feat(config-revisions): implement configuration history for Firewall, GRE, and WireGuard

- Added configuration history management for Firewall, GRE, and WireGuard pages, enabling users to view and restore previous configurations.
- Introduced new components for displaying configuration history and integrated them into the respective pages.
- Enhanced API routes to support fetching and restoring configuration revisions, ensuring data consistency across the application.
- Updated state management to handle loading and restoring states effectively, improving user experience during data operations.
- Enhanced tests to cover new functionalities and ensure reliability.

Co-authored-by: Cursor <[email protected]>

app/(main)/filters/page.tsx

@@ -27,7 +27,7 @@ import {
   StarIcon, ArrowUpDownIcon, ArrowUpIcon, ArrowDownIcon,
   FileCodeIcon, CopyIcon, NetworkIcon, TagIcon,
   ArrowRightIcon, AlertTriangleIcon, LoaderCircleIcon, RouteIcon,
-  CheckCircle2Icon, XCircleIcon, CircleDashedIcon, RefreshCwIcon,
+  RefreshCwIcon, HistoryIcon,
 } from "lucide-react"
 import {
   Sheet, SheetContent, SheetHeader, SheetTitle, SheetDescription, SheetFooter,
@@ -36,13 +36,13 @@ import { Tabs, TabsContent, TabsList, TabsTrigger } from "@/components/ui/tabs"
 import { Tooltip, TooltipContent, TooltipTrigger } from "@/components/ui/tooltip"
 import { toast } from "sonner"
 import { CodeExportSheet } from "@/components/reui-kit/code-export-sheet"
+import { ConfigHistorySheet } from "@/components/config-history-sheet"
+import type { ConfigRevisionDto } from "@/lib/config-revisions"
 import { ServerRailLayout, ServerRailMobileButton } from "@/components/server-rail-layout"
 import { type ServerTileItem } from "@/components/server-tile-rail"
 
 // ── helpers ────────────────────────────────────────────────────────────────────
 
-type FilterRouterSyncStatus = "synced" | "drift" | "missing"
-
 function newId() { return `r${Date.now()}-${Math.random().toString(36).slice(2, 6)}` }
 function innerIpToGateway(ip: string) { return ip.split("/")[0] }
 
@@ -1239,6 +1239,9 @@ interface BackendServer {
 interface LiveFiltersResponse {
   rulesets: ServerFilterRuleset[]
   greTunnels: GreTunnel[]
+  live?: boolean
+  stale?: boolean
+  error?: string
 }
 
 function buildRulesets(serverList: Server[], sourceRulesets: ServerFilterRuleset[]): ServerFilterRuleset[] {
@@ -1325,18 +1328,14 @@ export default function FiltersPage() {
   const [sheetMode,    setSheetMode]   = useState<"create" | "edit">("create")
   const [sheetInitial, setSheetInitial]= useState<RuleForm>(emptyForm())
   const [editingId,    setEditingId]   = useState<string | null>(null)
-  const [previewOpen,  setPreviewOpen] = useState(false)
-  const [copyOpen,     setCopyOpen]    = useState(false)
-  const [syncBusy,     setSyncBusy]    = useState<"from" | "to" | null>(null)
-  const [routerCompare, setRouterCompare] = useState<{
-    serverId: string
-    byCommunity: Record<string, FilterRouterSyncStatus>
-  } | null>(null)
-  const [routerCompareLoading, setRouterCompareLoading] = useState(false)
-
-  useEffect(() => {
-    setRouterCompare(null)
-  }, [selectedServerId])
+  const [previewOpen,  setPreviewOpen]  = useState(false)
+  const [copyOpen,     setCopyOpen]     = useState(false)
+  const [applyBusy,    setApplyBusy]    = useState(false)
+  const [liveStale,    setLiveStale]    = useState(false)
+  const [historyOpen,  setHistoryOpen]  = useState(false)
+  const [historyLoading, setHistoryLoading] = useState(false)
+  const [historyRestoring, setHistoryRestoring] = useState(false)
+  const [revisions, setRevisions] = useState<ConfigRevisionDto[]>([])
 
   useEffect(() => {
     if (!isLive) {
@@ -1347,6 +1346,7 @@ export default function FiltersPage() {
         setRulesets(buildRulesets(servers, serverFilterRulesets))
         setSelectedServerId(servers[0]?.id ?? "")
         setLiveLoadState("idle")
+        setLiveStale(false)
       })
       return
     }
@@ -1390,18 +1390,43 @@ export default function FiltersPage() {
       })
   }, [isLive, apiFetch])
 
+  const loadLiveRules = useCallback(async (serverId: string) => {
+    if (!isLive || !serverId) return
+    try {
+      const fresh = await apiFetch<LiveFiltersResponse>(
+        `/api/filters/rules?serverId=${encodeURIComponent(serverId)}`,
+      )
+      const liveRules = fresh.rulesets.find((r) => r.serverId === serverId)?.rules ?? fresh.rulesets[0]?.rules ?? []
+      setRulesets((prev) => {
+        const has = prev.some((rs) => rs.serverId === serverId)
+        if (!has) return [...prev, { serverId, rules: liveRules }]
+        return prev.map((rs) => rs.serverId === serverId ? { ...rs, rules: liveRules } : rs)
+      })
+      setLiveStale(Boolean(fresh.stale))
+      if (fresh.greTunnels?.length) {
+        setGreByServer((prev) => ({ ...prev, [serverId]: fresh.greTunnels }))
+      }
+    } catch (err) {
+      setLiveStale(true)
+      toast.error("Не удалось прочитать правила с роутера", { description: String(err) })
+    }
+  }, [isLive, apiFetch])
+
   useEffect(() => {
-    if (!isLive || !selectedServerId) return
+    if (!isLive || !selectedServerId || liveLoadState !== "idle") return
+    if (!liveServers.some((s) => s.id === selectedServerId)) return
     void Promise.all([
+      loadLiveRules(selectedServerId),
       ensureGreTunnels(selectedServerId),
       ensureRecursiveRoutes(selectedServerId),
     ])
-  }, [isLive, selectedServerId, ensureGreTunnels, ensureRecursiveRoutes])
+  }, [isLive, selectedServerId, liveLoadState, liveServers, ensureGreTunnels, ensureRecursiveRoutes, loadLiveRules])
 
-  const allServers = isLive ? liveServers : servers
-  const allTunnels = isLive ? (greByServer[selectedServerId] ?? []) : greTunnels
+  const allServers = !isLive || liveLoadState === "error" ? servers : liveServers
+  const allTunnels = !isLive || liveLoadState === "error" ? greTunnels : (greByServer[selectedServerId] ?? [])
   const selectedServer = allServers.find(s => s.id === selectedServerId) ?? allServers[0]
   const totalRules     = rulesets.reduce((s, r) => s + r.rules.length, 0)
+  const mutationsLocked = isLive && (applyBusy || liveStale || liveLoadState === "error")
 
   const filterRailItems = useMemo<ServerTileItem[]>(() => (
     allServers.map((s) => ({
@@ -1427,21 +1452,6 @@ export default function FiltersPage() {
     [rulesets, selectedServerId],
   )
 
-  const fetchRouterCompare = useCallback(async () => {
-    if (!isLive || !selectedServerId) return
-    setRouterCompareLoading(true)
-    try {
-      const d = await apiFetch<{ byCommunity: Record<string, FilterRouterSyncStatus> }>(
-        `/api/filters/router-compare?serverId=${encodeURIComponent(selectedServerId)}`,
-      )
-      setRouterCompare({ serverId: selectedServerId, byCommunity: d.byCommunity })
-    } catch {
-      setRouterCompare(null)
-    } finally {
-      setRouterCompareLoading(false)
-    }
-  }, [isLive, selectedServerId, apiFetch])
-
   const filteredRules = useMemo(() => {
     const q = search.toLowerCase()
     if (!q) return currentRules
@@ -1453,68 +1463,94 @@ export default function FiltersPage() {
     )
   }, [currentRules, search, communityNameMap])
 
-  const updateRules = useCallback((serverId: string, updater: (rules: FilterRule[]) => FilterRule[]) => {
-    setRouterCompare(rc => (rc && rc.serverId === serverId ? null : rc))
-    setRulesets(prev => {
-      const next = prev.map(rs =>
-        rs.serverId === serverId ? { ...rs, rules: updater(rs.rules) } : rs
-      )
-      if (isLive) {
-        void apiFetch<{ ok: boolean }>("/api/filters/rules", {
-          method: "PUT",
-          body: JSON.stringify({ rulesets: next }),
-        }).catch(() => {})
-      }
-      return next
-    })
-  }, [isLive, apiFetch])
-
-  const syncFromRouter = useCallback(async () => {
-    if (!isLive || syncBusy) return
-    setSyncBusy("from")
+  const applyRules = useCallback(async (
+    serverId: string,
+    nextRules: FilterRule[],
+    source: "apply" | "copy" = "apply",
+  ) => {
+    const prev = rulesets
+    setRulesets((p) => p.map((rs) => rs.serverId === serverId ? { ...rs, rules: nextRules } : rs))
+    if (!isLive) return
+    if (liveStale) {
+      setRulesets(prev)
+      toast.error("Роутер недоступен — изменения заблокированы")
+      return
+    }
+    setApplyBusy(true)
     try {
-      await apiFetch<{ ok: boolean }>("/api/filters/sync/from-router", {
-        method: "POST",
-        body: JSON.stringify({ serverId: selectedServerId }),
+      const res = await apiFetch<{ ok: boolean; rules?: FilterRule[] }>("/api/filters/rules", {
+        method: "PUT",
+        body: JSON.stringify({ serverId, rules: nextRules, source }),
       })
-      const fresh = await apiFetch<LiveFiltersResponse>("/api/filters/rules")
-      setRulesets(buildRulesets(allServers, fresh.rulesets))
+      if (res.rules) {
+        setRulesets((p) => p.map((rs) => rs.serverId === serverId ? { ...rs, rules: res.rules ?? nextRules } : rs))
+      }
+      toast.success("Правила применены на роутер")
+    } catch (err) {
+      setRulesets(prev)
+      toast.error("Не удалось применить правила на роутер", { description: String(err) })
+    } finally {
+      setApplyBusy(false)
+    }
+  }, [isLive, apiFetch, rulesets, liveStale])
+
+  const refreshFromRouter = useCallback(async () => {
+    if (!isLive || !selectedServerId || applyBusy) return
+    setApplyBusy(true)
+    try {
+      await loadLiveRules(selectedServerId)
       await Promise.all([
         ensureGreTunnels(selectedServerId),
         ensureRecursiveRoutes(selectedServerId),
       ])
-      await fetchRouterCompare()
     } finally {
-      setSyncBusy(null)
+      setApplyBusy(false)
     }
-  }, [isLive, syncBusy, apiFetch, allServers, selectedServerId, ensureGreTunnels, ensureRecursiveRoutes, fetchRouterCompare])
+  }, [isLive, selectedServerId, applyBusy, loadLiveRules, ensureGreTunnels, ensureRecursiveRoutes])
 
-  const syncToRouter = useCallback(async () => {
-    if (!isLive || syncBusy || !selectedServerId) return
-    setSyncBusy("to")
+  const loadRevisions = useCallback(async () => {
+    if (!isLive || !selectedServerId) return
+    setHistoryLoading(true)
     try {
-      const res = await apiFetch<{
-        ok: boolean
-        updatedServers: number
-        pushedRules: number
-        errors?: Array<{ serverId: number; error: string }>
-      }>("/api/filters/sync/to-router", {
-        method: "POST",
-        body: JSON.stringify({ serverId: selectedServerId }),
-      })
-      if (res.ok) {
-        toast.success(`Загружено правил на роутер: ${res.pushedRules}`)
-      } else {
-        const detail = res.errors?.[0]?.error ?? "неизвестная ошибка"
-        toast.error("Не удалось загрузить правила на роутер", { description: detail })
-      }
-      await fetchRouterCompare()
+      const res = await apiFetch<{ revisions: ConfigRevisionDto[] }>(
+        `/api/filters/revisions?serverId=${encodeURIComponent(selectedServerId)}`,
+      )
+      setRevisions(res.revisions)
     } catch (err) {
-      toast.error("Не удалось загрузить правила на роутер", { description: String(err) })
+      toast.error("Не удалось загрузить историю", { description: String(err) })
+      setRevisions([])
     } finally {
-      setSyncBusy(null)
+      setHistoryLoading(false)
     }
-  }, [isLive, syncBusy, selectedServerId, apiFetch, fetchRouterCompare])
+  }, [isLive, selectedServerId, apiFetch])
+
+  const restoreRevision = useCallback(async (id: string) => {
+    if (!isLive || !selectedServerId) return
+    setHistoryRestoring(true)
+    try {
+      const res = await apiFetch<{ ok: boolean; rules?: FilterRule[] }>(
+        `/api/filters/revisions/${encodeURIComponent(id)}/restore`,
+        { method: "POST", body: JSON.stringify({ serverId: selectedServerId }) },
+      )
+      if (res.rules) {
+        setRulesets((p) => p.map((rs) => rs.serverId === selectedServerId ? { ...rs, rules: res.rules ?? [] } : rs))
+      } else {
+        await loadLiveRules(selectedServerId)
+      }
+      setLiveStale(false)
+      toast.success("Версия применена на роутер")
+      await loadRevisions()
+    } catch (err) {
+      toast.error("Не удалось откатить", { description: String(err) })
+    } finally {
+      setHistoryRestoring(false)
+    }
+  }, [isLive, selectedServerId, apiFetch, loadLiveRules, loadRevisions])
+
+  const updateRules = useCallback((serverId: string, updater: (rules: FilterRule[]) => FilterRule[]) => {
+    const current = rulesets.find((rs) => rs.serverId === serverId)?.rules ?? []
+    void applyRules(serverId, updater(current))
+  }, [rulesets, applyRules])
 
   const openCreate = () => {
     setSheetInitial(emptyForm()); setSheetMode("create"); setEditingId(null); setSheetOpen(true)
@@ -1532,6 +1568,7 @@ export default function FiltersPage() {
   }
 
   const handleSave = (form: RuleForm) => {
+    if (mutationsLocked) return
     const { gatewayKind: _gk, ...payload } = form
     if (sheetMode === "create") {
       updateRules(selectedServerId, rules => [
@@ -1549,34 +1586,30 @@ export default function FiltersPage() {
     setSheetOpen(false)
   }
 
-  const handleDelete = (id: string) => updateRules(selectedServerId, rules => rules.filter(r => r.id !== id))
+  const handleDelete = (id: string) => {
+    if (mutationsLocked) return
+    updateRules(selectedServerId, rules => rules.filter(r => r.id !== id))
+  }
 
   const handleCopyRules = useCallback((targetServerId: string, rules: FilterRule[], mode: CopyMode) => {
-    updateRules(targetServerId, existing =>
-      mode === "replace" ? rules : [...existing, ...rules]
-    )
-  }, [updateRules])
+    const existing = rulesets.find((rs) => rs.serverId === targetServerId)?.rules ?? []
+    const next = mode === "replace" ? rules : [...existing, ...rules]
+    void applyRules(targetServerId, next, "copy")
+  }, [rulesets, applyRules])
   const handleMoveUp   = (index: number) => {
-    if (index === 0) return
+    if (mutationsLocked || index === 0) return
     updateRules(selectedServerId, rules => {
       const n = [...rules]; [n[index - 1], n[index]] = [n[index], n[index - 1]]; return n
     })
   }
   const handleMoveDown = (index: number) => {
+    if (mutationsLocked) return
     updateRules(selectedServerId, rules => {
       if (index >= rules.length - 1) return rules
       const n = [...rules]; [n[index], n[index + 1]] = [n[index + 1], n[index]]; return n
     })
   }
 
-  if (!selectedServer) {
-    return (
-      <div className="flex h-full items-center justify-center text-sm text-muted-foreground">
-        Нет доступных серверов
-      </div>
-    )
-  }
-
   if (isLive && liveLoadState === "loading") {
     return (
       <div className="flex h-full flex-col items-center justify-center gap-3 text-sm text-muted-foreground">
@@ -1586,6 +1619,14 @@ export default function FiltersPage() {
     )
   }
 
+  if (!selectedServer) {
+    return (
+      <div className="flex h-full items-center justify-center text-sm text-muted-foreground">
+        Нет доступных серверов
+      </div>
+    )
+  }
+
   return (
     <>
     <ServerRailLayout
@@ -1604,35 +1645,25 @@ export default function FiltersPage() {
                   <Button
                     variant="outline"
                     size="sm"
-                    onClick={syncFromRouter}
-                    disabled={syncBusy !== null}
-                    title="Синхронизация Router → БД"
+                    onClick={() => void refreshFromRouter()}
+                    disabled={applyBusy}
+                    title="Прочитать актуальные правила с роутера"
                   >
-                    {syncBusy === "from" ? "Синк Router → DB…" : "Router → DB"}
+                    <RefreshCwIcon className={cn("size-4", applyBusy && "animate-spin")} />
+                    Обновить
                   </Button>
                   <Button
                     variant="outline"
                     size="sm"
-                    onClick={syncToRouter}
-                    disabled={syncBusy !== null}
-                    title="Синхронизация БД → Router"
+                    onClick={() => {
+                      setHistoryOpen(true)
+                      void loadRevisions()
+                    }}
+                    disabled={applyBusy}
+                    title="История версий и откат на CHR"
                   >
-                    {syncBusy === "to" ? "Синк DB → Router…" : "DB → Router"}
-                  </Button>
-                  <Button
-                    variant="outline"
-                    size="sm"
-                    onClick={() => void fetchRouterCompare()}
-                    disabled={syncBusy !== null || routerCompareLoading}
-                    title="Сравнить правила в БД с цепочкой bgp-in на MikroTik"
-                    className="gap-1.5"
-                  >
-                    {routerCompareLoading ? (
-                      <LoaderCircleIcon className="size-4 animate-spin" />
-                    ) : (
-                      <RefreshCwIcon className="size-4" />
-                    )}
-                    Сверить
+                    <HistoryIcon className="size-4" />
+                    История
                   </Button>
                 </>
               )}
@@ -1642,12 +1673,12 @@ export default function FiltersPage() {
               <Button
                 variant="outline" size="sm"
                 onClick={() => setCopyOpen(true)}
-                disabled={currentRules.length === 0}
+                disabled={currentRules.length === 0 || mutationsLocked}
                 title="Копировать правила на другой сервер"
               >
                 <CopyIcon className="size-4" />Копировать
               </Button>
-              <Button size="sm" onClick={openCreate}>
+              <Button size="sm" onClick={openCreate} disabled={mutationsLocked}>
                 <PlusIcon className="size-4" />Новое правило
               </Button>
             </>
@@ -1662,6 +1693,12 @@ export default function FiltersPage() {
               Бекенд недоступен — показаны демо-данные из lib/data. Проверьте URL бекенда в настройках.
             </div>
           )}
+          {isLive && liveStale && liveLoadState !== "error" && (
+            <div className="shrink-0 border-b border-amber-500/30 bg-amber-500/10 px-6 py-2.5 text-xs text-amber-700 dark:text-amber-400 flex items-center gap-2">
+              <AlertTriangleIcon className="size-3.5 shrink-0" />
+              Роутер недоступен — показан кэш. Изменения заблокированы, пока не удастся прочитать CHR.
+            </div>
+          )}
           <div className="border-b px-4 py-3 flex items-center gap-3 flex-wrap shrink-0 md:px-6">
             <div className="relative min-w-[200px] max-w-xs flex-1">
               <SearchIcon className="absolute left-2.5 top-1/2 -translate-y-1/2 size-3.5 text-muted-foreground pointer-events-none" />
@@ -1745,15 +1782,7 @@ export default function FiltersPage() {
                 )}>{selectedServer.latency}мс</span>
               )}
               <div className="ml-auto flex items-center gap-2 text-xs text-muted-foreground flex-wrap justify-end">
-                {isLive && routerCompare?.serverId === selectedServerId && currentRules.length > 0 && (
-                  <span className="font-mono tabular-nums">
-                    роутер:{" "}
-                    <span className="text-emerald-600 dark:text-emerald-500">
-                      {Object.values(routerCompare.byCommunity).filter(s => s === "synced").length}
-                    </span>
-                    /{currentRules.length} совпало
-                  </span>
-                )}
+                {applyBusy && <span>Применение на роутер…</span>}
                 <span>{currentRules.length} правил</span>
               </div>
             </div>
@@ -1790,12 +1819,6 @@ export default function FiltersPage() {
                 serversList={allServers}
                 communityNameMap={communityNameMap}
                 recursiveRoutes={recRoutesByServer[selectedServerId] ?? []}
-                routerSyncByCommunity={
-                  !isLive || !routerCompare || routerCompare.serverId !== selectedServerId
-                    ? null
-                    : routerCompare.byCommunity
-                }
-                isLive={isLive}
                 enableSorting={!!search}
                 onEdit={openEdit}
                 onDelete={handleDelete}
@@ -1805,7 +1828,7 @@ export default function FiltersPage() {
             )}
 
             {/* add rule shortcut */}
-            <button onClick={openCreate}
+            <button onClick={openCreate} disabled={mutationsLocked}
               className="w-full flex items-center gap-2 px-5 py-2 text-xs text-muted-foreground hover:text-foreground hover:bg-muted/20 transition-colors border-t">
               <PlusIcon className="size-3.5" />
               Добавить правило для {selectedServer.name}
@@ -1854,6 +1877,17 @@ export default function FiltersPage() {
         recRoutesByServer={recRoutesByServer}
         ensureRecursiveFor={ensureRecursiveRoutes}
       />
+
+      <ConfigHistorySheet
+        open={historyOpen}
+        onOpenChange={setHistoryOpen}
+        title="История фильтров"
+        itemLabel="правил"
+        revisions={revisions}
+        loading={historyLoading}
+        restoring={historyRestoring}
+        onRestore={restoreRevision}
+      />
     </>
   )
 }

app/(main)/firewall/page.tsx

@@ -49,12 +49,14 @@ import {
   PowerIcon, CheckCircleIcon,
   PlayIcon, SquareIcon, RotateCcwIcon, ZapIcon,
   CheckCircle2Icon, XCircleIcon, MinusCircleIcon, SkipForwardIcon,
-  SlidersHorizontalIcon, RefreshCwIcon,
+  SlidersHorizontalIcon, RefreshCwIcon, HistoryIcon,
 } from "lucide-react"
 import { CodeExportSheet } from "@/components/reui-kit/code-export-sheet"
 import { ServerRailLayout, ServerRailMobileButton } from "@/components/server-rail-layout"
 import { ALL_SERVERS_ID, type ServerTileItem } from "@/components/server-tile-rail"
 import { toast } from "sonner"
+import { ConfigHistorySheet } from "@/components/config-history-sheet"
+import type { ConfigRevisionDto } from "@/lib/config-revisions"
 
 // ─── Types ────────────────────────────────────────────────────────────────────
 
@@ -1947,6 +1949,10 @@ function FirewallPageInner() {
   const [exportOpen, setExportOpen] = useState(false)
   const [editingAddr, setEditingAddr] = useState<Partial<AddressListEntry> | null>(null)
   const [addrSheetOpen, setAddrSheetOpen] = useState(false)
+  const [historyOpen, setHistoryOpen] = useState(false)
+  const [revisions, setRevisions] = useState<ConfigRevisionDto[]>([])
+  const [historyLoading, setHistoryLoading] = useState(false)
+  const [historyRestoring, setHistoryRestoring] = useState(false)
 
   const loadLive = useCallback(async () => {
     if (!isLive) return
@@ -1970,6 +1976,42 @@ function FirewallPageInner() {
     }
   }, [isLive, apiFetch])
 
+  const historyServerId = selectedServerId === ALL_SERVERS_ID ? null : selectedServerId
+
+  const loadRevisions = useCallback(async () => {
+    if (!isLive || !historyServerId) return
+    setHistoryLoading(true)
+    try {
+      const res = await apiFetch<{ revisions: ConfigRevisionDto[] }>(
+        `/api/firewall/revisions?serverId=${encodeURIComponent(historyServerId)}`,
+      )
+      setRevisions(res.revisions)
+    } catch (err) {
+      toast.error("Не удалось загрузить историю", { description: String(err) })
+      setRevisions([])
+    } finally {
+      setHistoryLoading(false)
+    }
+  }, [isLive, historyServerId, apiFetch])
+
+  const restoreRevision = useCallback(async (id: string) => {
+    if (!isLive || !historyServerId) return
+    setHistoryRestoring(true)
+    try {
+      await apiFetch(
+        `/api/firewall/revisions/${encodeURIComponent(id)}/restore`,
+        { method: "POST", body: JSON.stringify({ serverId: historyServerId }) },
+      )
+      toast.success("Версия применена на роутер")
+      await loadLive()
+      await loadRevisions()
+    } catch (err) {
+      toast.error("Не удалось откатить", { description: String(err) })
+    } finally {
+      setHistoryRestoring(false)
+    }
+  }, [isLive, historyServerId, apiFetch, loadLive, loadRevisions])
+
   useEffect(() => {
     if (!isLive) {
       queueMicrotask(() => {
@@ -2373,6 +2415,19 @@ function FirewallPageInner() {
                 <RefreshCwIcon className={cn("size-4", dataLoading && "animate-spin")} />
                 Обновить
               </Button>
+              <Button
+                variant="outline"
+                size="sm"
+                onClick={() => {
+                  setHistoryOpen(true)
+                  void loadRevisions()
+                }}
+                disabled={!isLive || !historyServerId || dataLoading}
+                title={!historyServerId ? "Выберите сервер, чтобы смотреть историю" : "История версий и откат на CHR"}
+              >
+                <HistoryIcon className="size-4" />
+                История
+              </Button>
               <Button variant="outline" size="sm" onClick={() => setExportOpen(true)}>
                 <CodeXmlIcon className="size-4" />Экспорт .rsc
               </Button>
@@ -2586,6 +2641,17 @@ function FirewallPageInner() {
         onClose={() => setExportOpen(false)}
         rules={familyRules}
       />
+
+      <ConfigHistorySheet
+        open={historyOpen}
+        onOpenChange={setHistoryOpen}
+        title="История Firewall"
+        itemLabel="объектов"
+        revisions={revisions}
+        loading={historyLoading}
+        restoring={historyRestoring}
+        onRestore={restoreRevision}
+      />
     </>
   )
 }

app/(main)/gre/page.tsx

@@ -13,11 +13,23 @@ import { useDataSource } from "@/lib/data-source"
 import { requestJson } from "@/shared/api/http-client"
 import { cn } from "@/lib/utils"
 import { toast } from "sonner"
-import { Frame, FramePanel } from "@/components/reui/frame"
 import { KpiStatGrid } from "@/components/reui-kit/kpi-stat-grid"
 import { OpsPanel } from "@/components/ops-panel"
 import { Button } from "@/components/ui/button"
 import { Input } from "@/components/ui/input"
+import { ConfigHistorySheet } from "@/components/config-history-sheet"
+import type { ConfigRevisionDto } from "@/lib/config-revisions"
+import {
+  AlertDialog,
+  AlertDialogAction,
+  AlertDialogCancel,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogFooter,
+  AlertDialogHeader,
+  AlertDialogMedia,
+  AlertDialogTitle,
+} from "@/components/ui/alert-dialog"
 import {
   Sheet, SheetContent, SheetHeader, SheetTitle,
   SheetDescription, SheetFooter, SheetClose,
@@ -31,7 +43,7 @@ import {
   LockIcon, LockOpenIcon, ShieldCheckIcon, NetworkIcon,
   EyeIcon, EyeOffIcon, ChevronDownIcon, ChevronRightIcon,
   CodeXmlIcon, PencilIcon, PowerIcon, Trash2Icon,
-  DatabaseIcon,
+  DatabaseIcon, HistoryIcon, TriangleAlertIcon,
 } from "lucide-react"
 import { CodeExportSheet } from "@/components/reui-kit/code-export-sheet"
 import { ServerRailLayout, ServerRailMobileButton } from "@/components/server-rail-layout"
@@ -164,6 +176,7 @@ interface BackendServer {
 
 interface GreTunnelsApiResponse {
   tunnels: GreTunnel[]
+  failures?: Array<{ serverId: string; serverName?: string; error: string }>
 }
 
 function makeApiFetch(backendUrl: string) {
@@ -237,7 +250,6 @@ export default function GrePage() {
   const [liveTunnels, setLiveTunnels] = useState<GreTunnel[]>([])
   const [dataLoading, setDataLoading] = useState(false)
   const [dataError, setDataError] = useState<string | null>(null)
-  const [syncJhBusy, setSyncJhBusy] = useState(false)
 
   const [pageTab,   setPageTab]   = useState<PageTab>("tunnels")
   const [tabFilter, setTabFilter] = useState<TabFilter>("all")
@@ -245,6 +257,15 @@ export default function GrePage() {
   const [selectedServerId, setSelectedServerId] = useState(ALL_SERVERS_ID)
 
   const [tunnelOpen,      setTunnelOpen]      = useState(false)
+  const [tunnelMode,      setTunnelMode]      = useState<"create" | "edit">("create")
+  const [editingTunnel,   setEditingTunnel]   = useState<GreTunnel | null>(null)
+  const [pendingDelete,   setPendingDelete]   = useState<GreTunnel | null>(null)
+  const [mutateBusy,      setMutateBusy]      = useState(false)
+  const [liveStale,       setLiveStale]       = useState(false)
+  const [historyOpen,     setHistoryOpen]     = useState(false)
+  const [revisions,       setRevisions]       = useState<ConfigRevisionDto[]>([])
+  const [historyLoading,  setHistoryLoading]  = useState(false)
+  const [historyRestoring, setHistoryRestoring] = useState(false)
   const [poolOpen,        setPoolOpen]        = useState(false)
   const [codePreviewTunnel, setCodePreviewTunnel] = useState<GreTunnel | null>(null)
 
