feat(health-checks): enhance health check functionality and add new routes

- Introduced origin health check routes and integrated them into the application. - Updated health check configuration to include success recovery thresholds. - Expanded error handling with new error codes for health check failures. - Added new service routes for managing health checks, including creation and listing. - Improved health check service logic to track consecutive successes and failures. This commit enhances the health check capabilities, providing better monitoring and management of service health.
2026-08-19 12:26:12 +07:00
parent 9c00b268dc
commit 3f6f402872
64 changed files with 6356 additions and 360 deletions
@@ -24,6 +24,7 @@ import { dnsRoutes } from "./routes/dns.js";
 import { subdomainRoutes } from "./routes/subdomains.js";
 import { certificateRoutes } from "./routes/certificates.js";
 import { syncRoutes } from "./routes/sync.js";
+import { originHealthCheckRoutes } from "./routes/origin-health-checks.js";
 import { healthCheckRoutes } from "./routes/health-check.js";
 import {
  domainMonitorRoutes,
@@ -81,6 +82,7 @@ export async function buildApp(opts: BuildAppOptions = {}) {
      await protectedApi.register(certificateRoutes);
      await protectedApi.register(syncRoutes);
      await protectedApi.register(healthCheckRoutes);
+      await protectedApi.register(originHealthCheckRoutes);
      await protectedApi.register(domainMonitorRoutes);
      await protectedApi.register(notificationRoutes);
      await protectedApi.register(settingsRoutes);
@@ -130,6 +132,7 @@ export async function buildApp(opts: BuildAppOptions = {}) {
          degradedFailures: config.healthDegradedFailures,
          downFailures: config.healthDownFailures,
          latencyWarnMs: config.healthLatencyWarnMs,
+          successRecoveries: config.healthSuccessRecoveries,
        };
        const n = await healthCheckService.runAllChecks(app.db, {
          thresholds,
@@ -13,6 +13,7 @@ export interface AppConfig {
  healthCheckCron: string;
  healthDegradedFailures: number;
  healthDownFailures: number;
+  healthSuccessRecoveries: number;
  healthLatencyWarnMs: number;
  /** Min pause between probes to different physical targets (same IP is probed once). */
  healthProbeGapMs: number;
@@ -55,6 +56,8 @@ export function loadConfig(): AppConfig {
    healthDegradedFailures:
      Number(process.env.HEALTH_DEGRADED_FAILURES ?? "1") || 1,
    healthDownFailures: Number(process.env.HEALTH_DOWN_FAILURES ?? "2") || 2,
+    healthSuccessRecoveries:
+      Number(process.env.HEALTH_SUCCESS_RECOVERIES ?? "2") || 2,
    healthLatencyWarnMs:
      Number(process.env.HEALTH_LATENCY_WARN_MS ?? "1000") || 1000,
    healthProbeGapMs: Number(process.env.HEALTH_PROBE_GAP_MS ?? "2000") || 2000,
@@ -8,6 +8,14 @@ export type ErrorCode =
  | "FORBIDDEN"
  | "CONFLICT"
  | "CLOUDFLARE_ERROR"
+  | "DNS_UPDATE_FAILED"
+  | "HEALTHCHECK_CREATE_FAILED"
+  | "ZONE_NOT_FOUND"
+  | "INVALID_IP"
+  | "INVALID_HOSTNAME"
+  | "RATE_LIMITED"
+  | "CLOUDFLARE_AUTH_FAILED"
+  | "SYNC_FAILED"
  | "INTERNAL_ERROR";

 export class AppError extends Error {
@@ -44,6 +52,42 @@ export class AppError extends Error {
    return new AppError("CLOUDFLARE_ERROR", message, 502);
  }

+  static dnsUpdateFailed(message: string) {
+    return new AppError(
+      "DNS_UPDATE_FAILED",
+      message,
+      502,
+    );
+  }
+
+  static healthcheckCreateFailed(message: string) {
+    return new AppError("HEALTHCHECK_CREATE_FAILED", message, 502);
+  }
+
+  static zoneNotFound(message = "зона Cloudflare не найдена") {
+    return new AppError("ZONE_NOT_FOUND", message, 404);
+  }
+
+  static invalidIp(message = "Некорректный IP-адрес") {
+    return new AppError("INVALID_IP", message, 400);
+  }
+
+  static invalidHostname(message = "Некорректное имя хоста") {
+    return new AppError("INVALID_HOSTNAME", message, 400);
+  }
+
+  static rateLimited(message = "Cloudflare временно ограничил запросы. Повторите попытку.") {
+    return new AppError("RATE_LIMITED", message, 429);
+  }
+
+  static cloudflareAuthFailed(message = "Cloudflare отклонил токен доступа") {
+    return new AppError("CLOUDFLARE_AUTH_FAILED", message, 401);
+  }
+
+  static syncFailed(message: string) {
+    return new AppError("SYNC_FAILED", message, 502);
+  }
+
  static internal(message: string) {
    return new AppError("INTERNAL_ERROR", message, 500);
  }
@@ -1,152 +1,84 @@
 import type {
  CfDnsRecord,
+  CfHealthCheck,
  CfZone,
  CreateDnsRecordPayload,
+  PatchDnsRecordPayload,
 } from "@cfdm/shared";
-import { AppError } from "../errors.js";
-import { withRetry, parseRetryAfter } from "./cf-retry.js";
+import { createDnsAdapter } from "./cloudflare/dns-service.js";
+import { createHealthCheckAdapter, type CfHealthCheckPayload } from "./cloudflare/healthcheck-service.js";
+import { createZoneAdapter } from "./cloudflare/zone-service.js";

-const BASE_URL = "https://api.cloudflare.com/client/v4";
-
-interface CfResponse<T> {
-  success: boolean;
-  result?: T;
-  errors?: Array<{ code: number; message: string }>;
-}
+export type { CfHealthCheckPayload };

 export class CloudflareClient {
-  constructor(private readonly token: string) {}
+  private readonly zones;
+  private readonly dns;
+  private readonly healthchecks;

-  private async handleResponse<T>(
-    response: Response,
-    operation: string,
-  ): Promise<T> {
-    if (response.status === 429) {
-      const wait = parseRetryAfter(response.headers) ?? 5000;
-      throw AppError.cloudflare(`rate limited, retry after ${wait}ms`);
-    }
-
-    const body = (await response.json()) as CfResponse<T>;
-    if (!body.success) {
-      const msg =
-        body.errors?.map((e) => e.message).join("; ") ??
-        "unknown cloudflare error";
-      throw AppError.cloudflare(`${operation}: ${msg}`);
-    }
-    if (body.result === undefined) {
-      throw AppError.cloudflare(`${operation}: empty result`);
-    }
-    return body.result;
+  constructor(token: string) {
+    this.zones = createZoneAdapter(token);
+    this.dns = createDnsAdapter(token);
+    this.healthchecks = createHealthCheckAdapter(token);
  }

-  async listZones(): Promise<CfZone[]> {
-    return withRetry(async () => {
-      const all: CfZone[] = [];
-      let page = 1;
-      while (true) {
-        const url = new URL(`${BASE_URL}/zones`);
-        url.searchParams.set("per_page", "50");
-        url.searchParams.set("page", String(page));
-        const response = await fetch(url, {
-          headers: { Authorization: `Bearer ${this.token}` },
-          signal: AbortSignal.timeout(30_000),
-        });
-        if (response.status >= 500 || response.status === 429) {
-          throw AppError.cloudflare(String(response.status));
-        }
-        const batch = await this.handleResponse<CfZone[]>(
-          response,
-          "list_zones",
-        );
-        if (batch.length === 0) break;
-        all.push(...batch);
-        if (batch.length < 50) break;
-        page += 1;
-      }
-      return all;
-    });
+  listZones(): Promise<CfZone[]> {
+    return this.zones.listZones();
  }

-  async getZone(zoneId: string): Promise<CfZone> {
-    const response = await fetch(`${BASE_URL}/zones/${zoneId}`, {
-      headers: { Authorization: `Bearer ${this.token}` },
-      signal: AbortSignal.timeout(30_000),
-    });
-    return this.handleResponse(response, "get_zone");
+  getZone(zoneId: string): Promise<CfZone> {
+    return this.zones.getZone(zoneId);
  }

-  async listDnsRecords(zoneId: string): Promise<CfDnsRecord[]> {
-    return withRetry(async () => {
-      const all: CfDnsRecord[] = [];
-      let page = 1;
-      while (page <= 50) {
-        const url = new URL(`${BASE_URL}/zones/${zoneId}/dns_records`);
-        url.searchParams.set("per_page", "100");
-        url.searchParams.set("page", String(page));
-        const response = await fetch(url, {
-          headers: { Authorization: `Bearer ${this.token}` },
-          signal: AbortSignal.timeout(30_000),
-        });
-        if (response.status >= 500 || response.status === 429) {
-          throw AppError.cloudflare(String(response.status));
-        }
-        const batch = await this.handleResponse<CfDnsRecord[]>(
-          response,
-          "list_dns_records",
-        );
-        if (batch.length === 0) break;
-        all.push(...batch);
-        page += 1;
-      }
-      return all;
-    });
+  listDnsRecords(zoneId: string): Promise<CfDnsRecord[]> {
+    return this.dns.listDnsRecords(zoneId);
  }

-  async createDnsRecord(
-    zoneId: string,
-    payload: CreateDnsRecordPayload,
-  ): Promise<CfDnsRecord> {
-    const response = await fetch(`${BASE_URL}/zones/${zoneId}/dns_records`, {
-      method: "POST",
-      headers: {
-        Authorization: `Bearer ${this.token}`,
-        "Content-Type": "application/json",
-      },
-      body: JSON.stringify(payload),
-      signal: AbortSignal.timeout(30_000),
-    });
-    return this.handleResponse(response, "create_dns_record");
+  createDnsRecord(zoneId: string, payload: CreateDnsRecordPayload): Promise<CfDnsRecord> {
+    return this.dns.createDnsRecord(zoneId, payload);
  }

-  async updateDnsRecord(
+  updateDnsRecord(
    zoneId: string,
    recordId: string,
    payload: CreateDnsRecordPayload,
  ): Promise<CfDnsRecord> {
-    const response = await fetch(
-      `${BASE_URL}/zones/${zoneId}/dns_records/${recordId}`,
-      {
-        method: "PUT",
-        headers: {
-          Authorization: `Bearer ${this.token}`,
-          "Content-Type": "application/json",
-        },
-        body: JSON.stringify(payload),
-        signal: AbortSignal.timeout(30_000),
-      },
-    );
-    return this.handleResponse(response, "update_dns_record");
+    return this.dns.updateDnsRecord(zoneId, recordId, payload);
  }

-  async deleteDnsRecord(zoneId: string, recordId: string): Promise<void> {
-    const response = await fetch(
-      `${BASE_URL}/zones/${zoneId}/dns_records/${recordId}`,
-      {
-        method: "DELETE",
-        headers: { Authorization: `Bearer ${this.token}` },
-        signal: AbortSignal.timeout(30_000),
-      },
-    );
-    await this.handleResponse(response, "delete_dns_record");
+  patchDnsRecord(
+    zoneId: string,
+    recordId: string,
+    payload: PatchDnsRecordPayload,
+  ): Promise<CfDnsRecord> {
+    return this.dns.patchDnsRecord(zoneId, recordId, payload);
+  }
+
+  deleteDnsRecord(zoneId: string, recordId: string): Promise<void> {
+    return this.dns.deleteDnsRecord(zoneId, recordId);
+  }
+
+  listHealthChecks(zoneId: string): Promise<CfHealthCheck[]> {
+    return this.healthchecks.listHealthChecks(zoneId);
+  }
+
+  getHealthCheck(zoneId: string, id: string): Promise<CfHealthCheck> {
+    return this.healthchecks.getHealthCheck(zoneId, id);
+  }
+
+  createHealthCheck(zoneId: string, payload: CfHealthCheckPayload): Promise<CfHealthCheck> {
+    return this.healthchecks.createHealthCheck(zoneId, payload);
+  }
+
+  updateHealthCheck(
+    zoneId: string,
+    id: string,
+    payload: CfHealthCheckPayload,
+  ): Promise<CfHealthCheck> {
+    return this.healthchecks.updateHealthCheck(zoneId, id, payload);
+  }
+
+  deleteHealthCheck(zoneId: string, id: string): Promise<void> {
+    return this.healthchecks.deleteHealthCheck(zoneId, id);
  }
 }
@@ -0,0 +1,106 @@
+import type { CfDnsRecord, CreateDnsRecordPayload, PatchDnsRecordPayload } from "@cfdm/shared";
+import { withRetry } from "../cf-retry.js";
+import { CF_API_BASE, handleCfResponse, mapCloudflareFailure } from "./http.js";
+
+export function createDnsAdapter(token: string) {
+  return {
+    async listDnsRecords(zoneId: string): Promise<CfDnsRecord[]> {
+      return withRetry(async () => {
+        const all: CfDnsRecord[] = [];
+        let page = 1;
+        while (page <= 50) {
+          const url = new URL(`${CF_API_BASE}/zones/${zoneId}/dns_records`);
+          url.searchParams.set("per_page", "100");
+          url.searchParams.set("page", String(page));
+          const response = await fetch(url, {
+            headers: { Authorization: `Bearer ${token}` },
+            signal: AbortSignal.timeout(30_000),
+          });
+          if (response.status >= 500 || response.status === 429) {
+            throw mapCloudflareFailure(
+              "list_dns_records",
+              response.status,
+              String(response.status),
+            );
+          }
+          const batch = await handleCfResponse<CfDnsRecord[]>(
+            response,
+            "list_dns_records",
+          );
+          if (batch.length === 0) break;
+          all.push(...batch);
+          page += 1;
+        }
+        return all;
+      });
+    },
+
+    async createDnsRecord(
+      zoneId: string,
+      payload: CreateDnsRecordPayload,
+    ): Promise<CfDnsRecord> {
+      const response = await fetch(`${CF_API_BASE}/zones/${zoneId}/dns_records`, {
+        method: "POST",
+        headers: {
+          Authorization: `Bearer ${token}`,
+          "Content-Type": "application/json",
+        },
+        body: JSON.stringify(payload),
+        signal: AbortSignal.timeout(30_000),
+      });
+      return handleCfResponse(response, "create_dns_record");
+    },
+
+    async updateDnsRecord(
+      zoneId: string,
+      recordId: string,
+      payload: CreateDnsRecordPayload,
+    ): Promise<CfDnsRecord> {
+      const response = await fetch(
+        `${CF_API_BASE}/zones/${zoneId}/dns_records/${recordId}`,
+        {
+          method: "PUT",
+          headers: {
+            Authorization: `Bearer ${token}`,
+            "Content-Type": "application/json",
+          },
+          body: JSON.stringify(payload),
+          signal: AbortSignal.timeout(30_000),
+        },
+      );
+      return handleCfResponse(response, "update_dns_record");
+    },
+
+    async patchDnsRecord(
+      zoneId: string,
+      recordId: string,
+      payload: PatchDnsRecordPayload,
+    ): Promise<CfDnsRecord> {
+      const response = await fetch(
+        `${CF_API_BASE}/zones/${zoneId}/dns_records/${recordId}`,
+        {
+          method: "PATCH",
+          headers: {
+            Authorization: `Bearer ${token}`,
+            "Content-Type": "application/json",
+          },
+          body: JSON.stringify(payload),
+          signal: AbortSignal.timeout(30_000),
+        },
+      );
+      return handleCfResponse(response, "patch_dns_record");
+    },
+
+    async deleteDnsRecord(zoneId: string, recordId: string): Promise<void> {
+      const response = await fetch(
+        `${CF_API_BASE}/zones/${zoneId}/dns_records/${recordId}`,
+        {
+          method: "DELETE",
+          headers: { Authorization: `Bearer ${token}` },
+          signal: AbortSignal.timeout(30_000),
+        },
+      );
+      await handleCfResponse(response, "delete_dns_record");
+    },
+  };
+}
@@ -0,0 +1,110 @@
+import type { CfHealthCheck } from "@cfdm/shared";
+import { CF_API_BASE, handleCfResponse } from "./http.js";
+
+export interface CfHealthCheckHttpConfig {
+  method?: string;
+  path?: string;
+  expected_codes?: string[];
+  header?: Record<string, string[]>;
+  port?: number;
+  follow_redirects?: boolean;
+  allow_insecure?: boolean;
+}
+
+export interface CfHealthCheckTcpConfig {
+  method?: "connection_established";
+  port?: number;
+}
+
+export interface CfHealthCheckPayload {
+  address: string;
+  name: string;
+  type?: "HTTP" | "HTTPS" | "TCP";
+  description?: string;
+  interval?: number;
+  timeout?: number;
+  retries?: number;
+  consecutive_fails?: number;
+  consecutive_successes?: number;
+  suspended?: boolean;
+  check_regions?: string[];
+  http_config?: CfHealthCheckHttpConfig;
+  tcp_config?: CfHealthCheckTcpConfig;
+}
+
+export function createHealthCheckAdapter(token: string) {
+  return {
+    async listHealthChecks(zoneId: string): Promise<CfHealthCheck[]> {
+      const response = await fetch(
+        `${CF_API_BASE}/zones/${zoneId}/healthchecks`,
+        {
+          headers: { Authorization: `Bearer ${token}` },
+          signal: AbortSignal.timeout(30_000),
+        },
+      );
+      return handleCfResponse(response, "list_healthchecks");
+    },
+
+    async getHealthCheck(zoneId: string, id: string): Promise<CfHealthCheck> {
+      const response = await fetch(
+        `${CF_API_BASE}/zones/${zoneId}/healthchecks/${id}`,
+        {
+          headers: { Authorization: `Bearer ${token}` },
+          signal: AbortSignal.timeout(30_000),
+        },
+      );
+      return handleCfResponse(response, "get_healthcheck");
+    },
+
+    async createHealthCheck(
+      zoneId: string,
+      payload: CfHealthCheckPayload,
+    ): Promise<CfHealthCheck> {
+      const response = await fetch(
+        `${CF_API_BASE}/zones/${zoneId}/healthchecks`,
+        {
+          method: "POST",
+          headers: {
+            Authorization: `Bearer ${token}`,
+            "Content-Type": "application/json",
+          },
+          body: JSON.stringify(payload),
+          signal: AbortSignal.timeout(30_000),
+        },
+      );
+      return handleCfResponse(response, "create_healthcheck");
+    },
+
+    async updateHealthCheck(
+      zoneId: string,
+      id: string,
+      payload: CfHealthCheckPayload,
+    ): Promise<CfHealthCheck> {
+      const response = await fetch(
+        `${CF_API_BASE}/zones/${zoneId}/healthchecks/${id}`,
+        {
+          method: "PUT",
+          headers: {
+            Authorization: `Bearer ${token}`,
+            "Content-Type": "application/json",
+          },
+          body: JSON.stringify(payload),
+          signal: AbortSignal.timeout(30_000),
+        },
+      );
+      return handleCfResponse(response, "update_healthcheck");
+    },
+
+    async deleteHealthCheck(zoneId: string, id: string): Promise<void> {
+      const response = await fetch(
+        `${CF_API_BASE}/zones/${zoneId}/healthchecks/${id}`,
+        {
+          method: "DELETE",
+          headers: { Authorization: `Bearer ${token}` },
+          signal: AbortSignal.timeout(30_000),
+        },
+      );
+      await handleCfResponse(response, "delete_healthcheck");
+    },
+  };
+}
@@ -0,0 +1,91 @@
+import type { CfDnsRecord } from "@cfdm/shared";
+import { AppError } from "../../errors.js";
+import { parseRetryAfter } from "../cf-retry.js";
+
+export const CF_API_BASE = "https://api.cloudflare.com/client/v4";
+
+export interface CfResponse<T> {
+  success: boolean;
+  result?: T;
+  errors?: Array<{ code: number; message: string }>;
+}
+
+export function mapCloudflareFailure(
+  operation: string,
+  status: number,
+  message: string,
+): AppError {
+  const lower = message.toLowerCase();
+  if (status === 401 || status === 403 || lower.includes("authentication")) {
+    return AppError.cloudflareAuthFailed(
+      "Cloudflare отклонил токен. Проверьте CLOUDFLARE_API_TOKEN.",
+    );
+  }
+  if (status === 429 || lower.includes("rate limit")) {
+    return AppError.rateLimited();
+  }
+  if (lower.includes("zone") && (lower.includes("not found") || status === 404)) {
+    return AppError.zoneNotFound();
+  }
+  if (
+    operation.includes("healthcheck") &&
+    (lower.includes("plan") ||
+      lower.includes("not entitled") ||
+      lower.includes("not allowed") ||
+      lower.includes("permission"))
+  ) {
+    return AppError.healthcheckCreateFailed(
+      "Cloudflare Health Checks недоступны для этой зоны. Используйте локальные проверки.",
+    );
+  }
+  if (operation.includes("dns") || operation.includes("dns_record")) {
+    return AppError.dnsUpdateFailed(`Не удалось обновить DNS в Cloudflare: ${message}`);
+  }
+  return AppError.cloudflare(`${operation}: ${message}`);
+}
+
+export async function handleCfResponse<T>(
+  response: Response,
+  operation: string,
+): Promise<T> {
+  if (response.status === 429) {
+    const wait = parseRetryAfter(response.headers) ?? 5000;
+    throw AppError.rateLimited(
+      `Cloudflare временно ограничил запросы. Повторите через ${Math.ceil(wait / 1000)} с.`,
+    );
+  }
+
+  const body = (await response.json()) as CfResponse<T>;
+  if (!body.success) {
+    const msg =
+      body.errors?.map((e) => e.message).join("; ") ?? "unknown cloudflare error";
+    throw mapCloudflareFailure(operation, response.status, msg);
+  }
+  if (body.result === undefined) {
+    throw mapCloudflareFailure(operation, response.status, "empty result");
+  }
+  return body.result;
+}
+
+export async function cfRequest<T>(
+  token: string,
+  path: string,
+  operation: string,
+  init: RequestInit = {},
+): Promise<T> {
+  const response = await fetch(`${CF_API_BASE}${path}`, {
+    ...init,
+    headers: {
+      Authorization: `Bearer ${token}`,
+      ...(init.body ? { "Content-Type": "application/json" } : {}),
+      ...init.headers,
+    },
+    signal: init.signal ?? AbortSignal.timeout(30_000),
+  });
+  if (response.status >= 500 || response.status === 429) {
+    throw mapCloudflareFailure(operation, response.status, String(response.status));
+  }
+  return handleCfResponse<T>(response, operation);
+}
+
+export type DnsRecordResult = CfDnsRecord;
@@ -0,0 +1,40 @@
+import type { CfZone } from "@cfdm/shared";
+import { withRetry } from "../cf-retry.js";
+import { CF_API_BASE, handleCfResponse, mapCloudflareFailure } from "./http.js";
+
+export function createZoneAdapter(token: string) {
+  return {
+    async listZones(): Promise<CfZone[]> {
+      return withRetry(async () => {
+        const all: CfZone[] = [];
+        let page = 1;
+        while (true) {
+          const url = new URL(`${CF_API_BASE}/zones`);
+          url.searchParams.set("per_page", "50");
+          url.searchParams.set("page", String(page));
+          const response = await fetch(url, {
+            headers: { Authorization: `Bearer ${token}` },
+            signal: AbortSignal.timeout(30_000),
+          });
+          if (response.status >= 500 || response.status === 429) {
+            throw mapCloudflareFailure("list_zones", response.status, String(response.status));
+          }
+          const batch = await handleCfResponse<CfZone[]>(response, "list_zones");
+          if (batch.length === 0) break;
+          all.push(...batch);
+          if (batch.length < 50) break;
+          page += 1;
+        }
+        return all;
+      });
+    },
+
+    async getZone(zoneId: string): Promise<CfZone> {
+      const response = await fetch(`${CF_API_BASE}/zones/${zoneId}`, {
+        headers: { Authorization: `Bearer ${token}` },
+        signal: AbortSignal.timeout(30_000),
+      });
+      return handleCfResponse(response, "get_zone");
+    },
+  };
+}
@@ -94,14 +94,17 @@ const RULES: Rule[] = [
    methods: ["GET"],
    match: (p) =>
      p.startsWith("/api/v1/services") ||
-      p.startsWith("/api/v1/service-bindings"),
+      p.startsWith("/api/v1/service-bindings") ||
+      p.startsWith("/api/v1/health-checks") ||
+      p === "/api/v1/ops-summary",
    permission: "cfdm:services:read",
  },
  {
    methods: ["POST", "PUT", "PATCH", "DELETE"],
    match: (p) =>
      p.startsWith("/api/v1/services") ||
-      p.startsWith("/api/v1/service-bindings"),
+      p.startsWith("/api/v1/service-bindings") ||
+      p.startsWith("/api/v1/health-checks"),
    permission: "cfdm:services:write",
  },
  {
@@ -114,8 +117,7 @@ const RULES: Rule[] = [
    match: (p) =>
      p.startsWith("/api/v1/settings") ||
      p.startsWith("/api/v1/notifications") ||
-      p.startsWith("/api/v1/health-check") ||
-      p.startsWith("/api/v1/health-checks"),
+      p.startsWith("/api/v1/health-check"),
    permission: "cfdm:settings:admin",
  },
  {
@@ -20,6 +20,7 @@ export async function healthCheckRoutes(app: FastifyInstance) {
      degradedFailures: config.healthDegradedFailures,
      downFailures: config.healthDownFailures,
      latencyWarnMs: config.healthLatencyWarnMs,
+      successRecoveries: config.healthSuccessRecoveries,
    };
    const checked = await healthCheckService.runAllChecks(request.server.db, {
      thresholds,
@@ -0,0 +1,77 @@
+import type { FastifyInstance } from "fastify";
+import {
+  createOriginHealthCheckSchema,
+} from "@cfdm/shared";
+import * as originHealth from "../services/origin-health-check-service.js";
+import { recordAudit } from "../lib/audit.js";
+
+export async function originHealthCheckRoutes(app: FastifyInstance) {
+  app.get("/health-checks", async (request) => {
+    return originHealth.listOriginHealthChecks(request.server.db);
+  });
+
+  app.post("/health-checks", async (request) => {
+    const body = createOriginHealthCheckSchema.parse(request.body);
+    const check = await originHealth.createOriginHealthCheck(
+      request.server.db,
+      request.server.cf,
+      body,
+    );
+    recordAudit(request.server, request, {
+      action: "healthcheck.create",
+      targetType: "app_resource",
+      targetId: String(check.id),
+      summary: `Создан health check «${check.name}» (${check.provider})`,
+    });
+    return check;
+  });
+
+  app.get("/health-checks/:id", async (request) => {
+    const { id } = request.params as { id: string };
+    return originHealth.getOriginHealthCheck(request.server.db, Number(id));
+  });
+
+  app.patch("/health-checks/:id", async (request) => {
+    const { id } = request.params as { id: string };
+    const body = createOriginHealthCheckSchema.partial().parse(request.body);
+    const check = await originHealth.updateOriginHealthCheck(
+      request.server.db,
+      request.server.cf,
+      Number(id),
+      body,
+    );
+    recordAudit(request.server, request, {
+      action: "healthcheck.update",
+      targetType: "app_resource",
+      targetId: id,
+      summary: `Обновлён health check «${check.name}»`,
+    });
+    return check;
+  });
+
+  app.delete("/health-checks/:id", async (request) => {
+    const { id } = request.params as { id: string };
+    await originHealth.deleteOriginHealthCheck(
+      request.server.db,
+      request.server.cf,
+      Number(id),
+    );
+    recordAudit(request.server, request, {
+      action: "healthcheck.delete",
+      severity: "warning",
+      targetType: "app_resource",
+      targetId: id,
+      summary: `Удалён health check ${id}`,
+    });
+    return { deleted: true };
+  });
+
+  app.post("/health-checks/:id/sync", async (request) => {
+    const { id } = request.params as { id: string };
+    return originHealth.syncOriginHealthCheck(
+      request.server.db,
+      request.server.cf,
+      Number(id),
+    );
+  });
+}
@@ -1,6 +1,9 @@
 import type { FastifyInstance } from "fastify";
 import { z } from "zod";
+import { changeIpSchema } from "@cfdm/shared";
 import * as bindingService from "../services/binding-service.js";
+import * as changeIp from "../services/change-ip-service.js";
+import { recordAudit } from "../lib/audit.js";

