feat(health-checks): enhance health check functionality and add new routes

- Introduced origin health check routes and integrated them into the application. - Updated health check configuration to include success recovery thresholds. - Expanded error handling with new error codes for health check failures. - Added new service routes for managing health checks, including creation and listing. - Improved health check service logic to track consecutive successes and failures. This commit enhances the health check capabilities, providing better monitoring and management of service health.
2026-08-19 12:26:12 +07:00
parent 9c00b268dc
commit 3f6f402872
64 changed files with 6356 additions and 360 deletions
@@ -24,6 +24,7 @@ import { dnsRoutes } from "./routes/dns.js";
 import { subdomainRoutes } from "./routes/subdomains.js";
 import { certificateRoutes } from "./routes/certificates.js";
 import { syncRoutes } from "./routes/sync.js";
+import { originHealthCheckRoutes } from "./routes/origin-health-checks.js";
 import { healthCheckRoutes } from "./routes/health-check.js";
 import {
  domainMonitorRoutes,
@@ -81,6 +82,7 @@ export async function buildApp(opts: BuildAppOptions = {}) {
      await protectedApi.register(certificateRoutes);
      await protectedApi.register(syncRoutes);
      await protectedApi.register(healthCheckRoutes);
+      await protectedApi.register(originHealthCheckRoutes);
      await protectedApi.register(domainMonitorRoutes);
      await protectedApi.register(notificationRoutes);
      await protectedApi.register(settingsRoutes);
@@ -130,6 +132,7 @@ export async function buildApp(opts: BuildAppOptions = {}) {
          degradedFailures: config.healthDegradedFailures,
          downFailures: config.healthDownFailures,
          latencyWarnMs: config.healthLatencyWarnMs,
+          successRecoveries: config.healthSuccessRecoveries,
        };
        const n = await healthCheckService.runAllChecks(app.db, {
          thresholds,
@@ -13,6 +13,7 @@ export interface AppConfig {
  healthCheckCron: string;
  healthDegradedFailures: number;
  healthDownFailures: number;
+  healthSuccessRecoveries: number;
  healthLatencyWarnMs: number;
  /** Min pause between probes to different physical targets (same IP is probed once). */
  healthProbeGapMs: number;
@@ -55,6 +56,8 @@ export function loadConfig(): AppConfig {
    healthDegradedFailures:
      Number(process.env.HEALTH_DEGRADED_FAILURES ?? "1") || 1,
    healthDownFailures: Number(process.env.HEALTH_DOWN_FAILURES ?? "2") || 2,
+    healthSuccessRecoveries:
+      Number(process.env.HEALTH_SUCCESS_RECOVERIES ?? "2") || 2,
    healthLatencyWarnMs:
      Number(process.env.HEALTH_LATENCY_WARN_MS ?? "1000") || 1000,
    healthProbeGapMs: Number(process.env.HEALTH_PROBE_GAP_MS ?? "2000") || 2000,
@@ -8,6 +8,14 @@ export type ErrorCode =
  | "FORBIDDEN"
  | "CONFLICT"
  | "CLOUDFLARE_ERROR"
+  | "DNS_UPDATE_FAILED"
+  | "HEALTHCHECK_CREATE_FAILED"
+  | "ZONE_NOT_FOUND"
+  | "INVALID_IP"
+  | "INVALID_HOSTNAME"
+  | "RATE_LIMITED"
+  | "CLOUDFLARE_AUTH_FAILED"
+  | "SYNC_FAILED"
  | "INTERNAL_ERROR";

 export class AppError extends Error {
@@ -44,6 +52,42 @@ export class AppError extends Error {
    return new AppError("CLOUDFLARE_ERROR", message, 502);
  }