@@ -261,14 +282,19 @@ export default function GrePage() {
     try {
       const [backendServers, greRes] = await Promise.all([
         apiFetch<BackendServer[]>("/api/servers"),
-        apiFetch<GreTunnelsApiResponse>("/api/filters/gre-tunnels"),
+        apiFetch<GreTunnelsApiResponse>("/api/gre/tunnels"),
       ])
       setLiveServers(backendServers.map(mapBackendToServer))
       setLiveTunnels(greRes.tunnels)
+      setLiveStale(false)
+      if (greRes.failures?.length) {
+        toast.warning(
+          `Не удалось опросить: ${greRes.failures.map((f) => f.serverName ?? f.serverId).join(", ")}`,
+        )
+      }
     } catch (e) {
       setDataError(e instanceof Error ? e.message : "Ошибка загрузки")
-      setLiveServers([])
-      setLiveTunnels([])
+      setLiveStale(true)
     } finally {
       setDataLoading(false)
     }
@@ -280,6 +306,7 @@ export default function GrePage() {
         setLiveServers([])
         setLiveTunnels([])
         setDataError(null)
+        setLiveStale(false)
       })
       return
     }
@@ -323,39 +350,186 @@ export default function GrePage() {
     [displayPools],
   )
 
-  const syncJhToDb = useCallback(async () => {
-    if (!isLive || syncJhBusy) return
-    const jh = displayServers.filter((s) => s.type === "jump-host" && s.enabled)
-    if (jh.length === 0) {
-      toast.info("Нет включённых Jump Host в списке серверов")
+  const historyServerId = selectedServerId === ALL_SERVERS_ID ? null : selectedServerId
+  const mutationsLocked = isLive && (mutateBusy || liveStale || historyRestoring)
+
+  const loadRevisions = useCallback(async () => {
+    if (!isLive || !historyServerId) return
+    setHistoryLoading(true)
+    try {
+      const res = await apiFetch<{ revisions: ConfigRevisionDto[] }>(
+        `/api/gre/revisions?serverId=${encodeURIComponent(historyServerId)}`,
+      )
+      setRevisions(res.revisions)
+    } catch (err) {
+      toast.error("Не удалось загрузить историю", { description: String(err) })
+      setRevisions([])
+    } finally {
+      setHistoryLoading(false)
+    }
+  }, [isLive, historyServerId, apiFetch])
+
+  const restoreRevision = useCallback(async (id: string) => {
+    if (!isLive || !historyServerId) return
+    setHistoryRestoring(true)
+    try {
+      await apiFetch(
+        `/api/gre/revisions/${encodeURIComponent(id)}/restore`,
+        { method: "POST", body: JSON.stringify({ serverId: historyServerId }) },
+      )
+      toast.success("Версия применена на роутер")
+      await loadLive()
+      await loadRevisions()
+    } catch (err) {
+      toast.error("Не удалось откатить", { description: String(err) })
+    } finally {
+      setHistoryRestoring(false)
+    }
+  }, [isLive, historyServerId, apiFetch, loadLive, loadRevisions])
+
+  function tunnelWriteBody(form: typeof defaultTunnelForm) {
+    return {
+      serverId: form.serverId,
+      name: form.name.trim(),
+      localAddress: form.localAddress.trim() || undefined,
+      remoteAddress: form.remoteAddress.trim(),
+      localInnerIp: form.localInnerIp.trim() || undefined,
+      remoteInnerIp: form.remoteInnerIp.trim() || undefined,
+      comment: form.comment || undefined,
+      enabled: form.enabled,
+      mtu: form.mtu,
+      keepaliveInterval: form.keepaliveInterval,
+      keepaliveRetries: form.keepaliveRetries,
+      dscp: form.dscp,
+      clampTcpMss: form.clampTcpMss,
+      allowFastPath: form.allowFastPath,
+      ipsecSecret: form.ipsecEnabled ? form.ipsecSecret : undefined,
+    }
+  }
+
+  async function submitTunnel() {
+    if (!isLive) {
+      toast.info("Создание на роутер доступно только в live-режиме")
       return
     }
-    setSyncJhBusy(true)
-    const errors: string[] = []
-    try {
-      for (const s of jh) {
-        try {
-          await apiFetch<{ ok: boolean }>("/api/filters/sync/from-router", {
-            method: "POST",
-            body: JSON.stringify({ serverId: s.id }),
-          })
-        } catch (e) {
-          errors.push(`${s.name}: ${e instanceof Error ? e.message : "ошибка"}`)
-        }
-      }
-      const fresh = await apiFetch<GreTunnelsApiResponse>("/api/filters/gre-tunnels")
-      setLiveTunnels(fresh.tunnels)
-      if (errors.length) {
-        toast.warning(`Синхронизировано JH: ${jh.length - errors.length}/${jh.length}. Ошибки: ${errors.join("; ")}`)
-      } else {
-        toast.success(`Правила с ${jh.length} JH записаны в БД, список GRE обновлён.`)
-      }
-    } catch (e) {
-      toast.error(e instanceof Error ? e.message : "Ошибка после синхронизации")
-    } finally {
-      setSyncJhBusy(false)
+    if (liveStale) {
+      toast.error("Роутер недоступен — изменения заблокированы")
+      return
     }
-  }, [isLive, syncJhBusy, apiFetch, displayServers])
+    if (!tForm.name.trim() || !tForm.serverId || !tForm.remoteAddress.trim()) {
+      toast.error("Заполните имя, сервер и удалённый адрес")
+      return
+    }
+    if (tForm.ipsecEnabled && tForm.ipsecSecret.trim().length < 8) {
+      toast.error("Для IPsec нужен PSK не короче 8 символов")
+      return
+    }
+    setMutateBusy(true)
+    try {
+      if (tunnelMode === "edit" && editingTunnel) {
+        await apiFetch("/api/gre/tunnels", {
+          method: "PATCH",
+          body: JSON.stringify({
+            ...tunnelWriteBody(tForm),
+            rosId: editingTunnel.id,
+            name: editingTunnel.name,
+          }),
+        })
+        toast.success(`Туннель ${tForm.name} обновлён`)
+      } else {
+        await apiFetch("/api/gre/tunnels", {
+          method: "POST",
+          body: JSON.stringify(tunnelWriteBody(tForm)),
+        })
+        toast.success(`Туннель ${tForm.name} создан`)
+      }
+      setTunnelOpen(false)
+      setEditingTunnel(null)
+      await loadLive()
+    } catch (err) {
+      toast.error("Не удалось сохранить туннель", { description: String(err) })
+    } finally {
+      setMutateBusy(false)
+    }
+  }
+
+  async function toggleTunnel(t: GreTunnel) {
+    if (!isLive || mutationsLocked) return
+    setMutateBusy(true)
+    try {
+      await apiFetch("/api/gre/tunnels", {
+        method: "PATCH",
+        body: JSON.stringify({
+          serverId: t.serverId,
+          rosId: t.id,
+          name: t.name,
+          enabled: !t.enabled,
+          remoteAddress: t.remoteAddress,
+        }),
+      })
+      toast.success(t.enabled ? `Выключен ${t.name}` : `Включён ${t.name}`)
+      await loadLive()
+    } catch (err) {
+      toast.error("Не удалось изменить туннель", { description: String(err) })
+    } finally {
+      setMutateBusy(false)
+    }
+  }
+
+  async function confirmDeleteTunnel() {
+    const t = pendingDelete
+    if (!t || !isLive) return
+    setMutateBusy(true)
+    try {
+      await apiFetch("/api/gre/tunnels", {
+        method: "DELETE",
+        body: JSON.stringify({ serverId: t.serverId, rosId: t.id, name: t.name }),
+      })
+      toast.success(`Удалён ${t.name}`)
+      setPendingDelete(null)
+      await loadLive()
+    } catch (err) {
+      toast.error("Не удалось удалить туннель", { description: String(err) })
+    } finally {
+      setMutateBusy(false)
+    }
+  }
+
+  function openCreateTunnel() {
+    setTunnelMode("create")
+    setEditingTunnel(null)
+    setTForm({
+      ...defaultTunnelForm,
+      serverId: selectedServerId === ALL_SERVERS_ID ? "" : selectedServerId,
+    })
+    setTunnelOpen(true)
+  }
+
+  function openEditTunnel(t: GreTunnel) {
+    setTunnelMode("edit")
+    setEditingTunnel(t)
+    setTForm({
+      ...defaultTunnelForm,
+      name: t.name,
+      serverId: t.serverId,
+      localAddress: t.localAddress === "0.0.0.0" ? "" : t.localAddress,
+      remoteAddress: t.remoteAddress,
+      poolId: t.poolId === "live" ? "" : t.poolId,
+      localInnerIp: t.localInnerIp,
+      remoteInnerIp: t.remoteInnerIp,
+      comment: t.comment,
+      enabled: t.enabled,
+      ipsecEnabled: !!t.ipsec,
+      ipsecSecret: t.ipsec?.secret ?? "",
+      mtu: t.mtu,
+      keepaliveInterval: t.keepaliveInterval,
+      keepaliveRetries: t.keepaliveRetries,
+      dscp: String(t.dscp),
+      clampTcpMss: t.clampTcpMss,
+      allowFastPath: t.allowFastPath,
+    })
+    setTunnelOpen(true)
+  }
 
   useEffect(() => {
     if (dataError) toast.error(dataError)
@@ -403,6 +577,14 @@ export default function GrePage() {
       showAll
       allCount={displayServers.length}
       loading={isLive && dataLoading && displayServers.length === 0}
+      banner={
+        isLive && liveStale ? (
+          <div className="shrink-0 border-b border-amber-500/30 bg-amber-500/10 px-6 py-2.5 text-xs text-amber-700 dark:text-amber-400 flex items-center gap-2">
+            <TriangleAlertIcon className="size-3.5 shrink-0" />
+            Роутер недоступен — показан кэш. Изменения заблокированы, пока не удастся прочитать CHR.
+          </div>
+        ) : null
+      }
       header={
         <PageHeader
           crumbs={[{ label: "Управление" }, { label: "GRE-туннели" }]}
@@ -422,14 +604,17 @@ export default function GrePage() {
               <Button
                 variant="outline"
                 size="sm"
-                onClick={() => { void syncJhToDb() }}
-                disabled={!isLive || syncJhBusy || dataLoading}
-                title="Загрузить правила фильтрации с каждого Jump Host в БД и обновить опрос GRE"
+                onClick={() => {
+                  setHistoryOpen(true)
+                  void loadRevisions()
+                }}
+                disabled={!isLive || !historyServerId || dataLoading}
+                title={!historyServerId ? "Выберите сервер, чтобы смотреть историю" : "История версий и откат на CHR"}
               >
-                <DatabaseIcon className={cn("size-4", syncJhBusy && "animate-pulse")} />
-                JH → БД
+                <HistoryIcon className="size-4" />
+                История
               </Button>
-              <Button size="sm" onClick={() => { setTForm(defaultTunnelForm); setTunnelOpen(true) }}>
+              <Button size="sm" onClick={openCreateTunnel} disabled={mutateBusy}>
                 <PlusIcon className="size-4" />Добавить туннель
               </Button>
             </>
@@ -521,6 +706,10 @@ export default function GrePage() {
                 servers={displayServers}
                 pools={displayPools}
                 onCodePreview={setCodePreviewTunnel}
+                onEdit={openEditTunnel}
+                onToggle={(t) => { void toggleTunnel(t) }}
+                onDelete={setPendingDelete}
+                mutationsLocked={mutationsLocked}
               />
             </DataPageCard>
           )}
@@ -638,18 +827,18 @@ export default function GrePage() {
       <Sheet open={tunnelOpen} onOpenChange={setTunnelOpen}>
         <SheetContent side="right" className="w-full sm:max-w-lg flex flex-col gap-0 p-0">
           <SheetHeader className="px-6 pt-6 pb-4 border-b shrink-0">
-            <SheetTitle>Новый GRE-туннель</SheetTitle>
-            <SheetDescription>RouterOS 7.20+ · /interface gre add</SheetDescription>
+            <SheetTitle>{tunnelMode === "edit" ? "Редактировать GRE-туннель" : "Новый GRE-туннель"}</SheetTitle>
+            <SheetDescription>RouterOS 7.20+ · /interface gre {tunnelMode === "edit" ? "set" : "add"}</SheetDescription>
           </SheetHeader>
 
           <div className="flex-1 overflow-y-auto px-6 py-5 flex flex-col gap-5">
             <div className="flex flex-col gap-4">
               <SectionTitle>Основные</SectionTitle>
               <FormField label="Имя интерфейса" required hint="Только латиница, цифры и дефис, например gre-msk-spb">
-                <Input className="font-mono" placeholder="gre-msk-spb" value={tForm.name} onChange={(e) => setT("name", e.target.value)} />
+                <Input className="font-mono" placeholder="gre-msk-spb" value={tForm.name} disabled={tunnelMode === "edit"} onChange={(e) => setT("name", e.target.value)} />
               </FormField>
               <FormField label="Сервер (MikroTik)" required>
-                <select value={tForm.serverId} onChange={(e) => setT("serverId", e.target.value)}
+                <select value={tForm.serverId} onChange={(e) => setT("serverId", e.target.value)} disabled={tunnelMode === "edit"}
                   className="h-8 w-full rounded-lg border border-input bg-background px-2.5 text-sm text-foreground outline-none focus-visible:border-ring focus-visible:ring-3 focus-visible:ring-ring/50">
                   <option value="" disabled>Выбрать сервер…</option>
                   {displayServers.map((s) => <option key={s.id} value={s.id}>{s.name} ({s.site})</option>)}
@@ -676,7 +865,7 @@ export default function GrePage() {
 
             <div className="flex flex-col gap-4">
               <SectionTitle>Внутренний IP</SectionTitle>
-              <FormField label="IP-пул" required hint="Из какого пула выделяется /30-блок">
+              <FormField label="IP-пул" hint="Необязательно — внутренний IP можно указать вручную">
                 <select value={tForm.poolId} onChange={(e) => setT("poolId", e.target.value)}
                   className="h-8 w-full rounded-lg border border-input bg-background px-2.5 text-sm text-foreground outline-none focus-visible:border-ring focus-visible:ring-3 focus-visible:ring-ring/50">
                   <option value="" disabled>Выбрать пул…</option>
@@ -798,7 +987,9 @@ export default function GrePage() {
 
           <SheetFooter className="px-6 py-4 border-t shrink-0 flex-row gap-2">
             <SheetClose render={<Button variant="outline" className="flex-1" />}>Отмена</SheetClose>
-            <Button className="flex-1" onClick={() => setTunnelOpen(false)}>Создать туннель</Button>
+            <Button className="flex-1" onClick={() => void submitTunnel()} disabled={mutateBusy}>
+              {tunnelMode === "edit" ? "Сохранить" : "Создать туннель"}
+            </Button>
           </SheetFooter>
         </SheetContent>
       </Sheet>
@@ -845,6 +1036,39 @@ export default function GrePage() {
           </SheetFooter>
         </SheetContent>
       </Sheet>
+
+      <ConfigHistorySheet
+        open={historyOpen}
+        onOpenChange={setHistoryOpen}
+        title="История GRE"
+        itemLabel="туннелей"
+        revisions={revisions}
+        loading={historyLoading}
+        restoring={historyRestoring}
+        onRestore={restoreRevision}
+      />
+
+      <AlertDialog open={!!pendingDelete} onOpenChange={(v) => { if (!v) setPendingDelete(null) }}>
+        <AlertDialogContent size="default">
+          <AlertDialogHeader>
+            <AlertDialogMedia className="bg-destructive/10 text-destructive">
+              <Trash2Icon />
+            </AlertDialogMedia>
+            <AlertDialogTitle>Удалить GRE-туннель?</AlertDialogTitle>
+            <AlertDialogDescription>
+              {pendingDelete
+                ? `${pendingDelete.name} на сервере ${serverById[pendingDelete.serverId]?.name ?? pendingDelete.serverId}. Будут удалены интерфейс и связанный /ip/address.`
+                : null}
+            </AlertDialogDescription>
+          </AlertDialogHeader>
+          <AlertDialogFooter>
+            <AlertDialogCancel onClick={() => setPendingDelete(null)}>Отмена</AlertDialogCancel>
+            <AlertDialogAction variant="destructive" onClick={() => void confirmDeleteTunnel()}>
+              Удалить
+            </AlertDialogAction>
+          </AlertDialogFooter>
+        </AlertDialogContent>
+      </AlertDialog>
     </>
   )
 }

app/(main)/recursive-routes/page.tsx

@@ -18,9 +18,12 @@ import { Flag } from "@/components/flag"
 import { useDataSource } from "@/lib/data-source"
 import { cn } from "@/lib/utils"
 import { servers as mockServers, type Server } from "@/lib/data"
-import { PlusIcon, SaveIcon, TrashIcon, SearchIcon, XIcon, PencilIcon, CheckIcon, AlertCircleIcon } from "lucide-react"
+import { PlusIcon, TrashIcon, SearchIcon, XIcon, PencilIcon, CheckIcon, AlertCircleIcon, RefreshCwIcon, HistoryIcon, AlertTriangleIcon } from "lucide-react"
+import { toast } from "sonner"
 import { requestJson } from "@/shared/api/http-client"
 import { ServerRailLayout, ServerRailMobileButton } from "@/components/server-rail-layout"
+import { ConfigHistorySheet } from "@/components/config-history-sheet"
+import type { ConfigRevisionDto } from "@/lib/config-revisions"
 import { type ServerTileItem } from "@/components/server-tile-rail"
 
 interface BackendServer {
@@ -364,7 +367,7 @@ export default function RecursiveRoutesPage() {
   const [servers, setServers] = useState<Server[]>([])
   const [selectedServerId, setSelectedServerId] = useState<string>("")
   const [rows, setRows] = useState<RecursiveRouteRow[]>([])
-  const [busy, setBusy] = useState<"load" | "save" | "from" | "to" | null>(null)
+  const [busy, setBusy] = useState<"load" | "apply" | null>(null)
   const [search, setSearch] = useState("")
   const [sheetOpen, setSheetOpen] = useState(false)
   const [sheetMode, setSheetMode] = useState<"create" | "edit">("create")
@@ -373,6 +376,11 @@ export default function RecursiveRoutesPage() {
   const [gatewayOptions, setGatewayOptions] = useState<GatewayOption[]>([])
   const [expandedGroupKey, setExpandedGroupKey] = useState<string | null>(null)
   const [opError, setOpError] = useState<string | null>(null)
+  const [liveStale, setLiveStale] = useState(false)
+  const [historyOpen, setHistoryOpen] = useState(false)
+  const [historyLoading, setHistoryLoading] = useState(false)
+  const [historyRestoring, setHistoryRestoring] = useState(false)
+  const [revisions, setRevisions] = useState<ConfigRevisionDto[]>([])
   /** В live не дергаем API с id мока (srv1…) пока не подтянули /api/servers */
   const [liveServerListReady, setLiveServerListReady] = useState(false)
 
@@ -407,10 +415,13 @@ export default function RecursiveRoutesPage() {
     setOpError(null)
     setBusy("load")
     try {
-      const res = await apiFetch<{ routes: RecursiveRouteRow[] }>(`/api/recursive-routes?serverId=${selectedServerId}`)
+      const res = await apiFetch<{ routes: RecursiveRouteRow[]; stale?: boolean }>(
+        `/api/recursive-routes?serverId=${selectedServerId}`,
+      )
       setRows(res.routes)
+      setLiveStale(Boolean(res.stale))
     } catch (e) {
-      setRows([])
+      setLiveStale(true)
       setOpError(e instanceof Error ? e.message : "Не удалось загрузить маршруты")
     } finally {
       setBusy(null)
@@ -437,56 +448,65 @@ export default function RecursiveRoutesPage() {
     void loadGateways()
   }, [loadGateways])
 
-  const saveToDb = useCallback(async () => {
-    if (!isLive || !selectedServerId) return
+  const applyRoutes = useCallback(async (next: RecursiveRouteRow[]) => {
+    if (!isLive || !selectedServerId || liveStale) return
+    const prev = rows
+    setRows(next)
     setOpError(null)
-    setBusy("save")
+    setBusy("apply")
     try {
-      await apiFetch<{ ok: boolean }>("/api/recursive-routes", {
+      const res = await apiFetch<{ ok: boolean; routes?: RecursiveRouteRow[] }>("/api/recursive-routes", {
         method: "PUT",
-        body: JSON.stringify({ serverId: selectedServerId, routes: rows }),
+        body: JSON.stringify({ serverId: selectedServerId, routes: next }),
       })
-      await loadRoutes()
+      setRows(res.routes ?? next)
+      setLiveStale(false)
+      toast.success("Маршруты применены на роутер")
     } catch (e) {
-      setOpError(e instanceof Error ? e.message : "Не удалось сохранить маршруты в БД")
+      setRows(prev)
+      const msg = e instanceof Error ? e.message : "Не удалось применить маршруты на роутер"
+      setOpError(msg)
+      toast.error(msg)
     } finally {
       setBusy(null)
     }
-  }, [isLive, selectedServerId, rows, apiFetch, loadRoutes])
+  }, [isLive, selectedServerId, liveStale, rows, apiFetch])
 
-  const syncFromRouter = useCallback(async () => {
+  const loadRevisions = useCallback(async () => {
     if (!isLive || !selectedServerId) return
-    setOpError(null)
-    setBusy("from")
+    setHistoryLoading(true)
     try {
-      await apiFetch<{ ok: boolean }>("/api/recursive-routes/sync/from-router", {
-        method: "POST",
-        body: JSON.stringify({ serverId: selectedServerId }),
-      })
-      await loadRoutes()
+      const res = await apiFetch<{ revisions: ConfigRevisionDto[] }>(
+        `/api/recursive-routes/revisions?serverId=${encodeURIComponent(selectedServerId)}`,
+      )
+      setRevisions(res.revisions)
     } catch (e) {
-      setOpError(e instanceof Error ? e.message : "Не удалось синхронизировать маршруты с роутера")
+      toast.error(e instanceof Error ? e.message : "Не удалось загрузить историю")
+      setRevisions([])
     } finally {
-      setBusy(null)
-    }
-  }, [isLive, selectedServerId, apiFetch, loadRoutes])
-
-  const syncToRouter = useCallback(async () => {
-    if (!isLive || !selectedServerId) return
-    setOpError(null)
-    setBusy("to")
-    try {
-      await apiFetch<{ ok: boolean }>("/api/recursive-routes/sync/to-router", {
-        method: "POST",
-        body: JSON.stringify({ serverId: selectedServerId }),
-      })
-    } catch (e) {
-      setOpError(e instanceof Error ? e.message : "Не удалось применить маршруты на роутер")
-    } finally {
-      setBusy(null)
+      setHistoryLoading(false)
     }
   }, [isLive, selectedServerId, apiFetch])
 