 export async function serviceBindingRoutes(app: FastifyInstance) {
  const createSchema = z.object({
@@ -52,6 +55,27 @@ export async function serviceBindingRoutes(app: FastifyInstance) {
    return { deleted: true };
  });

+  app.post("/service-bindings/:id/change-ip", async (request) => {
+    const { id } = request.params as { id: string };
+    const body = changeIpSchema.parse(request.body);
+    const result = await changeIp.changeBindingIp(
+      request.server.db,
+      request.server.cf,
+      Number(id),
+      body,
+    );
+    if (result.applied) {
+      recordAudit(request.server, request, {
+        action: "binding.change_ip",
+        targetType: "app_resource",
+        targetId: id,
+        summary: `Сменён IP: ${result.message}`,
+        details: result,
+      });
+    }
+    return result;
+  });
+
  app.get("/domains/:id/service-bindings", async (request) => {
    const { id } = request.params as { id: string };
    return bindingService.listByDomain(request.server.db, Number(id));
@@ -1,8 +1,16 @@
 import type { FastifyInstance } from "fastify";
 import { z } from "zod";
-import { reorderServicesSchema, updateServiceConfigSchema } from "@cfdm/shared";
+import {
+  changeDomainSchema,
+  createServiceNodeSchema,
+  reorderServicesSchema,
+  updateServiceConfigSchema,
+  updateServiceNodeSchema,
+} from "@cfdm/shared";
 import { repos } from "@cfdm/db";
 import * as serviceConfig from "../services/service-config-service.js";
+import * as nodeService from "../services/node-service.js";
+import * as changeDomain from "../services/change-domain-service.js";
 import { recordAudit } from "../lib/audit.js";

 export async function serviceRoutes(app: FastifyInstance) {
@@ -56,6 +64,88 @@ export async function serviceRoutes(app: FastifyInstance) {
    return serviceConfig.getView(request.server.db, Number(id));
  });

+  app.get("/services/:id/overview", async (request) => {
+    const { id } = request.params as { id: string };
+    return nodeService.getOverview(request.server.db, Number(id));
+  });
+
+  app.get("/services/:id/nodes", async (request) => {
+    const { id } = request.params as { id: string };
+    return nodeService.listNodes(request.server.db, Number(id));
+  });
+
+  app.post("/services/:id/nodes", async (request) => {
+    const { id } = request.params as { id: string };
+    const body = createServiceNodeSchema.parse(request.body);
+    const node = nodeService.createNode(request.server.db, Number(id), body);
+    recordAudit(request.server, request, {
+      action: "node.create",
+      targetType: "app_resource",
+      targetId: String(node.id),
+      summary: `Добавлена нода ${node.address}`,
+      details: { service_id: Number(id), address: node.address },
+    });
+    return node;
+  });
+
+  app.patch("/services/:id/nodes/:nodeId", async (request) => {
+    const { id, nodeId } = request.params as { id: string; nodeId: string };
+    const body = updateServiceNodeSchema.parse(request.body);
+    const node = nodeService.updateNode(
+      request.server.db,
+      Number(id),
+      Number(nodeId),
+      body,
+    );
+    recordAudit(request.server, request, {
+      action: "node.update",
+      targetType: "app_resource",
+      targetId: String(node.id),
+      summary: `Обновлена нода ${node.address}`,
+      details: body,
+    });
+    return node;
+  });
+
+  app.delete("/services/:id/nodes/:nodeId", async (request) => {
+    const { id, nodeId } = request.params as { id: string; nodeId: string };
+    const node = repos.getNode(request.server.db, Number(nodeId));
+    nodeService.deleteNode(request.server.db, Number(id), Number(nodeId));
+    recordAudit(request.server, request, {
+      action: "node.delete",
+      severity: "warning",
+      targetType: "app_resource",
+      targetId: nodeId,
+      summary: `Удалена нода ${node.address}`,
+    });
+    return { deleted: true };
+  });
+
+  app.post("/services/:id/change-domain", async (request) => {
+    const { id } = request.params as { id: string };
+    const body = changeDomainSchema.parse(request.body);
+    const result = await changeDomain.changeServiceDomain(
+      request.server.db,
+      request.server.cf,
+      Number(id),
+      body,
+    );
+    if (result.applied) {
+      recordAudit(request.server, request, {
+        action: "service.change_domain",
+        targetType: "app_resource",
+        targetId: id,
+        summary: result.message,
+        details: result,
+      });
+    }
+    return result;
+  });
+
+  app.get("/ops-summary", async (request) => {
+    return nodeService.opsSummary(request.server.db);
+  });
+

  app.patch("/services/:id", async (request) => {
    const { id } = request.params as { id: string };
@@ -0,0 +1,118 @@
+import type { Db } from "@cfdm/db";
+import { repos } from "@cfdm/db";
+import type { ChangeDomainInput } from "@cfdm/shared";
+import type { CloudflareClient } from "../lib/cf-client.js";
+import { AppError } from "../errors.js";
+import * as dnsService from "./dns-service.js";
+import { withBindingLock } from "./routing/index.js";
+import { applyBindingDesiredDns, fqdnToDisplay } from "./service-config-service.js";
+
+export interface ChangeDomainItem {
+  binding_id: number;
+  hostname: string;
+  from_fqdn: string;
+  to_fqdn: string;
+}
+
+export interface ChangeDomainPreview {
+  from_domain_id: number;
+  to_domain_id: number;
+  from_zone: string;
+  to_zone: string;
+  items: ChangeDomainItem[];
+  dry_run: boolean;
+  applied: boolean;
+  message: string;
+}
+
+export async function changeServiceDomain(
+  db: Db,
+  cf: CloudflareClient,
+  serviceId: number,
+  input: ChangeDomainInput,
+): Promise<ChangeDomainPreview> {
+  repos.getService(db, serviceId);
+  if (input.from_domain_id === input.to_domain_id) {
+    throw AppError.validation("укажите другой целевой домен");
+  }
+  const fromDomain = repos.getDomain(db, input.from_domain_id);
+  const toDomain = repos.getDomain(db, input.to_domain_id);
+  const bindings = repos
+    .listBindingsByService(db, serviceId)
+    .filter((b) => b.domain_id === input.from_domain_id);
+  const selected = input.hostnames?.length
+    ? bindings.filter((b) => input.hostnames!.includes(b.hostname))
+    : bindings;
+  if (selected.length === 0) {
+    throw AppError.validation("нет привязок для переноса");
+  }
+
+  const items: ChangeDomainItem[] = selected.map((binding) => ({
+    binding_id: binding.id,
+    hostname: binding.hostname,
+    from_fqdn: fqdnToDisplay(binding.hostname, fromDomain.zone_name),
+    to_fqdn: fqdnToDisplay(binding.hostname, toDomain.zone_name),
+  }));
+
+  const preview: ChangeDomainPreview = {
+    from_domain_id: fromDomain.id,
+    to_domain_id: toDomain.id,
+    from_zone: fromDomain.zone_name,
+    to_zone: toDomain.zone_name,
+    items,
+    dry_run: Boolean(input.dry_run),
+    applied: false,
+    message: `Перенос ${items.length} привязок ${fromDomain.zone_name} → ${toDomain.zone_name}`,
+  };
+
+  if (input.dry_run) return preview;
+
+  const createdRecordIds: number[] = [];
+  try {
+    for (const binding of selected) {
+      const existing = repos.findBinding(
+        db,
+        serviceId,
+        toDomain.id,
+        binding.hostname,
+      );
+      if (existing) {
+        throw AppError.conflict(
+          `привязка ${fqdnToDisplay(binding.hostname, toDomain.zone_name)} уже существует`,
+        );
+      }
+      await withBindingLock(binding.id, async () => {
+        repos.bumpBindingVersion(db, binding.id);
+        const ips = repos.listBindingIps(db, binding.id);
+        repos.updateBindingDomain(db, binding.id, toDomain.id, binding.hostname);
+        await applyBindingDesiredDns(db, cf, binding.id, ips);
+        const newRecords = repos.listRecordsForBinding(db, binding.id);
+        createdRecordIds.push(...newRecords.map((r) => r.id));
+
+        const oldRecords = newRecords.filter((r) => r.domain_id === fromDomain.id);
+        for (const record of oldRecords) {
+          repos.unlinkBindingRecord(db, binding.id, record.id);
+          try {
+            await dnsService.deleteRecord(db, cf, fromDomain.id, record.id);
+          } catch {
+            // best-effort cleanup of old zone
+          }
+        }
+      });
+    }
+  } catch (err) {
+    throw err instanceof AppError
+      ? err
+      : AppError.syncFailed(
+          err instanceof Error ? err.message : "не удалось перенести привязки",
+        );
+  }
+
+  void createdRecordIds;
+  return {
+    ...preview,
+    dry_run: false,
+    applied: true,
+    message: `Привязки перенесены в ${toDomain.zone_name}. Старые записи зоны удалены.`,
+  };
+}
@@ -0,0 +1,142 @@
+import type { Db } from "@cfdm/db";
+import { repos } from "@cfdm/db";
+import type { ChangeIpInput } from "@cfdm/shared";
+import type { CloudflareClient } from "../lib/cf-client.js";
+import { AppError } from "../errors.js";
+import { isValidIpv4 } from "../lib/validators.js";
+import { withBindingLock } from "./routing/index.js";
+import { applyBindingDesiredDns } from "./service-config-service.js";
+
+export interface ChangeIpPreview {
+  binding_id: number;
+  hostname: string;
+  zone_name: string;
+  from_ip: string;
+  to_ip: string;
+  dry_run: boolean;
+  applied: boolean;
+  message: string;
+}
+
+async function patchRecordContent(
+  db: Db,
+  cf: CloudflareClient,
+  domainId: number,
+  recordId: number,
+  content: string,
+): Promise<void> {
+  const domain = repos.getDomain(db, domainId);
+  const record = repos.getDnsRecord(db, domainId, recordId);
+  if (!record.cf_record_id) {
+    throw AppError.dnsUpdateFailed("у DNS-записи нет идентификатора Cloudflare");
+  }
+  try {
+    const patched = await cf.patchDnsRecord(domain.cf_zone_id, record.cf_record_id, {
+      content,
+    });
+    repos.updateDnsFields(
+      db,
+      record.id,
+      patched.type ?? record.record_type,
+      patched.name ?? record.name,
+      patched.content ?? content,
+      patched.ttl ?? record.ttl,
+      patched.proxied ?? record.proxied,
+      patched.priority ?? record.priority,
+      "synced",
+      patched.id ?? record.cf_record_id,
+      null,
+    );
+  } catch (err) {
+    if (err instanceof AppError) throw err;
+    throw AppError.dnsUpdateFailed(
+      err instanceof Error ? err.message : "не удалось обновить запись в Cloudflare",
+    );
+  }
+}
+
+export async function changeBindingIp(
+  db: Db,
+  cf: CloudflareClient,
+  bindingId: number,
+  input: ChangeIpInput,
+): Promise<ChangeIpPreview> {
+  const binding = repos.getBinding(db, bindingId);
+  const domain = repos.getDomain(db, binding.domain_id);
+  const current = repos.listBindingIpsWithMeta(db, bindingId);
+  if (current.length === 0) {
+    throw AppError.validation("у привязки нет IP для замены");
+  }
+
+  let fromIp = input.from_ip?.trim();
+  let toIp = input.to_ip?.trim();
+
+  if (input.node_id) {
+    const node = repos.getNode(db, input.node_id);
+    if (node.service_id !== binding.service_id) {
+      throw AppError.validation("нода не принадлежит сервису этой привязки");
+    }
+    toIp = node.address;
+  }
+
+  if (!fromIp) {
+    fromIp = current[0]!.ip;
+  }
+  if (!toIp) {
+    throw AppError.invalidIp("укажите новый IP или ноду");
+  }
+  if (!isValidIpv4(toIp)) {
+    throw AppError.invalidIp(`Некорректный IP-адрес: ${toIp}`);
+  }
+  if (!current.some((row) => row.ip === fromIp)) {
+    throw AppError.validation(`IP ${fromIp} нет в привязке`);
+  }
+
+  const preview: ChangeIpPreview = {
+    binding_id: bindingId,
+    hostname: binding.hostname,
+    zone_name: domain.zone_name,
+    from_ip: fromIp,
+    to_ip: toIp,
+    dry_run: Boolean(input.dry_run),
+    applied: false,
+    message: `${fromIp} → ${toIp}`,
+  };
+
+  if (input.dry_run || fromIp === toIp) {
+    return preview;
+  }
+
+  return withBindingLock(bindingId, async () => {
+    repos.bumpBindingVersion(db, bindingId);
+    const next = current.map((row) =>
+      row.ip === fromIp ? { ...row, ip: toIp } : row,
+    );
+    repos.replaceBindingIpsWithMeta(db, bindingId, next);
+
+    const records = repos.listRecordsForBinding(db, bindingId);
+    const match = records.find(
+      (record) =>
+        record.content === fromIp &&
+        (record.record_type.toUpperCase() === "A" ||
+          record.record_type.toUpperCase() === "AAAA"),
+    );
+    if (match) {
+      await patchRecordContent(db, cf, binding.domain_id, match.id, toIp);
+    } else {
+      await applyBindingDesiredDns(
+        db,
+        cf,
+        bindingId,
+        next.map((row) => row.ip),
+      );
+    }
+
+    return {
+      ...preview,
+      dry_run: false,
+      applied: true,
+      message: `Запись обновлена в Cloudflare (${fromIp} → ${toIp}). Распространение зависит от TTL.`,
+    };
+  });
+}
@@ -1,6 +1,6 @@
 import type { Db } from "@cfdm/db";
 import { repos, type DnsListFilter } from "@cfdm/db";
-import type { CreateDnsRecordPayload, DnsRecord } from "@cfdm/shared";
+import type { CreateDnsRecordPayload, DnsRecord, PatchDnsRecordPayload } from "@cfdm/shared";
 import {
  SYNC_CONFLICT,
  SYNC_ERROR,
@@ -179,6 +179,52 @@ export async function update(
  return pushRecord(db, cf, domainId, domain.cf_zone_id, updated);
 }