+  static dnsUpdateFailed(message: string) {
+    return new AppError(
+      "DNS_UPDATE_FAILED",
+      message,
+      502,
+    );
+  }
+
+  static healthcheckCreateFailed(message: string) {
+    return new AppError("HEALTHCHECK_CREATE_FAILED", message, 502);
+  }
+
+  static zoneNotFound(message = "зона Cloudflare не найдена") {
+    return new AppError("ZONE_NOT_FOUND", message, 404);
+  }
+
+  static invalidIp(message = "Некорректный IP-адрес") {
+    return new AppError("INVALID_IP", message, 400);
+  }
+
+  static invalidHostname(message = "Некорректное имя хоста") {
+    return new AppError("INVALID_HOSTNAME", message, 400);
+  }
+
+  static rateLimited(message = "Cloudflare временно ограничил запросы. Повторите попытку.") {
+    return new AppError("RATE_LIMITED", message, 429);
+  }
+
+  static cloudflareAuthFailed(message = "Cloudflare отклонил токен доступа") {
+    return new AppError("CLOUDFLARE_AUTH_FAILED", message, 401);
+  }
+
+  static syncFailed(message: string) {
+    return new AppError("SYNC_FAILED", message, 502);
+  }
+
  static internal(message: string) {
    return new AppError("INTERNAL_ERROR", message, 500);
  }
@@ -1,152 +1,84 @@
 import type {
  CfDnsRecord,
+  CfHealthCheck,
  CfZone,
  CreateDnsRecordPayload,
+  PatchDnsRecordPayload,
 } from "@cfdm/shared";
-import { AppError } from "../errors.js";
-import { withRetry, parseRetryAfter } from "./cf-retry.js";
+import { createDnsAdapter } from "./cloudflare/dns-service.js";
+import { createHealthCheckAdapter, type CfHealthCheckPayload } from "./cloudflare/healthcheck-service.js";
+import { createZoneAdapter } from "./cloudflare/zone-service.js";

-const BASE_URL = "https://api.cloudflare.com/client/v4";
-
-interface CfResponse<T> {
-  success: boolean;
-  result?: T;
-  errors?: Array<{ code: number; message: string }>;
-}
+export type { CfHealthCheckPayload };

 export class CloudflareClient {
-  constructor(private readonly token: string) {}
+  private readonly zones;
+  private readonly dns;
+  private readonly healthchecks;

-  private async handleResponse<T>(
-    response: Response,
-    operation: string,
-  ): Promise<T> {
-    if (response.status === 429) {
-      const wait = parseRetryAfter(response.headers) ?? 5000;
-      throw AppError.cloudflare(`rate limited, retry after ${wait}ms`);
-    }
-
-    const body = (await response.json()) as CfResponse<T>;
-    if (!body.success) {
-      const msg =
-        body.errors?.map((e) => e.message).join("; ") ??
-        "unknown cloudflare error";
-      throw AppError.cloudflare(`${operation}: ${msg}`);
-    }
-    if (body.result === undefined) {
-      throw AppError.cloudflare(`${operation}: empty result`);
-    }
-    return body.result;
+  constructor(token: string) {
+    this.zones = createZoneAdapter(token);
+    this.dns = createDnsAdapter(token);
+    this.healthchecks = createHealthCheckAdapter(token);
  }

-  async listZones(): Promise<CfZone[]> {
-    return withRetry(async () => {
-      const all: CfZone[] = [];
-      let page = 1;
-      while (true) {
-        const url = new URL(`${BASE_URL}/zones`);
-        url.searchParams.set("per_page", "50");
-        url.searchParams.set("page", String(page));
-        const response = await fetch(url, {
-          headers: { Authorization: `Bearer ${this.token}` },
-          signal: AbortSignal.timeout(30_000),
-        });
-        if (response.status >= 500 || response.status === 429) {
-          throw AppError.cloudflare(String(response.status));
-        }
-        const batch = await this.handleResponse<CfZone[]>(
-          response,
-          "list_zones",
-        );
-        if (batch.length === 0) break;
-        all.push(...batch);
-        if (batch.length < 50) break;
-        page += 1;
-      }
-      return all;
-    });
+  listZones(): Promise<CfZone[]> {
+    return this.zones.listZones();
  }

-  async getZone(zoneId: string): Promise<CfZone> {
-    const response = await fetch(`${BASE_URL}/zones/${zoneId}`, {
-      headers: { Authorization: `Bearer ${this.token}` },
-      signal: AbortSignal.timeout(30_000),
-    });
-    return this.handleResponse(response, "get_zone");
+  getZone(zoneId: string): Promise<CfZone> {
+    return this.zones.getZone(zoneId);
  }