+  const restoreRevision = useCallback(async (id: string) => {
+    if (!isLive || !selectedServerId) return
+    setHistoryRestoring(true)
+    try {
+      const res = await apiFetch<{ ok: boolean; routes?: RecursiveRouteRow[] }>(
+        `/api/recursive-routes/revisions/${encodeURIComponent(id)}/restore`,
+        { method: "POST", body: JSON.stringify({ serverId: selectedServerId }) },
+      )
+      setRows(res.routes ?? [])
+      setLiveStale(false)
+      toast.success("Версия применена на роутер")
+      await loadRevisions()
+    } catch (e) {
+      toast.error(e instanceof Error ? e.message : "Не удалось откатить")
+    } finally {
+      setHistoryRestoring(false)
+    }
+  }, [isLive, selectedServerId, apiFetch, loadRevisions])
+
   function groupKeyOf(row: RecursiveRouteRow): string {
     return row.dstAddress.trim().toLowerCase()
   }
@@ -529,22 +549,26 @@ export default function RecursiveRoutesPage() {
       disabled: false,
       country: ep.country || inferCountry(ep.gateway) || "",
     })
+    let next: RecursiveRouteRow[]
     if (sheetMode === "create") {
       const base = `new-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`
       const expanded = v.endpoints.map((ep, i) => toRow(ep, `${base}-${i}`))
-      setRows(prev => [...prev, ...expanded])
+      next = [...rows, ...expanded]
     } else if (editingGroupKey) {
-      setRows(prev => {
-        const kept = prev.filter(r => groupKeyOf(r) !== editingGroupKey)
-        const base = `edit-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`
-        const expanded = v.endpoints.map((ep, i) => toRow(ep, `${base}-${i}`))
-        return [...kept, ...expanded]
-      })
+      const kept = rows.filter(r => groupKeyOf(r) !== editingGroupKey)
+      const base = `edit-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`
+      const expanded = v.endpoints.map((ep, i) => toRow(ep, `${base}-${i}`))
+      next = [...kept, ...expanded]
+    } else {
+      setSheetOpen(false)
+      return
     }
     setSheetOpen(false)
+    void applyRoutes(next)
   }
 
   const currentServer = servers.find(s => s.id === selectedServerId)
+  const mutationsLocked = !isLive || busy !== null || liveStale
   const rrRailItems = useMemo<ServerTileItem[]>(() => (
     servers.map((s) => ({
       id: s.id,
@@ -602,16 +626,33 @@ export default function RecursiveRoutesPage() {
           actions={
             <>
               <ServerRailMobileButton />
-              <Button variant="outline" size="sm" onClick={syncFromRouter} disabled={!isLive || busy !== null}>
-                {busy === "from" ? "Синхронизация..." : "Router => DB"}
-              </Button>
-              <Button variant="outline" size="sm" onClick={syncToRouter} disabled={!isLive || busy !== null}>
-                {busy === "to" ? "Применение..." : "DB => Router"}
-              </Button>
-              <Button variant="outline" size="sm" onClick={saveToDb} disabled={!isLive || busy !== null}>
-                <SaveIcon className="size-4" />Сохранить в БД
-              </Button>
-              <Button size="sm" onClick={openCreate} disabled={!isLive || busy !== null}>
+              {isLive && (
+                <>
+                  <Button
+                    variant="outline"
+                    size="sm"
+                    onClick={() => void loadRoutes()}
+                    disabled={busy !== null}
+                    title="Прочитать маршруты с роутера"
+                  >
+                    <RefreshCwIcon className={cn("size-4", busy === "load" && "animate-spin")} />
+                    Обновить
+                  </Button>
+                  <Button
+                    variant="outline"
+                    size="sm"
+                    onClick={() => {
+                      setHistoryOpen(true)
+                      void loadRevisions()
+                    }}
+                    disabled={busy !== null}
+                  >
+                    <HistoryIcon className="size-4" />
+                    История
+                  </Button>
+                </>
+              )}
+              <Button size="sm" onClick={openCreate} disabled={mutationsLocked}>
                 <PlusIcon className="size-4" />Добавить
               </Button>
             </>
@@ -643,6 +684,12 @@ export default function RecursiveRoutesPage() {
               {opError}
             </div>
           )}
+          {liveStale && (
+            <div className="w-full text-xs text-amber-700 dark:text-amber-400 bg-amber-500/10 border border-amber-500/20 rounded-md px-3 py-2 flex items-center gap-2">
+              <AlertTriangleIcon className="size-3.5 shrink-0" />
+              Роутер недоступен — показан кэш. Изменения заблокированы.
+            </div>
+          )}
         </div>
       }
     >
@@ -679,10 +726,13 @@ export default function RecursiveRoutesPage() {
               expandedKey={expandedGroupKey}
               onExpandedChange={setExpandedGroupKey}
               onEdit={openEdit}
-              onDelete={(g) => setRows((prev) => prev.filter((r) => groupKeyOf(r) !== g.key))}
+              onDelete={(g) => {
+                if (mutationsLocked) return
+                void applyRoutes(rows.filter((r) => groupKeyOf(r) !== g.key))
+              }}
             />
-            <button onClick={openCreate}
-              className="w-full flex items-center gap-2 px-5 py-2 text-xs text-muted-foreground hover:text-foreground hover:bg-muted/20 transition-colors border-t">
+            <button onClick={openCreate} disabled={mutationsLocked}
+              className="w-full flex items-center gap-2 px-5 py-2 text-xs text-muted-foreground hover:text-foreground hover:bg-muted/20 transition-colors border-t disabled:opacity-50">
               <PlusIcon className="size-3.5" />
               Добавить маршрут
             </button>
@@ -698,6 +748,17 @@ export default function RecursiveRoutesPage() {
         onClose={() => setSheetOpen(false)}
         gateways={gatewayOptions}
       />
+
+      <ConfigHistorySheet
+        open={historyOpen}
+        onOpenChange={setHistoryOpen}
+        title="История маршрутов"
+        itemLabel="маршрутов"
+        revisions={revisions}
+        loading={historyLoading}
+        restoring={historyRestoring}
+        onRestore={restoreRevision}
+      />
     </>
   )
 }

app/(main)/wireguard/page.tsx

@@ -57,10 +57,12 @@ import {
   type ServerTileItem,
 } from "@/components/server-tile-rail"
 import { toast } from "sonner"
+import { ConfigHistorySheet } from "@/components/config-history-sheet"
+import type { ConfigRevisionDto } from "@/lib/config-revisions"
 import {
   ShieldCheckIcon, PlusIcon, KeyRoundIcon,
   UsersIcon, ActivityIcon, RefreshCwIcon, UploadIcon, InfoIcon,
-  Trash2Icon, CodeXmlIcon, AlertCircleIcon,
+  Trash2Icon, CodeXmlIcon, AlertCircleIcon, HistoryIcon,
 } from "lucide-react"
 
 type WgWorkspaceTab = "interfaces" | "peers" | "cli"
@@ -188,6 +190,10 @@ export default function WireGuardPage() {
   const [exportPeerId, setExportPeerId] = useState<string | null>(null)
   const [peerIface, setPeerIface] = useState<WgIfaceWithServer | null>(null)
   const [pendingDelete, setPendingDelete] = useState<PendingDelete | null>(null)
+  const [historyOpen, setHistoryOpen] = useState(false)
+  const [revisions, setRevisions] = useState<ConfigRevisionDto[]>([])
+  const [historyLoading, setHistoryLoading] = useState(false)
+  const [historyRestoring, setHistoryRestoring] = useState(false)
   const [liveExport, setLiveExport] = useState<{
     rsc?: string
     conf?: string
@@ -242,6 +248,44 @@ export default function WireGuardPage() {
       ? selectedServerId
       : ALL_SERVERS_ID
 
+  const historyServerId = effectiveServerId === ALL_SERVERS_ID ? null : effectiveServerId
+
+  const loadRevisions = useCallback(async () => {
+    if (!isLive || !historyServerId) return
+    setHistoryLoading(true)
+    try {
+      const res = await requestJson<{ revisions: ConfigRevisionDto[] }>(
+        backendUrl,
+        `/api/wireguard/revisions?serverId=${encodeURIComponent(historyServerId)}`,
+      )
+      setRevisions(res.revisions)
+    } catch (err) {
+      toast.error("Не удалось загрузить историю", { description: String(err) })
+      setRevisions([])
+    } finally {
+      setHistoryLoading(false)
+    }
+  }, [isLive, historyServerId, backendUrl])
+
+  const restoreRevision = useCallback(async (id: string) => {
+    if (!isLive || !historyServerId) return
+    setHistoryRestoring(true)
+    try {
+      await requestJson(
+        backendUrl,
+        `/api/wireguard/revisions/${encodeURIComponent(id)}/restore`,
+        { method: "POST", body: JSON.stringify({ serverId: historyServerId }) },
+      )
+      toast.success("Версия применена на роутер")
+      await loadLive()
+      await loadRevisions()
+    } catch (err) {
+      toast.error("Не удалось откатить", { description: String(err) })
+    } finally {
+      setHistoryRestoring(false)
+    }
+  }, [isLive, historyServerId, backendUrl, loadLive, loadRevisions])
+
   const scopedIfaces = useMemo(() => {
     if (effectiveServerId === ALL_SERVERS_ID) return displayIfaces
     return displayIfaces.filter((i) => i.serverId === effectiveServerId)
@@ -544,6 +588,7 @@ export default function WireGuardPage() {
             <>
               <ServerRailMobileButton />
               {isLive && (
+                <>
                 <Button
                   size="sm"
                   variant="outline"
@@ -553,6 +598,20 @@ export default function WireGuardPage() {
                   <RefreshCwIcon className={`size-4 ${loading ? "animate-spin" : ""}`} />
                   Обновить
                 </Button>
+                <Button
+                  size="sm"
+                  variant="outline"
+                  disabled={loading || !historyServerId}
+                  title={!historyServerId ? "Выберите сервер, чтобы смотреть историю" : "История версий и откат на CHR"}
+                  onClick={() => {
+                    setHistoryOpen(true)
+                    void loadRevisions()
+                  }}
+                >
+                  <HistoryIcon className="size-4" />
+                  История
+                </Button>
+                </>
               )}
               <Button size="sm" variant="outline" onClick={() => setImportOpen(true)}>
                 <UploadIcon className="size-4" />
@@ -822,6 +881,17 @@ export default function WireGuardPage() {
           </AlertDialogFooter>
         </AlertDialogContent>
       </AlertDialog>
+
+      <ConfigHistorySheet
+        open={historyOpen}
+        onOpenChange={setHistoryOpen}
+        title="История WireGuard"
+        itemLabel="интерфейсов"
+        revisions={revisions}
+        loading={historyLoading}
+        restoring={historyRestoring}
+        onRestore={restoreRevision}
+      />
     </>
   )
 }

backend/drizzle/0006_config_revisions.sql

@@ -0,0 +1,16 @@
+-- История desired/actual снапшотов managed-секций (фильтры, рекурсивные маршруты).
+-- Retention — prune в сервисе (последние 50 на пару server+section).
+
+CREATE TABLE IF NOT EXISTS config_revisions (
+  id TEXT PRIMARY KEY,
+  server_id BIGINT NOT NULL REFERENCES servers(id) ON DELETE CASCADE,
+  section TEXT NOT NULL,
+  source TEXT NOT NULL,
+  fingerprint TEXT NOT NULL,
+  payload JSONB NOT NULL DEFAULT '[]'::jsonb,
+  note TEXT,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS idx_config_revisions_server_section_created
+  ON config_revisions (server_id, section, created_at DESC);

backend/package.json

@@ -18,10 +18,11 @@
     "test:traffic-rate": "tsx src/services/traffic-rate.test.ts",
     "test:traffic-flow": "tsx src/services/traffic-flow-parse.test.ts && tsx src/services/traffic-flow-map-exporter.test.ts && tsx src/services/traffic-flow-ifaces.test.ts && tsx src/services/traffic-flow-ifindex.test.ts && tsx src/services/traffic-flow-dedup.test.ts && tsx src/services/traffic-flow-planes.test.ts && tsx src/services/traffic-flow-ip.test.ts && tsx src/services/traffic-flow-dest.test.ts && tsx src/services/traffic-flow-classify.test.ts && tsx src/services/traffic-flow-ripe.test.ts && tsx src/services/traffic-flow-brands.test.ts && tsx src/services/traffic-flow-ingest.test.ts && tsx src/services/traffic-flow-analytics.test.ts && tsx src/services/traffic-flow-map-hops.test.ts && tsx src/services/traffic-flow-purge.test.ts && tsx src/services/traffic-flow-geoip.test.ts && tsx src/services/traffic-flow-facts.test.ts && tsx src/services/traffic-flow-facts-filter.test.ts && tsx src/services/traffic-flow-facts-rebuild.test.ts && tsx src/services/statistics-aggregate.test.ts",
     "test:users": "tsx src/modules/users/iface-type.test.ts && tsx src/modules/users/bindings.test.ts",
-    "test:pg": "tsx src/db/sql-bind.test.ts && tsx src/db/sqlite-json.test.ts && tsx src/db/traffic-flags.test.ts && tsx src/db/pg-schema.test.ts",
+    "test:pg": "tsx src/db/sql-bind.test.ts && tsx src/db/sqlite-json.test.ts && tsx src/db/traffic-flags.test.ts && tsx src/db/pg-schema.test.ts && tsx src/services/config-revisions.test.ts",
+    "test:config-sync": "tsx src/services/config-apply-plan.test.ts && tsx src/services/entity-snapshots.test.ts",
     "test:backups": "tsx src/services/s3-backup-client.test.ts",
     "test:live-maps": "tsx src/services/ospf-route-parse.test.ts && tsx src/services/vxlan-live.test.ts && tsx src/services/containers-live.test.ts",
-    "test": "npm run test:alert-engine && npm run test:auth && npm run test:wireguard && npm run test:traffic-rate && npm run test:traffic-flow && npm run test:users && npm run test:pg && npm run test:backups && npm run test:live-maps",
+    "test": "npm run test:alert-engine && npm run test:auth && npm run test:wireguard && npm run test:traffic-rate && npm run test:traffic-flow && npm run test:users && npm run test:pg && npm run test:backups && npm run test:live-maps && npm run test:config-sync",
     "test:geoip": "tsx src/services/traffic-flow-geoip.test.ts"
   },
   "dependencies": {

backend/src/db/pg-schema.test.ts

@@ -163,6 +163,22 @@ if (!(await withPgOrSkip())) {
   await dbQuery(`DELETE FROM servers WHERE name = 'pg-wipe-idempotent'`)
 }
 
+{
+  const mig = await dbQuery<{ id: string }>(
+    `SELECT id FROM schema_migrations WHERE id = '0006_config_revisions'`,
+  )
+  assert.equal(mig.rows.length, 1, "0006 применена")
+
+  const { rows } = await dbQuery<{ column_name: string; udt_name: string }>(`
+    SELECT column_name, udt_name FROM information_schema.columns
+    WHERE table_schema = 'public' AND table_name = 'config_revisions'
+  `)
+  const by = Object.fromEntries(rows.map((r) => [r.column_name, r.udt_name]))
+  assert.equal(by.payload, "jsonb")
+  assert.equal(by.fingerprint, "text")
+  assert.equal(by.section, "text")
+}
+
 {
   const marker = await dbQuery<{ sqlite_imported_at: string | null }>(
     `SELECT sqlite_imported_at FROM data_migration WHERE id = 1`,

backend/src/db/schema.ts

@@ -93,6 +93,19 @@ export const filterRules = pgTable("filter_rules", {
   index("idx_filter_rules_server_sort").on(t.serverId, t.sortOrder),
 ])
 
+export const configRevisions = pgTable("config_revisions", {
+  id:          text("id").primaryKey(),
+  serverId:    intPkRef().references(() => servers.id, { onDelete: "cascade" }),
+  section:     text("section", { enum: ["filters", "recursive-routes", "firewall", "wireguard", "gre"] }).notNull(),
+  source:      text("source", { enum: ["apply", "rollback", "observed", "copy"] }).notNull(),
+  fingerprint: text("fingerprint").notNull(),
+  payload:     jsonb("payload").$type<unknown>().notNull().default(sql`'[]'::jsonb`),
+  note:        text("note"),
+  createdAt:   ts("created_at").notNull().defaultNow(),
+}, (t) => [
+  index("idx_config_revisions_server_section_created").on(t.serverId, t.section, t.createdAt),
+])
+
 export const recursiveRoutes = pgTable("recursive_routes", {
   id:            idIdentity().primaryKey(),
   serverId:      intPkRef().references(() => servers.id, { onDelete: "cascade" }),
@@ -733,6 +746,7 @@ export type ServerInsert   = typeof servers.$inferInsert
 export type Snapshot       = typeof serverSnapshots.$inferSelect
 export type SnapshotInsert = typeof serverSnapshots.$inferInsert
 export type FilterRuleRow  = typeof filterRules.$inferSelect
+export type ConfigRevisionRow = typeof configRevisions.$inferSelect
 export type RecursiveRouteRow = typeof recursiveRoutes.$inferSelect
 export type TrafficSettingsRow = typeof trafficSettings.$inferSelect
 export type TrafficFlowSettingsRow = typeof trafficFlowSettings.$inferSelect

backend/src/index.ts

@@ -32,6 +32,7 @@ import wireguardRoutes from "./routes/wireguard.js"
 import vxlanRoutes from "./routes/vxlan.js"
 import containersRoutes from "./routes/containers.js"
 import firewallRoutes from "./routes/firewall.js"
+import greRoutes from "./routes/gre.js"
 import usersRoutes from "./routes/users.js"
 import statisticsRoutes from "./routes/statistics.js"
 import { refreshScheduler, stopScheduler } from "./services/scheduler.js"
@@ -139,6 +140,7 @@ export async function buildApp(opts?: {
   await app.register(vxlanRoutes, { prefix: "/api" })
   await app.register(containersRoutes, { prefix: "/api" })
   await app.register(firewallRoutes, { prefix: "/api" })
+  await app.register(greRoutes, { prefix: "/api" })
   await app.register(usersRoutes, { prefix: "/api" })
   await app.register(statisticsRoutes, { prefix: "/api" })
 

backend/src/lib/permissions.test.ts

@@ -41,6 +41,14 @@ assert.equal(
   permissionForRequest("GET", "/api/firewall/all"),
   "mm:network:read",
 )
+assert.equal(
+  permissionForRequest("GET", "/api/gre/tunnels"),
+  "mm:network:read",
+)
+assert.equal(
+  permissionForRequest("POST", "/api/gre/tunnels"),
+  "mm:network:write",
+)
 assert.equal(
   permissionForRequest("GET", "/api/users"),
   "mm:users:read",

backend/src/lib/permissions.ts

@@ -155,7 +155,8 @@ const RULES: Rule[] = [
       p.startsWith("/api/internet-path") ||
       p.startsWith("/api/exec") ||
       p.startsWith("/api/wireguard") ||
-      p.startsWith("/api/firewall"),
+      p.startsWith("/api/firewall") ||
+      p.startsWith("/api/gre"),
     permission: "mm:network:read",
   },
   {
@@ -168,7 +169,8 @@ const RULES: Rule[] = [
       p.startsWith("/api/internet-path") ||
       p.startsWith("/api/exec") ||
       p.startsWith("/api/wireguard") ||
-      p.startsWith("/api/firewall"),
+      p.startsWith("/api/firewall") ||
+      p.startsWith("/api/gre"),
     permission: "mm:network:write",
   },
 ]

backend/src/managed-markers.ts

@@ -19,5 +19,31 @@ export function managedComment(label: string): string {
 }
 
 export function managedRecursiveComment(comment?: string | null): string {
-  return comment ? `${PRODUCT_NAME}:recursive ${comment}` : `${PRODUCT_NAME}:recursive`
+  const stripped = stripManagedRecursiveComment(comment ?? "")
+  return stripped ? `${PRODUCT_NAME}:recursive ${stripped}` : `${PRODUCT_NAME}:recursive`
+}
+
+const LEGACY_RECURSIVE_PREFIX = /^recursive:\s*/i
+
+export function stripManagedRecursiveComment(comment: string): string {
+  const value = comment.trim()
+  if (!value) return ""
+  const managedPrefixes = [
+    `${PRODUCT_NAME}:recursive`,
+    `${LEGACY_PRODUCT_NAME}:recursive`,
+  ]
+  for (const prefix of managedPrefixes) {
+    if (value.startsWith(prefix)) return value.slice(prefix.length).trim()
+  }
+  if (LEGACY_RECURSIVE_PREFIX.test(value)) {
+    return value.replace(LEGACY_RECURSIVE_PREFIX, "").trim()
+  }
+  return value
+}
+
+/** Owned recursive route: MM/legacy prefix or old `recursive:` mask. */
+export function isOwnedRecursiveComment(comment: string | undefined): boolean {
+  if (!comment) return false
+  const value = comment.trim()
+  return hasManagedRecursiveComment(value) || LEGACY_RECURSIVE_PREFIX.test(value)
 }

backend/src/routes/filters.ts

@@ -1,14 +1,20 @@
-import { and, asc, eq, inArray } from "drizzle-orm"
+import { and, asc, eq } from "drizzle-orm"
+import { z } from "zod"
 import type { FastifyPluginAsyncZod } from "@fastify/type-provider-zod"
 import { db } from "../db/index.js"
 import { filterRules, recursiveRoutes, servers } from "../db/schema.js"
 import { MikrotikClient } from "../services/mikrotik.js"
 import { parseDbServerId } from "../utils/server-id.js"
 import { appendEvent } from "../modules/events/service/events-service.js"
+import { managedComment } from "../managed-markers.js"
+import { planBgpInApply } from "../services/config-apply-plan.js"
 import {
-  hasManagedCommentPrefix,
-  managedComment,
-} from "../managed-markers.js"
+  appendRevisionIfChanged,
+  canonicalFilterRules,
+  getRevisionById,
+  listRevisions,
+  type ConfigRevisionSource,
+} from "../services/config-revisions.js"
 
 type ServerRow = typeof servers.$inferSelect
 
@@ -296,47 +302,6 @@ async function resolveRouteTargets(serverId: number, rule: ApiFilterRule): Promi
   return { gateway: rule.gateway, outIface: tid }
 }
 
-function normalizeCommunity(c: string): string {
-  return (c ?? "").trim()
-}
-
-/** Одинаковый эффект на роутере при одинаковой community (blackhole vs gateway + out-interface) */
-async function ruleEffectSignature(serverId: number, r: ApiFilterRule): Promise<string> {
-  if (r.action === "blackhole") return `bh:${normalizeCommunity(r.community)}`
-  const { gateway, outIface } = await resolveRouteTargets(serverId, r)
-  return `rt:${normalizeCommunity(r.community)}:${gateway}:${outIface}`
-}
-
-export type FilterRouterCompareStatus = "synced" | "drift" | "missing"
-
-async function compareDbRulesWithRouter(
-  serverId: number,
-  dbRules: ApiFilterRule[],
-  remoteRules: ApiFilterRule[],
-): Promise<Record<string, FilterRouterCompareStatus>> {
-  const remoteSigByComm = new Map<string, string>()
-  for (const rr of remoteRules) {
-    const c = normalizeCommunity(rr.community)
-    if (!remoteSigByComm.has(c)) {
-      remoteSigByComm.set(c, await ruleEffectSignature(serverId, rr))
-    }
-  }
-  const out: Record<string, FilterRouterCompareStatus> = {}
-  for (const dr of dbRules) {
-    const c = normalizeCommunity(dr.community)
-    const sigD = await ruleEffectSignature(serverId, dr)
-    const sigR = remoteSigByComm.get(c)
-    if (sigR === undefined) {
-      out[c] = "missing"
-    } else if (sigR !== sigD) {
-      out[c] = "drift"
-    } else {
-      out[c] = "synced"
-    }
-  }
-  return out
-}
-
 async function toRouterRuleBody(serverId: number, rules: ApiFilterRule[]): Promise<string> {
   if (rules.length === 0) return ""
   // Группируем по эффекту (action + gateway + out-interface). Communities с одним и тем же
@@ -421,44 +386,80 @@ async function replaceDbRules(serverId: number, rules: ApiFilterRule[]) {
   )
 }
 
-const filtersRoutes: FastifyPluginAsyncZod = async (app) => {
-  /** Сравнение правил в БД с живым bgp-in на MikroTik (один запрос API к роутеру) */
-  app.get("/filters/router-compare", async (req, reply) => {
-    const q = req.query as { serverId?: string | number }
-    const serverId = parseDbServerId(q.serverId)
-    if (serverId === null) {
-      return reply.status(400).send({ error: "serverId is required" })
-    }
+async function cacheRulesetsForServer(serverId: number): Promise<ApiFilterRule[]> {
+  const rows = await db
+    .select()
+    .from(filterRules)
+    .where(eq(filterRules.serverId, serverId))
+    .orderBy(asc(filterRules.sortOrder))
+  return rows.map((r) => ({
+    id: String(r.id),
+    community: r.community,
+    communityName: r.communityName ?? undefined,
+    action: r.action,
+    gateway: r.gateway,
+    gatewayTunnelId: r.gatewayTunnelId,
+    description: r.description,
+  }))
+}
 
-    const server = (await db.select().from(servers).where(eq(servers.id, serverId)).limit(1))[0]
-    if (!server) return reply.status(404).send({ error: "Server not found" })
+async function applyFiltersToServer(
+  server: ServerRow,
+  rules: ApiFilterRule[],
+  source: ConfigRevisionSource,
+): Promise<{ pushed: number; action: string; conflictsRemoved: number }> {
+  const client = MikrotikClient.fromServer(server)
+  const existing = await client.get<RosFilterRule[]>("/routing/filter/rule")
+  const plan = planBgpInApply(existing, rules.length)
+  const managedCommentValue = managedComment(server.name || server.host)
 
-    try {
-      const remote = await fetchServerFilters(server)
-      const rows = await db
-        .select()
-        .from(filterRules)
-        .where(eq(filterRules.serverId, serverId))
-        .orderBy(asc(filterRules.sortOrder))
+  if (plan.action === "patch" && plan.managedId) {
+    const ruleBody = await toRouterRuleBody(server.id, rules)
+    await client.patch(
+      `/routing/filter/rule/${encodeURIComponent(plan.managedId)}`,
+      {
+        chain: "bgp-in",
+        comment: managedCommentValue,
+        rule: ruleBody,
+        disabled: "no",
+      },
+    )
+  } else if (plan.action === "create") {
+    const ruleBody = await toRouterRuleBody(server.id, rules)
+    await client.post("/routing/filter/rule/add", {
+      chain: "bgp-in",
+      comment: managedCommentValue,
+      rule: ruleBody,
+    })
+  } else if (plan.action === "delete" && plan.managedId) {
+    await client.delete(
+      `/routing/filter/rule/${encodeURIComponent(plan.managedId)}`,
+    )
+  }
 
-      const dbRules: ApiFilterRule[] = rows.map(r => ({
-        id: String(r.id),
-        community: r.community,
-        communityName: r.communityName ?? undefined,
-        action: r.action,
-        gateway: r.gateway,
-        gatewayTunnelId: r.gatewayTunnelId,
-        description: r.description,
-      }))
+  for (const id of plan.conflictIds) {
+    await client.delete(`/routing/filter/rule/${encodeURIComponent(id)}`)
+  }
 
-      const byCommunity = await compareDbRulesWithRouter(serverId, dbRules, remote.rules)
-      return reply.send({ byCommunity })
-    } catch (err) {
-      app.log.error({ serverId, err: String(err) }, "filters router-compare failed")
-      return reply.status(500).send({ error: String(err) })
-    }
+  await replaceDbRules(server.id, rules)
+  await appendRevisionIfChanged({
+    serverId: server.id,
+    section: "filters",
+    source,
+    payload: canonicalFilterRules(rules),
   })
 
+  return {
+    pushed: rules.length,
+    action: plan.action,
+    conflictsRemoved: plan.conflictIds.length,
+  }
+}
+
+const RevisionIdParamSchema = z.object({ id: z.string().min(1) })
+
+const filtersRoutes: FastifyPluginAsyncZod = async (app) => {
+
   /** GRE с роутеров: один сервер (?serverId) или все включённые (без query) — для /gre, карты сети */
   app.get("/filters/gre-tunnels", async (req, reply) => {
     const q = req.query as { serverId?: string | number }
@@ -487,74 +488,103 @@ const filtersRoutes: FastifyPluginAsyncZod = async (app) => {
     return reply.send({ tunnels: results.flat() })
   })
 
-  /** Только правила фильтров из БД (без опроса MikroTik за GRE) */
-  app.get("/filters/rules", async (_req, reply) => {
+  /** Без serverId — cache для дашборда. С serverId — live с CHR, cache fallback. */
+  app.get("/filters/rules", async (req, reply) => {
+    const q = req.query as { serverId?: string | number }
+    const serverId = parseDbServerId(q.serverId)
     const allServers = await db.select().from(servers).where(eq(servers.enabled, true))
-    const dbRulesets = await toApiRulesets(allServers)
 