+export async function patchContent(
+  db: Db,
+  cf: CloudflareClient,
+  domainId: number,
+  recordId: number,
+  payload: PatchDnsRecordPayload,
+): Promise<DnsRecord> {
+  const domain = repos.getDomain(db, domainId);
+  const existing = repos.getDnsRecord(db, domainId, recordId);
+  if (!existing.cf_record_id) {
+    throw AppError.dnsUpdateFailed("у DNS-записи нет идентификатора Cloudflare");
+  }
+  try {
+    const cfRec = await cf.patchDnsRecord(
+      domain.cf_zone_id,
+      existing.cf_record_id,
+      payload,
+    );
+    repos.updateDnsFields(
+      db,
+      existing.id,
+      cfRec.type ?? existing.record_type,
+      cfRec.name ?? existing.name,
+      cfRec.content ?? existing.content,
+      cfRec.ttl ?? existing.ttl,
+      cfRec.proxied ?? existing.proxied,
+      cfRec.priority ?? existing.priority,
+      SYNC_SYNCED,
+      cfRec.id ?? existing.cf_record_id,
+      null,
+    );
+    return repos.getDnsRecord(db, domainId, existing.id);
+  } catch (e) {
+    repos.setDnsSyncStatus(
+      db,
+      existing.id,
+      SYNC_ERROR,
+      existing.cf_record_id,
+      e instanceof Error ? e.message : String(e),
+    );
+    throw e instanceof AppError
+      ? e
+      : AppError.dnsUpdateFailed(e instanceof Error ? e.message : String(e));
+  }
+}
+
 export async function deleteRecord(
  db: Db,
  cf: CloudflareClient,
@@ -5,11 +5,13 @@ import type { Db } from "@cfdm/db";
 import { repos } from "@cfdm/db";
 import type { HealthCheckTarget, IpHealthState } from "@cfdm/shared";
 import { AppError } from "../errors.js";
+import { nextHealthState } from "./health/state-machine.js";

 export interface HealthCheckThresholds {
  degradedFailures: number;
  downFailures: number;
  latencyWarnMs: number;
+  successRecoveries?: number;
 }

 export interface ProbeResult {
@@ -234,23 +236,25 @@ export async function probeTarget(
 function deriveState(
  ok: boolean,
  latencyMs: number,
-  prev: { consecutive_failures: number; status: string } | null,
+  prev: {
+    consecutive_failures: number;
+    consecutive_successes?: number;
+    status: string;
+  } | null,
  thresholds: HealthCheckThresholds,
-): { state: IpHealthState; failures: number } {
-  if (!ok) {
-    const failures = (prev?.consecutive_failures ?? 0) + 1;
-    if (failures >= thresholds.downFailures) {
-      return { state: "down", failures };
-    }
-    if (failures >= thresholds.degradedFailures) {
-      return { state: "degraded", failures };
-    }
-    return { state: "degraded", failures };
-  }
-  if (latencyMs > thresholds.latencyWarnMs) {
-    return { state: "degraded", failures: 0 };
-  }
-  return { state: "up", failures: 0 };
+): { state: IpHealthState; failures: number; successes: number; node: string } {
+  const next = nextHealthState(ok, latencyMs, prev, {
+    degradedFailures: thresholds.degradedFailures,
+    downFailures: thresholds.downFailures,
+    latencyWarnMs: thresholds.latencyWarnMs,
+    successRecoveries: thresholds.successRecoveries ?? 2,
+  });
+  return {
+    state: next.legacy,
+    failures: next.failures,
+    successes: next.successes,
+    node: next.node,
+  };
 }

 export interface RunAllChecksOptions {
@@ -324,12 +328,13 @@ export async function runAllChecks(
        target.ref_id,
        target.ip,
      );
-      const { state, failures } = deriveState(
+      const { state, failures, successes, node } = deriveState(
        result.ok,
        result.latencyMs,
        prev
          ? {
              consecutive_failures: prev.consecutive_failures,
+              consecutive_successes: prev.consecutive_successes,
              status: prev.status,
            }
          : null,
@@ -347,7 +352,18 @@ export async function runAllChecks(
        result.latencyMs,
        failures,
        result.error,
+        successes,
      );
+      const matchedNode = repos.findNodeByIp(db, target.ip);
+      if (matchedNode && matchedNode.enabled) {
+        repos.updateNode(db, matchedNode.id, {
+          health_status: node,
+          consecutive_failures: failures,
+          consecutive_successes: successes,
+          last_check_at: new Date().toISOString().replace("T", " ").slice(0, 19),
+          last_failure_reason: result.error,
+        });
+      }
      if (prevState !== state) {
        options.onStatusChange?.(target, prevState, state);
      }
@@ -402,6 +418,7 @@ export async function runDomainMonitors(
      result.latencyMs,
      {
        consecutive_failures: result.ok ? 0 : 1,
+        consecutive_successes: result.ok ? 1 : 0,
        status: prevStatus,
      },
      thresholds,
@@ -0,0 +1,112 @@
+import type { Db } from "@cfdm/db";
+import { repos } from "@cfdm/db";
+import type { CfHealthCheck, HealthCheckTarget, OriginHealthCheck } from "@cfdm/shared";
+import type { CloudflareClient } from "../../lib/cf-client.js";
+import type { CfHealthCheckPayload } from "../../lib/cloudflare/healthcheck-service.js";
+import { AppError } from "../../errors.js";
+import type { ProbeResult } from "../health-check-service.js";
+import type { HealthCheckProvider } from "./provider.js";
+
+function toPayload(
+  check: OriginHealthCheck,
+  address: string,
+): CfHealthCheckPayload {
+  const type = (check.protocol || "TCP").toUpperCase() as "HTTP" | "HTTPS" | "TCP";
+  const payload: CfHealthCheckPayload = {
+    address,
+    name: check.name,
+    type,
+    interval: check.interval_sec,
+    timeout: check.timeout,
+    retries: check.retries,
+    consecutive_fails: check.consecutive_fails,
+    consecutive_successes: check.consecutive_successes,
+    suspended: check.suspended,
+  };
+  if (type === "HTTP" || type === "HTTPS") {
+    payload.http_config = {
+      method: check.method ?? "GET",
+      path: check.path ?? "/",
+      expected_codes: check.expected_status != null ? [String(check.expected_status)] : ["200"],
+    };
+  } else {
+    payload.tcp_config = { method: "connection_established" };
+  }
+  return payload;
+}
+
+export class CloudflareHealthCheckProvider implements HealthCheckProvider {
+  readonly kind = "cloudflare" as const;
+
+  constructor(
+    private readonly db: Db,
+    private readonly cf: CloudflareClient,
+  ) {}
+
+  async probe(target: HealthCheckTarget): Promise<ProbeResult> {
+    const node = repos.findNodeByIp(this.db, target.ip);
+    if (!node?.health_check_id) {
+      return { ok: false, latencyMs: 0, error: "нет Cloudflare Health Check" };
+    }
+    const check = repos.getHealthCheck(this.db, node.health_check_id);
+    if (!check.cf_zone_id || !check.cf_healthcheck_id) {
+      return { ok: false, latencyMs: 0, error: "Cloudflare Health Check не синхронизирован" };
+    }
+    try {
+      const remote = await this.cf.getHealthCheck(check.cf_zone_id, check.cf_healthcheck_id);
+      const status = (remote.status ?? "").toLowerCase();
+      const ok = status === "healthy" || status === "ok";
+      return {
+        ok,
+        latencyMs: 0,
+        error: ok ? null : remote.status ?? "unhealthy",
+      };
+    } catch (err) {
+      return {
+        ok: false,
+        latencyMs: 0,
+        error: err instanceof Error ? err.message : String(err),
+      };
+    }
+  }
+
+  async syncCreate(
+    check: OriginHealthCheck,
+    zoneId: string,
+    address: string,
+  ): Promise<CfHealthCheck> {
+    try {
+      const remote = await this.cf.createHealthCheck(zoneId, toPayload(check, address));
+      repos.updateHealthCheck(this.db, check.id, {
+        cf_healthcheck_id: remote.id,
+        cf_zone_id: zoneId,
+        provider: "cloudflare",
+      });
+      return remote;
+    } catch (err) {
+      if (err instanceof AppError) throw err;
+      throw AppError.healthcheckCreateFailed(
+        err instanceof Error ? err.message : "не удалось создать Cloudflare Health Check",
+      );
+    }
+  }
+
+  async syncUpdate(
+    check: OriginHealthCheck,
+    address: string,
+  ): Promise<CfHealthCheck> {
+    if (!check.cf_zone_id || !check.cf_healthcheck_id) {
+      throw AppError.healthcheckCreateFailed("Cloudflare Health Check не привязан к зоне");
+    }
+    return this.cf.updateHealthCheck(
+      check.cf_zone_id,
+      check.cf_healthcheck_id,
+      toPayload(check, address),
+    );
+  }
+
+  async syncDelete(check: OriginHealthCheck): Promise<void> {
+    if (!check.cf_zone_id || !check.cf_healthcheck_id) return;
+    await this.cf.deleteHealthCheck(check.cf_zone_id, check.cf_healthcheck_id);
+  }
+}
@@ -0,0 +1,11 @@
+import type { HealthCheckTarget } from "@cfdm/shared";
+import { probeTarget, type ProbeResult } from "../health-check-service.js";
+import type { HealthCheckProvider } from "./provider.js";
+
+export class LocalHealthCheckProvider implements HealthCheckProvider {
+  readonly kind = "local" as const;
+
+  probe(target: HealthCheckTarget): Promise<ProbeResult> {
+    return probeTarget(target);
+  }
+}
@@ -0,0 +1,7 @@
+import type { HealthCheckTarget } from "@cfdm/shared";
+import type { ProbeResult } from "../health-check-service.js";
+
+export interface HealthCheckProvider {
+  readonly kind: "local" | "cloudflare";
+  probe(target: HealthCheckTarget): Promise<ProbeResult>;
+}
@@ -0,0 +1,75 @@
+import type { IpHealthState, NodeHealthState } from "@cfdm/shared";
+
+export interface HealthThresholds {
+  degradedFailures: number;
+  downFailures: number;
+  successRecoveries: number;
+  latencyWarnMs: number;
+}
+
+export interface HealthCounters {
+  status: string;
+  consecutive_failures: number;
+  consecutive_successes?: number;
+}
+
+export interface NextHealth {
+  legacy: IpHealthState;
+  node: NodeHealthState;
+  failures: number;
+  successes: number;
+}
+
+function wasHealthy(status: string | undefined): boolean {
+  return status === "up" || status === "healthy";
+}
+
+function wasUnhealthy(status: string | undefined): boolean {
+  return (
+    status === "down" ||
+    status === "unhealthy" ||
+    status === "checking" ||
+    status === "degraded"
+  );
+}
+
+export function nextHealthState(
+  ok: boolean,
+  latencyMs: number,
+  prev: HealthCounters | null,
+  thresholds: HealthThresholds,
+): NextHealth {
+  if (!ok) {
+    const failures = (prev?.consecutive_failures ?? 0) + 1;
+    if (failures >= thresholds.downFailures) {
+      return { legacy: "down", node: "unhealthy", failures, successes: 0 };
+    }
+    return { legacy: "degraded", node: "degraded", failures, successes: 0 };
+  }
+
+  if (latencyMs > thresholds.latencyWarnMs) {
+    return { legacy: "degraded", node: "degraded", failures: 0, successes: 0 };
+  }
+
+  if (!prev || wasHealthy(prev.status) || !wasUnhealthy(prev.status)) {
+    return {
+      legacy: "up",
+      node: "healthy",
+      failures: 0,
+      successes: (prev?.consecutive_successes ?? 0) + 1,
+    };
+  }
+
+  const successes = (prev.consecutive_successes ?? 0) + 1;
+  if (successes >= thresholds.successRecoveries) {
+    return { legacy: "up", node: "healthy", failures: 0, successes };
+  }
+  return { legacy: "unknown", node: "checking", failures: 0, successes };
+}
+
+export function toLegacyHealth(status: NodeHealthState | IpHealthState): IpHealthState {
+  if (status === "healthy" || status === "up") return "up";
+  if (status === "unhealthy" || status === "down") return "down";
+  if (status === "degraded") return "degraded";
+  return "unknown";
+}
@@ -0,0 +1,150 @@
+import type { Db } from "@cfdm/db";
+import { repos } from "@cfdm/db";
+import type {
+  CreateServiceNodeInput,
+  ServiceNode,
+  ServiceOverview,
+  UpdateServiceNodeInput,
+} from "@cfdm/shared";
+import { AppError } from "../errors.js";
+import { isValidIpv4 } from "../lib/validators.js";
+import { getView } from "./service-config-service.js";
+import { selectActiveIpsByMode } from "./routing/index.js";
+
+function assertAddress(address: string): void {
+  if (!isValidIpv4(address)) {
+    throw AppError.invalidIp(`Некорректный IP-адрес: ${address}`);
+  }
+}
+
+export function listNodes(db: Db, serviceId: number): ServiceNode[] {
+  repos.getService(db, serviceId);
+  return repos.listNodes(db, serviceId);
+}
+
+export function createNode(
+  db: Db,
+  serviceId: number,
+  input: CreateServiceNodeInput,
+): ServiceNode {
+  repos.getService(db, serviceId);
+  assertAddress(input.address);
+  try {
+    return repos.createNode(db, serviceId, {
+      address: input.address,
+      protocol: input.protocol,
+      port: input.port,
+      enabled: input.enabled,
+      priority: input.priority,
+      weight: input.weight,
+      health_check_id: input.health_check_id,
+    });
+  } catch (err) {
+    if (err instanceof Error && err.name === "ConflictError") {
+      throw AppError.conflict(err.message);
+    }
+    throw err;
+  }
+}
+
+export function updateNode(
+  db: Db,
+  serviceId: number,
+  nodeId: number,
+  patch: UpdateServiceNodeInput,
+): ServiceNode {
+  const node = repos.getNode(db, nodeId);
+  if (node.service_id !== serviceId) {
+    throw AppError.notFound(`node ${nodeId}`);
+  }
+  if (patch.address) assertAddress(patch.address);
+  return repos.updateNode(db, nodeId, patch);
+}
+
+export function deleteNode(db: Db, serviceId: number, nodeId: number): void {
+  const node = repos.getNode(db, nodeId);
+  if (node.service_id !== serviceId) {
+    throw AppError.notFound(`node ${nodeId}`);
+  }
+  repos.deleteNode(db, nodeId);
+}
+
+export async function getOverview(
+  db: Db,
+  serviceId: number,
+): Promise<ServiceOverview> {
+  const service = await getView(db, serviceId);
+  const nodes = repos.listNodes(db, serviceId);
+  const bindings = repos.listBindingsByService(db, serviceId);
+  const first = bindings[0];
+  const routing = first?.routing_strategy ?? first?.lb_mode ?? "round_robin";
+  const healthCheck =
+    nodes
+      .map((n) => n.health_check_id)
+      .find((id): id is number => id != null) != null
+      ? repos.getHealthCheck(
+          db,
+          nodes.find((n) => n.health_check_id != null)!.health_check_id!,
+        )
+      : null;
+
+  const active = new Set<string>();
+  for (const binding of bindings) {
+    const metas = repos.listBindingIpsWithMeta(db, binding.id);
+    const rows = metas.map((entry) => {
+      const status = repos.getIpHealthStatusRow(db, "binding", binding.id, entry.ip);
+      return {
+        ip: entry.ip,
+        weight: entry.weight,
+        priority: entry.priority,
+        health: status ? status.status : ("unknown" as const),
+      };
+    });
+    for (const ip of selectActiveIpsByMode(
+      {
+        lb_mode: binding.lb_mode,
+        health_check_enabled: binding.health_check_enabled,
+      },
+      rows,
+    )) {
+      active.add(ip);
+    }
+  }
+
+  return {
+    service,
+    nodes,
+    health_check: healthCheck,
+    routing_strategy: routing,
+    active_addresses: [...active],
+  };
+}
+
+export function opsSummary(db: Db) {
+  const allNodes = repos.listAllNodes(db);
+  const services = repos.listServices(db);
+  const domains = repos.listDomains(db);
+  const healthy = allNodes.filter(
+    (n) => n.health_status === "healthy" || n.health_status === "up",
+  ).length;
+  const unhealthy = allNodes.filter(
+    (n) => n.health_status === "unhealthy" || n.health_status === "down",
+  ).length;
+  const failoverActive = repos.listAllBindings(db).filter((binding) => {
+    if (binding.lb_mode !== "failover" || !binding.health_check_enabled) {
+      return false;
+    }
+    return binding.target_ips.some((ip) => {
+      const row = repos.getIpHealthStatusRow(db, "binding", binding.id, ip);
+      return row?.status === "down";
+    });
+  }).length;
+  return {
+    domains: domains.length,
+    services: services.length,
+    nodes: allNodes.length,
+    healthy,
+    unhealthy,
+    active_failovers: failoverActive,
+  };
+}
@@ -0,0 +1,126 @@
+import type { Db } from "@cfdm/db";
+import { repos } from "@cfdm/db";
+import type {
+  CreateOriginHealthCheckInput,
+  OriginHealthCheck,
+} from "@cfdm/shared";
+import type { CloudflareClient } from "../lib/cf-client.js";
+import { AppError } from "../errors.js";
+import { CloudflareHealthCheckProvider } from "./health/cloudflare.js";
+
+export function listOriginHealthChecks(db: Db): OriginHealthCheck[] {
+  return repos.listHealthChecks(db);
+}
+
+export function getOriginHealthCheck(db: Db, id: number): OriginHealthCheck {
+  return repos.getHealthCheck(db, id);
+}
+
+export async function createOriginHealthCheck(
+  db: Db,
+  cf: CloudflareClient,
+  input: CreateOriginHealthCheckInput,
+): Promise<OriginHealthCheck> {
+  const protocol = (input.protocol ?? "tcp").toLowerCase();
+  const check = repos.createHealthCheck(db, {
+    provider: input.provider,
+    name: input.name,
+    cf_zone_id: input.cf_zone_id ?? null,
+    protocol,
+    path: input.path,
+    method: input.method,
+    timeout: input.timeout,
+    interval_sec: input.interval_sec,
+    retries: input.retries,
+    expected_status: input.expected_status,
+    consecutive_fails: input.consecutive_fails,
+    consecutive_successes: input.consecutive_successes,
+    suspended: input.suspended,
+  });
+
+  if (input.node_id) {
+    const node = repos.getNode(db, input.node_id);
+    repos.updateNode(db, node.id, { health_check_id: check.id });
+  }
+
+  if (input.provider === "cloudflare") {
+    const zoneId = input.cf_zone_id;
+    if (!zoneId) {
+      throw AppError.zoneNotFound("укажите зону Cloudflare для Health Check");
+    }
+    const address = input.node_id
+      ? repos.getNode(db, input.node_id).address
+      : check.name;
+    const provider = new CloudflareHealthCheckProvider(db, cf);
+    await provider.syncCreate(check, zoneId, address);
+    return repos.getHealthCheck(db, check.id);
+  }
+
+  return check;
+}
+
+export async function updateOriginHealthCheck(
+  db: Db,
+  cf: CloudflareClient,
+  id: number,
+  patch: Partial<CreateOriginHealthCheckInput>,
+): Promise<OriginHealthCheck> {
+  const current = repos.getHealthCheck(db, id);
+  const updated = repos.updateHealthCheck(db, id, {
+    provider: patch.provider,
+    name: patch.name,
+    cf_zone_id: patch.cf_zone_id,
+    protocol: patch.protocol?.toLowerCase(),
+    path: patch.path,
+    method: patch.method,
+    timeout: patch.timeout,
+    interval_sec: patch.interval_sec,
+    retries: patch.retries,
+    expected_status: patch.expected_status,
+    consecutive_fails: patch.consecutive_fails,
+    consecutive_successes: patch.consecutive_successes,
+    suspended: patch.suspended,
+  });
+  if (updated.provider === "cloudflare" && updated.cf_healthcheck_id) {
+    const address = repos.findNodeByIp(db, updated.name)?.address ?? updated.name;
+    const provider = new CloudflareHealthCheckProvider(db, cf);
+    await provider.syncUpdate(updated, address);
+  }
+  void current;
+  return repos.getHealthCheck(db, id);
+}
+
+export async function deleteOriginHealthCheck(
+  db: Db,
+  cf: CloudflareClient,
+  id: number,
+): Promise<void> {
+  const check = repos.getHealthCheck(db, id);
+  if (check.provider === "cloudflare") {
+    const provider = new CloudflareHealthCheckProvider(db, cf);
+    await provider.syncDelete(check);
+  }
+  repos.deleteHealthCheck(db, id);
+}
+
+export async function syncOriginHealthCheck(
+  db: Db,
+  cf: CloudflareClient,
+  id: number,
+): Promise<OriginHealthCheck> {
+  const check = repos.getHealthCheck(db, id);
+  if (check.provider !== "cloudflare") {
+    throw AppError.validation("синхронизация доступна только для Cloudflare Health Checks");
+  }
+  if (!check.cf_zone_id) {
+    throw AppError.zoneNotFound();
+  }
+  const provider = new CloudflareHealthCheckProvider(db, cf);
+  const address = repos.findNodeByIp(db, check.name)?.address ?? check.name;
+  if (check.cf_healthcheck_id) {
+    await provider.syncUpdate(check, address);
+  } else {
+    await provider.syncCreate(check, check.cf_zone_id, address);
+  }
+  return repos.getHealthCheck(db, id);
+}
@@ -0,0 +1,25 @@
+const locks = new Map<number, Promise<void>>();
+
+export async function withBindingLock<T>(
+  bindingId: number,
+  fn: () => Promise<T>,
+): Promise<T> {
+  const previous = locks.get(bindingId) ?? Promise.resolve();
+  let release!: () => void;
+  const current = new Promise<void>((resolve) => {
+    release = resolve;
+  });
+  locks.set(
+    bindingId,
+    previous.then(() => current).catch(() => current),
+  );
+  await previous.catch(() => undefined);
+  try {
+    return await fn();
+  } finally {
+    release();
+    if (locks.get(bindingId) === current) {
+      locks.delete(bindingId);
+    }
+  }
+}
@@ -0,0 +1,17 @@
+import type { LbIpRow } from "./types.js";
+import { isHealthy } from "./health.js";
+
+export function failoverDesired(rows: LbIpRow[]): string[] {
+  if (rows.length === 0) return [];
+  const healthy = rows.filter((r) => isHealthy(r.health));
+  const pool = healthy.length > 0 ? healthy : rows;
+  const sorted = [...pool].sort(
+    (a, b) => a.priority - b.priority || a.weight - b.weight,
+  );
+  const minPriority = sorted[0]!.priority;
+  const primaries = sorted.filter((r) => r.priority === minPriority);
+  if (healthy.length > 0) {
+    return primaries.map((r) => r.ip);
+  }
+  return [sorted[0]!.ip];
+}
@@ -0,0 +1,5 @@
+import type { IpHealthState, NodeHealthState } from "@cfdm/shared";
+
+export function isHealthy(state: IpHealthState | NodeHealthState | string): boolean {
+  return state === "up" || state === "healthy";
+}
@@ -0,0 +1,26 @@
+import type { LbMode } from "@cfdm/shared";
+import { failoverDesired } from "./failover.js";
+import { roundRobinDesired } from "./round-robin.js";
+import type { LbIpRow, LbTargetConfig } from "./types.js";
+
+export type { LbIpRow, LbTargetConfig } from "./types.js";
+export { isHealthy } from "./health.js";
+export { withBindingLock } from "./binding-lock.js";
+
+export function selectActiveIpsByMode(
+  config: LbTargetConfig,
+  rows: LbIpRow[],
+): string[] {
+  if (rows.length === 0) return [];
+  if (config.lb_mode === "failover") {
+    return failoverDesired(rows);
+  }
+  // weighted = round_robin on DNS (one A per IP)
+  return roundRobinDesired(rows);
+}
+
+export function strategyLabel(mode: LbMode): string {
+  if (mode === "failover") return "Failover";
+  if (mode === "weighted") return "Round Robin (weighted alias)";
+  return "Round Robin";
+}
@@ -0,0 +1,8 @@
+import type { LbIpRow } from "./types.js";
+import { isHealthy } from "./health.js";
+
+export function roundRobinDesired(rows: LbIpRow[]): string[] {
+  const healthy = rows.filter((r) => isHealthy(r.health));
+  const pool = healthy.length > 0 ? healthy : rows;
+  return pool.map((r) => r.ip);
+}
@@ -0,0 +1,13 @@
+import type { IpHealthState, LbMode } from "@cfdm/shared";
+
+export interface LbTargetConfig {
+  lb_mode: LbMode;
+  health_check_enabled: boolean;
+}
+
+export interface LbIpRow {
+  ip: string;
+  weight: number;
+  priority: number;
+  health: IpHealthState;
+}
@@ -24,6 +24,15 @@ import { isValidIpv4 } from "../lib/validators.js";
 import * as dnsService from "./dns-service.js";
 import * as domainService from "./domain-service.js";
 import { syncServiceToVpsTracker } from "./vps-tracker-sync.js";
+import {
+  selectActiveIpsByMode,
+  withBindingLock,
+  type LbIpRow,
+  type LbTargetConfig,
+} from "./routing/index.js";
+
+export type { LbIpRow, LbTargetConfig };
+export { selectActiveIpsByMode };