-  async listDnsRecords(zoneId: string): Promise<CfDnsRecord[]> {
-    return withRetry(async () => {
-      const all: CfDnsRecord[] = [];
-      let page = 1;
-      while (page <= 50) {
-        const url = new URL(`${BASE_URL}/zones/${zoneId}/dns_records`);
-        url.searchParams.set("per_page", "100");
-        url.searchParams.set("page", String(page));
-        const response = await fetch(url, {
-          headers: { Authorization: `Bearer ${this.token}` },
-          signal: AbortSignal.timeout(30_000),
-        });
-        if (response.status >= 500 || response.status === 429) {
-          throw AppError.cloudflare(String(response.status));
-        }
-        const batch = await this.handleResponse<CfDnsRecord[]>(
-          response,
-          "list_dns_records",
-        );
-        if (batch.length === 0) break;
-        all.push(...batch);
-        page += 1;
-      }
-      return all;
-    });
+  listDnsRecords(zoneId: string): Promise<CfDnsRecord[]> {
+    return this.dns.listDnsRecords(zoneId);
  }

-  async createDnsRecord(
-    zoneId: string,
-    payload: CreateDnsRecordPayload,
-  ): Promise<CfDnsRecord> {
-    const response = await fetch(`${BASE_URL}/zones/${zoneId}/dns_records`, {
-      method: "POST",
-      headers: {
-        Authorization: `Bearer ${this.token}`,
-        "Content-Type": "application/json",
-      },
-      body: JSON.stringify(payload),
-      signal: AbortSignal.timeout(30_000),
-    });
-    return this.handleResponse(response, "create_dns_record");
+  createDnsRecord(zoneId: string, payload: CreateDnsRecordPayload): Promise<CfDnsRecord> {
+    return this.dns.createDnsRecord(zoneId, payload);
  }

-  async updateDnsRecord(
+  updateDnsRecord(
    zoneId: string,
    recordId: string,
    payload: CreateDnsRecordPayload,
  ): Promise<CfDnsRecord> {
-    const response = await fetch(
-      `${BASE_URL}/zones/${zoneId}/dns_records/${recordId}`,
-      {
-        method: "PUT",
-        headers: {
-          Authorization: `Bearer ${this.token}`,
-          "Content-Type": "application/json",
-        },
-        body: JSON.stringify(payload),
-        signal: AbortSignal.timeout(30_000),
-      },
-    );
-    return this.handleResponse(response, "update_dns_record");
+    return this.dns.updateDnsRecord(zoneId, recordId, payload);
  }