-    return reply.send({
-      rulesets: dbRulesets,
-      greTunnels: [] as LiveGreTunnel[],
-    })
-  })
-
-  app.put("/filters/rules", async (req, reply) => {
-    const body = req.body as { rulesets?: Array<{ serverId: string; rules: ApiFilterRule[] }> }
-    const payload = body.rulesets ?? []
-    const serverIds = payload.map(r => Number.parseInt(r.serverId, 10)).filter(Number.isFinite)
-    if (serverIds.length > 0) {
-      await db.delete(filterRules).where(inArray(filterRules.serverId, serverIds))
-    }
-    for (const rs of payload) {
-      const sid = Number.parseInt(rs.serverId, 10)
-      if (!Number.isFinite(sid)) continue
-      await replaceDbRules(sid, rs.rules ?? [])
-    }
-    return reply.send({ ok: true })
-  })
-
-  app.post("/filters/sync/from-router", async (_req, reply) => {
-    const body = _req.body as { serverId?: string | number } | undefined
-    const rawServerId = body?.serverId
-    const serverId = parseDbServerId(rawServerId)
     if (serverId === null) {
-      return reply.status(400).send({ error: "serverId is required" })
+      const dbRulesets = await toApiRulesets(allServers)
+      return reply.send({
+        rulesets: dbRulesets,
+        greTunnels: [] as LiveGreTunnel[],
+        live: false,
+        stale: false,
+      })
     }
 
-    const server = (await db.select().from(servers).where(eq(servers.id, serverId)).limit(1))[0]
+    const server = allServers.find((s) => s.id === serverId)
+      ?? (await db.select().from(servers).where(eq(servers.id, serverId)).limit(1))[0]
     if (!server) return reply.status(404).send({ error: "Server not found" })
 
     try {
-      app.log.info({ serverId, host: server.host }, "Filters sync from router started")
-      await appendEvent({
-        level: "info",
-        eventType: "filters.sync.from_router.started",
-        sourceModule: "filters",
-        title: "Синхронизация фильтров запущена",
-        message: `${server.name || server.host} → БД`,
-        entityType: "server",
-        entityId: String(serverId),
-      })
       const remote = await fetchServerFilters(server)
       await replaceDbRules(server.id, remote.rules)
-      app.log.info({ serverId, totalRules: remote.rules.length }, "Filters sync from router completed")
+      await appendRevisionIfChanged({
+        serverId: server.id,
+        section: "filters",
+        source: "observed",
+        payload: canonicalFilterRules(remote.rules),
+      })
+      const cached = await cacheRulesetsForServer(server.id)
+      return reply.send({
+        rulesets: [{ serverId: String(server.id), rules: cached }],
+        greTunnels: remote.tunnels,
+        live: true,
+        stale: false,
+      })
+    } catch (err) {
+      app.log.warn({ serverId, err: String(err) }, "filters live GET failed, serving cache")
+      const cached = await cacheRulesetsForServer(server.id)
+      return reply.send({
+        rulesets: [{ serverId: String(server.id), rules: cached }],
+        greTunnels: [] as LiveGreTunnel[],
+        live: false,
+        stale: true,
+        error: String(err),
+      })
+    }
+  })
+
+  app.put("/filters/rules", async (req, reply) => {
+    const body = req.body as {
+      serverId?: string | number
+      rules?: ApiFilterRule[]
+      source?: ConfigRevisionSource
+    }
+    const serverId = parseDbServerId(body.serverId)
+    if (serverId === null) return reply.status(400).send({ error: "serverId is required" })
+    const server = (await db.select().from(servers).where(eq(servers.id, serverId)).limit(1))[0]
+    if (!server) return reply.status(404).send({ error: "Server not found" })
+
+    const rules = body.rules ?? []
+    const source: ConfigRevisionSource = body.source === "copy" ? "copy" : "apply"
+    try {
       await appendEvent({
         level: "info",
-        eventType: "filters.sync.from_router.done",
+        eventType: "filters.apply.started",
         sourceModule: "filters",
-        title: "Синхронизация фильтров завершена",
-        message: `${server.name || server.host}: ${remote.rules.length} правил`,
+        title: "Применение фильтров на роутер",
+        message: `${server.name || server.host}: ${rules.length} правил`,
         entityType: "server",
         entityId: String(serverId),
       })
-      return reply.send({ ok: true, updatedServers: 1, totalRules: remote.rules.length, serverId })
+      const result = await applyFiltersToServer(server, rules, source)
+      const cached = await cacheRulesetsForServer(server.id)
+      await appendEvent({
+        level: "info",
+        eventType: "filters.apply.done",
+        sourceModule: "filters",
+        title: "Фильтры применены",
+        message: `${server.name || server.host}: ${result.pushed} правил (${result.action})`,
+        entityType: "server",
+        entityId: String(serverId),
+      })
+      return reply.send({
+        ok: true,
+        serverId,
+        pushedRules: result.pushed,
+        action: result.action,
+        rules: cached,
+      })
     } catch (err) {
-      app.log.error({ serverId, err: String(err) }, "Filters sync from router failed")
+      app.log.error({ serverId, err: String(err) }, "filters apply failed")
       await appendEvent({
         level: "critical",
-        eventType: "filters.sync.from_router.failed",
+        eventType: "filters.apply.failed",
         sourceModule: "filters",
-        title: "Ошибка синхронизации фильтров",
+        title: "Ошибка применения фильтров",
         message: `${server.name || server.host}: ${String(err)}`,
         entityType: "server",
         entityId: String(serverId),
@@ -563,145 +593,60 @@ const filtersRoutes: FastifyPluginAsyncZod = async (app) => {
     }
   })
 
-  app.post("/filters/sync/to-router", async (req, reply) => {
+  app.get("/filters/revisions", async (req, reply) => {
+    const q = req.query as { serverId?: string | number }
+    const serverId = parseDbServerId(q.serverId)
+    if (serverId === null) return reply.status(400).send({ error: "serverId is required" })
+    const revisions = await listRevisions(serverId, "filters")
+    return reply.send({ revisions })
+  })
+
+  app.post("/filters/revisions/:id/restore", {
+    schema: { params: RevisionIdParamSchema },
+  }, async (req, reply) => {
+    const { id } = req.params
     const body = req.body as { serverId?: string | number } | undefined
-    const requestedServerId = parseDbServerId(body?.serverId)
-
-    const allServers = await db.select().from(servers).where(eq(servers.enabled, true))
-    const targetServers = requestedServerId !== null
-      ? allServers.filter(s => s.id === requestedServerId)
-      : allServers
-
-    if (requestedServerId !== null && targetServers.length === 0) {
-      return reply.status(404).send({ error: "Server not found" })
+    const rev = await getRevisionById(id)
+    if (!rev) return reply.status(404).send({ error: "Revision not found" })
+    if (rev.section !== "filters") return reply.status(400).send({ error: "Revision section mismatch" })
+    const requested = parseDbServerId(body?.serverId)
+    if (requested !== null && requested !== rev.serverId) {
+      return reply.status(400).send({ error: "Revision belongs to another server" })
     }
+    const server = (await db.select().from(servers).where(eq(servers.id, rev.serverId)).limit(1))[0]
+    if (!server) return reply.status(404).send({ error: "Server not found" })
 
-    let updatedServers = 0
-    let pushedRules = 0
-    const errors: Array<{ serverId: number; error: string }> = []
-    await appendEvent({
-      level: "info",
-      eventType: "filters.sync.to_router.started",
-      sourceModule: "filters",
-      title: "Отправка фильтров на роутеры запущена",
-      message: `Целевых серверов: ${targetServers.length}`,
-      payload: { requestedServerId },
-    })
-
-    for (const server of targetServers) {
-      try {
-        app.log.info({ serverId: server.id, host: server.host }, "Filters sync to router started")
-        const client = MikrotikClient.fromServer(server)
-        const existing = await client.get<RosFilterRule[]>("/routing/filter/rule")
-
-        const isInBgpIn = (r: RosFilterRule) =>
-          (r.chain ?? "").trim().toLowerCase() === "bgp-in"
-        const managedCommentValue = managedComment(server.name || server.host)
-
-        // Уже созданное нами правило — будем PATCH'ить, чтобы сохранить ID/позицию в цепочке.
-        const managedRule = existing.find(
-          r => isInBgpIn(r) && hasManagedCommentPrefix(r.comment ?? ""),
-        )
-
-        // Конфликтующие легаси-правила в bgp-in (без нашего comment, но с bgp-communities) —
-        // удаляем после успешного upsert: иначе старое правило с `else { reject; }`
-        // отрабатывает первым и перебивает наш upsert.
-        const conflictIds = existing
-          .filter(r =>
-            isInBgpIn(r) &&
-            !hasManagedCommentPrefix(r.comment ?? "") &&
-            /bgp-communities/i.test(r.rule ?? ""),
-          )
-          .map(r => r[".id"])
-          .filter((id): id is string => Boolean(id))
-
-        const rows = await db.select().from(filterRules)
-          .where(and(eq(filterRules.serverId, server.id)))
-          .orderBy(asc(filterRules.sortOrder))
-
-        const rules: ApiFilterRule[] = rows.map(r => ({
-          id: String(r.id),
-          community: r.community,
-          communityName: r.communityName ?? undefined,
-          action: r.action,
-          gateway: r.gateway,
-          gatewayTunnelId: r.gatewayTunnelId,
-          description: r.description,
-        }))
-
-        // Upsert: PATCH существующего managed-правила или POST /add нового.
-        // Если ошибка — конфликтные правила НЕ удаляем (роутер не остаётся с пустым bgp-in).
-        // Путь `/routing/filter/rule/add` обязателен: голый POST на коллекцию RouterOS REST
-        // трактует как «вызов команды» и отдаёт 400 «no such command».
-        // См. https://help.mikrotik.com/docs/spaces/ROS/pages/47579162/REST+API
-        if (rules.length > 0) {
-          const ruleBody = await toRouterRuleBody(server.id, rules)
-          if (managedRule && managedRule[".id"]) {
-            await client.patch(
-              `/routing/filter/rule/${encodeURIComponent(managedRule[".id"])}`,
-              {
-                chain: "bgp-in",
-                comment: managedCommentValue,
-                rule: ruleBody,
-                disabled: "no",
-              },
-            )
-            app.log.info({ serverId: server.id, id: managedRule[".id"] }, "bgp-in rule updated")
-          } else {
-            await client.post("/routing/filter/rule/add", {
-              chain: "bgp-in",
-              comment: managedCommentValue,
-              rule: ruleBody,
-            })
-            app.log.info({ serverId: server.id }, "bgp-in rule created")
-          }
-          pushedRules += rules.length
-        } else if (managedRule && managedRule[".id"]) {
-          // В БД нет правил → удаляем наш managed-rule на роутере.
-          await client.delete(
-            `/routing/filter/rule/${encodeURIComponent(managedRule[".id"])}`,
-          )
-          app.log.info({ serverId: server.id }, "bgp-in rule removed (no rules in DB)")
-        }
-
-        for (const id of conflictIds) {
-          await client.delete(`/routing/filter/rule/${encodeURIComponent(id)}`)
-        }
-
-        updatedServers += 1
-        app.log.info(
-          {
-            serverId: server.id,
-            mode: managedRule ? "patch" : "create",
-            conflictsRemoved: conflictIds.length,
-            pushed: rules.length,
-          },
-          "Filters sync to router completed",
-        )
-      } catch (err) {
-        app.log.error({ serverId: server.id, err: String(err) }, "filters sync to-router failed")
-        errors.push({ serverId: server.id, error: String(err) })
+    const raw = Array.isArray(rev.payload) ? rev.payload : []
+    const rules: ApiFilterRule[] = raw.map((item, idx) => {
+      const r = item as Partial<ApiFilterRule>
+      return {
+        id: `rev-${idx}`,
+        community: r.community ?? "",
+        communityName: r.communityName,
+        action: r.action === "blackhole" ? "blackhole" : "route",
+        gateway: r.gateway ?? "",
+        gatewayTunnelId: r.gatewayTunnelId ?? "",
+        description: r.description ?? "",
       }
-    }
+    })
 
-    await appendEvent({
-      level: errors.length === 0 ? "info" : "warning",
-      eventType: errors.length === 0 ? "filters.sync.to_router.done" : "filters.sync.to_router.partial",
-      sourceModule: "filters",
-      title: errors.length === 0 ? "Отправка фильтров завершена" : "Отправка фильтров завершена с ошибками",
-      message: `Успешно: ${updatedServers}, ошибок: ${errors.length}, правил: ${pushedRules}`,
-      payload: {
-        updatedServers,
-        pushedRules,
-        errors,
-      },
-    })
-    return reply.send({
-      ok: errors.length === 0,
-      updatedServers,
-      pushedRules,
-      errors,
-    })
+    try {
+      const result = await applyFiltersToServer(server, rules, "rollback")
+      const cached = await cacheRulesetsForServer(server.id)
+      await appendEvent({
+        level: "info",
+        eventType: "filters.rollback.done",
+        sourceModule: "filters",
+        title: "Откат фильтров",
+        message: `${server.name || server.host}: ${result.pushed} правил`,
+        entityType: "server",
+        entityId: String(server.id),
+      })
+      return reply.send({ ok: true, rules: cached, pushedRules: result.pushed })
+    } catch (err) {
+      app.log.error({ serverId: server.id, err: String(err) }, "filters restore failed")
+      return reply.status(500).send({ error: String(err) })
+    }
   })
 }
 

backend/src/routes/firewall.ts

@@ -2,7 +2,20 @@ import type { FastifyPluginAsyncZod } from "@fastify/type-provider-zod"
 import { z } from "zod"
 import { MikrotikClient, MikrotikError, encodeRosId, firewallRestPath } from "../services/mikrotik.js"
 import { getEnabledServerById } from "../services/wireguard-live.js"
-import { listFirewallAll } from "../services/firewall-live.js"
+import {
+  captureFirewallSnapshot,
+  fetchFirewallState,
+  listFirewallAll,
+} from "../services/firewall-live.js"
+import {
+  captureAndAppendRevision,
+  listRevisions,
+  loadRevisionForRestore,
+  type ConfigRevisionSource,
+} from "../services/config-revisions.js"
+import { parseFirewallSnapshot, planFirewallRestore } from "../services/entity-snapshots.js"
+import { executeRosOps } from "../services/ros-ops.js"
+import { parseDbServerId } from "../utils/server-id.js"
 import type { FirewallFamily, FirewallTable } from "../types/server.js"
 
 const FamilySchema = z.enum(["ip", "ip6"])
@@ -120,6 +133,20 @@ async function requireServer(serverId: string) {
   return await getEnabledServerById(serverId)
 }
 
+async function recordFirewall(
+  server: NonNullable<Awaited<ReturnType<typeof requireServer>>>,
+  source: ConfigRevisionSource,
+) {
+  await captureAndAppendRevision({
+    serverId: server.id,
+    section: "firewall",
+    source,
+    capture: () => captureFirewallSnapshot(server),
+  })
+}
+
+const RevisionIdParamSchema = z.object({ id: z.string().min(1) })
+
 const firewallRoutes: FastifyPluginAsyncZod = async (app) => {
   app.get("/firewall/all", async (_req, reply) => {
     const data = await listFirewallAll()
@@ -138,6 +165,7 @@ const firewallRoutes: FastifyPluginAsyncZod = async (app) => {
     const path = firewallRestPath(body.family as FirewallFamily, body.table as FirewallTable)
     try {
       await client.put(path, ruleToRos(body))
+      await recordFirewall(server, "apply")
       return reply.status(201).send({ ok: true })
     } catch (e) {
       return reply.status(502).send({ error: `RouterOS: ${rosErr(e)}` })
@@ -156,6 +184,7 @@ const firewallRoutes: FastifyPluginAsyncZod = async (app) => {
     const path = `${firewallRestPath(body.family as FirewallFamily, body.table as FirewallTable)}/${encodeRosId(body.rosId)}`
     try {
       await client.patch(path, ruleToRos(body))
+      await recordFirewall(server, "apply")
       return reply.send({ ok: true })
     } catch (e) {
       return reply.status(502).send({ error: `RouterOS: ${rosErr(e)}` })
@@ -174,6 +203,7 @@ const firewallRoutes: FastifyPluginAsyncZod = async (app) => {
     const path = `${firewallRestPath(body.family, body.table)}/${encodeRosId(body.rosId)}`
     try {
       await client.patch(path, { disabled: body.disabled ? "yes" : "no" })
+      await recordFirewall(server, "apply")
       return reply.send({ ok: true })
     } catch (e) {
       return reply.status(502).send({ error: `RouterOS: ${rosErr(e)}` })
@@ -192,6 +222,7 @@ const firewallRoutes: FastifyPluginAsyncZod = async (app) => {
     const path = `${firewallRestPath(body.family, body.table)}/${encodeRosId(body.rosId)}`
     try {
       await client.delete(path)
+      await recordFirewall(server, "apply")
       return reply.send({ ok: true })
     } catch (e) {
       return reply.status(502).send({ error: `RouterOS: ${rosErr(e)}` })
@@ -213,6 +244,7 @@ const firewallRoutes: FastifyPluginAsyncZod = async (app) => {
         numbers: body.rosId,
         ...(body.destinationRosId ? { destination: body.destinationRosId } : {}),
       })
+      await recordFirewall(server, "apply")
       return reply.send({ ok: true })
     } catch (e) {
       return reply.status(502).send({ error: `RouterOS: ${rosErr(e)}` })
@@ -230,6 +262,7 @@ const firewallRoutes: FastifyPluginAsyncZod = async (app) => {
     const client = MikrotikClient.fromServer(server)
     try {
       await client.put(firewallRestPath(body.family, "address-list"), addressToRos(body))
+      await recordFirewall(server, "apply")
       return reply.status(201).send({ ok: true })
     } catch (e) {
       return reply.status(502).send({ error: `RouterOS: ${rosErr(e)}` })
@@ -248,6 +281,7 @@ const firewallRoutes: FastifyPluginAsyncZod = async (app) => {
     const path = `${firewallRestPath(body.family, "address-list")}/${encodeRosId(body.rosId)}`
     try {
       await client.patch(path, addressToRos(body))
+      await recordFirewall(server, "apply")
       return reply.send({ ok: true })
     } catch (e) {
       return reply.status(502).send({ error: `RouterOS: ${rosErr(e)}` })
@@ -266,6 +300,7 @@ const firewallRoutes: FastifyPluginAsyncZod = async (app) => {
     const path = `${firewallRestPath(body.family, "address-list")}/${encodeRosId(body.rosId)}`
     try {
       await client.patch(path, { disabled: body.disabled ? "yes" : "no" })
+      await recordFirewall(server, "apply")
       return reply.send({ ok: true })
     } catch (e) {
       return reply.status(502).send({ error: `RouterOS: ${rosErr(e)}` })
@@ -284,11 +319,48 @@ const firewallRoutes: FastifyPluginAsyncZod = async (app) => {
     const path = `${firewallRestPath(body.family, "address-list")}/${encodeRosId(body.rosId)}`
     try {
       await client.delete(path)
+      await recordFirewall(server, "apply")
       return reply.send({ ok: true })
     } catch (e) {
       return reply.status(502).send({ error: `RouterOS: ${rosErr(e)}` })
     }
   })
+
+  app.get("/firewall/revisions", async (req, reply) => {
+    const q = req.query as { serverId?: string | number }
+    const serverId = parseDbServerId(q.serverId)
+    if (serverId === null) return reply.status(400).send({ error: "serverId is required" })
+    const revisions = await listRevisions(serverId, "firewall")
+    return reply.send({ revisions })
+  })
+
+  app.post("/firewall/revisions/:id/restore", {
+    schema: { params: RevisionIdParamSchema },
+  }, async (req, reply) => {
+    const { id } = req.params
+    const body = req.body as { serverId?: string | number } | undefined
+    const loaded = await loadRevisionForRestore({
+      id,
+      section: "firewall",
+      requestedServerId: parseDbServerId(body?.serverId),
+    })
+    if (!loaded.ok) return reply.status(loaded.status).send({ error: loaded.error })
+    const client = MikrotikClient.fromServer(loaded.server)
+    try {
+      const desired = parseFirewallSnapshot(loaded.row.payload)
+      const state = await fetchFirewallState(loaded.server)
+      const ops = planFirewallRestore(desired, {
+        rules: state.liveRules,
+        addressLists: state.liveLists,
+      })
+      await executeRosOps(client, ops)
+      await recordFirewall(loaded.server, "rollback")
+      const next = await fetchFirewallState(loaded.server)
+      return reply.send({ ok: true, rules: next.rules, addressLists: next.addressLists })
+    } catch (e) {
+      return reply.status(502).send({ error: `RouterOS: ${rosErr(e)}` })
+    }
+  })
 }
 
 export default firewallRoutes

backend/src/routes/gre.ts

@@ -0,0 +1,229 @@
+import type { FastifyPluginAsyncZod } from "@fastify/type-provider-zod"
+import { z } from "zod"
+import { MikrotikClient, MikrotikError } from "../services/mikrotik.js"
+import { getEnabledServerById } from "../services/wireguard-live.js"
+import {
+  captureGreSnapshot,
+  fetchGreState,
+  formatKeepalive,
+  listGreTunnels,
+  parseKeepalive,
+} from "../services/gre-live.js"
+import {
+  canonicalGreSnapshot,
+  parseGreSnapshot,
+  planGreCreate,
+  planGreDelete,
+  planGreRestore,
+} from "../services/entity-snapshots.js"
+import { executeRosOps } from "../services/ros-ops.js"
+import {
+  captureAndAppendRevision,
+  listRevisions,
+  loadRevisionForRestore,
+  type ConfigRevisionSource,
+} from "../services/config-revisions.js"
+import { parseDbServerId } from "../utils/server-id.js"
+
+const TunnelWriteSchema = z.object({
+  serverId: z.string().min(1),
+  name: z.string().min(1),
+  rosId: z.string().optional(),
+  localAddress: z.string().optional(),
+  remoteAddress: z.string().min(1),
+  localInnerIp: z.string().optional(),
+  remoteInnerIp: z.string().optional(),
+  comment: z.string().optional(),
+  enabled: z.boolean().optional(),
+  mtu: z.number().optional(),
+  keepaliveInterval: z.number().optional(),
+  keepaliveRetries: z.number().optional(),
+  dscp: z.union([z.literal("inherit"), z.number(), z.string()]).optional(),
+  clampTcpMss: z.boolean().optional(),
+  allowFastPath: z.boolean().optional(),
+  ipsecSecret: z.string().optional(),
+})
+
+const TunnelKeySchema = z.object({
+  serverId: z.string().min(1),
+  rosId: z.string().optional(),
+  name: z.string().optional(),
+  disabled: z.boolean().optional(),
+})
+
+const RevisionIdParamSchema = z.object({ id: z.string().min(1) })
+
+function rosErr(e: unknown): string {
+  if (e instanceof MikrotikError) return e.message
+  if (e instanceof Error) return e.message
+  return String(e)
+}
+
+async function recordGre(
+  server: NonNullable<Awaited<ReturnType<typeof getEnabledServerById>>>,
+  source: ConfigRevisionSource,
+) {
+  await captureAndAppendRevision({
+    serverId: server.id,
+    section: "gre",
+    source,
+    capture: () => captureGreSnapshot(server),
+  })
+}
+
+function tunnelFromBody(body: z.infer<typeof TunnelWriteSchema> & { keepaliveInterval?: number; keepaliveRetries?: number }) {
+  const dscp = body.dscp == null
+    ? "inherit"
+    : typeof body.dscp === "number"
+      ? String(body.dscp)
+      : body.dscp
+  const keepalive = body.keepaliveInterval === undefined && body.keepaliveRetries === undefined
+    ? undefined
+    : formatKeepalive(body.keepaliveInterval ?? 0, body.keepaliveRetries ?? 10)
+  return canonicalGreSnapshot({
+    tunnels: [{
+      name: body.name,
+      localAddress: body.localAddress ?? "",
+      remoteAddress: body.remoteAddress,
+      localInnerIp: body.localInnerIp ?? "",
+      remoteInnerIp: body.remoteInnerIp ?? "",
+      comment: body.comment ?? "",
+      disabled: body.enabled === false,
+      mtu: body.mtu ?? 1476,
+      keepalive: keepalive ?? "0",
+      dscp,
+      clampTcpMss: body.clampTcpMss,
+      allowFastPath: body.allowFastPath,
+      ipsecSecret: body.ipsecSecret ?? "",
+    }],
+  }).tunnels[0]!
+}
+
+const greRoutes: FastifyPluginAsyncZod = async (app) => {
+  app.get("/gre/tunnels", async (req, reply) => {
+    const q = req.query as { serverId?: string | number }
+    const sid = parseDbServerId(q.serverId)
+    const result = await listGreTunnels({ serverId: sid !== null ? String(sid) : undefined })
+    return reply.send(result)
+  })
+
+  app.post("/gre/tunnels", async (req, reply) => {
+    const parsed = TunnelWriteSchema.safeParse(req.body ?? {})
+    if (!parsed.success) {
+      return reply.status(400).send({ error: "Некорректное тело запроса", details: parsed.error.flatten() })
+    }
+    const body = parsed.data
+    const server = await getEnabledServerById(body.serverId)
+    if (!server) return reply.status(404).send({ error: "Сервер не найден" })
+    const client = MikrotikClient.fromServer(server)
+    try {
+      const tunnel = tunnelFromBody(body)
+      await executeRosOps(client, planGreCreate(tunnel))
+      await recordGre(server, "apply")
+      const state = await fetchGreState(server)
+      const created = state.tunnels.find((t) => t.name === tunnel.name)
+      return reply.status(201).send(created ?? { ok: true, name: tunnel.name })
+    } catch (e) {
+      return reply.status(502).send({ error: `RouterOS: ${rosErr(e)}` })
+    }
+  })
+
+  app.patch("/gre/tunnels", async (req, reply) => {
+    const parsed = TunnelWriteSchema.partial().required({ serverId: true }).safeParse(req.body ?? {})
+    if (!parsed.success) {
+      return reply.status(400).send({ error: "Некорректное тело запроса", details: parsed.error.flatten() })
+    }
+    const body = parsed.data
+    const server = await getEnabledServerById(body.serverId)
+    if (!server) return reply.status(404).send({ error: "Сервер не найден" })
+    try {
+      const state = await fetchGreState(server)
+      const live = state.gre.find((g) =>
+        (body.rosId && g.rosId === body.rosId) || (body.name && g.name === body.name),
+      )
+      if (!live) return reply.status(404).send({ error: "Туннель не найден" })
+      const merged = tunnelFromBody({
+        serverId: body.serverId,
+        name: body.name || live.name,
+        localAddress: body.localAddress ?? live.localAddress,
+        remoteAddress: body.remoteAddress || live.remoteAddress,
+        localInnerIp: body.localInnerIp ?? state.addrs.find((a) => a.interfaceName === live.name)?.address ?? "",
+        remoteInnerIp: body.remoteInnerIp,
+        comment: body.comment ?? live.comment,
+        enabled: body.enabled ?? !live.disabled,
+        mtu: body.mtu ?? live.mtu,
+        keepaliveInterval: body.keepaliveInterval ?? parseKeepalive(live.keepalive).interval,
+        keepaliveRetries: body.keepaliveRetries ?? parseKeepalive(live.keepalive).retries,
+        dscp: body.dscp ?? live.dscp,
+        clampTcpMss: body.clampTcpMss ?? live.clampTcpMss,
+        allowFastPath: body.allowFastPath ?? live.allowFastPath,
+        ipsecSecret: body.ipsecSecret ?? live.ipsecSecret,
+      })
+      const ops = planGreRestore(
+        { tunnels: state.snapshot.tunnels.map((t) => t.name === live.name ? merged : t) },
+        { gre: state.gre, addrs: state.addrs },
+      )
+      await executeRosOps(state.client, ops)
+      await recordGre(server, "apply")
+      return reply.send({ ok: true })
+    } catch (e) {
+      return reply.status(502).send({ error: `RouterOS: ${rosErr(e)}` })
+    }
+  })
+
+  app.delete("/gre/tunnels", async (req, reply) => {
+    const parsed = TunnelKeySchema.safeParse(req.body ?? {})
+    if (!parsed.success) {
+      return reply.status(400).send({ error: "Некорректное тело запроса", details: parsed.error.flatten() })
+    }
+    const body = parsed.data
+    const server = await getEnabledServerById(body.serverId)
+    if (!server) return reply.status(404).send({ error: "Сервер не найден" })
+    try {
+      const state = await fetchGreState(server)
+      const live = state.gre.find((g) =>
+        (body.rosId && g.rosId === body.rosId) || (body.name && g.name === body.name),
+      )
+      if (!live) return reply.status(404).send({ error: "Туннель не найден" })
+      await executeRosOps(state.client, planGreDelete(live.name, { gre: state.gre, addrs: state.addrs }))
+      await recordGre(server, "apply")
+      return reply.send({ ok: true })
+    } catch (e) {
+      return reply.status(502).send({ error: `RouterOS: ${rosErr(e)}` })
+    }
+  })
+
+  app.get("/gre/revisions", async (req, reply) => {
+    const q = req.query as { serverId?: string | number }
+    const serverId = parseDbServerId(q.serverId)
+    if (serverId === null) return reply.status(400).send({ error: "serverId is required" })
+    const revisions = await listRevisions(serverId, "gre")
+    return reply.send({ revisions })
+  })
+
+  app.post("/gre/revisions/:id/restore", {
+    schema: { params: RevisionIdParamSchema },
+  }, async (req, reply) => {
+    const { id } = req.params
+    const body = req.body as { serverId?: string | number } | undefined
+    const loaded = await loadRevisionForRestore({
+      id,
+      section: "gre",
+      requestedServerId: parseDbServerId(body?.serverId),
+    })
+    if (!loaded.ok) return reply.status(loaded.status).send({ error: loaded.error })
+    try {
+      const desired = parseGreSnapshot(loaded.row.payload)
+      const state = await fetchGreState(loaded.server)
+      const ops = planGreRestore(desired, { gre: state.gre, addrs: state.addrs })
+      await executeRosOps(state.client, ops)
+      await recordGre(loaded.server, "rollback")
+      const next = await fetchGreState(loaded.server)
+      return reply.send({ ok: true, tunnels: next.tunnels })
+    } catch (e) {
+      return reply.status(502).send({ error: `RouterOS: ${rosErr(e)}` })
+    }
+  })
+}
+
+export default greRoutes