 export interface ServiceDomainInput {
  fqdn: string;
@@ -137,54 +146,6 @@ function aggregateSyncStatus(statuses: string[]): string | null {
  return statuses[0] ?? null;
 }

-function isHealthy(state: IpHealthState): boolean {
-  return state === "up" || state === "unknown";
-}
-
-export interface LbTargetConfig {
-  lb_mode: LbMode;
-  health_check_enabled: boolean;
-}
-
-export interface LbIpRow {
-  ip: string;
-  weight: number;
-  priority: number;
-  health: IpHealthState;
-}
-
-export function selectActiveIpsByMode(
-  config: LbTargetConfig,
-  rows: LbIpRow[],
-): string[] {
-  if (rows.length === 0) return [];
-
-  const healthy = rows.filter((r) => isHealthy(r.health));
-  const pool = healthy.length > 0 ? healthy : rows;
-
-  if (config.lb_mode === "failover") {
-    const sorted = [...pool].sort(
-      (a, b) => a.priority - b.priority || a.weight - b.weight,
-    );
-    const minPriority = sorted[0]!.priority;
-    const primaries = sorted.filter((r) => r.priority === minPriority);
-    if (healthy.length > 0) {
-      return primaries.map((r) => r.ip);
-    }
-    return [sorted[0]!.ip];
-  }
-
-  if (config.lb_mode === "weighted") {
-    // Cloudflare не допускает дублирования A-записей с одинаковым name+content,
-    // поэтому weighted на уровне DNS реализован как RR по одному A на IP.
-    // Веса сохраняются в БД и используются для приоритизации/отображения;
-    // точное weighted-распределение требует CF Load Balancer (см. README).
-    return pool.map((r) => r.ip);
-  }
-
-  return pool.map((r) => r.ip);
-}
-
 function getBindingLbState(
  db: Db,
  bindingId: number,
@@ -1411,6 +1372,25 @@ export function reorderServices(
  repos.reorderServices(db, groupId, serviceIds);
 }

+export async function applyBindingDesiredDns(
+  db: Db,
+  cf: CloudflareClient,
+  bindingId: number,
+  desiredIps: string[],
+): Promise<void> {
+  const binding = repos.getBinding(db, bindingId);
+  const cnameTarget = binding.cname_target?.trim() || null;
+  await syncBindingDns(
+    db,
+    cf,
+    binding.id,
+    binding.domain_id,
+    binding.hostname,
+    desiredIps,
+    cnameTarget,
+  );
+}
+
 export async function reconcileDnsForTarget(
  db: Db,
  cf: CloudflareClient,
@@ -1418,26 +1398,28 @@ export async function reconcileDnsForTarget(
  refId: number,
 ): Promise<void> {
  if (scope === "binding") {
-    const binding = repos.getBinding(db, refId);
-    if (!binding.health_check_enabled) return;
-    const service = repos.getService(db, binding.service_id);
-    if (!shouldPushDns(db, service)) return;
-    const cnameTarget = binding.cname_target?.trim() || null;
-    if (cnameTarget) return;
-    const ips = repos.listServiceIps(db, service.id);
-    const targetIps = repos.listBindingIps(db, binding.id);
-    validateTargetIpsInPool(targetIps, ips);
-    const activeIps = computeActiveIps(db, "binding", refId);
-    const desiredIps = activeIps.length > 0 ? activeIps : targetIps;
-    await syncBindingDns(
-      db,
-      cf,
-      binding.id,
-      binding.domain_id,
-      binding.hostname,
-      desiredIps,
-      null,
-    );
+    await withBindingLock(refId, async () => {
+      const binding = repos.getBinding(db, refId);
+      if (!binding.health_check_enabled) return;
+      const service = repos.getService(db, binding.service_id);
+      if (!shouldPushDns(db, service)) return;
+      const cnameTarget = binding.cname_target?.trim() || null;
+      if (cnameTarget) return;
+      const ips = repos.listServiceIps(db, service.id);
+      const targetIps = repos.listBindingIps(db, binding.id);
+      validateTargetIpsInPool(targetIps, ips);
+      const activeIps = computeActiveIps(db, "binding", refId);
+      const desiredIps = activeIps.length > 0 ? activeIps : targetIps;
+      await syncBindingDns(
+        db,
+        cf,
+        binding.id,
+        binding.domain_id,
+        binding.hostname,
+        desiredIps,
+        null,
+      );
+    });
    return;
  }

@@ -0,0 +1,38 @@
+import { describe, expect, it } from "vitest";
+import { repos } from "@cfdm/db";
+import { buildApp } from "../src/app.js";
+import { loadConfig } from "../src/config.js";
+
+async function authHeaders(app: Awaited<ReturnType<typeof buildApp>>) {
+  const config = loadConfig();
+  const res = await app.inject({
+    method: "POST",
+    url: "/api/v1/auth/login",
+    payload: { username: config.adminUsername, password: "admin" },
+  });
+  expect(res.statusCode).toBe(200);
+  const { token } = res.json() as { token: string };
+  return { authorization: `Bearer ${token}` };
+}
+
+describe("origin health checks", () => {
+  it("creates a local health check", async () => {
+    const app = await buildApp({
+      config: { ...loadConfig(), staticDir: null },
+      memory: true,
+    });
+    const headers = await authHeaders(app);
+    const res = await app.inject({
+      method: "POST",
+      url: "/api/v1/health-checks",
+      headers,
+      payload: { provider: "local", name: "origin-1", protocol: "tcp" },
+    });
+    expect(res.statusCode).toBe(200);
+    const body = res.json() as { provider: string; name: string };
+    expect(body.provider).toBe("local");
+    expect(body.name).toBe("origin-1");
+    expect(repos.listHealthChecks(app.db)).toHaveLength(1);
+    await app.close();
+  });
+});
@@ -0,0 +1,76 @@
+import { describe, expect, it } from "vitest";
+import { repos } from "@cfdm/db";
+import type { CloudflareClient } from "../src/lib/cf-client.js";
+import { buildApp } from "../src/app.js";
+import { loadConfig } from "../src/config.js";
+import { changeServiceDomain } from "../src/services/change-domain-service.js";
+import { updateConfig } from "../src/services/service-config-service.js";
+
+function mockCf(): CloudflareClient {
+  return {
+    listDnsRecords: async () => [],
+    createDnsRecord: async (_zoneId: string, payload: { type: string; name: string; content: string }) => ({
+      id: `cf-${payload.name}-${payload.content}`,
+      type: payload.type,
+      name: payload.name,
+      content: payload.content,
+      ttl: 1,
+      proxied: false,
+    }),
+    updateDnsRecord: async (
+      _zoneId: string,
+      id: string,
+      payload: { type: string; name: string; content: string },
+    ) => ({
+      id,
+      type: payload.type,
+      name: payload.name,
+      content: payload.content,
+      ttl: 1,
+      proxied: false,
+    }),
+    patchDnsRecord: async (
+      _zoneId: string,
+      id: string,
+      payload: { content?: string },
+    ) => ({
+      id,
+      type: "A",
+      name: "app.example.com",
+      content: payload.content ?? "1.1.1.1",
+      ttl: 1,
+      proxied: false,
+    }),
+    deleteDnsRecord: async () => undefined,
+    listZones: async () => [
+      { id: "zone-1", name: "example.com", status: "active" },
+      { id: "zone-2", name: "other.com", status: "active" },
+    ],
+  } as unknown as CloudflareClient;
+}
+
+describe("change-domain", () => {
+  it("dry-run lists FQDN from → to", async () => {
+    const app = await buildApp({
+      config: { ...loadConfig(), staticDir: null },
+      memory: true,
+    });
+    const cf = mockCf();
+    const from = repos.createDomain(app.db, null, "example.com", "zone-1");
+    const to = repos.createDomain(app.db, null, "other.com", "zone-2");
+    const service = repos.createService(app.db, "App", "app");
+    await updateConfig(app.db, cf, service.id, {
+      ips: ["1.1.1.1"],
+      domains: [{ fqdn: "app.example.com", target_ips: ["1.1.1.1"] }],
+    });
+    const preview = await changeServiceDomain(app.db, cf, service.id, {
+      from_domain_id: from.id,
+      to_domain_id: to.id,
+      dry_run: true,
+    });
+    expect(preview.applied).toBe(false);
+    expect(preview.items[0]?.from_fqdn).toBe("app.example.com");
+    expect(preview.items[0]?.to_fqdn).toBe("app.other.com");
+    await app.close();
+  });
+});
@@ -0,0 +1,110 @@
+import { describe, expect, it } from "vitest";
+import { repos } from "@cfdm/db";
+import type { CloudflareClient } from "../src/lib/cf-client.js";
+import { buildApp } from "../src/app.js";
+import { loadConfig } from "../src/config.js";
+import { changeBindingIp } from "../src/services/change-ip-service.js";
+import { withBindingLock } from "../src/services/routing/index.js";
+import { updateConfig } from "../src/services/service-config-service.js";
+
+function mockCf(): CloudflareClient {
+  return {
+    listDnsRecords: async () => [],
+    createDnsRecord: async (_zoneId: string, payload: { type: string; name: string; content: string }) => ({
+      id: `cf-${payload.name}-${payload.content}`,
+      type: payload.type,
+      name: payload.name,
+      content: payload.content,
+      ttl: 1,
+      proxied: false,
+    }),
+    updateDnsRecord: async (
+      _zoneId: string,
+      id: string,
+      payload: { type: string; name: string; content: string },
+    ) => ({
+      id,
+      type: payload.type,
+      name: payload.name,
+      content: payload.content,
+      ttl: 1,
+      proxied: false,
+    }),
+    patchDnsRecord: async (
+      _zoneId: string,
+      id: string,
+      payload: { content?: string },
+    ) => ({
+      id,
+      type: "A",
+      name: "panel.example.com",
+      content: payload.content ?? "0.0.0.0",
+      ttl: 1,
+      proxied: false,
+    }),
+    deleteDnsRecord: async () => undefined,
+    listZones: async () => [{ id: "zone-1", name: "example.com", status: "active" }],
+  } as unknown as CloudflareClient;
+}
+
+describe("change-ip", () => {
+  it("dry-run previews from → to without writing", async () => {
+    const app = await buildApp({
+      config: { ...loadConfig(), staticDir: null },
+      memory: true,
+    });
+    const cf = mockCf();
+    repos.createDomain(app.db, null, "example.com", "zone-1");
+    const service = repos.createService(app.db, "Panel", "panel");
+    await updateConfig(app.db, cf, service.id, {
+      ips: ["10.0.0.10"],
+      domains: [{ fqdn: "panel.example.com", target_ips: ["10.0.0.10"] }],
+    });
+    const bindings = repos.listBindingsByService(app.db, service.id);
+    const preview = await changeBindingIp(app.db, cf, bindings[0]!.id, {
+      from_ip: "10.0.0.10",
+      to_ip: "10.0.0.20",
+      dry_run: true,
+    });
+    expect(preview.applied).toBe(false);
+    expect(preview.message).toBe("10.0.0.10 → 10.0.0.20");
+    expect(repos.listBindingIps(app.db, bindings[0]!.id)).toEqual(["10.0.0.10"]);
+    await app.close();
+  });
+
+  it("apply patches binding IP", async () => {
+    const app = await buildApp({
+      config: { ...loadConfig(), staticDir: null },
+      memory: true,
+    });
+    const cf = mockCf();
+    repos.createDomain(app.db, null, "example.com", "zone-1");
+    const service = repos.createService(app.db, "Panel", "panel");
+    await updateConfig(app.db, cf, service.id, {
+      ips: ["10.0.0.10"],
+      domains: [{ fqdn: "panel.example.com", target_ips: ["10.0.0.10"] }],
+    });
+    const binding = repos.listBindingsByService(app.db, service.id)[0]!;
+    const result = await changeBindingIp(app.db, cf, binding.id, {
+      from_ip: "10.0.0.10",
+      to_ip: "10.0.0.20",
+    });
+    expect(result.applied).toBe(true);
+    expect(repos.listBindingIps(app.db, binding.id)).toEqual(["10.0.0.20"]);
+    await app.close();
+  });
+
+  it("serializes concurrent binding locks", async () => {
+    const order: number[] = [];
+    await Promise.all([
+      withBindingLock(1, async () => {
+        await new Promise((r) => setTimeout(r, 20));
+        order.push(1);
+      }),
+      withBindingLock(1, async () => {
+        order.push(2);
+      }),
+    ]);
+    expect(order).toEqual([1, 2]);
+  });
+});
@@ -0,0 +1,62 @@
+import { describe, expect, it } from "vitest";
+import { nextHealthState } from "../src/services/health/state-machine.js";
+
+const thresholds = {
+  degradedFailures: 1,
+  downFailures: 2,
+  successRecoveries: 2,
+  latencyWarnMs: 1000,
+};
+
+describe("health state machine", () => {
+  it("first success from unknown is healthy immediately", () => {
+    const next = nextHealthState(true, 20, null, thresholds);
+    expect(next.legacy).toBe("up");
+    expect(next.node).toBe("healthy");
+  });
+
+  it("recovery from down goes checking until consecutive successes", () => {
+    const first = nextHealthState(
+      true,
+      10,
+      { status: "down", consecutive_failures: 3, consecutive_successes: 0 },
+      thresholds,
+    );
+    expect(first.node).toBe("checking");
+    expect(first.legacy).toBe("unknown");
+    const second = nextHealthState(
+      true,
+      10,
+      {
+        status: "checking",
+        consecutive_failures: 0,
+        consecutive_successes: first.successes,
+      },
+      thresholds,
+    );
+    expect(second.node).toBe("healthy");
+    expect(second.legacy).toBe("up");
+  });
+
+  it("two failures mark unhealthy", () => {
+    const first = nextHealthState(
+      false,
+      5,
+      { status: "up", consecutive_failures: 0, consecutive_successes: 1 },
+      thresholds,
+    );
+    expect(first.node).toBe("degraded");
+    const second = nextHealthState(
+      false,
+      5,
+      {
+        status: "degraded",
+        consecutive_failures: first.failures,
+        consecutive_successes: 0,
+      },
+      thresholds,
+    );
+    expect(second.node).toBe("unhealthy");
+    expect(second.legacy).toBe("down");
+  });
+});
@@ -39,7 +39,10 @@ describe("selectActiveIpsByMode", () => {
      lb_mode: "round_robin",
      health_check_enabled: true,
    };
-    const rows = [row("1.1.1.1", { health: "unknown" }), row("2.2.2.2")];
+    const rows = [
+      row("1.1.1.1", { health: "unknown" }),
+      row("2.2.2.2", { health: "unknown" }),
+    ];
    expect(selectActiveIpsByMode(config, rows).sort()).toEqual([
      "1.1.1.1",
      "2.2.2.2",
@@ -88,6 +91,18 @@ describe("selectActiveIpsByMode", () => {
    ]);
  });

