chore: update .gitignore, remove Dockerfile, and enhance documentation

- Added .release-version, CHANGELOG.md, and deploy/docker/docker-bake.override.hcl to .gitignore.
- Removed Dockerfile as part of the cleanup.
- Updated AGENTS.md and README.md to include new documentation on CI/Docker processes and deployment instructions.
- Enhanced package.json with new devDependencies for commit linting and semantic release.
- Updated pnpm-lock.yaml to reflect new dependencies and versions.

These changes streamline the project structure and improve documentation clarity.

deploy/compose/docker-compose.example.yaml

@@ -1,6 +1,7 @@
 services:
   evofirewall:
-    image: git.shx.one/denozord/evofirewall:latest
+    # evofw и evofirewall — один образ (алиас для drop-in).
+    image: git.shx.one/denozord/evofw:latest
     restart: unless-stopped
     environment:
       DATABASE_URL: sqlite:/data/app.db

deploy/docker/README.md

@@ -0,0 +1,54 @@
+# Docker-образы EvoFirewall
+
+## CI (Gitea Actions)
+
+Сборка образов — **`docker buildx bake`** ([docker-bake.hcl](docker-bake.hcl)), не отдельные `docker build`.
+
+**Publish:** push в `main` после quality gates — workflow [CD](../../.gitea/workflows/cd.yaml) job **publish**: semantic-release + зеркало base-образов + bake с `VERSION` из релиза.
+
+Bake читает переменные из **окружения** (`REGISTRY`, `IMAGE_TAG`, `CACHE_REF_NODE`, `BASE_NODE`). Скрипт [write-bake-override.sh](write-bake-override.sh) — опциональный helper для локальной отладки.
+
+BuildKit кэширует pnpm store через `RUN --mount=type=cache`. На CI mounts живут, пока named builder `evofw` не удаляют (`cleanup: false`).
+
+### Слои и runtime
+
+| Образ | Runtime base | Заметка |
+|-------|----------------|---------|
+| `evofw`, `evofirewall` | `node:22-alpine` | один процесс: API + SPA + SQLite; `better-sqlite3` собирается в alpine на stage `build` |
+
+`python3` / `make` / `g++` только в `deps`/`build`. Context режется корневым [.dockerignore](../../.dockerignore).
+
+Теги `evofw` и `evofirewall` — один и тот же образ (`evofirewall` — drop-in для старого compose).
+
+### Кэш registry
+
+- `git.shx.one/<owner>/evofw-buildcache:node-buildcache` — **запись** только из `node-build`
+- `git.shx.one/<owner>/evofw-buildcache:base-node-22-alpine` — зеркало FROM с Docker Hub. Только `linux/amd64`; skip если тег уже в Gitea. Неуспешный copy не валит CD — bake берёт Docker Hub FROM.
+
+`pull = false` в bake: не перекачивать FROM, если слой уже в builder. Не запускайте `docker system prune -a` на runner.
+
+Параллельный `cache-to` в один ref ломает manifest (`content descriptor … not found`).
+
+Если CI падает на «not found» после смены схемы кэша — один раз удалите теги `evofw-buildcache:*` в registry и пересоберите.
+
+## Локальная сборка
+
+Из корня репозитория:
+
+```bash
+cd deploy/docker
+export REGISTRY=git.shx.one/<owner>
+export IMAGE_TAG=latest
+export SHORT_SHA=$(git rev-parse --short HEAD)
+export VERSION=dev
+export BUILD_TIME=
+docker buildx bake --allow=fs.read=../.. -f docker-bake.hcl default
+```
+
+Проверка манифеста без сборки:
+
+```bash
+docker buildx bake --allow=fs.read=../.. -f docker-bake.hcl --print default
+```
+
+В `docker-bake.hcl`: `context = "../.."` резолвится **от cwd** (каталог `deploy/docker/`). `dockerfile` — путь от этого context (корень репо). Из корня репо не вызывать bake с `-f deploy/docker/docker-bake.hcl`: получится `lstat ../../deploy`. Можно задать `BUILDX_BAKE_FILE_RELATIVE_PATHS=1`.