backend/src/routes/recursive-routes.ts

@@ -1,13 +1,23 @@
 import { asc, eq } from "drizzle-orm"
+import { z } from "zod"
 import type { FastifyPluginAsyncZod } from "@fastify/type-provider-zod"
 import { db } from "../db/index.js"
 import { recursiveRoutes, servers } from "../db/schema.js"
 import { MikrotikClient } from "../services/mikrotik.js"
 import { parseDbServerId } from "../utils/server-id.js"
+import { managedRecursiveComment } from "../managed-markers.js"
 import {
-  hasManagedRecursiveComment,
-  managedRecursiveComment,
-} from "../managed-markers.js"
+  mapRosManagedRoutes,
+  planRecursiveApply,
+  userRecursiveComment,
+} from "../services/config-apply-plan.js"
+import {
+  appendRevisionIfChanged,
+  canonicalRecursiveRoutes,
+  getRevisionById,
+  listRevisions,
+  type ConfigRevisionSource,
+} from "../services/config-revisions.js"
 
 type ServerRow = typeof servers.$inferSelect
 
@@ -51,27 +61,6 @@ interface RecursiveRouteDto {
   disabled: boolean
 }
 
-function isIpGateway(gw: string): boolean {
-  return /^\d{1,3}(\.\d{1,3}){3}(?:%\S+)?$/.test(gw.trim())
-}
-
-function isRecursiveRoute(r: RosRoute): boolean {
-  if ((r.static ?? "false") !== "true") return false
-  if ((r.dynamic ?? "false") === "true") return false
-  if ((r.blackhole ?? "false") === "true") return false
-  if ((r.unreachable ?? "false") === "true") return false
-  if ((r.prohibit ?? "false") === "true") return false
-  const dst = r["dst-address"] ?? ""
-  const gw = r.gateway ?? ""
-  if (!dst || !gw) return false
-  return isIpGateway(gw)
-}
-
-function hasRecursiveCommentMask(comment: string | undefined): boolean {
-  if (!comment) return false
-  return /^recursive:\s*/i.test(comment.trim())
-}
-
 function splitGateway(raw: string): { ip: string; name: string } | null {
   const v = raw.trim()
   if (!v) return null
@@ -102,6 +91,21 @@ async function mapDbRoutes(serverId: number): Promise<RecursiveRouteDto[]> {
   }))
 }
 
+function mergeCachedCountry(
+  live: RecursiveRouteDto[],
+  cached: RecursiveRouteDto[],
+): RecursiveRouteDto[] {
+  return live.map((row) => {
+    if (row.country) return row
+    const match = cached.find((c) =>
+      c.dstAddress === row.dstAddress &&
+      c.gateway === row.gateway &&
+      c.distance === row.distance,
+    )
+    return match?.country ? { ...row, country: match.country } : row
+  })
+}
+
 function toRouterPayload(route: RecursiveRouteDto): Record<string, string> {
   return {
     "dst-address": route.dstAddress,
@@ -132,7 +136,7 @@ async function replaceDbRoutes(serverId: number, routes: RecursiveRouteDto[]) {
       routingTable: r.routingTable || "main",
       checkGateway: r.checkGateway ?? "",
       country: r.country ?? "",
-      comment: r.comment ?? "",
+      comment: userRecursiveComment(r.comment),
       disabled: r.disabled,
       createdAt: now,
       updatedAt: now,
@@ -140,6 +144,34 @@ async function replaceDbRoutes(serverId: number, routes: RecursiveRouteDto[]) {
   )
 }
 
+async function applyRecursiveToServer(
+  server: ServerRow,
+  routes: RecursiveRouteDto[],
+  source: ConfigRevisionSource,
+): Promise<{ pushed: number; deleted: number }> {
+  const client = MikrotikClient.fromServer(server)
+  const existing = await client.get<RosRoute[]>("/ip/route")
+  const { deleteIds } = planRecursiveApply(existing)
+
+  for (const route of routes) {
+    await client.post("/ip/route", toRouterPayload(route))
+  }
+  for (const id of deleteIds) {
+    await client.delete(`/ip/route/${encodeURIComponent(id)}`)
+  }
+
+  await replaceDbRoutes(server.id, routes)
+  await appendRevisionIfChanged({
+    serverId: server.id,
+    section: "recursive-routes",
+    source,
+    payload: canonicalRecursiveRoutes(routes),
+  })
+  return { pushed: routes.length, deleted: deleteIds.length }
+}
+
+const RevisionIdParamSchema = z.object({ id: z.string().min(1) })
+
 const recursiveRoutesPlugin: FastifyPluginAsyncZod = async (app) => {
   app.get("/recursive-routes/gateways", async (req, reply) => {
     const q = req.query as { serverId?: string | number }
@@ -175,79 +207,108 @@ const recursiveRoutesPlugin: FastifyPluginAsyncZod = async (app) => {
     const q = req.query as { serverId?: string | number }
     const serverId = parseDbServerId(q.serverId)
     if (serverId === null) return reply.status(400).send({ error: "serverId is required" })
-    const server = (await db.select().from(servers).where(eq(servers.id, serverId)).limit(1))[0]
-    if (!server) return reply.status(404).send({ error: "Server not found" })
-    return reply.send({ routes: await mapDbRoutes(serverId) })
-  })
-
-  app.put("/recursive-routes", async (req, reply) => {
-    const body = req.body as { serverId?: string | number; routes?: RecursiveRouteDto[] }
-    const serverId = parseDbServerId(body.serverId)
-    if (serverId === null) return reply.status(400).send({ error: "serverId is required" })
-    const server = (await db.select().from(servers).where(eq(servers.id, serverId)).limit(1))[0]
-    if (!server) return reply.status(404).send({ error: "Server not found" })
-    await replaceDbRoutes(serverId, body.routes ?? [])
-    return reply.send({ ok: true })
-  })
-
-  app.post("/recursive-routes/sync/from-router", async (req, reply) => {
-    const body = req.body as { serverId?: string | number } | undefined
-    const serverId = parseDbServerId(body?.serverId)
-    if (serverId === null) return reply.status(400).send({ error: "serverId is required" })
     const server: ServerRow | undefined = (await db
       .select().from(servers)
       .where(eq(servers.id, serverId))
       .limit(1))[0]
     if (!server) return reply.status(404).send({ error: "Server not found" })
 
+    const cached = await mapDbRoutes(serverId)
     try {
       const client = MikrotikClient.fromServer(server)
       const rosRoutes = await client.get<RosRoute[]>("/ip/route")
-      const rec = rosRoutes.filter(r =>
-        isRecursiveRoute(r) && hasRecursiveCommentMask(r.comment),
-      )
-      const mapped: RecursiveRouteDto[] = rec.map((r, i) => ({
-        id: r[".id"] ?? `ros-${i}`,
-        dstAddress: r["dst-address"] ?? "",
-        gateway: r.gateway ?? "",
-        distance: Number.parseInt(r.distance ?? "1", 10) || 1,
-        scope: r.scope ? (Number.parseInt(r.scope, 10) || null) : null,
-        targetScope: r["target-scope"] ? (Number.parseInt(r["target-scope"], 10) || null) : null,
-        routingTable: r["routing-table"] ?? "main",
-        checkGateway: r["check-gateway"] ?? "",
-        country: "",
-        comment: r.comment ?? "",
-        disabled: r.disabled === "true",
-      }))
-      await replaceDbRoutes(serverId, mapped)
-      return reply.send({ ok: true, serverId, totalRoutes: mapped.length })
+      const live = mergeCachedCountry(mapRosManagedRoutes(rosRoutes), cached)
+      await replaceDbRoutes(serverId, live)
+      await appendRevisionIfChanged({
+        serverId,
+        section: "recursive-routes",
+        source: "observed",
+        payload: canonicalRecursiveRoutes(live),
+      })
+      const stored = await mapDbRoutes(serverId)
+      return reply.send({ routes: stored, live: true, stale: false })
+    } catch (err) {
+      app.log.warn({ serverId, err: String(err) }, "recursive live GET failed, serving cache")
+      return reply.send({
+        routes: cached,
+        live: false,
+        stale: true,
+        error: String(err),
+      })
+    }
+  })
+
+  app.put("/recursive-routes", async (req, reply) => {
+    const body = req.body as {
+      serverId?: string | number
+      routes?: RecursiveRouteDto[]
+      source?: ConfigRevisionSource
+    }
+    const serverId = parseDbServerId(body.serverId)
+    if (serverId === null) return reply.status(400).send({ error: "serverId is required" })
+    const server = (await db.select().from(servers).where(eq(servers.id, serverId)).limit(1))[0]
+    if (!server) return reply.status(404).send({ error: "Server not found" })
+    const routes = (body.routes ?? []).map((r) => ({
+      ...r,
+      comment: userRecursiveComment(r.comment),
+    }))
+    const source: ConfigRevisionSource = body.source === "copy" ? "copy" : "apply"
+    try {
+      const result = await applyRecursiveToServer(server, routes, source)
+      const stored = await mapDbRoutes(serverId)
+      return reply.send({ ok: true, routes: stored, pushedRoutes: result.pushed })
     } catch (err) {
       return reply.status(500).send({ error: String(err) })
     }
   })
 
-  app.post("/recursive-routes/sync/to-router", async (req, reply) => {
-    const body = req.body as { serverId?: string | number } | undefined
-    const serverId = parseDbServerId(body?.serverId)
+  app.get("/recursive-routes/revisions", async (req, reply) => {
+    const q = req.query as { serverId?: string | number }
+    const serverId = parseDbServerId(q.serverId)
     if (serverId === null) return reply.status(400).send({ error: "serverId is required" })
-    const server = (await db.select().from(servers).where(eq(servers.id, serverId)).limit(1))[0]
+    const revisions = await listRevisions(serverId, "recursive-routes")
+    return reply.send({ revisions })
+  })
+
+  app.post("/recursive-routes/revisions/:id/restore", {
+    schema: { params: RevisionIdParamSchema },
+  }, async (req, reply) => {
+    const { id } = req.params
+    const body = req.body as { serverId?: string | number } | undefined
+    const rev = await getRevisionById(id)
+    if (!rev) return reply.status(404).send({ error: "Revision not found" })
+    if (rev.section !== "recursive-routes") {
+      return reply.status(400).send({ error: "Revision section mismatch" })
+    }
+    const requested = parseDbServerId(body?.serverId)
+    if (requested !== null && requested !== rev.serverId) {
+      return reply.status(400).send({ error: "Revision belongs to another server" })
+    }
+    const server = (await db.select().from(servers).where(eq(servers.id, rev.serverId)).limit(1))[0]
     if (!server) return reply.status(404).send({ error: "Server not found" })
 
+    const raw = Array.isArray(rev.payload) ? rev.payload : []
+    const routes: RecursiveRouteDto[] = raw.map((item, idx) => {
+      const r = item as Partial<RecursiveRouteDto>
+      return {
+        id: `rev-${idx}`,
+        dstAddress: r.dstAddress ?? "",
+        gateway: r.gateway ?? "",
+        distance: r.distance ?? 1,
+        scope: r.scope ?? null,
+        targetScope: r.targetScope ?? null,
+        routingTable: r.routingTable || "main",
+        checkGateway: r.checkGateway ?? "",
+        country: r.country ?? "",
+        comment: userRecursiveComment(r.comment),
+        disabled: Boolean(r.disabled),
+      }
+    })
+
     try {
-      const client = MikrotikClient.fromServer(server)
-      const existing = await client.get<RosRoute[]>("/ip/route")
-      const managed = existing.filter(r => hasManagedRecursiveComment(r.comment ?? ""))
-      for (const r of managed) {
-        if (!r[".id"]) continue
-        await client.delete(`/ip/route/${encodeURIComponent(r[".id"])}`)
-      }
-
-      const dbRows = await mapDbRoutes(serverId)
-      for (const route of dbRows) {
-        await client.post("/ip/route", toRouterPayload(route))
-      }
-
-      return reply.send({ ok: true, serverId, pushedRoutes: dbRows.length })
+      const result = await applyRecursiveToServer(server, routes, "rollback")
+      const stored = await mapDbRoutes(server.id)
+      return reply.send({ ok: true, routes: stored, pushedRoutes: result.pushed })
     } catch (err) {
       return reply.status(500).send({ error: String(err) })
     }

backend/src/routes/wireguard.ts

@@ -18,6 +18,8 @@ import {
   type WgParsedConfig,
 } from "../services/wireguard-config.js"
 import {
+  captureWireguardSnapshot,
+  fetchWireguardRestoreState,
   getEnabledServerById,
   listWireGuardInterfaces,
 } from "../services/wireguard-live.js"
@@ -27,6 +29,16 @@ import {
   putWireguardPeer,
   toRosBody,
 } from "../services/wireguard-ros.js"
+import {
+  captureAndAppendRevision,
+  listRevisions,
+  loadRevisionForRestore,
+  type ConfigRevisionSource,
+} from "../services/config-revisions.js"
+import { parseWireguardSnapshot, planWireguardRestore } from "../services/entity-snapshots.js"
+import { executeRosOps } from "../services/ros-ops.js"
+import { parseDbServerId } from "../utils/server-id.js"
+import { z } from "zod"
 
 function serverIdParam(v: string): string {
   return decodeURIComponent(v)
@@ -137,6 +149,20 @@ function findIface(
   return list.find((i) => i.serverId === serverId && i.name === interfaceName)
 }
 
+async function recordWireguard(
+  server: NonNullable<Awaited<ReturnType<typeof getEnabledServerById>>>,
+  source: ConfigRevisionSource,
+) {
+  await captureAndAppendRevision({
+    serverId: server.id,
+    section: "wireguard",
+    source,
+    capture: () => captureWireguardSnapshot(server),
+  })
+}
+
+const RevisionIdParamSchema = z.object({ id: z.string().min(1) })
+
 const wireguardRoutes: FastifyPluginAsyncZod = async (app) => {
   app.get("/wireguard", async (req, reply) => {
     const q = req.query as { serverId?: string; includePrivateKey?: string }
@@ -145,6 +171,11 @@ const wireguardRoutes: FastifyPluginAsyncZod = async (app) => {
       serverId: q.serverId,
       includePrivateKey,
     })
+    const sid = parseDbServerId(q.serverId)
+    if (sid !== null) {
+      const server = await getEnabledServerById(sid)
+      if (server) await recordWireguard(server, "observed")
+    }
     return reply.send(result)
   })
 
@@ -181,6 +212,7 @@ const wireguardRoutes: FastifyPluginAsyncZod = async (app) => {
         includePrivateKey: true,
       })
       const created = list.interfaces.find((i) => i.name === body.name)
+      await recordWireguard(server, "apply")
       return reply.status(201).send(created ?? { ok: true, name: body.name })
     } catch (e) {
       const msg = e instanceof MikrotikError ? e.message : e instanceof Error ? e.message : String(e)
@@ -210,6 +242,7 @@ const wireguardRoutes: FastifyPluginAsyncZod = async (app) => {
           disabled: d.disabled === true ? "yes" : d.disabled === false ? "no" : undefined,
         }),
       )
+      await recordWireguard(server, "apply")
       return reply.send({ ok: true })
     } catch (e) {
       const msg = e instanceof Error ? e.message : String(e)
@@ -224,6 +257,7 @@ const wireguardRoutes: FastifyPluginAsyncZod = async (app) => {
     const client = MikrotikClient.fromServer(server)
     try {
       await client.delete(`/interface/wireguard/${encodeURIComponent(rosIdParam(rosId))}`)
+      await recordWireguard(server, "apply")
       return reply.send({ ok: true })
     } catch (e) {
       const msg = e instanceof Error ? e.message : String(e)
@@ -242,6 +276,7 @@ const wireguardRoutes: FastifyPluginAsyncZod = async (app) => {
     const client = MikrotikClient.fromServer(server)
     try {
       await putWireguardPeer(client, peerToRosBody(body))
+      await recordWireguard(server, "apply")
       return reply.status(201).send({ ok: true })
     } catch (e) {
       const msg = e instanceof Error ? e.message : String(e)
@@ -277,6 +312,7 @@ const wireguardRoutes: FastifyPluginAsyncZod = async (app) => {
           disabled: d.disabled === true ? "yes" : d.disabled === false ? "no" : undefined,
         }),
       )
+      await recordWireguard(server, "apply")
       return reply.send({ ok: true })
     } catch (e) {
       const msg = e instanceof Error ? e.message : String(e)
@@ -291,6 +327,7 @@ const wireguardRoutes: FastifyPluginAsyncZod = async (app) => {
     const client = MikrotikClient.fromServer(server)
     try {
       await client.delete(`/interface/wireguard/peers/${encodeURIComponent(rosIdParam(rosId))}`)
+      await recordWireguard(server, "apply")
       return reply.send({ ok: true })
     } catch (e) {
       const msg = e instanceof Error ? e.message : String(e)
@@ -320,6 +357,7 @@ const wireguardRoutes: FastifyPluginAsyncZod = async (app) => {
     const client = MikrotikClient.fromServer(server)
     try {
       const applied = await applyParsedConfig(client, config)
+      await recordWireguard(server, "copy")
       return reply.send({ dryRun: false, preview, applied })
     } catch (e) {
       const msg = e instanceof Error ? e.message : String(e)
@@ -437,6 +475,46 @@ const wireguardRoutes: FastifyPluginAsyncZod = async (app) => {
       content,
     })
   })
+
+  app.get("/wireguard/revisions", async (req, reply) => {
+    const q = req.query as { serverId?: string | number }
+    const serverId = parseDbServerId(q.serverId)
+    if (serverId === null) return reply.status(400).send({ error: "serverId is required" })
+    const revisions = await listRevisions(serverId, "wireguard")
+    return reply.send({ revisions })
+  })
+
+  app.post("/wireguard/revisions/:id/restore", {
+    schema: { params: RevisionIdParamSchema },
+  }, async (req, reply) => {
+    const { id } = req.params
+    const body = req.body as { serverId?: string | number } | undefined
+    const loaded = await loadRevisionForRestore({
+      id,
+      section: "wireguard",
+      requestedServerId: parseDbServerId(body?.serverId),
+    })
+    if (!loaded.ok) return reply.status(loaded.status).send({ error: loaded.error })
+    try {
+      const desired = parseWireguardSnapshot(loaded.row.payload)
+      const state = await fetchWireguardRestoreState(loaded.server)
+      const ops = planWireguardRestore(desired, {
+        ifaces: state.ifaces,
+        peers: state.peers,
+        addrs: state.addrs,
+      })
+      await executeRosOps(state.client, ops)
+      await recordWireguard(loaded.server, "rollback")
+      const list = await listWireGuardInterfaces({
+        serverId: String(loaded.server.id),
+        includePrivateKey: true,
+      })
+      return reply.send({ ok: true, interfaces: list.interfaces })
+    } catch (e) {
+      const msg = e instanceof Error ? e.message : String(e)
+      return reply.status(502).send({ error: `RouterOS: ${msg}` })
+    }
+  })
 }
 
 export default wireguardRoutes

backend/src/services/config-apply-plan.test.ts

@@ -0,0 +1,96 @@
+import assert from "node:assert/strict"
+import { hasManagedCommentPrefix, isOwnedRecursiveComment, managedRecursiveComment, stripManagedRecursiveComment } from "../managed-markers.js"
+import {
+  planBgpInApply,
+  planRecursiveApply,
+  unmanagedRouteIds,
+} from "./config-apply-plan.js"
+import {
+  canonicalFilterRules,
+  fingerprintPayload,
+} from "./config-revisions.js"
+import { mapRosManagedRoutes } from "./config-apply-plan.js"
+
+{
+  const fp1 = fingerprintPayload(canonicalFilterRules([
+    { community: "65001:100", action: "route", gateway: "10.0.0.1", gatewayTunnelId: "gre1", description: "a" },
+  ]))
+  const fp2 = fingerprintPayload(canonicalFilterRules([
+    { community: "65001:100", action: "route", gateway: "10.0.0.1", gatewayTunnelId: "gre1", description: "a" },
+  ]))
+  const fp3 = fingerprintPayload(canonicalFilterRules([
+    { community: "65001:100", action: "route", gateway: "10.0.0.2", gatewayTunnelId: "gre1", description: "a" },
+  ]))
+  assert.equal(fp1, fp2)
+  assert.notEqual(fp1, fp3)
+}
+
+{
+  const existing = [
+    { ".id": "*1", chain: "bgp-in", comment: "MikrotikManager: msk", rule: "if (true) { accept; }" },
+    { ".id": "*2", chain: "bgp-in", comment: "legacy", rule: "if (bgp-communities includes 1:1) { reject; }" },
+    { ".id": "*3", chain: "bgp-out", comment: "MikrotikManager: other", rule: "if (bgp-communities includes 1:1) { accept; }" },
+  ]
+  const patch = planBgpInApply(existing, 3)
+  assert.equal(patch.action, "patch")
+  assert.equal(patch.managedId, "*1")
+  assert.deepEqual(patch.conflictIds, ["*2"])
+
+  const create = planBgpInApply(existing.filter((r) => r[".id"] !== "*1"), 1)
+  assert.equal(create.action, "create")
+  assert.equal(create.managedId, undefined)
+
+  const del = planBgpInApply(existing, 0)
+  assert.equal(del.action, "delete")
+  assert.equal(del.managedId, "*1")
+
+  const noop = planBgpInApply([], 0)
+  assert.equal(noop.action, "noop")
+}
+
+{
+  const routes = [
+    { ".id": "*10", comment: "MikrotikManager:recursive via de", static: "true", "dst-address": "8.8.8.8/32", gateway: "1.1.1.1" },
+    { ".id": "*11", comment: "user static", static: "true", "dst-address": "1.1.1.1/32", gateway: "9.9.9.9" },
+    { ".id": "*12", comment: "recursive: old", static: "true", "dst-address": "9.9.9.9/32", gateway: "1.1.1.1" },
+  ]
+  const plan = planRecursiveApply(routes)
+  assert.deepEqual(plan.deleteIds, ["*10", "*12"])
+  assert.deepEqual(unmanagedRouteIds(routes), ["*11"])
+}
+
+{
+  assert.equal(stripManagedRecursiveComment("MikrotikManager:recursive via de"), "via de")
+  assert.equal(stripManagedRecursiveComment("recursive: old"), "old")
+  assert.equal(managedRecursiveComment("MikrotikManager:recursive via de"), "MikrotikManager:recursive via de")
+  assert.equal(isOwnedRecursiveComment("MikrotikManager:recursive via de"), true)
+  assert.equal(isOwnedRecursiveComment("recursive: x"), true)
+  assert.equal(isOwnedRecursiveComment("user static"), false)
+  assert.equal(hasManagedCommentPrefix("MikrotikManager: msk"), true)
+}
+
+{
+  const mapped = mapRosManagedRoutes([
+    {
+      ".id": "*1",
+      static: "true",
+      "dst-address": "10.9.9.2/32",
+      gateway: "1.2.3.4",
+      comment: "MikrotikManager:recursive hop-de",
+      distance: "1",
+    },
+    {
+      ".id": "*2",
+      static: "true",
+      "dst-address": "10.9.9.3/32",
+      gateway: "1.2.3.4",
+      comment: "not ours",
+      distance: "1",
+    },
+  ])
+  assert.equal(mapped.length, 1)
+  assert.equal(mapped[0]?.dstAddress, "10.9.9.2/32")
+  assert.equal(mapped[0]?.comment, "hop-de")
+}
+
+console.log("config-apply-plan.test.ts: ok")

