `successCmd` при **новом** релизе. Если тег `vX.Y.Z` уже создан, а `docker buildx bake` упал, повторный run того же SHA делает semantic-release no-op (файла нет). Job **publish** тогда берёт версию из git-тега на `HEAD` и публикует образы.

-Перезапускать нужно **весь job release**, не отдельный шаг bake: checkout + semantic-release + detect + bake идут подряд.
+Перезапускать нужно **весь job publish**, не отдельный шаг bake: checkout + semantic-release + detect + bake идут подряд.

 ## CHANGELOG

@@ -91,7 +92,7 @@ Release notes — в Gitea Release; файл `CHANGELOG.md` генерирует

 ## Проверка после релиза

-1. Один run workflow **CI** на push в main: job **release** зелёный.
+1. Один run workflow **CD** на push в main: job **publish** зелёный.
 2. Gitea: тег `vX.Y.Z` на том же commit, что и merge; Release с notes.
 3. Container Registry: `evobgp-api:vX.Y.Z`, `evobgp-api:X.Y.Z`, `evobgp-api:latest`.
 4. `curl http://localhost:8080/version` → `"version":"X.Y.Z"`.
@@ -13,10 +13,12 @@
    "@commitlint/cli": "^19.8.1",
    "@commitlint/config-conventional": "^19.8.1",
    "@markwylde/semantic-release-gitea": "^2.2.0",
+    "@redocly/cli": "1.34.5",
    "@semantic-release/changelog": "^6.0.3",
    "@semantic-release/commit-analyzer": "^13.0.1",
    "@semantic-release/exec": "^7.0.0",
    "@semantic-release/release-notes-generator": "^14.0.3",
+    "conventional-commits-parser": "^6.4.0",
    "semantic-release": "^25.0.2"
  }
 }
@@ -4,7 +4,9 @@
 * Exit 0 always — semantic-release still decides release/no-op.
 */
 import { execSync } from 'node:child_process';
-import parser from 'conventional-commits-parser';
+import { CommitParser } from 'conventional-commits-parser';
+
+const parser = new CommitParser();

 const RELEASABLE = new Set(['feat', 'fix', 'perf', 'ci', 'refactor']);

@@ -32,8 +34,14 @@ const unparseable = [];
 const releasable = [];

 for (const { hash, subject } of commits) {
-	const parsed = parser.sync(subject);
-	if (!parsed.type) {
+	let parsed;
+	try {
+		parsed = parser.parse(subject);
+	} catch {
+		unparseable.push({ hash: hash.slice(0, 7), subject });
+		continue;
+	}
+	if (!parsed?.type) {
 		unparseable.push({ hash: hash.slice(0, 7), subject });
 		continue;
 	}
Author	SHA1	Message	Date
Denozordec	e55d2c5aba	feat(docker): enable relative path support for Docker bake configurations quality / commitlint (push) Skipped Details quality / changes (push) Successful in 7s Details quality / docker-check (push) Skipped Details quality / openapi (push) Successful in 28s Details quality / web (push) Successful in 1m2s Details quality / go (push) Successful in 1m6s Details quality / bird2 (push) Successful in 17s Details CD / quality (push) Successful in 3m12s Details CD / publish (push) Successful in 5m44s Details - Added `BUILDX_BAKE_FILE_RELATIVE_PATHS` environment variable to CI workflows to support relative paths in Docker bake commands. - Updated `docker-bake.hcl` comments to clarify context resolution from the current working directory. - Revised README documentation to reflect changes in context resolution and usage of the new environment variable.	2026-08-18 18:45:51 +07:00
Denozordec	f63e9b5fd0	fix(docker): update base image references to Docker Hub quality / commitlint (push) Skipped Details quality / changes (push) Successful in 8s Details quality / openapi (push) Skipped Details quality / web (push) Skipped Details quality / docker-check (push) Skipped Details quality / go (push) Successful in 57s Details quality / bird2 (push) Successful in 15s Details CD / quality (push) Successful in 1m27s Details CD / publish (push) Failing after 4m13s Details - Changed base image references in `docker-bake.hcl`, Dockerfiles, and `mirror-base-images.sh` from public ECR to Docker Hub to avoid 429 errors and improve reliability. - Updated README documentation to reflect the new source for base images, clarifying the mirroring process and behavior when tags already exist.	2026-08-18 18:30:22 +07:00
Denozordec	0148d4ca37	feat(docker): enhance base image mirroring process and update documentation quality / commitlint (push) Skipped Details quality / changes (push) Successful in 8s Details quality / docker-check (push) Skipped Details quality / openapi (push) Successful in 40s Details quality / web (push) Successful in 1m27s Details quality / go (push) Successful in 1m4s Details quality / bird2 (push) Successful in 18s Details CD / quality (push) Successful in 3m45s Details CD / publish (push) Canceled after 10m39s Details - Updated `mirror-base-images.sh` to skip existing tags in Gitea and retry on 429 errors, improving efficiency and reducing unnecessary requests. - Modified CI workflow to utilize a temporary environment file for mirrored base images, ensuring better handling of existing images. - Enhanced README documentation to reflect changes in the mirroring process and clarify the behavior when tags already exist.	2026-08-18 18:22:26 +07:00
Denozordec	e0ecabb22f	feat(dependencies): add conventional-commits-parser and update verification script quality / changes (push) Successful in 8s Details quality / commitlint (push) Skipped Details quality / docker-check (push) Skipped Details quality / openapi (push) Successful in 45s Details quality / web (push) Successful in 1m30s Details quality / go (push) Successful in 1m7s Details quality / bird2 (push) Successful in 16s Details CD / quality (push) Successful in 3m59s Details CD / publish (push) Failing after 1m2s Details - Added `conventional-commits-parser` version 6.4.0 to `package.json` and `pnpm-lock.yaml` for improved commit message parsing. - Updated the commit verification script to utilize the new parser, enhancing error handling for unparseable commit messages. - Adjusted CI workflow to run the verification script using `pnpm exec` for consistency in package execution.	2026-08-18 18:13:44 +07:00
Denozordec	da301b1a94	feat(dependencies): add @redocly/cli and update CI workflows quality / commitlint (push) Skipped Details quality / changes (push) Successful in 20s Details quality / docker-check (push) Skipped Details quality / openapi (push) Successful in 2m54s Details quality / web (push) Successful in 1m22s Details quality / go (push) Successful in 3m37s Details quality / bird2 (push) Successful in 15s Details CD / quality (push) Successful in 8m37s Details CD / publish (push) Failing after 1m51s Details - Added `@redocly/cli` version 1.34.5 to `package.json` and `pnpm-lock.yaml` for OpenAPI linting. - Updated CI workflows to reflect changes in job names and processes, including adjustments to the `publish` job in the CD workflow. - Enhanced documentation to clarify the new CI/CD processes and Docker build configurations.	2026-08-18 17:48:41 +07:00
Denozordec	653bc6cc91	fix(web): update Russian translations for various components CI / changes (push) Successful in 8s Details CI / commitlint (push) Skipped Details CI / go (push) Skipped Details CI / bird2 (push) Skipped Details CI / openapi (push) Successful in 38s Details CI / web (push) Successful in 56s Details CI / release (push) Successful in 4m4s Details Обновлены переводы на русский язык для компонентов, включая карточки мониторинга, сетевые панели и настройки. Исправлены описания и метки для улучшения пользовательского интерфейса, а также добавлены новые элементы для поддержки локализации в компонентах, таких как DataGrid и ResourcePage.	2026-08-18 17:00:15 +07:00