+  it("round_robin excludes unknown when another ip is up", () => {
+    const config: LbTargetConfig = {
+      lb_mode: "round_robin",
+      health_check_enabled: true,
+    };
+    const rows = [
+      row("1.1.1.1", { health: "up" }),
+      row("2.2.2.2", { health: "unknown" }),
+    ];
+    expect(selectActiveIpsByMode(config, rows)).toEqual(["1.1.1.1"]);
+  });
+
  it("returns empty array for no rows", () => {
    const config: LbTargetConfig = {
      lb_mode: "round_robin",
@@ -0,0 +1,54 @@
+import { describe, expect, it } from "vitest";
+import { repos } from "@cfdm/db";
+import { buildApp } from "../src/app.js";
+import { loadConfig } from "../src/config.js";
+
+async function authHeaders(app: Awaited<ReturnType<typeof buildApp>>) {
+  const config = loadConfig();
+  const res = await app.inject({
+    method: "POST",
+    url: "/api/v1/auth/login",
+    payload: { username: config.adminUsername, password: "admin" },
+  });
+  expect(res.statusCode).toBe(200);
+  const { token } = res.json() as { token: string };
+  return { authorization: `Bearer ${token}` };
+}
+
+describe("service nodes API", () => {
+  it("creates and lists nodes without changing empty DNS pool until bound", async () => {
+    const app = await buildApp({
+      config: { ...loadConfig(), staticDir: null },
+      memory: true,
+    });
+    const headers = await authHeaders(app);
+    const service = repos.createService(app.db, "Panel", "panel");
+
+    const created = await app.inject({
+      method: "POST",
+      url: `/api/v1/services/${service.id}/nodes`,
+      headers,
+      payload: { address: "10.0.0.8", protocol: "tcp" },
+    });
+    expect(created.statusCode).toBe(200);
+    const node = created.json() as { address: string };
+    expect(node.address).toBe("10.0.0.8");
+    expect(repos.listServiceIps(app.db, service.id)).toContain("10.0.0.8");
+
+    const listed = await app.inject({
+      method: "GET",
+      url: `/api/v1/services/${service.id}/nodes`,
+      headers,
+    });
+    expect(listed.statusCode).toBe(200);
+    expect(listed.json()).toHaveLength(1);
+
+    const overview = await app.inject({
+      method: "GET",
+      url: `/api/v1/services/${service.id}/overview`,
+      headers,
+    });
+    expect(overview.statusCode).toBe(200);
+    await app.close();
+  });
+});
@@ -25,15 +25,18 @@ import {
 const infrastructureNav = [
  { to: '/', label: 'Панель управления', icon: LayoutDashboardIcon, exact: true },
  { to: '/domains', label: 'Домены', icon: GlobeIcon, exact: false },
-  { to: '/groups', label: 'Группы доменов', icon: FolderTreeIcon, exact: false },
 ] as const

 const operationsNav = [
  { to: '/services', label: 'Сервисы', icon: ServerIcon, exact: false },
-  { to: '/certificates', label: 'Сертификаты', icon: ShieldCheckIcon, exact: false },
  { to: '/settings/appearance', label: 'Настройки', icon: SettingsIcon, exact: false, matchPrefix: '/settings' },
 ] as const

+const secondaryNav = [
+  { to: '/groups', label: 'Группы доменов', icon: FolderTreeIcon, exact: false },
+  { to: '/certificates', label: 'Сертификаты', icon: ShieldCheckIcon, exact: false },
+] as const
+
 function isNavActive(
  pathname: string,
  to: string,
@@ -106,6 +109,7 @@ export function AppSidebar() {
      <SidebarContent>
        <NavSection label="Инфраструктура" items={infrastructureNav} pathname={pathname} />
        <NavSection label="Операции" items={operationsNav} pathname={pathname} />
+        <NavSection label="Прочее" items={secondaryNav} pathname={pathname} />
      </SidebarContent>
      <SidebarFooter>
        <NavUser />
@@ -0,0 +1,162 @@
+import { useEffect, useState } from 'react'
+import { useForm } from 'react-hook-form'
+import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query'
+import { toast } from 'sonner'
+import { FormSheet } from '@/components/form-sheet'
+import { FormFieldSimple } from '@/components/form-field'
+import { Button } from '@cfdm/ui/components/button'
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from '@cfdm/ui/components/select'
+import { Alert, AlertDescription, AlertTitle } from '@/components/reui/alert'
+import { ConfirmDialog } from '@/components/confirm-dialog'
+import { changeServiceDomain, domainsListQueryOptions } from '@/queries'
+
+interface ChangeDomainSheetProps {
+  open: boolean
+  onOpenChange: (open: boolean) => void
+  serviceId: number
+  fromDomainId?: number | null
+}
+
+interface FormValues {
+  from_domain_id: string
+  to_domain_id: string
+}
+
+export function ChangeDomainSheet({
+  open,
+  onOpenChange,
+  serviceId,
+  fromDomainId,
+}: ChangeDomainSheetProps) {
+  const queryClient = useQueryClient()
+  const domainsQuery = useQuery(domainsListQueryOptions())
+  const form = useForm<FormValues>({
+    defaultValues: {
+      from_domain_id: fromDomainId ? String(fromDomainId) : '',
+      to_domain_id: '',
+    },
+  })
+  const [confirmOpen, setConfirmOpen] = useState(false)
+  const [preview, setPreview] = useState<string | null>(null)
+
+  useEffect(() => {
+    if (open) {
+      form.reset({
+        from_domain_id: fromDomainId ? String(fromDomainId) : '',
+        to_domain_id: '',
+      })
+      setPreview(null)
+    }
+  }, [open, fromDomainId, form])
+
+  const domains = domainsQuery.data ?? []
+  const fromId = form.watch('from_domain_id')
+  const toId = form.watch('to_domain_id')
+  const fromZone = domains.find((d) => String(d.id) === fromId)?.zone_name
+  const toZone = domains.find((d) => String(d.id) === toId)?.zone_name
+
+  const mutate = useMutation({
+    mutationFn: () =>
+      changeServiceDomain(serviceId, {
+        from_domain_id: Number(fromId),
+        to_domain_id: Number(toId),
+        dry_run: false,
+      }),
+    onSuccess: async (result: { message?: string }) => {
+      toast.success(result.message ?? 'Привязки перенесены')
+      await queryClient.invalidateQueries()
+      setConfirmOpen(false)
+      onOpenChange(false)
+    },
+    onError: (e: unknown) =>
+      toast.error(e instanceof Error ? e.message : 'Не удалось перенести домен'),
+  })
+
+  return (
+    <>
+      <FormSheet
+        open={open}
+        onOpenChange={onOpenChange}
+        title="Сменить домен"
+        description="Перенос привязок между зонами Cloudflare без orphan-записей."
+        form={form}
+        onSubmit={() => {
+          setPreview(
+            fromZone && toZone
+              ? `${fromZone} → ${toZone}`
+              : 'Проверьте выбранные зоны',
+          )
+          setConfirmOpen(true)
+        }}
+        footer={
+          <>
+            <Button type="button" variant="outline" onClick={() => onOpenChange(false)}>
+              Отмена
+            </Button>
+            <Button type="submit" disabled={!fromId || !toId || fromId === toId}>
+              Предпросмотр
+            </Button>
+          </>
+        }
+      >
+        <FormFieldSimple label="Исходная зона" htmlFor="from_domain_id">
+          <Select
+            value={fromId || null}
+            onValueChange={(value) => form.setValue('from_domain_id', value ?? '')}
+          >
+            <SelectTrigger id="from_domain_id">
+              <SelectValue placeholder="Откуда" />
+            </SelectTrigger>
+            <SelectContent>
+              {domains.map((domain) => (
+                <SelectItem key={domain.id} value={String(domain.id)}>
+                  {domain.zone_name}
+                </SelectItem>
+              ))}
+            </SelectContent>
+          </Select>
+        </FormFieldSimple>
+        <FormFieldSimple label="Целевая зона" htmlFor="to_domain_id">
+          <Select
+            value={toId || null}
+            onValueChange={(value) => form.setValue('to_domain_id', value ?? '')}
+          >
+            <SelectTrigger id="to_domain_id">
+              <SelectValue placeholder="Куда" />
+            </SelectTrigger>
+            <SelectContent>
+              {domains.map((domain) => (
+                <SelectItem key={domain.id} value={String(domain.id)}>
+                  {domain.zone_name}
+                </SelectItem>
+              ))}
+            </SelectContent>
+          </Select>
+        </FormFieldSimple>
+        {fromZone && toZone ? (
+          <Alert>
+            <AlertTitle>Предпросмотр FQDN</AlertTitle>
+            <AlertDescription>
+              Привязки будут перенесены из {fromZone} в {toZone}. Старые DNS-записи
+              исходной зоны будут удалены.
+            </AlertDescription>
+          </Alert>
+        ) : null}
+      </FormSheet>
+      <ConfirmDialog
+        open={confirmOpen}
+        onOpenChange={setConfirmOpen}
+        title="Подтвердить перенос"
+        description={preview ?? 'Перенести привязки в другую зону?'}
+        confirmLabel="Перенести"
+        onConfirm={() => mutate.mutate()}
+      />
+    </>
+  )
+}
@@ -0,0 +1,152 @@
+import { useEffect, useMemo, useState } from 'react'
+import { useForm } from 'react-hook-form'
+import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query'
+import { toast } from 'sonner'
+import { FormSheet } from '@/components/form-sheet'
+import { FormFieldSimple } from '@/components/form-field'
+import { LoadingButton } from '@/components/loading-button'
+import { Button } from '@cfdm/ui/components/button'
+import { Input } from '@cfdm/ui/components/input'
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from '@cfdm/ui/components/select'
+import { Alert, AlertDescription, AlertTitle } from '@/components/reui/alert'
+import { changeBindingIp, serviceNodesQueryOptions } from '@/queries'
+
+interface ChangeIpSheetProps {
+  open: boolean
+  onOpenChange: (open: boolean) => void
+  bindingId: number | null
+  serviceId?: number | null
+  currentIp?: string | null
+}
+
+interface FormValues {
+  from_ip: string
+  to_ip: string
+  node_id: string
+}
+
+export function ChangeIpSheet({
+  open,
+  onOpenChange,
+  bindingId,
+  serviceId,
+  currentIp,
+}: ChangeIpSheetProps) {
+  const queryClient = useQueryClient()
+  const form = useForm<FormValues>({
+    defaultValues: { from_ip: currentIp ?? '', to_ip: '', node_id: '' },
+  })
+  const [preview, setPreview] = useState<string | null>(null)
+  const nodesQuery = useQuery({
+    ...serviceNodesQueryOptions(serviceId ?? 0),
+    enabled: open && serviceId != null,
+  })
+
+  useEffect(() => {
+    if (open) {
+      form.reset({ from_ip: currentIp ?? '', to_ip: '', node_id: '' })
+      setPreview(null)
+    }
+  }, [open, currentIp, form])
+
+  const fromIp = form.watch('from_ip')
+  const toIp = form.watch('to_ip')
+  const nodeId = form.watch('node_id')
+  const nodes = (nodesQuery.data ?? []) as Array<{ id: number; address: string }>
+
+  const previewText = useMemo(() => {
+    const next = nodeId
+      ? nodes.find((n) => String(n.id) === nodeId)?.address
+      : toIp
+    if (!fromIp || !next) return null
+    return `${fromIp} → ${next}`
+  }, [fromIp, toIp, nodeId, nodes])
+
+  const mutate = useMutation({
+    mutationFn: async () => {
+      if (bindingId == null) throw new Error('нет привязки')
+      const selectedNode = nodeId ? Number(nodeId) : undefined
+      return changeBindingIp(bindingId, {
+        from_ip: fromIp || undefined,
+        to_ip: selectedNode ? undefined : toIp || undefined,
+        node_id: selectedNode,
+        dry_run: false,
+      })
+    },
+    onSuccess: async (result) => {
+      setPreview(result.message)
+      toast.success(result.message)
+      await queryClient.invalidateQueries()
+      onOpenChange(false)
+    },
+    onError: (e: unknown) =>
+      toast.error(e instanceof Error ? e.message : 'Не удалось сменить IP'),
+  })
+
+  return (
+    <FormSheet
+      open={open}
+      onOpenChange={onOpenChange}
+      title="Сменить IP"
+      description="Обновить A-запись в Cloudflare без перехода на страницу DNS."
+      form={form}
+      onSubmit={() => mutate.mutate()}
+      footer={
+        <>
+          <Button type="button" variant="outline" onClick={() => onOpenChange(false)}>
+            Отмена
+          </Button>
+          <LoadingButton
+            type="submit"
+            isLoading={mutate.isPending}
+            loadingLabel="Updating…"
+          >
+            Сменить IP
+          </LoadingButton>
+        </>
+      }
+    >
+      <FormFieldSimple label="Текущий IP" htmlFor="from_ip">
+        <Input id="from_ip" {...form.register('from_ip')} />
+      </FormFieldSimple>
+      {nodes.length > 0 ? (
+        <FormFieldSimple label="Нода" htmlFor="node_id">
+          <Select
+            value={nodeId || null}
+            onValueChange={(value) => {
+              form.setValue('node_id', value ?? '')
+              const node = nodes.find((n) => String(n.id) === value)
+              if (node) form.setValue('to_ip', node.address)
+            }}
+          >
+            <SelectTrigger id="node_id">
+              <SelectValue placeholder="Выберите ноду" />
+            </SelectTrigger>
+            <SelectContent>
+              {nodes.map((node) => (
+                <SelectItem key={node.id} value={String(node.id)}>
+                  {node.address}
+                </SelectItem>
+              ))}
+            </SelectContent>
+          </Select>
+        </FormFieldSimple>
+      ) : null}
+      <FormFieldSimple label="Новый IP" htmlFor="to_ip" hint="IPv4">
+        <Input id="to_ip" {...form.register('to_ip')} placeholder="10.0.0.20" />
+      </FormFieldSimple>
+      {previewText ? (
+        <Alert>
+          <AlertTitle>Предпросмотр</AlertTitle>
+          <AlertDescription>{preview ?? previewText}</AlertDescription>
+        </Alert>
+      ) : null}
+    </FormSheet>
+  )
+}
@@ -0,0 +1,40 @@
+import {
+  Timeline,
+  TimelineContent,
+  TimelineHeader,
+  TimelineIndicator,
+  TimelineItem,
+  TimelineSeparator,
+  TimelineTitle,
+} from '@/components/reui/timeline'
+
+export interface FailoverEvent {
+  id: string
+  title: string
+  detail: string
+}
+
+export function FailoverTimeline({ events }: { events: FailoverEvent[] }) {
+  if (events.length === 0) {
+    return (
+      <p className="text-muted-foreground text-sm">
+        Событий failover пока нет.
+      </p>
+    )
+  }
+
+  return (
+    <Timeline defaultValue={events.length} className="w-full">
+      {events.map((event, index) => (
+        <TimelineItem key={event.id} step={index + 1}>
+          <TimelineSeparator />
+          <TimelineIndicator />
+          <TimelineHeader>
+            <TimelineTitle>{event.title}</TimelineTitle>
+          </TimelineHeader>
+          <TimelineContent>{event.detail}</TimelineContent>
+        </TimelineItem>
+      ))}
+    </Timeline>
+  )
+}
@@ -7,6 +7,20 @@ import { formatDate } from '@/lib/format'

 type BadgeVariant = NonNullable<ComponentProps<typeof Badge>['variant']>

+type HealthStatus =
+  | IpHealthStatus['status']
+  | 'healthy'
+  | 'unhealthy'
+  | 'checking'
+  | 'disabled'
+
+function normalizeHealth(status: HealthStatus): IpHealthStatus['status'] {
+  if (status === 'healthy') return 'up'
+  if (status === 'unhealthy' || status === 'disabled') return 'down'
+  if (status === 'checking') return 'unknown'
+  return status
+}
+
 const healthVariants: Record<IpHealthStatus['status'], BadgeVariant> = {
  up: 'success-light',
  degraded: 'warning-light',
@@ -21,6 +35,13 @@ const healthLabels: Record<IpHealthStatus['status'], string> = {
  unknown: '—',
 }