backend/src/services/config-apply-plan.ts

@@ -0,0 +1,140 @@
+import {
+  hasManagedCommentPrefix,
+  isOwnedRecursiveComment,
+  stripManagedRecursiveComment,
+} from "../managed-markers.js"
+
+export type RosFilterRuleLike = {
+  ".id"?: string
+  chain?: string
+  rule?: string
+  comment?: string
+}
+
+export type BgpInApplyAction = "patch" | "create" | "delete" | "noop"
+
+export interface BgpInApplyPlan {
+  action: BgpInApplyAction
+  managedId?: string
+  conflictIds: string[]
+}
+
+function isInBgpIn(rule: RosFilterRuleLike): boolean {
+  return (rule.chain ?? "").trim().toLowerCase() === "bgp-in"
+}
+
+export function planBgpInApply(
+  existing: RosFilterRuleLike[],
+  rulesCount: number,
+): BgpInApplyPlan {
+  const managed = existing.find(
+    (r) => isInBgpIn(r) && hasManagedCommentPrefix(r.comment ?? ""),
+  )
+  const conflictIds = existing
+    .filter((r) =>
+      isInBgpIn(r) &&
+      !hasManagedCommentPrefix(r.comment ?? "") &&
+      /bgp-communities/i.test(r.rule ?? ""),
+    )
+    .map((r) => r[".id"])
+    .filter((id): id is string => Boolean(id))
+
+  if (rulesCount > 0) {
+    return {
+      action: managed?.[".id"] ? "patch" : "create",
+      managedId: managed?.[".id"],
+      conflictIds,
+    }
+  }
+  if (managed?.[".id"]) {
+    return { action: "delete", managedId: managed[".id"], conflictIds }
+  }
+  return { action: "noop", conflictIds }
+}
+
+export type RosRouteLike = {
+  ".id"?: string
+  comment?: string
+  static?: string
+  dynamic?: string
+  blackhole?: string
+  unreachable?: string
+  prohibit?: string
+  "dst-address"?: string
+  gateway?: string
+}
+
+export function planRecursiveApply(existing: RosRouteLike[]): { deleteIds: string[] } {
+  return {
+    deleteIds: existing
+      .filter((r) => isOwnedRecursiveComment(r.comment))
+      .map((r) => r[".id"])
+      .filter((id): id is string => Boolean(id)),
+  }
+}
+
+export function unmanagedRouteIds(existing: RosRouteLike[]): string[] {
+  return existing
+    .filter((r) => Boolean(r[".id"]) && !isOwnedRecursiveComment(r.comment))
+    .map((r) => r[".id"] as string)
+}
+
+export function userRecursiveComment(comment: string | undefined): string {
+  return stripManagedRecursiveComment(comment ?? "")
+}
+
+function isIpGateway(gw: string): boolean {
+  return /^\d{1,3}(\.\d{1,3}){3}(?:%\S+)?$/.test(gw.trim())
+}
+
+export function isManagedRecursiveRoute(r: RosRouteLike): boolean {
+  if ((r.static ?? "false") !== "true") return false
+  if ((r.dynamic ?? "false") === "true") return false
+  if ((r.blackhole ?? "false") === "true") return false
+  if ((r.unreachable ?? "false") === "true") return false
+  if ((r.prohibit ?? "false") === "true") return false
+  const dst = r["dst-address"] ?? ""
+  const gw = r.gateway ?? ""
+  if (!dst || !gw) return false
+  if (!isIpGateway(gw)) return false
+  return isOwnedRecursiveComment(r.comment)
+}
+
+export interface MappedRecursiveRoute {
+  id: string
+  dstAddress: string
+  gateway: string
+  distance: number
+  scope: number | null
+  targetScope: number | null
+  routingTable: string
+  checkGateway: string
+  country: string
+  comment: string
+  disabled: boolean
+}
+
+export function mapRosManagedRoutes(
+  rosRoutes: Array<RosRouteLike & {
+    distance?: string
+    scope?: string
+    "target-scope"?: string
+    "routing-table"?: string
+    "check-gateway"?: string
+    disabled?: string
+  }>,
+): MappedRecursiveRoute[] {
+  return rosRoutes.filter(isManagedRecursiveRoute).map((r, i) => ({
+    id: r[".id"] ?? `ros-${i}`,
+    dstAddress: r["dst-address"] ?? "",
+    gateway: r.gateway ?? "",
+    distance: Number.parseInt(r.distance ?? "1", 10) || 1,
+    scope: r.scope ? (Number.parseInt(r.scope, 10) || null) : null,
+    targetScope: r["target-scope"] ? (Number.parseInt(r["target-scope"], 10) || null) : null,
+    routingTable: r["routing-table"] ?? "main",
+    checkGateway: r["check-gateway"] ?? "",
+    country: "",
+    comment: userRecursiveComment(r.comment),
+    disabled: r.disabled === "true",
+  }))
+}

backend/src/services/config-revisions.test.ts

@@ -0,0 +1,101 @@
+import assert from "node:assert/strict"
+import { withPgOrSkip } from "../test/pg.js"
+import { dbQuery } from "../db/index.js"
+import {
+  appendRevisionIfChanged,
+  fingerprintPayload,
+  getRevisionById,
+  listRevisions,
+  pruneRevisions,
+} from "./config-revisions.js"
+
+if (!(await withPgOrSkip())) {
+  console.log("config-revisions.test.ts: skip")
+  process.exit(0)
+}
+
+const tag = `rev-test-${Date.now()}`
+await dbQuery(`INSERT INTO servers (name, host) VALUES ($1, '127.0.0.1')`, [tag])
+const { rows } = await dbQuery<{ id: number }>(`SELECT id FROM servers WHERE name = $1 LIMIT 1`, [tag])
+const serverId = rows[0]?.id
+assert.ok(serverId)
+
+try {
+  const payloadA = [{ community: "1:1", action: "route" }]
+  const first = await appendRevisionIfChanged({
+    serverId,
+    section: "filters",
+    source: "apply",
+    payload: payloadA,
+  })
+  assert.equal(first.created, true)
+  assert.equal(first.revision.source, "apply")
+
+  const dup = await appendRevisionIfChanged({
+    serverId,
+    section: "filters",
+    source: "observed",
+    payload: payloadA,
+  })
+  assert.equal(dup.created, false)
+  assert.equal(dup.revision.id, first.revision.id)
+
+  const payloadB = [{ community: "1:2", action: "blackhole" }]
+  const second = await appendRevisionIfChanged({
+    serverId,
+    section: "filters",
+    source: "rollback",
+    payload: payloadB,
+  })
+  assert.equal(second.created, true)
+  assert.equal(second.revision.source, "rollback")
+  assert.notEqual(second.revision.fingerprint, first.revision.fingerprint)
+
+  const listed = await listRevisions(serverId, "filters")
+  assert.equal(listed.length, 2)
+  assert.equal(listed[0]?.source, "rollback")
+
+  const stored = await getRevisionById(second.revision.id)
+  assert.ok(stored)
+  assert.equal(fingerprintPayload(stored.payload), second.revision.fingerprint)
+
+  const objPayload = { rules: [{ chain: "input" }], addressLists: [{ list: "vip" }] }
+  const objRev = await appendRevisionIfChanged({
+    serverId,
+    section: "firewall",
+    source: "apply",
+    payload: objPayload,
+  })
+  assert.equal(objRev.created, true)
+  assert.equal(objRev.revision.itemCount, 2)
+  const objStored = await getRevisionById(objRev.revision.id)
+  assert.ok(objStored)
+  assert.ok(!Array.isArray(objStored.payload))
+  assert.equal(fingerprintPayload(objStored.payload), objRev.revision.fingerprint)
+
+  const objDup = await appendRevisionIfChanged({
+    serverId,
+    section: "firewall",
+    source: "rollback",
+    payload: objPayload,
+  })
+  assert.equal(objDup.created, false)
+  assert.equal(objDup.revision.source, "apply")
+
+  for (let i = 0; i < 4; i++) {
+    await appendRevisionIfChanged({
+      serverId,
+      section: "filters",
+      source: "apply",
+      payload: [{ community: `9:${i}`, action: "route" }],
+    })
+  }
+  const pruned = await pruneRevisions(serverId, "filters", 3)
+  assert.ok(pruned >= 1)
+  const after = await listRevisions(serverId, "filters")
+  assert.equal(after.length, 3)
+} finally {
+  await dbQuery(`DELETE FROM servers WHERE id = $1`, [serverId])
+}
+
+console.log("config-revisions.test.ts: ok")

backend/src/services/config-revisions.ts

@@ -0,0 +1,236 @@
+import { createHash, randomUUID } from "node:crypto"
+import { and, desc, eq } from "drizzle-orm"
+import { db } from "../db/index.js"
+import { configRevisions, servers, type ConfigRevisionRow } from "../db/schema.js"
+
+export const CONFIG_REVISION_KEEP = 50
+
+export const CONFIG_SECTIONS = [
+  "filters",
+  "recursive-routes",
+  "firewall",
+  "wireguard",
+  "gre",
+] as const
+
+export type ConfigSection = (typeof CONFIG_SECTIONS)[number]
+export type ConfigRevisionSource = "apply" | "rollback" | "observed" | "copy"
+
+export interface ConfigRevisionDto {
+  id: string
+  serverId: string
+  section: ConfigSection
+  source: ConfigRevisionSource
+  fingerprint: string
+  createdAt: string
+  note: string | null
+  itemCount: number
+}
+
+export function stableStringify(value: unknown): string {
+  if (value === null || typeof value !== "object") return JSON.stringify(value)
+  if (Array.isArray(value)) return `[${value.map(stableStringify).join(",")}]`
+  const obj = value as Record<string, unknown>
+  const keys = Object.keys(obj).sort()
+  return `{${keys.map((k) => `${JSON.stringify(k)}:${stableStringify(obj[k])}`).join(",")}}`
+}
+
+export function fingerprintPayload(payload: unknown): string {
+  return createHash("sha256").update(stableStringify(payload)).digest("hex")
+}
+
+export function revisionItemCount(payload: unknown): number {
+  if (Array.isArray(payload)) return payload.length
+  if (payload && typeof payload === "object") {
+    let n = 0
+    for (const value of Object.values(payload as Record<string, unknown>)) {
+      if (Array.isArray(value)) n += value.length
+    }
+    return n
+  }
+  return 0
+}
+
+export function persistablePayload(payload: unknown): unknown {
+  if (payload === undefined) return []
+  return payload
+}
+
+export function canonicalFilterRules(
+  rules: Array<{
+    community?: string
+    action?: string
+    gateway?: string
+    gatewayTunnelId?: string
+    description?: string
+  }>,
+): unknown[] {
+  return rules.map((r) => ({
+    community: (r.community ?? "").trim(),
+    action: r.action === "blackhole" ? "blackhole" : "route",
+    gateway: r.gateway ?? "",
+    gatewayTunnelId: r.gatewayTunnelId ?? "",
+    description: r.description ?? "",
+  }))
+}
+
+export function canonicalRecursiveRoutes(
+  routes: Array<{
+    dstAddress?: string
+    gateway?: string
+    distance?: number
+    scope?: number | null
+    targetScope?: number | null
+    routingTable?: string
+    checkGateway?: string
+    comment?: string
+    disabled?: boolean
+    country?: string
+  }>,
+): unknown[] {
+  return routes.map((r) => ({
+    dstAddress: (r.dstAddress ?? "").trim(),
+    gateway: r.gateway ?? "",
+    distance: r.distance ?? 1,
+    scope: r.scope ?? null,
+    targetScope: r.targetScope ?? null,
+    routingTable: r.routingTable || "main",
+    checkGateway: r.checkGateway ?? "",
+    comment: r.comment ?? "",
+    disabled: Boolean(r.disabled),
+    country: r.country ?? "",
+  }))
+}
+
+export function toRevisionDto(row: ConfigRevisionRow): ConfigRevisionDto {
+  return {
+    id: row.id,
+    serverId: String(row.serverId),
+    section: row.section as ConfigSection,
+    source: row.source,
+    fingerprint: row.fingerprint,
+    createdAt: row.createdAt,
+    note: row.note ?? null,
+    itemCount: revisionItemCount(row.payload),
+  }
+}
+
+export async function listRevisions(
+  serverId: number,
+  section: ConfigSection,
+  limit = CONFIG_REVISION_KEEP,
+): Promise<ConfigRevisionDto[]> {
+  const rows = await db
+    .select()
+    .from(configRevisions)
+    .where(and(eq(configRevisions.serverId, serverId), eq(configRevisions.section, section)))
+    .orderBy(desc(configRevisions.createdAt))
+    .limit(limit)
+  return rows.map(toRevisionDto)
+}
+
+export async function getRevisionById(id: string): Promise<ConfigRevisionRow | undefined> {
+  return (await db.select().from(configRevisions).where(eq(configRevisions.id, id)).limit(1))[0]
+}
+
+export async function pruneRevisions(
+  serverId: number,
+  section: ConfigSection,
+  keep = CONFIG_REVISION_KEEP,
+): Promise<number> {
+  const rows = await db
+    .select({ id: configRevisions.id })
+    .from(configRevisions)
+    .where(and(eq(configRevisions.serverId, serverId), eq(configRevisions.section, section)))
+    .orderBy(desc(configRevisions.createdAt))
+  const extra = rows.slice(keep)
+  if (extra.length === 0) return 0
+  for (const row of extra) {
+    await db.delete(configRevisions).where(eq(configRevisions.id, row.id))
+  }
+  return extra.length
+}
+
+export async function appendRevisionIfChanged(input: {
+  serverId: number
+  section: ConfigSection
+  source: ConfigRevisionSource
+  payload: unknown
+  note?: string | null
+}): Promise<{ created: boolean; revision: ConfigRevisionDto }> {
+  const payload = persistablePayload(input.payload)
+  const fingerprint = fingerprintPayload(payload)
+  const latest = (await db
+    .select()
+    .from(configRevisions)
+    .where(and(
+      eq(configRevisions.serverId, input.serverId),
+      eq(configRevisions.section, input.section),
+    ))
+    .orderBy(desc(configRevisions.createdAt))
+    .limit(1))[0]
+
+  if (latest?.fingerprint === fingerprint) {
+    return { created: false, revision: toRevisionDto(latest) }
+  }
+
+  const now = new Date().toISOString()
+  const id = randomUUID()
+  await db.insert(configRevisions).values({
+    id,
+    serverId: input.serverId,
+    section: input.section,
+    source: input.source,
+    fingerprint,
+    payload,
+    note: input.note ?? null,
+    createdAt: now,
+  })
+  await pruneRevisions(input.serverId, input.section)
+  const row = await getRevisionById(id)
+  if (!row) throw new Error("config-revisions: insert vanished")
+  return { created: true, revision: toRevisionDto(row) }
+}
+
+/** После успешного mutate: capture live → append, ошибки snapshot не валят мутацию. */
+export async function captureAndAppendRevision(input: {
+  serverId: number
+  section: ConfigSection
+  source: ConfigRevisionSource
+  capture: () => Promise<unknown>
+  note?: string | null
+}): Promise<{ created: boolean; revision: ConfigRevisionDto } | null> {
+  try {
+    const payload = await input.capture()
+    return await appendRevisionIfChanged({
+      serverId: input.serverId,
+      section: input.section,
+      source: input.source,
+      payload,
+      note: input.note,
+    })
+  } catch {
+    return null
+  }
+}
+
+export async function loadRevisionForRestore(opts: {
+  id: string
+  section: ConfigSection
+  requestedServerId: number | null
+}): Promise<
+  | { ok: true; row: ConfigRevisionRow; server: typeof servers.$inferSelect }
+  | { ok: false; status: number; error: string }
+> {
+  const row = await getRevisionById(opts.id)
+  if (!row) return { ok: false, status: 404, error: "Revision not found" }
+  if (row.section !== opts.section) {
+    return { ok: false, status: 400, error: "Revision section mismatch" }
+  }
+  if (opts.requestedServerId !== null && opts.requestedServerId !== row.serverId) {
+    return { ok: false, status: 400, error: "Revision belongs to another server" }
+  }
+  const server = (await db.select().from(servers).where(eq(servers.id, row.serverId)).limit(1))[0]
+  if (!server) return { ok: false, status: 404, error: "Server not found" }
+  return { ok: true, row, server }
+}

backend/src/services/entity-snapshots.test.ts

@@ -0,0 +1,164 @@
+import assert from "node:assert/strict"
+import {
+  canonicalFirewallSnapshot,
+  canonicalGreSnapshot,
+  canonicalWireguardSnapshot,
+  opsPaths,
+  opsTouchOnly,
+  planFirewallRestore,
+  planGreCreate,
+  planGreDelete,
+  planGreRestore,
+  planWireguardRestore,
+} from "./entity-snapshots.js"
+import { fingerprintPayload, revisionItemCount } from "./config-revisions.js"
+
+{
+  const a = canonicalFirewallSnapshot({
+    rules: [{ family: "ip", table: "filter", chain: "input", action: "accept", comment: "ssh" }],
+    addressLists: [{ family: "ip", list: "vip", address: "1.1.1.1" }],
+  })
+  const b = canonicalFirewallSnapshot({
+    rules: [{ family: "ip", table: "filter", chain: "input", action: "accept", comment: "ssh" }],
+    addressLists: [{ family: "ip", list: "vip", address: "1.1.1.1" }],
+  })
+  assert.equal(fingerprintPayload(a), fingerprintPayload(b))
+  assert.equal(revisionItemCount(a), 2)
+}
+
+{
+  const desired = canonicalFirewallSnapshot({
+    rules: [{ family: "ip", table: "filter", chain: "input", action: "accept", comment: "keep" }],
+    addressLists: [],
+  })
+  const ops = planFirewallRestore(desired, {
+    rules: [
+      {
+        ...desired.rules[0]!,
+        rosId: "*1",
+        dynamic: false,
+      },
+      {
+        family: "ip",
+        table: "filter",
+        chain: "forward",
+        action: "drop",
+        protocol: "",
+        srcAddress: "",
+        dstAddress: "",
+        srcAddressList: "",
+        dstAddressList: "",
+        srcPort: "",
+        dstPort: "",
+        inInterface: "",
+        outInterface: "",
+        connectionState: "",
+        comment: "extra",
+        disabled: false,
+        log: false,
+        logPrefix: "",
+        tlsHost: "",
+        layer7Proto: "",
+        rosId: "*2",
+        dynamic: false,
+      },
+    ],
+    addressLists: [],
+  })
+  assert.ok(ops.some((op) => op.op === "delete" && op.path.includes("/ip/firewall/filter/")))
+  assert.equal(opsTouchOnly(ops, ["/ip/firewall", "/ipv6/firewall"]), true)
+  assert.equal(opsPaths(ops).some((p) => p.startsWith("/ip/route") || p.startsWith("/interface/wireguard")), false)
+}
+
+{
+  const snap = canonicalWireguardSnapshot({
+    interfaces: [{
+      name: "wg0",
+      privateKey: "abc",
+      address: "10.8.0.1/24",
+      peers: [{ publicKey: "pk", allowedAddresses: ["10.8.0.2/32"] }],
+    }],
+  })
+  const ops = planWireguardRestore(snap, {
+    ifaces: [{ name: "wg0", rosId: "*w", listenPort: 13231, mtu: 1420, privateKey: "abc", comment: "", disabled: false }],
+    peers: [{
+      rosId: "*p",
+      interfaceName: "wg0",
+      publicKey: "old",
+      allowedAddresses: ["0.0.0.0/0"],
+      endpointAddress: "",
+      endpointPort: "",
+      persistentKeepalive: null,
+      comment: "",
+      name: "",
+      disabled: false,
+      privateKey: "",
+      clientAddress: "",
+      clientDns: "",
+      clientEndpoint: "",
+    }],
+    addrs: [{ rosId: "*a", interfaceName: "wg0", address: "10.8.0.1/24" }],
+  })
+  assert.ok(ops.some((op) => op.op === "delete" && op.path.includes("/interface/wireguard/peers/")))
+  assert.ok(ops.some((op) => op.op === "put" && op.path === "/interface/wireguard/peers"))
+  assert.equal(opsTouchOnly(ops, ["/interface/wireguard", "/ip/address"]), true)
+  assert.equal(opsPaths(ops).some((p) => p.startsWith("/interface/gre") || p.startsWith("/ip/route")), false)
+}
+
+{
+  const tunnel = canonicalGreSnapshot({
+    tunnels: [{
+      name: "gre-a",
+      remoteAddress: "203.0.113.1",
+      localInnerIp: "10.200.0.1/30",
+      ipsecSecret: "psk-secret",
+    }],
+  }).tunnels[0]!
+  const create = planGreCreate(tunnel)
+  assert.deepEqual(create.map((op) => op.op), ["put", "put"])
+  assert.equal(create[0]?.path, "/interface/gre")
+  assert.equal(create[1]?.path, "/ip/address")
+  assert.equal(create[1] && create[1].op === "put" ? create[1].body.interface : "", "gre-a")
+  assert.equal(opsPaths(create).some((p) => p.includes("gre-b")), false)
+
+  const del = planGreDelete("gre-a", {
+    gre: [
+      { name: "gre-a", rosId: "*1", localAddress: "", remoteAddress: "203.0.113.1", comment: "", disabled: false, mtu: 1476, keepalive: "0", dscp: "inherit", clampTcpMss: true, allowFastPath: true, ipsecSecret: "" },
+      { name: "gre-b", rosId: "*2", localAddress: "", remoteAddress: "203.0.113.2", comment: "", disabled: false, mtu: 1476, keepalive: "0", dscp: "inherit", clampTcpMss: true, allowFastPath: true, ipsecSecret: "" },
+    ],
+    addrs: [
+      { rosId: "*a1", interfaceName: "gre-a", address: "10.200.0.1/30" },
+      { rosId: "*a2", interfaceName: "gre-b", address: "10.200.0.5/30" },
+    ],
+  })
+  assert.ok(del.some((op) => op.path === "/ip/address/*a1"))
+  assert.ok(del.some((op) => op.path === "/interface/gre/*1"))
+  assert.equal(opsPaths(del).some((p) => p.includes("*2") || p.includes("*a2")), false)
+
+  const restore = planGreRestore(
+    canonicalGreSnapshot({ tunnels: [tunnel] }),
+    {
+      gre: [
+        { name: "gre-a", rosId: "*1", localAddress: "", remoteAddress: "203.0.113.1", comment: "", disabled: false, mtu: 1476, keepalive: "0", dscp: "inherit", clampTcpMss: true, allowFastPath: true, ipsecSecret: "psk-secret" },
+        { name: "gre-b", rosId: "*2", localAddress: "", remoteAddress: "203.0.113.2", comment: "", disabled: false, mtu: 1476, keepalive: "0", dscp: "inherit", clampTcpMss: true, allowFastPath: true, ipsecSecret: "" },
+      ],
+      addrs: [
+        { rosId: "*a1", interfaceName: "gre-a", address: "10.200.0.1/30" },
+        { rosId: "*a2", interfaceName: "gre-b", address: "10.200.0.5/30" },
+      ],
+    },
+  )
+  assert.ok(restore.some((op) => op.path === "/interface/gre/*2"))
+  assert.ok(restore.some((op) => op.path === "/ip/address/*a2"))
+  assert.equal(opsTouchOnly(restore, ["/interface/gre", "/ip/address"]), true)
+}
+
+{
+  const p1 = fingerprintPayload({ tunnels: [{ name: "gre-a", mtu: 1476 }] })
+  const p2 = fingerprintPayload({ tunnels: [{ name: "gre-a", mtu: 1476 }] })
+  const p3 = fingerprintPayload({ tunnels: [{ name: "gre-a", mtu: 1400 }] })
+  assert.equal(p1, p2)
+  assert.notEqual(p1, p3)
+}
+
+console.log("entity-snapshots.test.ts: ok")