deploy/docker/docker-bake.hcl

@@ -0,0 +1,117 @@
+# Единая сборка образа EvoFirewall (buildx bake: -f deploy/docker/docker-bake.hcl).
+# context = "../.." — корень репо. Bake резолвит context от cwd (не от HCL),
+# поэтому вызов из deploy/docker/ либо BUILDX_BAKE_FILE_RELATIVE_PATHS=1.
+
+variable "REGISTRY" {
+  default = "git.shx.one/denozord"
+}
+
+variable "IMAGE_TAG" {
+  default = "latest"
+}
+
+variable "SHORT_SHA" {
+  default = "dev"
+}
+
+variable "SHA_FULL" {
+  default = ""
+}
+
+variable "VERSION" {
+  default = "dev"
+}
+
+variable "BUILD_TIME" {
+  default = ""
+}
+
+variable "CACHE_REF_NODE" {
+  default = ""
+}
+
+variable "BASE_NODE" {
+  default = "docker.io/library/node:22-alpine"
+}
+
+function "node-cache-from" {
+  params = []
+  result = notequal("", CACHE_REF_NODE) ? ["type=registry,ref=${CACHE_REF_NODE}"] : []
+}
+
+# Экспорт кэша — один writer на ref (параллельный cache-to в один ref ломает manifest).
+function "node-cache-to-export" {
+  params = []
+  result = notequal("", CACHE_REF_NODE) ? ["type=registry,ref=${CACHE_REF_NODE},mode=max"] : []
+}
+
+function "image-tags" {
+  params = [name]
+  result = concat(
+    notequal("", SHA_FULL) ? [
+      "${REGISTRY}/${name}:${IMAGE_TAG}",
+      "${REGISTRY}/${name}:${SHORT_SHA}",
+      "${REGISTRY}/${name}:sha-${SHA_FULL}",
+    ] : [
+      "${REGISTRY}/${name}:${IMAGE_TAG}",
+      "${REGISTRY}/${name}:${SHORT_SHA}",
+    ],
+    notequal(VERSION, "dev") && notequal(VERSION, "") ? [
+      "${REGISTRY}/${name}:v${VERSION}",
+      "${REGISTRY}/${name}:${VERSION}",
+    ] : []
+  )
+}
+
+group "default" {
+  targets = ["evofw"]
+}
+
+target "_common" {
+  platforms = ["linux/amd64"]
+  pull      = false
+}
+
+target "node-deps" {
+  inherits   = ["_common"]
+  context    = "../.."
+  dockerfile = "deploy/docker/evofw/Dockerfile"
+  target     = "deps"
+  args = {
+    BASE_NODE = BASE_NODE
+  }
+  cache-from = node-cache-from()
+}
+
+target "node-build" {
+  inherits   = ["_common"]
+  context    = "../.."
+  dockerfile = "deploy/docker/evofw/Dockerfile"
+  target     = "build"
+  args = {
+    BASE_NODE = BASE_NODE
+  }
+  contexts = {
+    deps = "target:node-deps"
+  }
+  cache-from = node-cache-from()
+  cache-to   = node-cache-to-export()
+}
+
+target "evofw" {
+  inherits   = ["_common"]
+  context    = "../.."
+  dockerfile = "deploy/docker/evofw/Dockerfile"
+  target     = "runtime"
+  args = {
+    BASE_NODE  = BASE_NODE
+    VERSION    = VERSION
+    GIT_SHA    = notequal("", SHA_FULL) ? SHA_FULL : SHORT_SHA
+    BUILD_TIME = BUILD_TIME
+  }
+  contexts = {
+    build = "target:node-build"
+  }
+  cache-from = node-cache-from()
+  tags       = concat(image-tags("evofw"), image-tags("evofirewall"))
+}

deploy/docker/evofw/Dockerfile

@@ -0,0 +1,54 @@
+# syntax=docker/dockerfile:1.7
+# All-in-one EvoFirewall (Fastify + SPA + SQLite). Analog evobgp-all.
+# Install slugs GET /{slug} stay on the same process — do not split nginx.
+ARG BASE_NODE=docker.io/library/node:22-alpine
+
+FROM ${BASE_NODE} AS deps
+WORKDIR /repo
+RUN apk add --no-cache python3 make g++ \
+    && corepack enable && corepack prepare [email protected] --activate
+COPY package.json pnpm-workspace.yaml pnpm-lock.yaml turbo.json ./
+COPY apps/web/package.json apps/web/
+COPY apps/api/package.json apps/api/
+COPY packages/ui/package.json packages/ui/
+COPY packages/shared/package.json packages/shared/
+COPY packages/db/package.json packages/db/
+RUN --mount=type=cache,target=/root/.local/share/pnpm/store,sharing=locked \
+    pnpm install --frozen-lockfile
+
+FROM deps AS build
+COPY apps/web apps/web
+COPY apps/api apps/api
+COPY packages/ui packages/ui
+COPY packages/shared packages/shared
+COPY packages/db packages/db
+RUN --mount=type=cache,target=/root/.local/share/pnpm/store,sharing=locked \
+    pnpm turbo build --filter=@evofw/web --filter=@evofw/api \
+    && pnpm --filter @evofw/api deploy --prod /out \
+    && cp -r apps/web/dist /out/static \
+    && mkdir -p /out/dist/agent-scripts \
+    && cp -r apps/api/src/agent-scripts/* /out/dist/agent-scripts/ \
+    && rm -rf /out/src /out/test /out/.turbo \
+    && rm -rf /out/node_modules/@evofw/db/src /out/node_modules/@evofw/db/.turbo \
+    && rm -rf /out/node_modules/@evofw/shared/src /out/node_modules/@evofw/shared/.turbo \
+    && find /out -name '*.map' -delete
+
+FROM ${BASE_NODE} AS runtime
+WORKDIR /app
+RUN apk add --no-cache ca-certificates
+ARG VERSION=dev
+ARG GIT_SHA=unknown
+ARG BUILD_TIME=
+ENV NODE_ENV=production \
+    STATIC_DIR=/app/static \
+    DATABASE_URL=sqlite:/data/app.db \
+    SERVER_PORT=8080 \
+    APP_VERSION=${VERSION} \
+    GIT_SHA=${GIT_SHA} \
+    BUILD_TIME=${BUILD_TIME}
+COPY --from=build /out ./
+EXPOSE 8080
+VOLUME ["/data"]
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+  CMD ["node", "-e", "fetch('http://127.0.0.1:8080/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
+CMD ["node", "dist/server.js"]