+const extraLabels: Partial<Record<HealthStatus, string>> = {
+  healthy: 'Healthy',
+  unhealthy: 'Unhealthy',
+  checking: 'Checking',
+  disabled: 'Disabled',
+}
+
 const dotColor: Record<IpHealthStatus['status'], string> = {
  up: 'bg-success',
  degraded: 'bg-warning',
@@ -29,7 +50,7 @@ const dotColor: Record<IpHealthStatus['status'], string> = {
 }

 interface HealthCheckBadgeProps {
-  status: IpHealthStatus['status']
+  status: HealthStatus
  latencyMs?: number | null
  lastCheckedAt?: string | null
  lastError?: string | null
@@ -49,8 +70,9 @@ export function HealthCheckBadge({
  size = 'sm',
  className,
 }: HealthCheckBadgeProps) {
-  const variant = healthVariants[status]
-  const label = healthLabels[status]
+  const normalized = normalizeHealth(status)
+  const variant = healthVariants[normalized]
+  const label = extraLabels[status] ?? healthLabels[normalized]

  const tooltipParts: string[] = []
  if (title) tooltipParts.push(title)
@@ -74,7 +96,7 @@ export function HealthCheckBadge({
            className={cn('gap-1.5', className)}
          >
            <span
-              className={cn('size-1.5 shrink-0 rounded-full', dotColor[status])}
+              className={cn('size-1.5 shrink-0 rounded-full', dotColor[normalized])}
              aria-hidden
            />
            {label}
@@ -32,6 +32,7 @@ export interface HealthCheckConfig {
  interval_sec: number
  timeout_ms: number
  verify_tls: boolean
+  provider?: 'local' | 'cloudflare'
 }

 export interface LbAndHealthConfig extends HealthCheckConfig {
@@ -136,6 +137,29 @@ export function HealthCheckConfigFields({
        </SettingRow>
      ) : null}

+      <SettingRow
+        title="Провайдер health-check"
+        description="Local TCP/HTTP или Cloudflare Health Checks API"
+        labelFor={`${idPrefix}-provider`}
+        compact
+        className={rowClass}
+      >
+        <Select
+          value={value.provider ?? 'local'}
+          onValueChange={(v) =>
+            patch({ provider: (v ?? 'local') as 'local' | 'cloudflare' })
+          }
+        >
+          <SelectTrigger id={`${idPrefix}-provider`} className="w-full">
+            <SelectValue />
+          </SelectTrigger>
+          <SelectContent>
+            <SelectItem value="local">Local</SelectItem>
+            <SelectItem value="cloudflare">Cloudflare</SelectItem>
+          </SelectContent>
+        </Select>
+      </SettingRow>
+
      <SettingRow
        title="Health-check"
        description="TCP/HTTP проверка цели DNS"
@@ -1,4 +1,5 @@
 import { useMemo } from 'react'
+import { Link } from '@tanstack/react-router'
 import type { ColumnDef } from '@tanstack/react-table'
 import {
  ChevronRightIcon,
@@ -264,6 +265,16 @@ export function createServicesGroupedColumns({
              <MoreHorizontalIcon aria-hidden />
            </DropdownMenuTrigger>
            <DropdownMenuContent align="end">
+              <DropdownMenuItem
+                render={
+                  <Link
+                    to="/services/$serviceId"
+                    params={{ serviceId: String(original.service.id) }}
+                  />
+                }
+              >
+                Обзор
+              </DropdownMenuItem>
              <DropdownMenuItem onClick={() => onEditService(original.service)}>
                Изменить
              </DropdownMenuItem>
@@ -83,3 +83,92 @@ export async function createServiceBinding(body: CreateServiceBindingBody) {
 export async function deleteServiceBinding(id: number) {
  return api.delete<{ deleted: boolean }>(`/api/v1/service-bindings/${id}`)
 }
+
+export const serviceDetailKeys = {
+  overview: (id: number) => [...serviceKeys.all, id, 'overview'] as const,
+  nodes: (id: number) => [...serviceKeys.all, id, 'nodes'] as const,
+}
+
+export const serviceOverviewQueryOptions = (id: number) =>
+  queryOptions({
+    queryKey: serviceDetailKeys.overview(id),
+    queryFn: () => api.get(`/api/v1/services/${id}/overview`),
+  })
+
+export const serviceNodesQueryOptions = (id: number) =>
+  queryOptions({
+    queryKey: serviceDetailKeys.nodes(id),
+    queryFn: () => api.get(`/api/v1/services/${id}/nodes`),
+  })
+
+export const opsSummaryQueryOptions = () =>
+  queryOptions({
+    queryKey: ['ops-summary'] as const,
+    queryFn: () =>
+      api.get<{
+        domains: number
+        services: number
+        nodes: number
+        healthy: number
+        unhealthy: number
+        active_failovers: number
+      }>('/api/v1/ops-summary'),
+  })
+
+export async function createServiceNode(
+  serviceId: number,
+  body: {
+    address: string
+    protocol?: string
+    port?: number | null
+    priority?: number
+    weight?: number
+  },
+) {
+  return api.post(`/api/v1/services/${serviceId}/nodes`, body)
+}
+
+export async function deleteServiceNode(serviceId: number, nodeId: number) {
+  return api.delete(`/api/v1/services/${serviceId}/nodes/${nodeId}`)
+}
+
+export async function changeBindingIp(
+  bindingId: number,
+  body: {
+    from_ip?: string
+    to_ip?: string
+    node_id?: number
+    dry_run?: boolean
+  },
+) {
+  return api.post<{
+    from_ip: string
+    to_ip: string
+    applied: boolean
+    dry_run: boolean
+    message: string
+  }>(`/api/v1/service-bindings/${bindingId}/change-ip`, body)
+}
+
+export async function changeServiceDomain(
+  serviceId: number,
+  body: {
+    from_domain_id: number
+    to_domain_id: number
+    hostnames?: string[]
+    dry_run?: boolean
+  },
+) {
+  return api.post<{ message?: string }>(
+    `/api/v1/services/${serviceId}/change-domain`,
+    body,
+  )
+}
+
+export async function createOriginHealthCheck(body: Record<string, unknown>) {
+  return api.post('/api/v1/health-checks', body)
+}
+
+export async function listOriginHealthChecks() {
+  return api.get('/api/v1/health-checks')
+}
@@ -9,49 +9,55 @@
 // Additionally, you should also exclude this file from your linter and/or formatter to prevent it from being checked or modified.

 import { Route as rootRouteImport } from './routes/__root'
-import { Route as AuthRouteImport } from './routes/_auth'
 import { Route as LoginRouteImport } from './routes/login'
+import { Route as AuthRouteImport } from './routes/_auth'
 import { Route as AuthIndexRouteImport } from './routes/_auth/index'
-import { Route as AuthCertificatesRouteImport } from './routes/_auth/certificates'
-import { Route as AuthGroupsRouteImport } from './routes/_auth/groups'
-import { Route as AuthServicesRouteImport } from './routes/_auth/services'
-import { Route as AuthSettingsRouteRouteImport } from './routes/_auth/settings/route'
 import { Route as AuthCallbackRouteImport } from './routes/auth.callback'
-import { Route as AuthDomainsIndexRouteImport } from './routes/_auth/domains/index'
-import { Route as AuthGroupsGroupIdRouteImport } from './routes/_auth/groups/$groupId'
+import { Route as AuthGroupsRouteImport } from './routes/_auth/groups'
+import { Route as AuthCertificatesRouteImport } from './routes/_auth/certificates'
+import { Route as AuthSettingsRouteRouteImport } from './routes/_auth/settings/route'
 import { Route as AuthSettingsIndexRouteImport } from './routes/_auth/settings/index'
-import { Route as AuthSettingsAppearanceRouteImport } from './routes/_auth/settings/appearance'
+import { Route as AuthServicesIndexRouteImport } from './routes/_auth/services/index'
+import { Route as AuthDomainsIndexRouteImport } from './routes/_auth/domains/index'
 import { Route as AuthSettingsIntegrationsRouteImport } from './routes/_auth/settings/integrations'
+import { Route as AuthSettingsAppearanceRouteImport } from './routes/_auth/settings/appearance'
+import { Route as AuthGroupsGroupIdRouteImport } from './routes/_auth/groups/$groupId'
+import { Route as AuthServicesServiceIdRouteRouteImport } from './routes/_auth/services/$serviceId/route'
+import { Route as AuthServicesServiceIdIndexRouteImport } from './routes/_auth/services/$serviceId/index'
 import { Route as AuthDomainsDomainIdIndexRouteImport } from './routes/_auth/domains/$domainId/index'
+import { Route as AuthServicesServiceIdSubdomainsRouteImport } from './routes/_auth/services/$serviceId/subdomains'
+import { Route as AuthServicesServiceIdRoutingRouteImport } from './routes/_auth/services/$serviceId/routing'
+import { Route as AuthServicesServiceIdNodesRouteImport } from './routes/_auth/services/$serviceId/nodes'
+import { Route as AuthServicesServiceIdHealthRouteImport } from './routes/_auth/services/$serviceId/health'
 import { Route as AuthDomainsDomainIdDnsRouteImport } from './routes/_auth/domains/$domainId/dns'

-const AuthRoute = AuthRouteImport.update({
-  id: '/_auth',
-  getParentRoute: () => rootRouteImport,
-} as any)
 const LoginRoute = LoginRouteImport.update({
  id: '/login',
  path: '/login',
  getParentRoute: () => rootRouteImport,
 } as any)
+const AuthRoute = AuthRouteImport.update({
+  id: '/_auth',
+  getParentRoute: () => rootRouteImport,
+} as any)
 const AuthIndexRoute = AuthIndexRouteImport.update({
  id: '/',
  path: '/',
  getParentRoute: () => AuthRoute,
 } as any)
-const AuthCertificatesRoute = AuthCertificatesRouteImport.update({
-  id: '/certificates',
-  path: '/certificates',
-  getParentRoute: () => AuthRoute,
+const AuthCallbackRoute = AuthCallbackRouteImport.update({
+  id: '/auth/callback',
+  path: '/auth/callback',
+  getParentRoute: () => rootRouteImport,
 } as any)
 const AuthGroupsRoute = AuthGroupsRouteImport.update({
  id: '/groups',
  path: '/groups',
  getParentRoute: () => AuthRoute,
 } as any)
-const AuthServicesRoute = AuthServicesRouteImport.update({
-  id: '/services',
-  path: '/services',
+const AuthCertificatesRoute = AuthCertificatesRouteImport.update({
+  id: '/certificates',
+  path: '/certificates',
  getParentRoute: () => AuthRoute,
 } as any)
 const AuthSettingsRouteRoute = AuthSettingsRouteRouteImport.update({
@@ -59,30 +65,20 @@ const AuthSettingsRouteRoute = AuthSettingsRouteRouteImport.update({
  path: '/settings',
  getParentRoute: () => AuthRoute,
 } as any)
-const AuthCallbackRoute = AuthCallbackRouteImport.update({
-  id: '/auth/callback',
-  path: '/auth/callback',
-  getParentRoute: () => rootRouteImport,
-} as any)
-const AuthDomainsIndexRoute = AuthDomainsIndexRouteImport.update({
-  id: '/domains/',
-  path: '/domains/',
-  getParentRoute: () => AuthRoute,
-} as any)
-const AuthGroupsGroupIdRoute = AuthGroupsGroupIdRouteImport.update({
-  id: '/$groupId',
-  path: '/$groupId',
-  getParentRoute: () => AuthGroupsRoute,
-} as any)
 const AuthSettingsIndexRoute = AuthSettingsIndexRouteImport.update({
  id: '/',
  path: '/',
  getParentRoute: () => AuthSettingsRouteRoute,
 } as any)
-const AuthSettingsAppearanceRoute = AuthSettingsAppearanceRouteImport.update({
-  id: '/appearance',
-  path: '/appearance',
-  getParentRoute: () => AuthSettingsRouteRoute,
+const AuthServicesIndexRoute = AuthServicesIndexRouteImport.update({
+  id: '/services/',
+  path: '/services/',
+  getParentRoute: () => AuthRoute,
+} as any)
+const AuthDomainsIndexRoute = AuthDomainsIndexRouteImport.update({
+  id: '/domains/',
+  path: '/domains/',
+  getParentRoute: () => AuthRoute,
 } as any)
 const AuthSettingsIntegrationsRoute =
  AuthSettingsIntegrationsRouteImport.update({
@@ -90,12 +86,58 @@ const AuthSettingsIntegrationsRoute =
    path: '/integrations',
    getParentRoute: () => AuthSettingsRouteRoute,
  } as any)
+const AuthSettingsAppearanceRoute = AuthSettingsAppearanceRouteImport.update({
+  id: '/appearance',
+  path: '/appearance',
+  getParentRoute: () => AuthSettingsRouteRoute,
+} as any)
+const AuthGroupsGroupIdRoute = AuthGroupsGroupIdRouteImport.update({
+  id: '/$groupId',
+  path: '/$groupId',
+  getParentRoute: () => AuthGroupsRoute,
+} as any)
+const AuthServicesServiceIdRouteRoute =
+  AuthServicesServiceIdRouteRouteImport.update({
+    id: '/services/$serviceId',
+    path: '/services/$serviceId',
+    getParentRoute: () => AuthRoute,
+  } as any)
+const AuthServicesServiceIdIndexRoute =
+  AuthServicesServiceIdIndexRouteImport.update({
+    id: '/',
+    path: '/',
+    getParentRoute: () => AuthServicesServiceIdRouteRoute,
+  } as any)
 const AuthDomainsDomainIdIndexRoute =
  AuthDomainsDomainIdIndexRouteImport.update({
    id: '/domains/$domainId/',
    path: '/domains/$domainId/',
    getParentRoute: () => AuthRoute,
  } as any)
+const AuthServicesServiceIdSubdomainsRoute =
+  AuthServicesServiceIdSubdomainsRouteImport.update({
+    id: '/subdomains',
+    path: '/subdomains',
+    getParentRoute: () => AuthServicesServiceIdRouteRoute,
+  } as any)
+const AuthServicesServiceIdRoutingRoute =
+  AuthServicesServiceIdRoutingRouteImport.update({
+    id: '/routing',
+    path: '/routing',
+    getParentRoute: () => AuthServicesServiceIdRouteRoute,
+  } as any)
+const AuthServicesServiceIdNodesRoute =
+  AuthServicesServiceIdNodesRouteImport.update({
+    id: '/nodes',
+    path: '/nodes',
+    getParentRoute: () => AuthServicesServiceIdRouteRoute,
+  } as any)
+const AuthServicesServiceIdHealthRoute =
+  AuthServicesServiceIdHealthRouteImport.update({
+    id: '/health',
+    path: '/health',
+    getParentRoute: () => AuthServicesServiceIdRouteRoute,
+  } as any)
 const AuthDomainsDomainIdDnsRoute = AuthDomainsDomainIdDnsRouteImport.update({
  id: '/domains/$domainId/dns',
  path: '/domains/$domainId/dns',
@@ -108,30 +150,41 @@ export interface FileRoutesByFullPath {
  '/settings': typeof AuthSettingsRouteRouteWithChildren
  '/certificates': typeof AuthCertificatesRoute
  '/groups': typeof AuthGroupsRouteWithChildren
-  '/services': typeof AuthServicesRoute
  '/auth/callback': typeof AuthCallbackRoute
+  '/services/$serviceId': typeof AuthServicesServiceIdRouteRouteWithChildren
  '/groups/$groupId': typeof AuthGroupsGroupIdRoute
  '/settings/appearance': typeof AuthSettingsAppearanceRoute
  '/settings/integrations': typeof AuthSettingsIntegrationsRoute
  '/domains/': typeof AuthDomainsIndexRoute
+  '/services/': typeof AuthServicesIndexRoute
  '/settings/': typeof AuthSettingsIndexRoute
  '/domains/$domainId/dns': typeof AuthDomainsDomainIdDnsRoute
+  '/services/$serviceId/health': typeof AuthServicesServiceIdHealthRoute
+  '/services/$serviceId/nodes': typeof AuthServicesServiceIdNodesRoute
+  '/services/$serviceId/routing': typeof AuthServicesServiceIdRoutingRoute
+  '/services/$serviceId/subdomains': typeof AuthServicesServiceIdSubdomainsRoute
  '/domains/$domainId/': typeof AuthDomainsDomainIdIndexRoute
+  '/services/$serviceId/': typeof AuthServicesServiceIdIndexRoute
 }
 export interface FileRoutesByTo {
  '/login': typeof LoginRoute
  '/certificates': typeof AuthCertificatesRoute
  '/groups': typeof AuthGroupsRouteWithChildren
-  '/services': typeof AuthServicesRoute
  '/auth/callback': typeof AuthCallbackRoute
  '/': typeof AuthIndexRoute
  '/groups/$groupId': typeof AuthGroupsGroupIdRoute
  '/settings/appearance': typeof AuthSettingsAppearanceRoute
  '/settings/integrations': typeof AuthSettingsIntegrationsRoute
  '/domains': typeof AuthDomainsIndexRoute
+  '/services': typeof AuthServicesIndexRoute
  '/settings': typeof AuthSettingsIndexRoute
  '/domains/$domainId/dns': typeof AuthDomainsDomainIdDnsRoute
+  '/services/$serviceId/health': typeof AuthServicesServiceIdHealthRoute
+  '/services/$serviceId/nodes': typeof AuthServicesServiceIdNodesRoute
+  '/services/$serviceId/routing': typeof AuthServicesServiceIdRoutingRoute
+  '/services/$serviceId/subdomains': typeof AuthServicesServiceIdSubdomainsRoute
  '/domains/$domainId': typeof AuthDomainsDomainIdIndexRoute
+  '/services/$serviceId': typeof AuthServicesServiceIdIndexRoute
 }
 export interface FileRoutesById {
  __root__: typeof rootRouteImport
@@ -140,16 +193,22 @@ export interface FileRoutesById {
  '/_auth/settings': typeof AuthSettingsRouteRouteWithChildren
  '/_auth/certificates': typeof AuthCertificatesRoute
  '/_auth/groups': typeof AuthGroupsRouteWithChildren
-  '/_auth/services': typeof AuthServicesRoute
  '/auth/callback': typeof AuthCallbackRoute
  '/_auth/': typeof AuthIndexRoute
+  '/_auth/services/$serviceId': typeof AuthServicesServiceIdRouteRouteWithChildren
  '/_auth/groups/$groupId': typeof AuthGroupsGroupIdRoute
  '/_auth/settings/appearance': typeof AuthSettingsAppearanceRoute
  '/_auth/settings/integrations': typeof AuthSettingsIntegrationsRoute
  '/_auth/domains/': typeof AuthDomainsIndexRoute
+  '/_auth/services/': typeof AuthServicesIndexRoute
  '/_auth/settings/': typeof AuthSettingsIndexRoute
  '/_auth/domains/$domainId/dns': typeof AuthDomainsDomainIdDnsRoute
+  '/_auth/services/$serviceId/health': typeof AuthServicesServiceIdHealthRoute
+  '/_auth/services/$serviceId/nodes': typeof AuthServicesServiceIdNodesRoute
+  '/_auth/services/$serviceId/routing': typeof AuthServicesServiceIdRoutingRoute
+  '/_auth/services/$serviceId/subdomains': typeof AuthServicesServiceIdSubdomainsRoute
  '/_auth/domains/$domainId/': typeof AuthDomainsDomainIdIndexRoute
+  '/_auth/services/$serviceId/': typeof AuthServicesServiceIdIndexRoute
 }
 export interface FileRouteTypes {
  fileRoutesByFullPath: FileRoutesByFullPath
@@ -159,30 +218,41 @@ export interface FileRouteTypes {
    | '/settings'
    | '/certificates'
    | '/groups'
-    | '/services'
    | '/auth/callback'
+    | '/services/$serviceId'
    | '/groups/$groupId'
    | '/settings/appearance'
    | '/settings/integrations'
    | '/domains/'
+    | '/services/'
    | '/settings/'
    | '/domains/$domainId/dns'
+    | '/services/$serviceId/health'
+    | '/services/$serviceId/nodes'
+    | '/services/$serviceId/routing'
+    | '/services/$serviceId/subdomains'
    | '/domains/$domainId/'
+    | '/services/$serviceId/'
  fileRoutesByTo: FileRoutesByTo
  to:
    | '/login'
    | '/certificates'
    | '/groups'
-    | '/services'
    | '/auth/callback'
    | '/'
    | '/groups/$groupId'
    | '/settings/appearance'
    | '/settings/integrations'
    | '/domains'
+    | '/services'
    | '/settings'
    | '/domains/$domainId/dns'
+    | '/services/$serviceId/health'
+    | '/services/$serviceId/nodes'
+    | '/services/$serviceId/routing'
+    | '/services/$serviceId/subdomains'
    | '/domains/$domainId'
+    | '/services/$serviceId'
  id:
    | '__root__'
    | '/_auth'
@@ -190,16 +260,22 @@ export interface FileRouteTypes {
    | '/_auth/settings'
    | '/_auth/certificates'
    | '/_auth/groups'
-    | '/_auth/services'
    | '/auth/callback'
    | '/_auth/'
+    | '/_auth/services/$serviceId'
    | '/_auth/groups/$groupId'
    | '/_auth/settings/appearance'
    | '/_auth/settings/integrations'
    | '/_auth/domains/'
+    | '/_auth/services/'
    | '/_auth/settings/'
    | '/_auth/domains/$domainId/dns'
+    | '/_auth/services/$serviceId/health'
+    | '/_auth/services/$serviceId/nodes'
+    | '/_auth/services/$serviceId/routing'
+    | '/_auth/services/$serviceId/subdomains'
    | '/_auth/domains/$domainId/'
+    | '/_auth/services/$serviceId/'
  fileRoutesById: FileRoutesById
 }
 export interface RootRouteChildren {
@@ -210,13 +286,6 @@ export interface RootRouteChildren {