backend/src/services/entity-snapshots.ts

@@ -0,0 +1,649 @@
+/** Канонические снапшоты и планы restore для firewall / WireGuard / GRE. */
+
+export type FirewallFamily = "ip" | "ip6"
+export type FirewallTable = "filter" | "nat" | "mangle" | "raw"
+
+export type RosWriteOp =
+  | { op: "put"; path: string; body: Record<string, string> }
+  | { op: "post"; path: string; body: Record<string, string> }
+  | { op: "patch"; path: string; body: Record<string, string> }
+  | { op: "delete"; path: string }
+  | { op: "move"; path: string; body: Record<string, string> }
+
+export interface FirewallSnapshotRule {
+  family: FirewallFamily
+  table: FirewallTable
+  chain: string
+  action: string
+  protocol: string
+  srcAddress: string
+  dstAddress: string
+  srcAddressList: string
+  dstAddressList: string
+  srcPort: string
+  dstPort: string
+  inInterface: string
+  outInterface: string
+  connectionState: string
+  comment: string
+  disabled: boolean
+  log: boolean
+  logPrefix: string
+  tlsHost: string
+  layer7Proto: string
+}
+
+export interface FirewallSnapshotList {
+  family: FirewallFamily
+  list: string
+  address: string
+  comment: string
+  disabled: boolean
+  timeout: string
+}
+
+export interface FirewallSnapshot {
+  rules: FirewallSnapshotRule[]
+  addressLists: FirewallSnapshotList[]
+}
+
+export interface FirewallLiveRule extends FirewallSnapshotRule {
+  rosId: string
+  dynamic: boolean
+}
+
+export interface FirewallLiveList extends FirewallSnapshotList {
+  rosId: string
+  dynamic: boolean
+}
+
+export interface WgSnapshotPeer {
+  publicKey: string
+  allowedAddresses: string[]
+  endpointAddress: string
+  endpointPort: string
+  persistentKeepalive: number | null
+  comment: string
+  name: string
+  disabled: boolean
+  privateKey: string
+  clientAddress: string
+  clientDns: string
+  clientEndpoint: string
+}
+
+export interface WgSnapshotIface {
+  name: string
+  listenPort: number
+  mtu: number
+  privateKey: string
+  address: string
+  comment: string
+  disabled: boolean
+  peers: WgSnapshotPeer[]
+}
+
+export interface WgSnapshot {
+  interfaces: WgSnapshotIface[]
+}
+
+export interface WgLiveIface {
+  name: string
+  rosId: string
+  listenPort: number
+  mtu: number
+  privateKey: string
+  comment: string
+  disabled: boolean
+}
+
+export interface WgLivePeer {
+  rosId: string
+  interfaceName: string
+  publicKey: string
+  allowedAddresses: string[]
+  endpointAddress: string
+  endpointPort: string
+  persistentKeepalive: number | null
+  comment: string
+  name: string
+  disabled: boolean
+  privateKey: string
+  clientAddress: string
+  clientDns: string
+  clientEndpoint: string
+}
+
+export interface WgLiveAddr {
+  rosId: string
+  interfaceName: string
+  address: string
+}
+
+export interface GreSnapshotTunnel {
+  name: string
+  localAddress: string
+  remoteAddress: string
+  localInnerIp: string
+  remoteInnerIp: string
+  comment: string
+  disabled: boolean
+  mtu: number
+  keepalive: string
+  dscp: string
+  clampTcpMss: boolean
+  allowFastPath: boolean
+  ipsecSecret: string
+}
+
+export interface GreSnapshot {
+  tunnels: GreSnapshotTunnel[]
+}
+
+export interface GreLiveIface {
+  name: string
+  rosId: string
+  localAddress: string
+  remoteAddress: string
+  comment: string
+  disabled: boolean
+  mtu: number
+  keepalive: string
+  dscp: string
+  clampTcpMss: boolean
+  allowFastPath: boolean
+  ipsecSecret: string
+}
+
+export interface GreLiveAddr {
+  rosId: string
+  interfaceName: string
+  address: string
+}
+
+function str(v: unknown): string {
+  return String(v ?? "").trim()
+}
+
+function bool(v: unknown): boolean {
+  if (typeof v === "boolean") return v
+  const s = str(v).toLowerCase()
+  return s === "true" || s === "yes" || s === "1"
+}
+
+function num(v: unknown, fallback: number): number {
+  const n = typeof v === "number" ? v : Number.parseInt(str(v), 10)
+  return Number.isFinite(n) ? n : fallback
+}
+
+export function isHiddenSecret(value: string | undefined): boolean {
+  const s = str(value)
+  if (!s) return true
+  if (s === "(hidden)") return true
+  return /^\*+$/.test(s)
+}
+
+export function firewallRestPath(
+  family: FirewallFamily,
+  table: FirewallTable | "address-list",
+): string {
+  const root = family === "ip6" ? "/ipv6/firewall" : "/ip/firewall"
+  return `${root}/${table}`
+}
+
+function rosYesNo(v: boolean | undefined): string | undefined {
+  if (v === true) return "yes"
+  if (v === false) return "no"
+  return undefined
+}
+
+function compactBody(obj: Record<string, string | undefined>): Record<string, string> {
+  const out: Record<string, string> = {}
+  for (const [k, v] of Object.entries(obj)) {
+    if (v !== undefined && v !== "") out[k] = v
+  }
+  return out
+}
+
+export function canonicalFirewallSnapshot(input: {
+  rules?: Array<Partial<FirewallSnapshotRule>>
+  addressLists?: Array<Partial<FirewallSnapshotList>>
+}): FirewallSnapshot {
+  const rules = (input.rules ?? []).map((r) => ({
+    family: r.family === "ip6" ? "ip6" as const : "ip" as const,
+    table: (["filter", "nat", "mangle", "raw"] as const).includes(r.table as FirewallTable)
+      ? (r.table as FirewallTable)
+      : "filter",
+    chain: str(r.chain),
+    action: str(r.action),
+    protocol: str(r.protocol),
+    srcAddress: str(r.srcAddress),
+    dstAddress: str(r.dstAddress),
+    srcAddressList: str(r.srcAddressList),
+    dstAddressList: str(r.dstAddressList),
+    srcPort: str(r.srcPort),
+    dstPort: str(r.dstPort),
+    inInterface: str(r.inInterface),
+    outInterface: str(r.outInterface),
+    connectionState: str(r.connectionState),
+    comment: str(r.comment),
+    disabled: Boolean(r.disabled),
+    log: Boolean(r.log),
+    logPrefix: str(r.logPrefix),
+    tlsHost: str(r.tlsHost),
+    layer7Proto: str(r.layer7Proto),
+  }))
+  const addressLists = (input.addressLists ?? []).map((e) => ({
+    family: e.family === "ip6" ? "ip6" as const : "ip" as const,
+    list: str(e.list),
+    address: str(e.address),
+    comment: str(e.comment),
+    disabled: Boolean(e.disabled),
+    timeout: str(e.timeout),
+  }))
+  return { rules, addressLists }
+}
+
+export function parseFirewallSnapshot(payload: unknown): FirewallSnapshot {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
+    return { rules: [], addressLists: [] }
+  }
+  const o = payload as Record<string, unknown>
+  return canonicalFirewallSnapshot({
+    rules: Array.isArray(o.rules) ? o.rules as Partial<FirewallSnapshotRule>[] : [],
+    addressLists: Array.isArray(o.addressLists) ? o.addressLists as Partial<FirewallSnapshotList>[] : [],
+  })
+}
+
+function firewallRuleKey(r: FirewallSnapshotRule): string {
+  return [
+    r.family, r.table, r.chain, r.action, r.protocol,
+    r.srcAddress, r.dstAddress, r.srcAddressList, r.dstAddressList,
+    r.srcPort, r.dstPort, r.inInterface, r.outInterface, r.connectionState,
+    r.comment, r.disabled ? "1" : "0", r.log ? "1" : "0", r.logPrefix, r.tlsHost, r.layer7Proto,
+  ].join("\0")
+}
+
+function firewallListKey(e: FirewallSnapshotList): string {
+  return [e.family, e.list, e.address, e.comment, e.disabled ? "1" : "0", e.timeout].join("\0")
+}
+
+function firewallRuleBody(r: FirewallSnapshotRule): Record<string, string> {
+  return compactBody({
+    chain: r.chain,
+    action: r.action,
+    protocol: r.protocol && r.protocol !== "all" ? r.protocol : undefined,
+    "src-address": r.srcAddress,
+    "dst-address": r.dstAddress,
+    "src-address-list": r.srcAddressList,
+    "dst-address-list": r.dstAddressList,
+    "src-port": r.srcPort,
+    "dst-port": r.dstPort,
+    "in-interface": r.inInterface,
+    "out-interface": r.outInterface,
+    "connection-state": r.connectionState,
+    comment: r.comment,
+    disabled: rosYesNo(r.disabled),
+    log: rosYesNo(r.log),
+    "log-prefix": r.logPrefix,
+    "tls-host": r.tlsHost,
+    "layer7-protocol": r.layer7Proto,
+  })
+}
+
+export function planFirewallRestore(
+  desiredInput: FirewallSnapshot,
+  current: { rules: FirewallLiveRule[]; addressLists: FirewallLiveList[] },
+): RosWriteOp[] {
+  const desired = canonicalFirewallSnapshot(desiredInput)
+  const ops: RosWriteOp[] = []
+  const usedRules = new Set<string>()
+  const usedLists = new Set<string>()
+
+  for (const live of current.rules) {
+    if (live.dynamic) continue
+    const key = firewallRuleKey(live)
+    const stillWanted = desired.rules.some((d) => firewallRuleKey(d) === key)
+    if (!stillWanted) {
+      ops.push({
+        op: "delete",
+        path: `${firewallRestPath(live.family, live.table)}/${live.rosId}`,
+      })
+    } else {
+      usedRules.add(key)
+    }
+  }
+
+  for (const live of current.addressLists) {
+    if (live.dynamic) continue
+    const key = firewallListKey(live)
+    const stillWanted = desired.addressLists.some((d) => firewallListKey(d) === key)
+    if (!stillWanted) {
+      ops.push({
+        op: "delete",
+        path: `${firewallRestPath(live.family, "address-list")}/${live.rosId}`,
+      })
+    } else {
+      usedLists.add(key)
+    }
+  }
+
+  for (const rule of desired.rules) {
+    if (usedRules.has(firewallRuleKey(rule))) continue
+    ops.push({
+      op: "put",
+      path: firewallRestPath(rule.family, rule.table),
+      body: firewallRuleBody(rule),
+    })
+  }
+
+  for (const entry of desired.addressLists) {
+    if (usedLists.has(firewallListKey(entry))) continue
+    ops.push({
+      op: "put",
+      path: firewallRestPath(entry.family, "address-list"),
+      body: compactBody({
+        list: entry.list,
+        address: entry.address,
+        comment: entry.comment,
+        timeout: entry.timeout,
+        disabled: rosYesNo(entry.disabled),
+      }),
+    })
+  }
+
+  return ops
+}
+
+function canonicalPeer(p: Partial<WgSnapshotPeer>): WgSnapshotPeer {
+  const allowed = Array.isArray(p.allowedAddresses)
+    ? p.allowedAddresses.map((a) => str(a)).filter(Boolean)
+    : str((p as { allowedIps?: unknown }).allowedIps)
+        .split(",")
+        .map((s) => s.trim())
+        .filter(Boolean)
+  return {
+    publicKey: str(p.publicKey),
+    allowedAddresses: allowed,
+    endpointAddress: str(p.endpointAddress),
+    endpointPort: str(p.endpointPort),
+    persistentKeepalive: p.persistentKeepalive == null ? null : num(p.persistentKeepalive, 0) || null,
+    comment: str(p.comment),
+    name: str(p.name),
+    disabled: Boolean(p.disabled),
+    privateKey: str(p.privateKey),
+    clientAddress: str(p.clientAddress),
+    clientDns: str(p.clientDns),
+    clientEndpoint: str(p.clientEndpoint),
+  }
+}
+
+export function canonicalWireguardSnapshot(input: {
+  interfaces?: Array<Partial<WgSnapshotIface> & { peers?: Array<Partial<WgSnapshotPeer>> }>
+}): WgSnapshot {
+  const interfaces = (input.interfaces ?? [])
+    .map((iface) => ({
+      name: str(iface.name),
+      listenPort: num(iface.listenPort, 13231),
+      mtu: num(iface.mtu, 1420),
+      privateKey: str(iface.privateKey),
+      address: str(iface.address),
+      comment: str(iface.comment),
+      disabled: Boolean(iface.disabled),
+      peers: (iface.peers ?? []).map(canonicalPeer).sort((a, b) => a.publicKey.localeCompare(b.publicKey)),
+    }))
+    .filter((i) => i.name)
+    .sort((a, b) => a.name.localeCompare(b.name))
+  return { interfaces }
+}
+
+export function parseWireguardSnapshot(payload: unknown): WgSnapshot {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
+    return { interfaces: [] }
+  }
+  const o = payload as Record<string, unknown>
+  return canonicalWireguardSnapshot({
+    interfaces: Array.isArray(o.interfaces)
+      ? o.interfaces as Array<Partial<WgSnapshotIface> & { peers?: Array<Partial<WgSnapshotPeer>> }>
+      : [],
+  })
+}
+
+function peerBody(interfaceName: string, p: WgSnapshotPeer): Record<string, string> {
+  return compactBody({
+    interface: interfaceName,
+    "public-key": p.publicKey,
+    "allowed-address": p.allowedAddresses.join(","),
+    "endpoint-address": p.endpointAddress,
+    "endpoint-port": p.endpointPort,
+    "persistent-keepalive": p.persistentKeepalive != null ? String(p.persistentKeepalive) : undefined,
+    comment: p.comment,
+    name: p.name,
+    "private-key": isHiddenSecret(p.privateKey) ? undefined : p.privateKey,
+    "client-address": p.clientAddress,
+    "client-dns": p.clientDns,
+    "client-endpoint": p.clientEndpoint,
+    disabled: rosYesNo(p.disabled),
+  })
+}
+
+export function planWireguardRestore(
+  desiredInput: WgSnapshot,
+  current: { ifaces: WgLiveIface[]; peers: WgLivePeer[]; addrs: WgLiveAddr[] },
+): RosWriteOp[] {
+  const desired = canonicalWireguardSnapshot(desiredInput)
+  const wantedNames = new Set(desired.interfaces.map((i) => i.name))
+  const ops: RosWriteOp[] = []
+
+  for (const peer of current.peers) {
+    const iface = desired.interfaces.find((i) => i.name === peer.interfaceName)
+    const keep = iface?.peers.some((p) => p.publicKey === peer.publicKey)
+    if (!keep) {
+      ops.push({ op: "delete", path: `/interface/wireguard/peers/${peer.rosId}` })
+    }
+  }
+
+  for (const addr of current.addrs) {
+    if (!wantedNames.has(addr.interfaceName)) {
+      ops.push({ op: "delete", path: `/ip/address/${addr.rosId}` })
+    }
+  }
+
+  for (const iface of current.ifaces) {
+    if (!wantedNames.has(iface.name)) {
+      ops.push({ op: "delete", path: `/interface/wireguard/${iface.rosId}` })
+    }
+  }
+
+  for (const want of desired.interfaces) {
+    const live = current.ifaces.find((i) => i.name === want.name)
+    const ifaceBody = compactBody({
+      name: want.name,
+      "listen-port": String(want.listenPort),
+      mtu: String(want.mtu),
+      "private-key": isHiddenSecret(want.privateKey) ? undefined : want.privateKey,
+      comment: want.comment,
+      disabled: rosYesNo(want.disabled),
+    })
+    if (!live) {
+      ops.push({ op: "put", path: "/interface/wireguard", body: ifaceBody })
+    } else {
+      ops.push({
+        op: "patch",
+        path: `/interface/wireguard/${live.rosId}`,
+        body: ifaceBody,
+      })
+    }
+
+    const liveAddr = current.addrs.find((a) => a.interfaceName === want.name)
+    if (want.address) {
+      if (!liveAddr) {
+        ops.push({ op: "put", path: "/ip/address", body: { address: want.address, interface: want.name } })
+      } else if (liveAddr.address !== want.address) {
+        ops.push({ op: "delete", path: `/ip/address/${liveAddr.rosId}` })
+        ops.push({ op: "put", path: "/ip/address", body: { address: want.address, interface: want.name } })
+      }
+    } else if (liveAddr) {
+      ops.push({ op: "delete", path: `/ip/address/${liveAddr.rosId}` })
+    }
+
+    for (const peer of want.peers) {
+      if (!peer.publicKey) continue
+      const livePeer = current.peers.find(
+        (p) => p.interfaceName === want.name && p.publicKey === peer.publicKey,
+      )
+      const body = peerBody(want.name, peer)
+      if (!livePeer) {
+        ops.push({ op: "put", path: "/interface/wireguard/peers", body })
+      } else {
+        ops.push({
+          op: "patch",
+          path: `/interface/wireguard/peers/${livePeer.rosId}`,
+          body,
+        })
+      }
+    }
+  }
+
+  return ops
+}
+
+export function canonicalGreSnapshot(input: {
+  tunnels?: Array<Partial<GreSnapshotTunnel>>
+}): GreSnapshot {
+  const tunnels = (input.tunnels ?? [])
+    .map((t) => ({
+      name: str(t.name),
+      localAddress: str(t.localAddress),
+      remoteAddress: str(t.remoteAddress),
+      localInnerIp: str(t.localInnerIp),
+      remoteInnerIp: str(t.remoteInnerIp),
+      comment: str(t.comment),
+      disabled: Boolean(t.disabled),
+      mtu: num(t.mtu, 1476),
+      keepalive: str(t.keepalive) || "0",
+      dscp: str(t.dscp) || "inherit",
+      clampTcpMss: t.clampTcpMss !== false,
+      allowFastPath: t.allowFastPath !== false,
+      ipsecSecret: str(t.ipsecSecret),
+    }))
+    .filter((t) => t.name)
+    .sort((a, b) => a.name.localeCompare(b.name))
+  return { tunnels }
+}
+
+export function parseGreSnapshot(payload: unknown): GreSnapshot {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
+    return { tunnels: [] }
+  }
+  const o = payload as Record<string, unknown>
+  return canonicalGreSnapshot({
+    tunnels: Array.isArray(o.tunnels) ? o.tunnels as Array<Partial<GreSnapshotTunnel>> : [],
+  })
+}
+
+export function greInterfaceBody(t: GreSnapshotTunnel): Record<string, string> {
+  return compactBody({
+    name: t.name,
+    "local-address": t.localAddress && t.localAddress !== "0.0.0.0" ? t.localAddress : undefined,
+    "remote-address": t.remoteAddress,
+    mtu: String(t.mtu),
+    keepalive: t.keepalive,
+    dscp: t.dscp,
+    "clamp-tcp-mss": t.clampTcpMss ? "yes" : "no",
+    "allow-fast-path": t.allowFastPath ? "yes" : "no",
+    comment: t.comment,
+    disabled: rosYesNo(t.disabled),
+    "ipsec-secret": isHiddenSecret(t.ipsecSecret) ? undefined : t.ipsecSecret,
+  })
+}
+
+export function planGreCreate(tunnel: GreSnapshotTunnel): RosWriteOp[] {
+  const t = canonicalGreSnapshot({ tunnels: [tunnel] }).tunnels[0]
+  if (!t) return []
+  const ops: RosWriteOp[] = [
+    { op: "put", path: "/interface/gre", body: greInterfaceBody(t) },
+  ]
+  if (t.localInnerIp) {
+    ops.push({
+      op: "put",
+      path: "/ip/address",
+      body: { address: t.localInnerIp, interface: t.name },
+    })
+  }
+  return ops
+}
+
+export function planGreDelete(
+  name: string,
+  current: { gre: GreLiveIface[]; addrs: GreLiveAddr[] },
+): RosWriteOp[] {
+  const want = str(name)
+  const ops: RosWriteOp[] = []
+  for (const addr of current.addrs) {
+    if (addr.interfaceName === want) {
+      ops.push({ op: "delete", path: `/ip/address/${addr.rosId}` })
+    }
+  }
+  for (const gre of current.gre) {
+    if (gre.name === want) {
+      ops.push({ op: "delete", path: `/interface/gre/${gre.rosId}` })
+    }
+  }
+  return ops
+}
+
+export function planGreRestore(
+  desiredInput: GreSnapshot,
+  current: { gre: GreLiveIface[]; addrs: GreLiveAddr[] },
+): RosWriteOp[] {
+  const desired = canonicalGreSnapshot(desiredInput)
+  const wanted = new Set(desired.tunnels.map((t) => t.name))
+  const ops: RosWriteOp[] = []
+
+  for (const gre of current.gre) {
+    if (!wanted.has(gre.name)) {
+      ops.push(...planGreDelete(gre.name, current))
+    }
+  }
+
+  for (const want of desired.tunnels) {
+    const live = current.gre.find((g) => g.name === want.name)
+    const body = greInterfaceBody(want)
+    if (!live) {
+      ops.push({ op: "put", path: "/interface/gre", body })
+    } else {
+      ops.push({ op: "patch", path: `/interface/gre/${live.rosId}`, body })
+    }
+
+    const liveAddr = current.addrs.find((a) => a.interfaceName === want.name)
+    if (want.localInnerIp) {
+      if (!liveAddr) {
+        ops.push({
+          op: "put",
+          path: "/ip/address",
+          body: { address: want.localInnerIp, interface: want.name },
+        })
+      } else if (liveAddr.address !== want.localInnerIp) {
+        ops.push({ op: "delete", path: `/ip/address/${liveAddr.rosId}` })
+        ops.push({
+          op: "put",
+          path: "/ip/address",
+          body: { address: want.localInnerIp, interface: want.name },
+        })
+      }
+    } else if (liveAddr) {
+      ops.push({ op: "delete", path: `/ip/address/${liveAddr.rosId}` })
+    }
+  }
+
+  return ops
+}
+
+export function opsPaths(ops: RosWriteOp[]): string[] {
+  return ops.map((op) => op.path)
+}
+
+export function opsTouchOnly(ops: RosWriteOp[], prefixes: string[]): boolean {
+  return ops.every((op) => prefixes.some((p) => op.path === p || op.path.startsWith(`${p}/`)))
+}

backend/src/services/firewall-live.ts

@@ -5,12 +5,21 @@ import {
   MikrotikClient,
   firewallRestPath,
 } from "./mikrotik.js"
+import {
+  captureAndAppendRevision,
+} from "./config-revisions.js"
 import type {
   FirewallFamily,
   FirewallTable,
   RosFirewallAddressList,
   RosFirewallFilter,
 } from "../types/server.js"
+import {
+  canonicalFirewallSnapshot,
+  type FirewallLiveList,
+  type FirewallLiveRule,
+  type FirewallSnapshot,
+} from "./entity-snapshots.js"
 
 type ServerRow = typeof servers.$inferSelect
 
@@ -150,29 +159,121 @@ async function safeGet<T>(fn: () => Promise<T[]>, fallback: T[] = []): Promise<T
   }
 }
 
-export async function fetchServerFirewall(server: ServerRow): Promise<{
+function rosYes(v: string | undefined): boolean {
+  return v === "true" || v === "yes"
+}
+
+export function mapFirewallSnapshotRule(
+  family: FirewallFamily,
+  table: FirewallTable,
+  raw: RosFirewallFilter,
+): FirewallLiveRule {
+  return {
+    rosId: raw[".id"] || "",
+    dynamic: rosYes(raw.dynamic),
+    family,
+    table,
+    chain: raw.chain || "",
+    action: raw.action || "",
+    protocol: raw.protocol || "",
+    srcAddress: raw["src-address"] ?? "",
+    dstAddress: raw["dst-address"] ?? "",
+    srcAddressList: raw["src-address-list"] ?? "",
+    dstAddressList: raw["dst-address-list"] ?? "",
+    srcPort: raw["src-port"] ?? "",
+    dstPort: raw["dst-port"] ?? "",
+    inInterface: raw["in-interface"] ?? "",
+    outInterface: raw["out-interface"] ?? "",
+    connectionState: raw["connection-state"] ?? "",
+    comment: raw.comment ?? "",
+    disabled: rosDisabled(raw.disabled),
+    log: rosYes(raw.log),
+    logPrefix: raw["log-prefix"] ?? "",
+    tlsHost: raw["tls-host"] ?? "",
+    layer7Proto: raw["layer7-protocol"] ?? "",
+  }
+}
+
+export function mapFirewallSnapshotList(
+  family: FirewallFamily,
+  raw: RosFirewallAddressList,
+): FirewallLiveList {
+  return {
+    rosId: raw[".id"] || "",
+    dynamic: rosYes(raw.dynamic),
+    family,
+    list: raw.list || "",
+    address: raw.address || "",
+    comment: raw.comment ?? "",
+    disabled: rosDisabled(raw.disabled),
+    timeout: raw.timeout ?? "",
+  }
+}
+
+export async function fetchFirewallState(server: ServerRow): Promise<{
   rules: FirewallRuleDto[]
   addressLists: FirewallAddressListDto[]
+  liveRules: FirewallLiveRule[]
+  liveLists: FirewallLiveList[]
+  snapshot: FirewallSnapshot
 }> {
   const client = MikrotikClient.fromServer(server)
   const ruleJobs = FAMILIES.flatMap((family) =>
     TABLES.map(async (table) => {
       const raw = await safeGet(() => client.getFirewallRules(family, table))
-      return raw.map((row, idx) => mapFirewallRule(server, family, table, row, idx))
+      return { family, table, raw }
     }),
   )
   const listJobs = FAMILIES.map(async (family) => {
     const raw = await safeGet(() => client.getFirewallAddressList(family))
-    return raw.map((row, idx) => mapAddressList(server, family, row, idx))
+    return { family, raw }
   })
   const [ruleChunks, listChunks] = await Promise.all([
     Promise.all(ruleJobs),
     Promise.all(listJobs),
   ])
-  return {
-    rules: ruleChunks.flat(),
-    addressLists: listChunks.flat(),
+
+  const rules: FirewallRuleDto[] = []
+  const liveRules: FirewallLiveRule[] = []
+  for (const chunk of ruleChunks) {
+    chunk.raw.forEach((row, idx) => {
+      rules.push(mapFirewallRule(server, chunk.family, chunk.table, row, idx))
+      liveRules.push(mapFirewallSnapshotRule(chunk.family, chunk.table, row))
+    })
   }
+
+  const addressLists: FirewallAddressListDto[] = []
+  const liveLists: FirewallLiveList[] = []
+  for (const chunk of listChunks) {
+    chunk.raw.forEach((row, idx) => {
+      addressLists.push(mapAddressList(server, chunk.family, row, idx))
+      liveLists.push(mapFirewallSnapshotList(chunk.family, row))
+    })
+  }
+
+  return {
+    rules,
+    addressLists,
+    liveRules,
+    liveLists,
+    snapshot: canonicalFirewallSnapshot({
+      rules: liveRules.filter((r) => !r.dynamic),
+      addressLists: liveLists.filter((e) => !e.dynamic),
+    }),
+  }
+}
+
+export async function fetchServerFirewall(server: ServerRow): Promise<{
+  rules: FirewallRuleDto[]
+  addressLists: FirewallAddressListDto[]
+}> {
+  const state = await fetchFirewallState(server)
+  return { rules: state.rules, addressLists: state.addressLists }
+}
+
+export async function captureFirewallSnapshot(server: ServerRow): Promise<FirewallSnapshot> {
+  const state = await fetchFirewallState(server)
+  return state.snapshot
 }
 
 export async function listFirewallAll(): Promise<{
@@ -183,7 +284,14 @@ export async function listFirewallAll(): Promise<{
   const perServer = await Promise.all(
     allServers.map(async (server) => {
       try {
-        return await fetchServerFirewall(server)
+        const state = await fetchFirewallState(server)
+        await captureAndAppendRevision({
+          serverId: server.id,
+          section: "firewall",
+          source: "observed",
+          capture: async () => state.snapshot,
+        })
+        return { rules: state.rules, addressLists: state.addressLists }
       } catch {
         return { rules: [] as FirewallRuleDto[], addressLists: [] as FirewallAddressListDto[] }
       }