deploy/docker/mirror-base-images.sh

@@ -0,0 +1,72 @@
+#!/usr/bin/env sh
+# Copy-by-digest зеркало базовых образов в Gitea Container Registry (без rebuild).
+# Требует: docker login в REGISTRY host, docker buildx.
+# REGISTRY=git.shx.one/<owner>  (без суффикса /evofw-buildcache)
+#
+# Источник library-образов — Docker Hub (docker.io).
+# Если тег уже есть в Gitea — skip (без повторного pull).
+# Копируем только linux/amd64 — bake platforms совпадает.
+# Шаг CD не должен падать: неуспешный copy оставляет bake на Docker Hub FROM.
+set -eu
+REGISTRY="${REGISTRY:?REGISTRY required (git.shx.one/<owner>)}"
+CACHE_REPO="${REGISTRY}/evofw-buildcache"
+ENV_FILE="${MIRROR_ENV_FILE:-}"
+PLATFORM="${MIRROR_PLATFORM:-linux/amd64}"
+RETRIES="${MIRROR_RETRIES:-4}"
+
+tmp="$(mktemp)"
+cleanup() { rm -f "$tmp"; }
+trap cleanup EXIT
+
+dest_exists() {
+  docker buildx imagetools inspect "$1" >/dev/null 2>&1
+}
+
+copy_retry() {
+  src="$1"
+  dest="$2"
+  n=0
+  while [ "$n" -lt "$RETRIES" ]; do
+    n=$((n + 1))
+    if docker buildx imagetools create --platform "$PLATFORM" --tag "$dest" "$src"; then
+      return 0
+    fi
+    delay=$((n * 25))
+    echo "mirror retry ${n}/${RETRIES}, sleep ${delay}s: ${dest}"
+    sleep "$delay"
+  done
+  return 1
+}
+
+mirror() {
+  src="$1"
+  tag="$2"
+  var="$3"
+  dest="${CACHE_REPO}:${tag}"
+  if dest_exists "$dest"; then
+    echo "skip (already in registry): ${dest}"
+    printf '%s=%s\n' "$var" "$dest" >>"$tmp"
+    return 0
+  fi
+  echo "mirror ${src} -> ${dest} (${PLATFORM})"
+  if copy_retry "$src" "$dest"; then
+    printf '%s=%s\n' "$var" "$dest" >>"$tmp"
+    return 0
+  fi
+  echo "warn: ${dest} not mirrored — bake uses Docker Hub FROM for ${var}"
+  return 0
+}
+
+mirror "docker.io/library/node:22-alpine" "base-node-22-alpine" BASE_NODE
+
+echo "----- mirrored BASE_* -----"
+cat "$tmp"
+if [ -n "$ENV_FILE" ]; then
+  env_dir="$(dirname "$ENV_FILE")"
+  if [ -d "$env_dir" ]; then
+    cp "$tmp" "$ENV_FILE"
+    echo "wrote ${ENV_FILE}"
+  else
+    echo "warn: MIRROR_ENV_FILE dir missing (${env_dir}) — skip write"
+  fi
+fi

deploy/docker/write-bake-override.sh

@@ -0,0 +1,24 @@
+#!/usr/bin/env sh
+# Optional helper for local bake when env-based Bake variables are inconvenient.
+# CI задаёт те же имена переменных в окружении и вызывает bake без этого файла.
+set -eu
+OUT="${1:-docker-bake.override.hcl}"
+REGISTRY="${REGISTRY:?REGISTRY required}"
+IMAGE_TAG="${IMAGE_TAG:-latest}"
+SHORT_SHA="${SHORT_SHA:-dev}"
+SHA_FULL="${SHA_FULL:-}"
+VERSION="${VERSION:-dev}"
+BUILD_TIME="${BUILD_TIME:-}"
+CACHE_REF_NODE="${CACHE_REF_NODE:-}"
+BASE_NODE="${BASE_NODE:-}"
+cat >"$OUT" <<EOF
+# Generated by deploy/docker/write-bake-override.sh — do not commit.
+variable "REGISTRY" { default = "${REGISTRY}" }
+variable "IMAGE_TAG" { default = "${IMAGE_TAG}" }
+variable "SHORT_SHA" { default = "${SHORT_SHA}" }
+variable "SHA_FULL" { default = "${SHA_FULL}" }
+variable "VERSION" { default = "${VERSION}" }
+variable "BUILD_TIME" { default = "${BUILD_TIME}" }
+variable "CACHE_REF_NODE" { default = "${CACHE_REF_NODE}" }
+EOF
+if [ -n "$BASE_NODE" ]; then printf 'variable "BASE_NODE" { default = "%s" }\n' "$BASE_NODE" >>"$OUT"; fi