 declare module '@tanstack/react-router' {
  interface FileRoutesByPath {
-    '/_auth': {
-      id: '/_auth'
-      path: ''
-      fullPath: '/'
-      preLoaderRoute: typeof AuthRouteImport
-      parentRoute: typeof rootRouteImport
-    }
    '/login': {
      id: '/login'
      path: '/login'
@@ -224,6 +293,13 @@ declare module '@tanstack/react-router' {
      preLoaderRoute: typeof LoginRouteImport
      parentRoute: typeof rootRouteImport
    }
+    '/_auth': {
+      id: '/_auth'
+      path: ''
+      fullPath: '/'
+      preLoaderRoute: typeof AuthRouteImport
+      parentRoute: typeof rootRouteImport
+    }
    '/_auth/': {
      id: '/_auth/'
      path: '/'
@@ -231,12 +307,12 @@ declare module '@tanstack/react-router' {
      preLoaderRoute: typeof AuthIndexRouteImport
      parentRoute: typeof AuthRoute
    }
-    '/_auth/certificates': {
-      id: '/_auth/certificates'
-      path: '/certificates'
-      fullPath: '/certificates'
-      preLoaderRoute: typeof AuthCertificatesRouteImport
-      parentRoute: typeof AuthRoute
+    '/auth/callback': {
+      id: '/auth/callback'
+      path: '/auth/callback'
+      fullPath: '/auth/callback'
+      preLoaderRoute: typeof AuthCallbackRouteImport
+      parentRoute: typeof rootRouteImport
    }
    '/_auth/groups': {
      id: '/_auth/groups'
@@ -245,11 +321,11 @@ declare module '@tanstack/react-router' {
      preLoaderRoute: typeof AuthGroupsRouteImport
      parentRoute: typeof AuthRoute
    }
-    '/_auth/services': {
-      id: '/_auth/services'
-      path: '/services'
-      fullPath: '/services'
-      preLoaderRoute: typeof AuthServicesRouteImport
+    '/_auth/certificates': {
+      id: '/_auth/certificates'
+      path: '/certificates'
+      fullPath: '/certificates'
+      preLoaderRoute: typeof AuthCertificatesRouteImport
      parentRoute: typeof AuthRoute
    }
    '/_auth/settings': {
@@ -259,12 +335,19 @@ declare module '@tanstack/react-router' {
      preLoaderRoute: typeof AuthSettingsRouteRouteImport
      parentRoute: typeof AuthRoute
    }
-    '/auth/callback': {
-      id: '/auth/callback'
-      path: '/auth/callback'
-      fullPath: '/auth/callback'
-      preLoaderRoute: typeof AuthCallbackRouteImport
-      parentRoute: typeof rootRouteImport
+    '/_auth/settings/': {
+      id: '/_auth/settings/'
+      path: '/'
+      fullPath: '/settings/'
+      preLoaderRoute: typeof AuthSettingsIndexRouteImport
+      parentRoute: typeof AuthSettingsRouteRoute
+    }
+    '/_auth/services/': {
+      id: '/_auth/services/'
+      path: '/services'
+      fullPath: '/services/'
+      preLoaderRoute: typeof AuthServicesIndexRouteImport
+      parentRoute: typeof AuthRoute
    }
    '/_auth/domains/': {
      id: '/_auth/domains/'
@@ -273,18 +356,11 @@ declare module '@tanstack/react-router' {
      preLoaderRoute: typeof AuthDomainsIndexRouteImport
      parentRoute: typeof AuthRoute
    }
-    '/_auth/groups/$groupId': {
-      id: '/_auth/groups/$groupId'
-      path: '/$groupId'
-      fullPath: '/groups/$groupId'
-      preLoaderRoute: typeof AuthGroupsGroupIdRouteImport
-      parentRoute: typeof AuthGroupsRoute
-    }
-    '/_auth/settings/': {
-      id: '/_auth/settings/'
-      path: '/'
-      fullPath: '/settings/'
-      preLoaderRoute: typeof AuthSettingsIndexRouteImport
+    '/_auth/settings/integrations': {
+      id: '/_auth/settings/integrations'
+      path: '/integrations'
+      fullPath: '/settings/integrations'
+      preLoaderRoute: typeof AuthSettingsIntegrationsRouteImport
      parentRoute: typeof AuthSettingsRouteRoute
    }
    '/_auth/settings/appearance': {
@@ -294,12 +370,26 @@ declare module '@tanstack/react-router' {
      preLoaderRoute: typeof AuthSettingsAppearanceRouteImport
      parentRoute: typeof AuthSettingsRouteRoute
    }
-    '/_auth/settings/integrations': {
-      id: '/_auth/settings/integrations'
-      path: '/integrations'
-      fullPath: '/settings/integrations'
-      preLoaderRoute: typeof AuthSettingsIntegrationsRouteImport
-      parentRoute: typeof AuthSettingsRouteRoute
+    '/_auth/groups/$groupId': {
+      id: '/_auth/groups/$groupId'
+      path: '/$groupId'
+      fullPath: '/groups/$groupId'
+      preLoaderRoute: typeof AuthGroupsGroupIdRouteImport
+      parentRoute: typeof AuthGroupsRoute
+    }
+    '/_auth/services/$serviceId': {
+      id: '/_auth/services/$serviceId'
+      path: '/services/$serviceId'
+      fullPath: '/services/$serviceId'
+      preLoaderRoute: typeof AuthServicesServiceIdRouteRouteImport
+      parentRoute: typeof AuthRoute
+    }
+    '/_auth/services/$serviceId/': {
+      id: '/_auth/services/$serviceId/'
+      path: '/'
+      fullPath: '/services/$serviceId/'
+      preLoaderRoute: typeof AuthServicesServiceIdIndexRouteImport
+      parentRoute: typeof AuthServicesServiceIdRouteRoute
    }
    '/_auth/domains/$domainId/': {
      id: '/_auth/domains/$domainId/'
@@ -308,6 +398,34 @@ declare module '@tanstack/react-router' {
      preLoaderRoute: typeof AuthDomainsDomainIdIndexRouteImport
      parentRoute: typeof AuthRoute
    }
+    '/_auth/services/$serviceId/subdomains': {
+      id: '/_auth/services/$serviceId/subdomains'
+      path: '/subdomains'
+      fullPath: '/services/$serviceId/subdomains'
+      preLoaderRoute: typeof AuthServicesServiceIdSubdomainsRouteImport
+      parentRoute: typeof AuthServicesServiceIdRouteRoute
+    }
+    '/_auth/services/$serviceId/routing': {
+      id: '/_auth/services/$serviceId/routing'
+      path: '/routing'
+      fullPath: '/services/$serviceId/routing'
+      preLoaderRoute: typeof AuthServicesServiceIdRoutingRouteImport
+      parentRoute: typeof AuthServicesServiceIdRouteRoute
+    }
+    '/_auth/services/$serviceId/nodes': {
+      id: '/_auth/services/$serviceId/nodes'
+      path: '/nodes'
+      fullPath: '/services/$serviceId/nodes'
+      preLoaderRoute: typeof AuthServicesServiceIdNodesRouteImport
+      parentRoute: typeof AuthServicesServiceIdRouteRoute
+    }
+    '/_auth/services/$serviceId/health': {
+      id: '/_auth/services/$serviceId/health'
+      path: '/health'
+      fullPath: '/services/$serviceId/health'
+      preLoaderRoute: typeof AuthServicesServiceIdHealthRouteImport
+      parentRoute: typeof AuthServicesServiceIdRouteRoute
+    }
    '/_auth/domains/$domainId/dns': {
      id: '/_auth/domains/$domainId/dns'
      path: '/domains/$domainId/dns'
@@ -345,13 +463,36 @@ const AuthGroupsRouteWithChildren = AuthGroupsRoute._addFileChildren(
  AuthGroupsRouteChildren,
 )

+interface AuthServicesServiceIdRouteRouteChildren {
+  AuthServicesServiceIdHealthRoute: typeof AuthServicesServiceIdHealthRoute
+  AuthServicesServiceIdNodesRoute: typeof AuthServicesServiceIdNodesRoute
+  AuthServicesServiceIdRoutingRoute: typeof AuthServicesServiceIdRoutingRoute
+  AuthServicesServiceIdSubdomainsRoute: typeof AuthServicesServiceIdSubdomainsRoute
+  AuthServicesServiceIdIndexRoute: typeof AuthServicesServiceIdIndexRoute
+}
+
+const AuthServicesServiceIdRouteRouteChildren: AuthServicesServiceIdRouteRouteChildren =
+  {
+    AuthServicesServiceIdHealthRoute: AuthServicesServiceIdHealthRoute,
+    AuthServicesServiceIdNodesRoute: AuthServicesServiceIdNodesRoute,
+    AuthServicesServiceIdRoutingRoute: AuthServicesServiceIdRoutingRoute,
+    AuthServicesServiceIdSubdomainsRoute: AuthServicesServiceIdSubdomainsRoute,
+    AuthServicesServiceIdIndexRoute: AuthServicesServiceIdIndexRoute,
+  }
+
+const AuthServicesServiceIdRouteRouteWithChildren =
+  AuthServicesServiceIdRouteRoute._addFileChildren(
+    AuthServicesServiceIdRouteRouteChildren,
+  )
+
 interface AuthRouteChildren {
  AuthSettingsRouteRoute: typeof AuthSettingsRouteRouteWithChildren
  AuthCertificatesRoute: typeof AuthCertificatesRoute
  AuthGroupsRoute: typeof AuthGroupsRouteWithChildren
-  AuthServicesRoute: typeof AuthServicesRoute
  AuthIndexRoute: typeof AuthIndexRoute
+  AuthServicesServiceIdRouteRoute: typeof AuthServicesServiceIdRouteRouteWithChildren
  AuthDomainsIndexRoute: typeof AuthDomainsIndexRoute
+  AuthServicesIndexRoute: typeof AuthServicesIndexRoute
  AuthDomainsDomainIdDnsRoute: typeof AuthDomainsDomainIdDnsRoute
  AuthDomainsDomainIdIndexRoute: typeof AuthDomainsDomainIdIndexRoute
 }
@@ -360,9 +501,10 @@ const AuthRouteChildren: AuthRouteChildren = {
  AuthSettingsRouteRoute: AuthSettingsRouteRouteWithChildren,
  AuthCertificatesRoute: AuthCertificatesRoute,
  AuthGroupsRoute: AuthGroupsRouteWithChildren,
-  AuthServicesRoute: AuthServicesRoute,
  AuthIndexRoute: AuthIndexRoute,
+  AuthServicesServiceIdRouteRoute: AuthServicesServiceIdRouteRouteWithChildren,
  AuthDomainsIndexRoute: AuthDomainsIndexRoute,
+  AuthServicesIndexRoute: AuthServicesIndexRoute,
  AuthDomainsDomainIdDnsRoute: AuthDomainsDomainIdDnsRoute,
  AuthDomainsDomainIdIndexRoute: AuthDomainsDomainIdIndexRoute,
 }
@@ -7,6 +7,7 @@ import {
  FolderTreeIcon,
  GlobeIcon,
  PlugIcon,
+  HeartPulseIcon,
  ServerIcon,
  ShieldCheckIcon,
 } from 'lucide-react'
@@ -15,6 +16,7 @@ import {
  certSummaryQueryOptions,
  domainsListQueryOptions,
  groupsQueryOptions,
+  opsSummaryQueryOptions,
  serviceGroupsQueryOptions,
 } from '@/queries'
 import { PageShell } from '@/components/page-shell'
@@ -50,23 +52,18 @@ export const Route = createFileRoute('/_auth/')({
      queryClient.ensureQueryData(groupsQueryOptions()),
      queryClient.ensureQueryData(serviceGroupsQueryOptions()),
      queryClient.ensureQueryData(certificatesQueryOptions()),
+      queryClient.ensureQueryData(opsSummaryQueryOptions()),
    ]),
  component: DashboardPage,
 })

-function countByStatus(summary: [string, number][] | undefined, statuses: string[]) {
-  if (!summary) return 0
-  return summary
-    .filter(([status]) => statuses.includes(status))
-    .reduce((sum, [, count]) => sum + count, 0)
-}
-
 function DashboardPage() {
  const { data: domains, isLoading: domainsLoading } = useQuery(domainsListQueryOptions())
  const { data: summary, isLoading: summaryLoading } = useQuery(certSummaryQueryOptions())
  const { data: certs } = useQuery(certificatesQueryOptions())
  const { data: groups } = useQuery(groupsQueryOptions())
  const { data: serviceData } = useQuery(serviceGroupsQueryOptions())
+  const { data: ops } = useQuery(opsSummaryQueryOptions())
  const { data: appSettings } = useQuery({
    queryKey: ['app-settings'],
    queryFn: () => api.get<{ showQuickActions?: boolean }>('/api/v1/settings'),
@@ -202,8 +199,7 @@ function DashboardPage() {

  const attentionCount = attentionServices.length

-  const certWarnings = countByStatus(summary, ['warning', 'expired', 'error'])
-  const certOk = countByStatus(summary, ['active', 'ok'])
+  const ungroupedServiceCount = serviceData?.ungrouped.length ?? 0

  useEffect(() => {
    if (isLoading) return
@@ -224,7 +220,6 @@ function DashboardPage() {
    )
  }, [isLoading, summary, statusChartData, groupChartData, domains, groups])

-  const ungroupedServiceCount = serviceData?.ungrouped.length ?? 0
  const kpiCards: KpiStatCard[] = [
    {
      id: 'domains',
@@ -239,19 +234,10 @@ function DashboardPage() {
      variant: ungroupedCount > 0 ? 'warning' : 'default',
      to: '/domains',
    },
-    {
-      id: 'groups',
-      label: 'Группы',
-      value: groups?.length ?? 0,
-      hint: `${groupChartData.filter((g) => g.count > 0).length} с зонами`,
-      icon: <FolderTreeIcon aria-hidden />,
-      iconClassName: 'text-primary',
-      to: '/groups',
-    },
    {
      id: 'services',
      label: 'Сервисы',
-      value: serviceCount,
+      value: ops?.services ?? serviceCount,
      hint: attentionCount
        ? `${attentionCount} требуют внимания`
        : ungroupedServiceCount
@@ -264,17 +250,37 @@ function DashboardPage() {
      search: { domainId: undefined },
    },
    {
-      id: 'certs',
-      label: 'Сертификаты',
-      value: certs?.length ?? 0,
-      hint:
-        certWarnings > 0
-          ? `${certOk} в норме · ${certWarnings} внимания`
-          : `${certOk} в норме`,
-      icon: <ShieldCheckIcon aria-hidden />,
+      id: 'nodes',
+      label: 'Ноды',
+      value: ops?.nodes ?? 0,
+      hint: `${ops?.healthy ?? 0} healthy`,
+      icon: <HeartPulseIcon aria-hidden />,
+      iconClassName: 'text-info',
+      to: '/services',
+    },
+    {
+      id: 'healthy',
+      label: 'Healthy',
+      value: ops?.healthy ?? 0,
+      icon: <ActivityIcon aria-hidden />,
+      iconClassName: 'text-success',
+    },
+    {
+      id: 'unhealthy',
+      label: 'Unhealthy',
+      value: ops?.unhealthy ?? 0,
+      variant: (ops?.unhealthy ?? 0) > 0 ? 'destructive' : 'default',
+      icon: <AlertTriangleIcon aria-hidden />,
+      iconClassName: 'text-destructive',
+    },
+    {
+      id: 'failovers',
+      label: 'Failover',
+      value: ops?.active_failovers ?? 0,
+      hint: 'активные переключения',
+      variant: (ops?.active_failovers ?? 0) > 0 ? 'warning' : 'default',
+      icon: <ActivityIcon aria-hidden />,
      iconClassName: 'text-warning',
-      variant: certWarnings > 0 ? 'warning' : 'default',
-      to: '/certificates',
    },
  ]