backend/src/services/gre-live.ts

@@ -0,0 +1,253 @@
+import { eq } from "drizzle-orm"
+import { db } from "../db/index.js"
+import { servers } from "../db/schema.js"
+import { MikrotikClient } from "./mikrotik.js"
+import {
+  canonicalGreSnapshot,
+  type GreLiveAddr,
+  type GreLiveIface,
+  type GreSnapshot,
+} from "./entity-snapshots.js"
+import { captureAndAppendRevision } from "./config-revisions.js"
+
+type ServerRow = typeof servers.$inferSelect
+
+export interface RosGre {
+  ".id"?: string
+  name?: string
+  "local-address"?: string
+  "remote-address"?: string
+  "allow-fast-path"?: string
+  "clamp-tcp-mss"?: string
+  mtu?: string
+  keepalive?: string
+  dscp?: string
+  running?: string
+  disabled?: string
+  comment?: string
+  "ipsec-secret"?: string
+}
+
+interface RosIpAddress {
+  ".id"?: string
+  address?: string
+  interface?: string
+  disabled?: string
+  network?: string
+}
+
+export interface LiveGreTunnel {
+  id: string
+  rosId: string
+  name: string
+  serverId: string
+  localAddress: string
+  remoteAddress: string
+  localInnerIp: string
+  remoteInnerIp: string
+  poolId: string
+  ipsec: { secret: string } | null
+  mtu: number
+  keepaliveInterval: number
+  keepaliveRetries: number
+  dscp: "inherit" | number
+  clampTcpMss: boolean
+  allowFastPath: boolean
+  comment: string
+  enabled: boolean
+  status: "up" | "down" | "degraded"
+}
+
+export function parseKeepalive(value: string | undefined): { interval: number; retries: number } {
+  if (!value || value.toLowerCase() === "none") return { interval: 0, retries: 0 }
+  const [intervalRaw, retriesRaw] = value.split(",")
+  const interval = Number.parseInt((intervalRaw ?? "").trim(), 10)
+  const retries = Number.parseInt((retriesRaw ?? "").trim(), 10)
+  return {
+    interval: Number.isFinite(interval) ? interval : 0,
+    retries: Number.isFinite(retries) ? retries : 0,
+  }
+}
+
+export function formatKeepalive(interval: number, retries: number): string {
+  if (!interval || interval <= 0) return "0"
+  return `${interval}s,${retries > 0 ? retries : 10}`
+}
+
+function parseDscp(value: string | undefined): "inherit" | number {
+  if (!value || value === "inherit") return "inherit"
+  const n = Number.parseInt(value, 10)
+  return Number.isFinite(n) ? n : "inherit"
+}
+
+function parseInnerFromComment(comment: string | undefined): { localInnerIp: string; remoteInnerIp: string } {
+  if (!comment) return { localInnerIp: "", remoteInnerIp: "" }
+  const local = comment.match(/address\s*=\s*([0-9.]+\/\d+)/)?.[1] ?? ""
+  const remote = comment.match(/(?:network|gateway)\s*=\s*([0-9.]+\/\d+)/)?.[1] ?? ""
+  return { localInnerIp: local, remoteInnerIp: remote }
+}
+
+function rosDisabled(v: string | undefined): boolean {
+  return v === "true" || v === "yes"
+}
+
+export function mapGreLive(
+  server: ServerRow,
+  greRaw: RosGre[],
+  addrsRaw: RosIpAddress[],
+): {
+  tunnels: LiveGreTunnel[]
+  snapshot: GreSnapshot
+  gre: GreLiveIface[]
+  addrs: GreLiveAddr[]
+} {
+  const addrsByIface = new Map<string, { address: string; rosId: string }[]>()
+  for (const a of addrsRaw) {
+    if (rosDisabled(a.disabled)) continue
+    const iface = (a.interface ?? "").trim()
+    const address = (a.address ?? "").trim()
+    const rosId = String(a[".id"] ?? "")
+    if (!iface || !address || !rosId) continue
+    const list = addrsByIface.get(iface) ?? []
+    list.push({ address, rosId })
+    addrsByIface.set(iface, list)
+  }
+
+  const gre: GreLiveIface[] = []
+  const addrs: GreLiveAddr[] = []
+  const tunnels: LiveGreTunnel[] = []
+
+  greRaw.forEach((g, idx) => {
+    const rosId = String(g[".id"] ?? g.name ?? `gre-${idx}`)
+    const name = (g.name ?? "").trim() || `gre-${idx + 1}`
+    const keepalive = parseKeepalive(g.keepalive)
+    const fromComment = parseInnerFromComment(g.comment)
+    const ifaceAddrs = addrsByIface.get(name) ?? []
+    const localInnerIp = ifaceAddrs[0]?.address || fromComment.localInnerIp
+    const secret = (g["ipsec-secret"] ?? "").trim()
+    const disabled = rosDisabled(g.disabled)
+    const running = g.running === "true" || g.running === "yes"
+
+    gre.push({
+      name,
+      rosId,
+      localAddress: g["local-address"] ?? "",
+      remoteAddress: g["remote-address"] ?? "",
+      comment: g.comment ?? "",
+      disabled,
+      mtu: Number.parseInt(g.mtu ?? "1476", 10) || 1476,
+      keepalive: g.keepalive ?? "0",
+      dscp: g.dscp ?? "inherit",
+      clampTcpMss: g["clamp-tcp-mss"] !== "false" && g["clamp-tcp-mss"] !== "no",
+      allowFastPath: g["allow-fast-path"] !== "false" && g["allow-fast-path"] !== "no",
+      ipsecSecret: secret,
+    })
+
+    for (const a of ifaceAddrs) {
+      addrs.push({ rosId: a.rosId, interfaceName: name, address: a.address })
+    }
+
+    tunnels.push({
+      id: rosId || `${server.id}:${name}`,
+      rosId,
+      name,
+      serverId: String(server.id),
+      localAddress: g["local-address"] ?? "",
+      remoteAddress: g["remote-address"] ?? "",
+      localInnerIp,
+      remoteInnerIp: fromComment.remoteInnerIp,
+      poolId: "live",
+      ipsec: secret ? { secret } : null,
+      mtu: Number.parseInt(g.mtu ?? "1476", 10) || 1476,
+      keepaliveInterval: keepalive.interval,
+      keepaliveRetries: keepalive.retries,
+      dscp: parseDscp(g.dscp),
+      clampTcpMss: g["clamp-tcp-mss"] !== "false" && g["clamp-tcp-mss"] !== "no",
+      allowFastPath: g["allow-fast-path"] !== "false" && g["allow-fast-path"] !== "no",
+      comment: g.comment ?? "",
+      enabled: !disabled,
+      status: disabled ? "down" : running ? "up" : "degraded",
+    })
+  })
+
+  return {
+    tunnels,
+    snapshot: canonicalGreSnapshot({
+      tunnels: gre.map((g) => ({
+        name: g.name,
+        localAddress: g.localAddress,
+        remoteAddress: g.remoteAddress,
+        localInnerIp: addrs.find((a) => a.interfaceName === g.name)?.address ?? "",
+        remoteInnerIp: "",
+        comment: g.comment,
+        disabled: g.disabled,
+        mtu: g.mtu,
+        keepalive: g.keepalive,
+        dscp: g.dscp,
+        clampTcpMss: g.clampTcpMss,
+        allowFastPath: g.allowFastPath,
+        ipsecSecret: g.ipsecSecret,
+      })),
+    }),
+    gre,
+    addrs,
+  }
+}
+
+export async function fetchGreState(server: ServerRow) {
+  const client = MikrotikClient.fromServer(server)
+  const [greRaw, addrsRaw] = await Promise.all([
+    client.get<RosGre[]>("/interface/gre"),
+    client.get<RosIpAddress[]>("/ip/address").catch(() => [] as RosIpAddress[]),
+  ])
+  return {
+    client,
+    ...mapGreLive(server, Array.isArray(greRaw) ? greRaw : [], Array.isArray(addrsRaw) ? addrsRaw : []),
+  }
+}
+
+export async function captureGreSnapshot(server: ServerRow): Promise<GreSnapshot> {
+  const state = await fetchGreState(server)
+  return state.snapshot
+}
+
+export async function listGreTunnels(opts?: { serverId?: string }): Promise<{
+  tunnels: LiveGreTunnel[]
+  failures: Array<{ serverId: string; serverName?: string; error: string }>
+}> {
+  let serverRows: ServerRow[]
+  if (opts?.serverId) {
+    const id = Number.parseInt(String(opts.serverId), 10)
+    if (!Number.isFinite(id)) {
+      return { tunnels: [], failures: [{ serverId: String(opts.serverId), error: "Некорректный serverId" }] }
+    }
+    const row = (await db.select().from(servers).where(eq(servers.id, id)).limit(1))[0]
+    serverRows = row ? [row] : []
+  } else {
+    serverRows = await db.select().from(servers).where(eq(servers.enabled, true))
+  }
+
+  const failures: Array<{ serverId: string; serverName?: string; error: string }> = []
+  const chunks = await Promise.all(
+    serverRows.map(async (server) => {
+      try {
+        const state = await fetchGreState(server)
+        await captureAndAppendRevision({
+          serverId: server.id,
+          section: "gre",
+          source: "observed",
+          capture: async () => state.snapshot,
+        })
+        return state.tunnels
+      } catch (e) {
+        failures.push({
+          serverId: String(server.id),
+          serverName: server.name ?? undefined,
+          error: e instanceof Error ? e.message : String(e),
+        })
+        return [] as LiveGreTunnel[]
+      }
+    }),
+  )
+  return { tunnels: chunks.flat(), failures }
+}

backend/src/services/ros-ops.ts

@@ -0,0 +1,32 @@
+import type { MikrotikClient } from "./mikrotik.js"
+import type { RosWriteOp } from "./entity-snapshots.js"
+
+function encodeIdSegment(path: string): string {
+  const i = path.lastIndexOf("/")
+  if (i < 0) return path
+  const last = path.slice(i + 1)
+  if (!last.startsWith("*")) return path
+  return `${path.slice(0, i + 1)}${encodeURIComponent(last)}`
+}
+
+export async function executeRosOps(client: MikrotikClient, ops: RosWriteOp[]): Promise<void> {
+  for (const op of ops) {
+    if (op.op === "put") {
+      await client.put(op.path, op.body)
+      continue
+    }
+    if (op.op === "post") {
+      await client.post(encodeIdSegment(op.path), op.body)
+      continue
+    }
+    if (op.op === "patch") {
+      await client.patch(encodeIdSegment(op.path), op.body)
+      continue
+    }
+    if (op.op === "delete") {
+      await client.delete(encodeIdSegment(op.path))
+      continue
+    }
+    await client.post(encodeIdSegment(op.path), op.body)
+  }
+}

backend/src/services/wireguard-live.ts

@@ -3,6 +3,13 @@ import { db } from "../db/index.js"
 import { servers } from "../db/schema.js"
 import { MikrotikClient } from "./mikrotik.js"
 import type { WgIfaceDto, WgPeerDto } from "@mmapp/contracts/wireguard"
+import {
+  canonicalWireguardSnapshot,
+  type WgLiveAddr,
+  type WgLiveIface,
+  type WgLivePeer,
+  type WgSnapshot,
+} from "./entity-snapshots.js"
 
 type ServerRow = typeof servers.$inferSelect
 
@@ -35,6 +42,7 @@ interface RosWireGuardPeer {
   "client-address"?: string
   "client-dns"?: string
   "client-endpoint"?: string
+  "private-key"?: string
 }
 
 interface RosIpAddress {
@@ -152,6 +160,85 @@ async function fetchForServer(
   })
 }
 
+export async function fetchWireguardRestoreState(server: ServerRow): Promise<{
+  client: MikrotikClient
+  ifaces: WgLiveIface[]
+  peers: WgLivePeer[]
+  addrs: WgLiveAddr[]
+  snapshot: WgSnapshot
+}> {
+  const client = MikrotikClient.fromServer(server)
+  const [ifacesRaw, peersRaw, addrsRaw] = await Promise.all([
+    client.get<RosWireGuard[]>("/interface/wireguard"),
+    client.get<RosWireGuardPeer[]>("/interface/wireguard/peers"),
+    client.get<RosIpAddress[]>("/ip/address").catch(() => [] as RosIpAddress[]),
+  ])
+
+  const ifaces: WgLiveIface[] = (Array.isArray(ifacesRaw) ? ifacesRaw : []).map((w) => ({
+    name: (w.name ?? "").trim(),
+    rosId: String(w[".id"] ?? w.name ?? ""),
+    listenPort: Number.parseInt(w["listen-port"] ?? "13231", 10) || 13231,
+    mtu: Number.parseInt(w.mtu ?? "1420", 10) || 1420,
+    privateKey: w["private-key"] ?? "",
+    comment: w.comment ?? "",
+    disabled: w.disabled === "true" || w.disabled === "yes",
+  }))
+
+  const peers: WgLivePeer[] = (Array.isArray(peersRaw) ? peersRaw : []).map((p, idx) => {
+    const mapped = mapPeer(p, idx)
+    const ep = (p["endpoint-address"] ?? "").trim()
+    const port = (p["endpoint-port"] ?? "").trim()
+    const ka = p["persistent-keepalive"] ? Number.parseInt(p["persistent-keepalive"], 10) : NaN
+    return {
+      rosId: mapped.rosId,
+      interfaceName: (p.interface ?? "").trim(),
+      publicKey: mapped.publicKey,
+      allowedAddresses: mapped.allowedIps,
+      endpointAddress: ep,
+      endpointPort: port,
+      persistentKeepalive: Number.isFinite(ka) ? ka : null,
+      comment: mapped.comment ?? "",
+      name: mapped.name ?? "",
+      disabled: mapped.disabled === true,
+      privateKey: p["private-key"] ?? "",
+      clientAddress: mapped.clientAddress ?? "",
+      clientDns: mapped.clientDns ?? "",
+      clientEndpoint: mapped.clientEndpoint ?? "",
+    }
+  })
+
+  const addrs: WgLiveAddr[] = []
+  for (const a of Array.isArray(addrsRaw) ? addrsRaw : []) {
+    if (a.disabled === "true" || a.disabled === "yes") continue
+    const iface = (a.interface ?? "").trim()
+    const address = (a.address ?? "").trim()
+    const rosId = String(a[".id"] ?? "")
+    if (!iface || !address || !rosId) continue
+    if (!ifaces.some((i) => i.name === iface)) continue
+    addrs.push({ rosId, interfaceName: iface, address })
+  }
+
+  const snapshot = canonicalWireguardSnapshot({
+    interfaces: ifaces.map((iface) => ({
+      name: iface.name,
+      listenPort: iface.listenPort,
+      mtu: iface.mtu,
+      privateKey: iface.privateKey,
+      address: addrs.find((a) => a.interfaceName === iface.name)?.address ?? "",
+      comment: iface.comment,
+      disabled: iface.disabled,
+      peers: peers.filter((p) => p.interfaceName === iface.name),
+    })),
+  })
+
+  return { client, ifaces, peers, addrs, snapshot }
+}
+
+export async function captureWireguardSnapshot(server: ServerRow): Promise<WgSnapshot> {
+  const state = await fetchWireguardRestoreState(server)
+  return state.snapshot
+}
+
 export type WgListResult = {
   interfaces: WgIfaceDto[]
   failures: Array<{ serverId: string; serverName?: string; error: string }>

components/config-history-sheet.tsx

@@ -0,0 +1,185 @@
+"use client"
+
+import { useMemo, useState, type ComponentProps } from "react"
+import { HistoryIcon, LoaderCircleIcon, RotateCcwIcon } from "lucide-react"
+import {
+  Sheet,
+  SheetContent,
+  SheetDescription,
+  SheetHeader,
+  SheetTitle,
+} from "@/components/ui/sheet"
+import {
+  AlertDialog,
+  AlertDialogAction,
+  AlertDialogCancel,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogFooter,
+  AlertDialogHeader,
+  AlertDialogMedia,
+  AlertDialogTitle,
+} from "@/components/ui/alert-dialog"
+import { Button } from "@/components/ui/button"
+import { Badge } from "@/components/reui/badge"
+import { Frame, FramePanel } from "@/components/reui/frame"
+import {
+  Timeline,
+  TimelineContent,
+  TimelineDate,
+  TimelineHeader,
+  TimelineIndicator,
+  TimelineItem,
+  TimelineSeparator,
+  TimelineTitle,
+} from "@/components/reui/timeline"
+import { EmptyState } from "@/components/empty-state"
+import { Alert, AlertDescription, AlertTitle } from "@/components/reui/alert"
+import { TriangleAlertIcon } from "lucide-react"
+import type { ConfigRevisionDto } from "@/lib/config-revisions"
+
+const SOURCE_LABEL: Record<ConfigRevisionDto["source"], string> = {
+  apply: "Изменение",
+  rollback: "Откат",
+  observed: "С роутера",
+  copy: "Копирование",
+}
+
+const SOURCE_BADGE: Record<ConfigRevisionDto["source"], ComponentProps<typeof Badge>["variant"]> = {
+  apply: "primary-light",
+  rollback: "warning-light",
+  observed: "secondary",
+  copy: "success-light",
+}
+
+function formatWhen(iso: string): string {
+  const d = new Date(iso)
+  if (Number.isNaN(d.getTime())) return iso
+  return d.toLocaleString("ru-RU", { dateStyle: "short", timeStyle: "short" })
+}
+
+export function ConfigHistorySheet({
+  open,
+  onOpenChange,
+  title,
+  itemLabel,
+  revisions,
+  loading,
+  restoring,
+  onRestore,
+}: {
+  open: boolean
+  onOpenChange: (open: boolean) => void
+  title: string
+  itemLabel: string
+  revisions: ConfigRevisionDto[]
+  loading: boolean
+  restoring: boolean
+  onRestore: (id: string) => Promise<void> | void
+}) {
+  const [pending, setPending] = useState<ConfigRevisionDto | null>(null)
+  const newestFirst = useMemo(() => revisions, [revisions])
+
+  return (
+    <>
+      <Sheet open={open} onOpenChange={onOpenChange}>
+        <SheetContent side="right" className="w-full sm:max-w-md flex flex-col gap-0 p-0">
+          <SheetHeader className="px-6 pt-6 pb-4 border-b shrink-0">
+            <SheetTitle>{title}</SheetTitle>
+            <SheetDescription>
+              Снапшоты managed-объектов. Откат применяет выбранную версию на CHR.
+            </SheetDescription>
+          </SheetHeader>
+          <div className="flex-1 min-h-0 overflow-y-auto px-6 py-5">
+            {loading ? (
+              <div className="flex items-center justify-center gap-2 py-16 text-sm text-muted-foreground">
+                <LoaderCircleIcon className="size-4 animate-spin" />
+                Загрузка истории…
+              </div>
+            ) : newestFirst.length === 0 ? (
+              <EmptyState
+                icon={<HistoryIcon className="size-4" />}
+                title="Истории пока нет"
+                description="Снапшот появится после первого чтения или изменения на роутере"
+                className="py-12"
+              />
+            ) : (
+              <Frame>
+                <FramePanel>
+                  <Timeline value={newestFirst.length} className="px-1">
+                    {newestFirst.map((rev, idx) => (
+                      <TimelineItem key={rev.id} step={newestFirst.length - idx}>
+                        <TimelineHeader>
+                          <TimelineDate dateTime={rev.createdAt}>{formatWhen(rev.createdAt)}</TimelineDate>
+                          <TimelineTitle className="flex items-center gap-2 flex-wrap">
+                            <Badge variant={SOURCE_BADGE[rev.source]} size="sm">
+                              {SOURCE_LABEL[rev.source]}
+                            </Badge>
+                            <span className="text-muted-foreground font-normal tabular-nums">
+                              {rev.itemCount} {itemLabel}
+                            </span>
+                          </TimelineTitle>
+                        </TimelineHeader>
+                        <TimelineIndicator />
+                        <TimelineSeparator />
+                        <TimelineContent>
+                          <Button
+                            type="button"
+                            variant="outline"
+                            size="sm"
+                            disabled={restoring}
+                            onClick={() => setPending(rev)}
+                          >
+                            <RotateCcwIcon className="size-3.5" />
+                            Откатить
+                          </Button>
+                        </TimelineContent>
+                      </TimelineItem>
+                    ))}
+                  </Timeline>
+                </FramePanel>
+              </Frame>
+            )}
+          </div>
+        </SheetContent>
+      </Sheet>
+
+      <AlertDialog open={Boolean(pending)} onOpenChange={(v) => { if (!v && !restoring) setPending(null) }}>
+        <AlertDialogContent>
+          <AlertDialogHeader>
+            <AlertDialogMedia className="bg-warning/10 text-warning">
+              <TriangleAlertIcon />
+            </AlertDialogMedia>
+            <AlertDialogTitle>Откатить на эту версию?</AlertDialogTitle>
+            <AlertDialogDescription className="flex flex-col gap-3">
+              <span>
+                На CHR будут применены {pending?.itemCount ?? 0} {itemLabel} от{" "}
+                {pending ? formatWhen(pending.createdAt) : ""}.
+              </span>
+              <Alert variant="warning">
+                <TriangleAlertIcon />
+                <AlertTitle>Изменятся только объекты MikrotikManager</AlertTitle>
+                <AlertDescription>
+                  Чужие правила и маршруты на роутере не удаляются.
+                </AlertDescription>
+              </Alert>
+            </AlertDialogDescription>
+          </AlertDialogHeader>
+          <AlertDialogFooter>
+            <AlertDialogCancel disabled={restoring} onClick={() => setPending(null)}>Отмена</AlertDialogCancel>
+            <AlertDialogAction
+              disabled={restoring || !pending}
+              onClick={() => {
+                if (!pending) return
+                void Promise.resolve(onRestore(pending.id)).finally(() => setPending(null))
+              }}
+            >
+              {restoring ? <LoaderCircleIcon className="size-4 animate-spin" /> : null}
+              Откатить
+            </AlertDialogAction>
+          </AlertDialogFooter>
+        </AlertDialogContent>
+      </AlertDialog>
+    </>
+  )
+}

components/data-grids/filters-data-grid.tsx

@@ -11,7 +11,6 @@ import type { FilterRule, GreTunnel, Server } from "@/lib/data"
 import { Flag } from "@/components/flag"
 import { cn } from "@/lib/utils"
 import { Button } from "@/components/ui/button"
-import { Tooltip, TooltipContent, TooltipTrigger } from "@/components/ui/tooltip"
 import { DataGridShell } from "@/components/data-grids/shared/data-grid-shell"
 import {
   DATA_GRID_CELL_PAD,
@@ -22,21 +21,15 @@ import { DataGridSortHeader } from "@/components/data-grids/shared/data-grid-sor
 import { EmptyState } from "@/components/empty-state"
 import {
   AlertCircleIcon,
-  AlertTriangleIcon,
-  CheckCircle2Icon,
   ChevronDownIcon,
   ChevronUpIcon,
-  CircleDashedIcon,
   PencilIcon,
   RouteIcon,
   StarIcon,
   TrashIcon,
-  XCircleIcon,
   FilterIcon,
 } from "lucide-react"
 
-export type FilterRouterSyncStatus = "synced" | "drift" | "missing"
-
 export interface RecursiveRouteLite {
   id: string
   dstAddress: string
@@ -47,42 +40,6 @@ export interface RecursiveRouteLite {
   disabled: boolean
 }
 
-function RouterSyncMarker({
-  status,
-}: {
-  status: FilterRouterSyncStatus | null | "skip"
-}) {
-  if (status === "skip") {
-    return <span className="size-3.5 shrink-0 block" aria-hidden />
-  }
-  const icon =
-    status === "synced"
-      ? <CheckCircle2Icon className="size-3.5 text-emerald-600 dark:text-emerald-500 shrink-0" />
-      : status === "drift"
-        ? <AlertTriangleIcon className="size-3.5 text-amber-500 shrink-0" />
-        : status === "missing"
-          ? <XCircleIcon className="size-3.5 text-destructive shrink-0" />
-          : <CircleDashedIcon className="size-3.5 text-muted-foreground/35 shrink-0" />
-  const title =
-    status === "synced"
-      ? "Совпадает с цепочкой bgp-in на MikroTik"
-      : status === "drift"
-        ? "В БД и на роутере разное действие (gateway, blackhole или out-interface)"
-        : status === "missing"
-          ? "Эта community не найдена в правиле bgp-in на роутере"
-          : "Не проверено — нажмите «Сверить с роутером»"
-  return (
-    <Tooltip>
-      <TooltipTrigger className="inline-flex cursor-default border-0 bg-transparent p-0">
-        {icon}
-      </TooltipTrigger>
-      <TooltipContent side="top" className="max-w-xs">
-        {title}
-      </TooltipContent>
-    </Tooltip>
-  )
-}
-
 function innerIpToGateway(ip: string) {
   return ip.split("/")[0]
 }
@@ -234,8 +191,6 @@ interface FiltersDataGridProps {
   serversList: Server[]
   communityNameMap: Record<string, string>
   recursiveRoutes: RecursiveRouteLite[]
-  routerSyncByCommunity?: Record<string, FilterRouterSyncStatus> | null
-  isLive?: boolean
   enableSorting?: boolean
   onEdit: (rule: FilterRule) => void
   onDelete: (id: string) => void
@@ -249,8 +204,6 @@ function FiltersDataGrid({
   serversList,
   communityNameMap,
   recursiveRoutes,
-  routerSyncByCommunity,
-  isLive,
   enableSorting = false,
   onEdit,
   onDelete,
@@ -308,33 +261,6 @@ function FiltersDataGrid({
         size: 28,
         meta: { headerClassName: DATA_GRID_CELL_PAD, cellClassName: DATA_GRID_CELL_PAD },
       },
-      {
-        id: "routerSync",
-        header: () => (
-          <Tooltip>
-            <TooltipTrigger className="cursor-help font-mono text-xs text-muted-foreground border-0 bg-transparent p-0">
-              MT
-            </TooltipTrigger>
-            <TooltipContent side="top" className="max-w-xs">
-              Совпадение с MikroTik (bgp-in)
-            </TooltipContent>
-          </Tooltip>
-        ),
-        enableSorting: false,
-        cell: ({ row }) => (
-          <RouterSyncMarker
-            status={
-              !isLive
-                ? "skip"
-                : !routerSyncByCommunity
-                  ? null
-                  : routerSyncByCommunity[row.original.community.trim()] ?? null
-            }
-          />
-        ),
-        size: 32,
-        meta: { headerClassName: DATA_GRID_CELL_PAD, cellClassName: DATA_GRID_CELL_PAD },
-      },
       {
         id: "community",
         accessorKey: "community",
@@ -413,13 +339,11 @@ function FiltersDataGrid({
     [
       communityNameMap,
       enableSorting,
-      isLive,
       onDelete,
       onEdit,
       onMoveDown,
       onMoveUp,
       recursiveRoutes,
-      routerSyncByCommunity,
       serversList,
       tunnelsList,
     ],
@@ -454,4 +378,4 @@ function FiltersDataGrid({
   )
 }
 
-export { FiltersDataGrid, RouterSyncMarker, type FiltersDataGridProps }
+export { FiltersDataGrid, type FiltersDataGridProps }

components/data-grids/gre-tunnels-data-grid.tsx

@@ -101,6 +101,10 @@ interface GreTunnelsDataGridProps {
   servers: Server[]
   pools: GrePool[]
   onCodePreview: (tunnel: GreTunnel) => void
+  onEdit?: (tunnel: GreTunnel) => void
+  onToggle?: (tunnel: GreTunnel) => void
+  onDelete?: (tunnel: GreTunnel) => void
+  mutationsLocked?: boolean
 }
 
 function GreTunnelsDataGrid({
@@ -108,6 +112,10 @@ function GreTunnelsDataGrid({
   servers,
   pools,
   onCodePreview,
+  onEdit,
+  onToggle,
+  onDelete,
+  mutationsLocked = false,
 }: GreTunnelsDataGridProps) {
   const serverMap = useMemo(() => new Map(servers.map((s) => [s.id, s])), [servers])
   const poolMap = useMemo(() => new Map(pools.map((p) => [p.id, p])), [pools])
@@ -297,16 +305,20 @@ function GreTunnelsDataGrid({
                   <DropdownMenuItem onClick={() => onCodePreview(t)}>
                     <CodeXmlIcon className="size-4" /> Просмотр кода
                   </DropdownMenuItem>
-                  <DropdownMenuItem>
+                  <DropdownMenuItem disabled={mutationsLocked || !onEdit} onClick={() => onEdit?.(t)}>
                     <PencilIcon className="size-4" /> Редактировать
                   </DropdownMenuItem>
                   <DropdownMenuSeparator />
-                  <DropdownMenuItem>
+                  <DropdownMenuItem disabled={mutationsLocked || !onToggle} onClick={() => onToggle?.(t)}>
                     <PowerIcon className="size-4" />
                     {t.enabled ? "Выключить" : "Включить"}
                   </DropdownMenuItem>
                   <DropdownMenuSeparator />
-                  <DropdownMenuItem variant="destructive">
+                  <DropdownMenuItem
+                    variant="destructive"
+                    disabled={mutationsLocked || !onDelete}
+                    onClick={() => onDelete?.(t)}
+                  >
                     <Trash2Icon className="size-4" /> Удалить туннель
                   </DropdownMenuItem>
                 </DropdownMenuContent>
@@ -318,7 +330,7 @@ function GreTunnelsDataGrid({
         meta: { headerClassName: DATA_GRID_CELL_PAD_LAST, cellClassName: DATA_GRID_CELL_PAD_LAST },
       },
     ],
-    [onCodePreview, poolMap, serverMap],
+    [onCodePreview, onEdit, onToggle, onDelete, mutationsLocked, poolMap, serverMap],
   )
 
   const table = useReactTable({

lib/config-revisions.ts

@@ -0,0 +1,12 @@
+export type ConfigRevisionSource = "apply" | "rollback" | "observed" | "copy"
+
+export interface ConfigRevisionDto {
+  id: string
+  serverId: string
+  section: "filters" | "recursive-routes" | "firewall" | "wireguard" | "gre"
+  source: ConfigRevisionSource
+  fingerprint: string
+  createdAt: string
+  note: string | null
+  itemCount: number
+}