@@ -0,0 +1,158 @@
+import { createFileRoute } from '@tanstack/react-router'
+import { useState } from 'react'
+import { useForm } from 'react-hook-form'
+import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query'
+import { toast } from 'sonner'
+import { DetailPanel } from '@/components/reui-kit'
+import { EmptyState } from '@/components/empty-state'
+import { FormSheet } from '@/components/form-sheet'
+import { FormFieldSimple } from '@/components/form-field'
+import { LoadingButton } from '@/components/loading-button'
+import { Button } from '@cfdm/ui/components/button'
+import { Input } from '@cfdm/ui/components/input'
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from '@cfdm/ui/components/select'
+import { Alert, AlertDescription, AlertTitle } from '@/components/reui/alert'
+import {
+  createOriginHealthCheck,
+  listOriginHealthChecks,
+  serviceOverviewQueryOptions,
+} from '@/queries'
+
+export const Route = createFileRoute('/_auth/services/$serviceId/health')({
+  component: ServiceHealthPage,
+})
+
+export function ServiceHealthPage() {
+  const { serviceId } = Route.useParams()
+  const id = Number(serviceId)
+  const queryClient = useQueryClient()
+  const overview = useQuery(serviceOverviewQueryOptions(id))
+  const checksQuery = useQuery({
+    queryKey: ['health-checks'],
+    queryFn: listOriginHealthChecks,
+  })
+  const [open, setOpen] = useState(false)
+  const form = useForm<{
+    name: string
+    provider: 'local' | 'cloudflare'
+    protocol: string
+  }>({
+    defaultValues: { name: '', provider: 'local', protocol: 'tcp' },
+  })
+  const provider = form.watch('provider')
+  const checks = (checksQuery.data ?? []) as Array<{
+    id: number
+    name: string
+    provider: string
+    protocol: string
+  }>
+
+  const createMut = useMutation({
+    mutationFn: (values: { name: string; provider: 'local' | 'cloudflare'; protocol: string }) =>
+      createOriginHealthCheck({
+        name: values.name,
+        provider: values.provider,
+        protocol: values.protocol,
+      }),
+    onSuccess: async () => {
+      toast.success('Health check сохранён')
+      await queryClient.invalidateQueries({ queryKey: ['health-checks'] })
+      setOpen(false)
+    },
+    onError: (e: unknown) =>
+      toast.error(
+        e instanceof Error
+          ? e.message
+          : 'Cloudflare Health Checks недоступны для этой зоны',
+      ),
+  })
+
+  void overview
+
+  return (
+    <DetailPanel>
+      <DetailPanel.Header
+        title="Health checks"
+        description="Local TCP/HTTP или официальный Cloudflare Health Checks API."
+        actions={
+          <Button size="sm" onClick={() => setOpen(true)}>
+            Добавить проверку
+          </Button>
+        }
+      />
+      {checks.length === 0 ? (
+        <EmptyState
+          title="Нет проверок"
+          description="Локальные пробы уже работают на привязках. Cloudflare Health Checks — опционально."
+        />
+      ) : (
+        <div className="flex flex-col gap-2">
+          {checks.map((check) => (
+            <div
+              key={check.id}
+              className="flex items-center justify-between gap-3 border-b py-3 last:border-0"
+            >
+              <div className="flex flex-col gap-1">
+                <span className="font-medium">{check.name}</span>
+                <span className="text-muted-foreground text-xs">
+                  {check.provider} · {check.protocol}
+                </span>
+              </div>
+            </div>
+          ))}
+        </div>
+      )}
+      <FormSheet
+        open={open}
+        onOpenChange={setOpen}
+        title="Health check"
+        description="Поля Cloudflare соответствуют официальному API (address, type, interval, timeout, retries)."
+        form={form}
+        onSubmit={(values) => createMut.mutate(values)}
+        footer={
+          <LoadingButton type="submit" isLoading={createMut.isPending}>
+            Сохранить
+          </LoadingButton>
+        }
+      >
+        <FormFieldSimple label="Имя" htmlFor="hc-name">
+          <Input id="hc-name" {...form.register('name')} />
+        </FormFieldSimple>
+        <FormFieldSimple label="Провайдер" htmlFor="hc-provider">
+          <Select
+            value={provider}
+            onValueChange={(value) =>
+              form.setValue('provider', (value as 'local' | 'cloudflare') ?? 'local')
+            }
+          >
+            <SelectTrigger id="hc-provider">
+              <SelectValue />
+            </SelectTrigger>
+            <SelectContent>
+              <SelectItem value="local">Local</SelectItem>
+              <SelectItem value="cloudflare">Cloudflare</SelectItem>
+            </SelectContent>
+          </Select>
+        </FormFieldSimple>
+        {provider === 'cloudflare' ? (
+          <Alert>
+            <AlertTitle>Cloudflare Health Checks</AlertTitle>
+            <AlertDescription>
+              Если зона не поддерживает Health Checks, вернётся ошибка плана — останется
+              Local. Workers не используются.
+            </AlertDescription>
+          </Alert>
+        ) : null}
+        <FormFieldSimple label="Протокол" htmlFor="hc-protocol">
+          <Input id="hc-protocol" {...form.register('protocol')} placeholder="tcp" />
+        </FormFieldSimple>
+      </FormSheet>
+    </DetailPanel>
+  )
+}
@@ -0,0 +1,94 @@
+import { createFileRoute } from '@tanstack/react-router'
+import { useQuery } from '@tanstack/react-query'
+import { ActivityIcon, GlobeIcon, ServerIcon } from 'lucide-react'
+import { DetailPanel } from '@/components/reui-kit'
+import { EmptyState } from '@/components/empty-state'
+import { HealthCheckBadge } from '@/components/health-check-badge'
+import { Badge } from '@/components/reui/badge'
+import { serviceOverviewQueryOptions } from '@/queries'
+
+export const Route = createFileRoute('/_auth/services/$serviceId/')({
+  component: ServiceOverviewPage,
+})
+
+function ServiceOverviewPage() {
+  const { serviceId } = Route.useParams()
+  const { data } = useQuery(serviceOverviewQueryOptions(Number(serviceId)))
+  const overview = data as {
+    service: {
+      name: string
+      enabled: boolean
+      health_status: 'up' | 'down' | 'degraded' | 'unknown'
+      domains: Array<{ fqdn: string; zone_name: string }>
+    }
+    nodes: Array<{ id: number; address: string; health_status: string }>
+    routing_strategy: string
+    active_addresses: string[]
+  } | undefined
+
+  if (!overview) {
+    return (
+      <EmptyState
+        title="Сервис не найден"
+        description="Вернитесь в каталог и выберите сервис."
+      />
+    )
+  }
+
+  const nodes = overview.nodes ?? []
+  const domains = overview.service.domains ?? []
+
+  return (
+    <DetailPanel>
+      <DetailPanel.Header
+        title={overview.service.name}
+        description={`Маршрутизация: ${overview.routing_strategy}. Активные IP: ${
+          overview.active_addresses.join(', ') || '—'
+        }`}
+        actions={
+          <HealthCheckBadge status={overview.service.health_status} />
+        }
+      />
+      <DetailPanel.Metrics
+        cards={[
+          {
+            id: 'subdomains',
+            icon: <GlobeIcon />,
+            label: 'Поддомены',
+            description:
+              domains.length > 0
+                ? domains.map((d) => d.fqdn).join(', ')
+                : 'Нет привязанных FQDN',
+            footer: <Badge variant="outline">{domains.length}</Badge>,
+          },
+          {
+            id: 'nodes',
+            icon: <ServerIcon />,
+            label: 'Ноды',
+            description:
+              nodes.length > 0
+                ? nodes.map((n) => n.address).join(', ')
+                : 'Добавьте ноду, чтобы публиковать DNS',
+            footer: <Badge variant="outline">{nodes.length}</Badge>,
+          },
+          {
+            id: 'health',
+            icon: <ActivityIcon />,
+            label: 'Пул',
+            description:
+              overview.active_addresses.length > 0
+                ? 'Здоровые адреса участвуют в DNS'
+                : 'unknown не попадает в пул, пока не станет healthy',
+          },
+        ]}
+      />
+      {domains.length === 0 && nodes.length === 0 ? (
+        <EmptyState
+          title="Пустой сервис"
+          description="Добавьте поддомен и ноду, затем настройте health-check."
+          stackedIcon
+        />
+      ) : null}
+    </DetailPanel>
+  )
+}
@@ -0,0 +1,143 @@
+import { createFileRoute } from '@tanstack/react-router'
+import { useState } from 'react'
+import { useForm } from 'react-hook-form'
+import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query'
+import { toast } from 'sonner'
+import { PlusIcon } from 'lucide-react'
+import { DetailPanel } from '@/components/reui-kit'
+import { EmptyState } from '@/components/empty-state'
+import { FormSheet } from '@/components/form-sheet'
+import { FormFieldSimple } from '@/components/form-field'
+import { LoadingButton } from '@/components/loading-button'
+import { HealthCheckBadge } from '@/components/health-check-badge'
+import { Button } from '@cfdm/ui/components/button'
+import { Input } from '@cfdm/ui/components/input'
+import { createServiceNode, deleteServiceNode, serviceNodesQueryOptions } from '@/queries'
+
+export const Route = createFileRoute('/_auth/services/$serviceId/nodes')({
+  component: ServiceNodesPage,
+})
+
+interface NodeRow {
+  id: number
+  address: string
+  port: number | null
+  protocol: string
+  health_status: 'up' | 'down' | 'degraded' | 'unknown' | 'healthy' | 'unhealthy' | 'checking' | 'disabled'
+  weight: number
+  priority: number
+}
+
+function mapHealth(
+  status: NodeRow['health_status'],
+): 'up' | 'down' | 'degraded' | 'unknown' {
+  if (status === 'healthy' || status === 'up') return 'up'
+  if (status === 'unhealthy' || status === 'down') return 'down'
+  if (status === 'degraded') return 'degraded'
+  return 'unknown'
+}
+
+export function ServiceNodesPage() {
+  const { serviceId } = Route.useParams()
+  const id = Number(serviceId)
+  const queryClient = useQueryClient()
+  const nodesQuery = useQuery(serviceNodesQueryOptions(id))
+  const nodes = (nodesQuery.data ?? []) as NodeRow[]
+  const [open, setOpen] = useState(false)
+  const form = useForm<{ address: string; port: string }>({
+    defaultValues: { address: '', port: '' },
+  })
+
+  const createMut = useMutation({
+    mutationFn: (values: { address: string; port: string }) =>
+      createServiceNode(id, {
+        address: values.address.trim(),
+        port: values.port ? Number(values.port) : null,
+      }),
+    onSuccess: async () => {
+      toast.success('Нода добавлена, статус CHECKING')
+      await queryClient.invalidateQueries({ queryKey: ['services'] })
+      setOpen(false)
+      form.reset()
+    },
+    onError: (e: unknown) =>
+      toast.error(e instanceof Error ? e.message : 'Не удалось добавить ноду'),
+  })
+
+  const deleteMut = useMutation({
+    mutationFn: (nodeId: number) => deleteServiceNode(id, nodeId),
+    onSuccess: async () => {
+      toast.success('Нода удалена')
+      await queryClient.invalidateQueries({ queryKey: ['services'] })
+    },
+  })
+
+  return (
+    <DetailPanel>
+      <DetailPanel.Header
+        title="Ноды"
+        description="Адреса происхождения сервиса."
+        actions={
+          <Button size="sm" onClick={() => setOpen(true)}>
+            <PlusIcon className="size-4" aria-hidden />
+            Добавить ноду
+          </Button>
+        }
+      />
+      {nodes.length === 0 ? (
+        <EmptyState
+          title="Нет нод"
+          description="Добавьте IP, затем настройте health-check."
+        />
+      ) : (
+        <div className="flex flex-col gap-2">
+          {nodes.map((node) => (
+            <div
+              key={node.id}
+              className="flex items-center justify-between gap-3 border-b py-3 last:border-0"
+            >
+              <div className="flex flex-col gap-1">
+                <span className="font-medium">{node.address}</span>
+                <span className="text-muted-foreground text-xs">
+                  {node.protocol}
+                  {node.port ? `:${node.port}` : ''} · вес {node.weight} · приоритет{' '}
+                  {node.priority}
+                </span>
+              </div>
+              <div className="flex items-center gap-2">
+                <HealthCheckBadge status={mapHealth(node.health_status)} />
+                <Button
+                  size="sm"
+                  variant="outline"
+                  onClick={() => deleteMut.mutate(node.id)}
+                >
+                  Удалить
+                </Button>
+              </div>
+            </div>
+          ))}
+        </div>
+      )}
+      <FormSheet
+        open={open}
+        onOpenChange={setOpen}
+        title="Добавить ноду"
+        description="IP станет CHECKING до порога успешных проверок."
+        form={form}
+        onSubmit={(values) => createMut.mutate(values)}
+        footer={
+          <LoadingButton type="submit" isLoading={createMut.isPending}>
+            Добавить
+          </LoadingButton>
+        }
+      >
+        <FormFieldSimple label="IP" htmlFor="address">
+          <Input id="address" {...form.register('address')} placeholder="10.0.0.10" />
+        </FormFieldSimple>
+        <FormFieldSimple label="Порт" htmlFor="port" hint="Необязательно">
+          <Input id="port" {...form.register('port')} placeholder="443" />
+        </FormFieldSimple>
+      </FormSheet>
+    </DetailPanel>
+  )
+}
@@ -0,0 +1,79 @@
+import { createFileRoute, Link, Outlet, useRouterState } from '@tanstack/react-router'
+import { useQuery } from '@tanstack/react-query'
+import { ArrowLeftIcon } from 'lucide-react'
+import { PageShell } from '@/components/page-shell'
+import { PageHeader } from '@/components/page-header'
+import { QueryState } from '@/components/query-state'
+import { Button } from '@cfdm/ui/components/button'
+import { serviceOverviewQueryOptions } from '@/queries'
+import { cn } from '@cfdm/ui/lib/utils'
+
+export const Route = createFileRoute('/_auth/services/$serviceId')({
+  loader: ({ context: { queryClient }, params }) =>
+    queryClient.ensureQueryData(serviceOverviewQueryOptions(Number(params.serviceId))),
+  component: ServiceLayout,
+})
+
+const tabs = [
+  { to: '/services/$serviceId', label: 'Обзор', exact: true },
+  { to: '/services/$serviceId/subdomains', label: 'Поддомены', exact: false },
+  { to: '/services/$serviceId/nodes', label: 'Ноды', exact: false },
+  { to: '/services/$serviceId/health', label: 'Health', exact: false },
+  { to: '/services/$serviceId/routing', label: 'Маршрутизация', exact: false },
+] as const
+
+function ServiceLayout() {
+  const { serviceId } = Route.useParams()
+  const id = Number(serviceId)
+  const pathname = useRouterState({ select: (s) => s.location.pathname })
+  const overview = useQuery(serviceOverviewQueryOptions(id))
+  const name = (overview.data as { service?: { name?: string } } | undefined)?.service?.name
+
+  return (
+    <PageShell>
+      <PageHeader
+        title={name ?? 'Сервис'}
+        description="Domain → Service → Node → Health → Failover"
+        actions={
+          <Button
+            variant="outline"
+            size="sm"
+            render={<Link to="/services" />}
+          >
+            <ArrowLeftIcon className="size-4" aria-hidden />
+            К каталогу
+          </Button>
+        }
+      />
+      <nav className="flex flex-wrap gap-4 border-b">
+        {tabs.map((tab) => {
+          const href = tab.to.replace('$serviceId', serviceId)
+          const active = tab.exact
+            ? pathname === `/services/${serviceId}` || pathname === `/services/${serviceId}/`
+            : pathname.startsWith(href)
+          return (
+            <Link
+              key={tab.to}
+              to={tab.to}
+              params={{ serviceId }}
+              className={cn(
+                'text-muted-foreground hover:text-foreground pb-3 text-sm font-medium',
+                active && 'text-foreground border-b-2 border-primary',
+              )}
+            >
+              {tab.label}
+            </Link>
+          )
+        })}
+      </nav>
+      <QueryState
+        isLoading={overview.isLoading}
+        isError={overview.isError}
+        error={overview.error}
+        onRetry={() => void overview.refetch()}
+      >
+        <Outlet />
+      </QueryState>
+    </PageShell>
+  )
+}
@@ -0,0 +1,59 @@
+import { createFileRoute } from '@tanstack/react-router'
+import { useQuery } from '@tanstack/react-query'
+import { DetailPanel } from '@/components/reui-kit'
+import { FailoverTimeline } from '@/components/failover-timeline'
+import { Badge } from '@/components/reui/badge'
+import { serviceOverviewQueryOptions } from '@/queries'
+
+export const Route = createFileRoute('/_auth/services/$serviceId/routing')({
+  component: ServiceRoutingPage,
+})
+
+export function ServiceRoutingPage() {
+  const { serviceId } = Route.useParams()
+  const { data } = useQuery(serviceOverviewQueryOptions(Number(serviceId)))
+  const overview = data as {
+    routing_strategy: string
+    active_addresses: string[]
+    nodes: Array<{
+      address: string
+      health_status: string
+      consecutive_failures: number
+      last_failure_reason: string | null
+    }>
+  } | undefined
+
+  const events =
+    overview?.nodes
+      .filter(
+        (node) =>
+          node.health_status === 'unhealthy' ||
+          node.health_status === 'down' ||
+          node.health_status === 'checking',
+      )
+      .map((node) => ({
+        id: node.address,
+        title: `${node.address}: ${node.health_status}`,
+        detail: node.last_failure_reason
+          ? `${node.last_failure_reason} · fail ${node.consecutive_failures}`
+          : `fail ${node.consecutive_failures}`,
+      })) ?? []
+
+  return (
+    <DetailPanel>
+      <DetailPanel.Header
+        title="Маршрутизация"
+        description="Round Robin / Failover. Weighted на DNS = alias Round Robin."
+        actions={<Badge variant="outline">{overview?.routing_strategy ?? 'round_robin'}</Badge>}
+      />
+      <p className="text-sm">
+        Активные адреса:{' '}
+        {overview?.active_addresses.join(', ') || 'нет (unknown не в пуле)'}
+      </p>
+      <p className="text-muted-foreground text-xs">
+        Запись обновляется в Cloudflare. Распространение зависит от TTL.
+      </p>
+      <FailoverTimeline events={events} />
+    </DetailPanel>
+  )
+}
@@ -0,0 +1,114 @@
+import { createFileRoute } from '@tanstack/react-router'
+import { useMemo, useState } from 'react'
+import { useQuery } from '@tanstack/react-query'
+import { ArrowRightLeftIcon } from 'lucide-react'
+import { DetailPanel } from '@/components/reui-kit'
+import { EmptyState } from '@/components/empty-state'
+import { Button } from '@cfdm/ui/components/button'
+import { Badge } from '@/components/reui/badge'
+import { ChangeIpSheet } from '@/components/change-ip-sheet'
+import { ChangeDomainSheet } from '@/components/change-domain-sheet'
+import { serviceOverviewQueryOptions } from '@/queries'
+
+export const Route = createFileRoute('/_auth/services/$serviceId/subdomains')({
+  component: ServiceSubdomainsPage,
+})
+
+export function ServiceSubdomainsPage() {
+  const { serviceId } = Route.useParams()
+  const id = Number(serviceId)
+  const { data } = useQuery(serviceOverviewQueryOptions(id))
+  const overview = data as {
+    service: {
+      domains: Array<{
+        binding_id: number
+        domain_id: number
+        fqdn: string
+        zone_name: string
+        target_ips: string[]
+      }>
+    }
+  } | undefined
+  const rows = overview?.service.domains ?? []
+  const [changeIp, setChangeIp] = useState<{
+    bindingId: number
+    ip?: string
+  } | null>(null)
+  const [changeDomain, setChangeDomain] = useState(false)
+  const fromDomainId = useMemo(
+    () => rows[0]?.domain_id ?? null,
+    [rows],
+  )
+
+  return (
+    <DetailPanel>
+      <DetailPanel.Header
+        title="Поддомены"
+        description="FQDN сервиса в одной или нескольких зонах Cloudflare."
+        actions={
+          <Button
+            variant="outline"
+            size="sm"
+            onClick={() => setChangeDomain(true)}
+            disabled={rows.length === 0}
+          >
+            <ArrowRightLeftIcon className="size-4" aria-hidden />
+            Сменить домен
+          </Button>
+        }
+      />
+      {rows.length === 0 ? (
+        <EmptyState
+          title="Нет поддоменов"
+          description="Привяжите FQDN к сервису из карточки редактирования."
+        />
+      ) : (
+        <div className="flex flex-col gap-2">
+          {rows.map((row) => (
+            <div
+              key={row.binding_id}
+              className="flex items-center justify-between gap-3 border-b py-3 last:border-0"
+            >
+              <div className="flex min-w-0 flex-col gap-1">
+                <span className="font-medium">{row.fqdn}</span>
+                <span className="text-muted-foreground text-xs">
+                  {row.zone_name} · {row.target_ips.join(', ') || 'нет IP'}
+                </span>
+              </div>
+              <div className="flex items-center gap-2">
+                <Badge variant="outline">{row.target_ips.length} IP</Badge>
+                <Button
+                  size="sm"
+                  variant="outline"
+                  onClick={() =>
+                    setChangeIp({
+                      bindingId: row.binding_id,
+                      ip: row.target_ips[0],
+                    })
+                  }
+                >
+                  Сменить IP
+                </Button>
+              </div>
+            </div>
+          ))}
+        </div>
+      )}
+      <ChangeIpSheet
+        open={changeIp != null}
+        onOpenChange={(open) => {
+          if (!open) setChangeIp(null)
+        }}
+        bindingId={changeIp?.bindingId ?? null}
+        serviceId={id}
+        currentIp={changeIp?.ip}
+      />
+      <ChangeDomainSheet
+        open={changeDomain}
+        onOpenChange={setChangeDomain}
+        serviceId={id}
+        fromDomainId={fromDomainId}
+      />
+    </DetailPanel>
+  )
+}
@@ -43,7 +43,7 @@ import {
 import { ServiceKanbanCard } from '@/components/kanban/service-kanban-card'
 import { Button } from '@cfdm/ui/components/button'

-export const Route = createFileRoute('/_auth/services')({
+export const Route = createFileRoute('/_auth/services/')({
  validateSearch: (
    search: Record<string, unknown>,
  ): { domainId?: number; serviceId?: number; view?: 'board' } => ({