-  async deleteDnsRecord(zoneId: string, recordId: string): Promise<void> {
-    const response = await fetch(
-      `${BASE_URL}/zones/${zoneId}/dns_records/${recordId}`,
-      {
-        method: "DELETE",
-        headers: { Authorization: `Bearer ${this.token}` },
-        signal: AbortSignal.timeout(30_000),
-      },
-    );
-    await this.handleResponse(response, "delete_dns_record");
+  patchDnsRecord(
+    zoneId: string,
+    recordId: string,
+    payload: PatchDnsRecordPayload,
+  ): Promise<CfDnsRecord> {
+    return this.dns.patchDnsRecord(zoneId, recordId, payload);
+  }
+
+  deleteDnsRecord(zoneId: string, recordId: string): Promise<void> {
+    return this.dns.deleteDnsRecord(zoneId, recordId);
+  }
+
+  listHealthChecks(zoneId: string): Promise<CfHealthCheck[]> {
+    return this.healthchecks.listHealthChecks(zoneId);
+  }
+
+  getHealthCheck(zoneId: string, id: string): Promise<CfHealthCheck> {
+    return this.healthchecks.getHealthCheck(zoneId, id);
+  }
+
+  createHealthCheck(zoneId: string, payload: CfHealthCheckPayload): Promise<CfHealthCheck> {
+    return this.healthchecks.createHealthCheck(zoneId, payload);
+  }
+
+  updateHealthCheck(
+    zoneId: string,
+    id: string,
+    payload: CfHealthCheckPayload,
+  ): Promise<CfHealthCheck> {
+    return this.healthchecks.updateHealthCheck(zoneId, id, payload);
+  }
+
+  deleteHealthCheck(zoneId: string, id: string): Promise<void> {
+    return this.healthchecks.deleteHealthCheck(zoneId, id);
  }
 }
@@ -0,0 +1,106 @@
+import type { CfDnsRecord, CreateDnsRecordPayload, PatchDnsRecordPayload } from "@cfdm/shared";
+import { withRetry } from "../cf-retry.js";
+import { CF_API_BASE, handleCfResponse, mapCloudflareFailure } from "./http.js";
+
+export function createDnsAdapter(token: string) {
+  return {
+    async listDnsRecords(zoneId: string): Promise<CfDnsRecord[]> {
+      return withRetry(async () => {
+        const all: CfDnsRecord[] = [];
+        let page = 1;
+        while (page <= 50) {
+          const url = new URL(`${CF_API_BASE}/zones/${zoneId}/dns_records`);
+          url.searchParams.set("per_page", "100");
+          url.searchParams.set("page", String(page));
+          const response = await fetch(url, {
+            headers: { Authorization: `Bearer ${token}` },
+            signal: AbortSignal.timeout(30_000),
+          });
+          if (response.status >= 500 || response.status === 429) {
+            throw mapCloudflareFailure(
+              "list_dns_records",
+              response.status,
+              String(response.status),
+            );
+          }
+          const batch = await handleCfResponse<CfDnsRecord[]>(
+            response,
+            "list_dns_records",
+          );
+          if (batch.length === 0) break;
+          all.push(...batch);
+          page += 1;
+        }
+        return all;
+      });
+    },
+
+    async createDnsRecord(
+      zoneId: string,
+      payload: CreateDnsRecordPayload,
+    ): Promise<CfDnsRecord> {
+      const response = await fetch(`${CF_API_BASE}/zones/${zoneId}/dns_records`, {
+        method: "POST",
+        headers: {
+          Authorization: `Bearer ${token}`,
+          "Content-Type": "application/json",
+        },
+        body: JSON.stringify(payload),
+        signal: AbortSignal.timeout(30_000),
+      });
+      return handleCfResponse(response, "create_dns_record");
+    },
+
+    async updateDnsRecord(
+      zoneId: string,
+      recordId: string,
+      payload: CreateDnsRecordPayload,
+    ): Promise<CfDnsRecord> {
+      const response = await fetch(
+        `${CF_API_BASE}/zones/${zoneId}/dns_records/${recordId}`,
+        {
+          method: "PUT",
+          headers: {
+            Authorization: `Bearer ${token}`,
+            "Content-Type": "application/json",
+          },
+          body: JSON.stringify(payload),
+          signal: AbortSignal.timeout(30_000),
+        },
+      );
+      return handleCfResponse(response, "update_dns_record");
+    },
+
+    async patchDnsRecord(
+      zoneId: string,
+      recordId: string,
+      payload: PatchDnsRecordPayload,
+    ): Promise<CfDnsRecord> {
+      const response = await fetch(
+        `${CF_API_BASE}/zones/${zoneId}/dns_records/${recordId}`,
+        {
+          method: "PATCH",
+          headers: {
+            Authorization: `Bearer ${token}`,
+            "Content-Type": "application/json",
+          },
+          body: JSON.stringify(payload),
+          signal: AbortSignal.timeout(30_000),
+        },
+      );
+      return handleCfResponse(response, "patch_dns_record");
+    },
+
+    async deleteDnsRecord(zoneId: string, recordId: string): Promise<void> {
+      const response = await fetch(
+        `${CF_API_BASE}/zones/${zoneId}/dns_records/${recordId}`,
+        {
+          method: "DELETE",
+          headers: { Authorization: `Bearer ${token}` },
+          signal: AbortSignal.timeout(30_000),
+        },
+      );
+      await handleCfResponse(response, "delete_dns_record");
+    },
+  };
+}
@@ -0,0 +1,110 @@
+import type { CfHealthCheck } from "@cfdm/shared";
+import { CF_API_BASE, handleCfResponse } from "./http.js";
+
+export interface CfHealthCheckHttpConfig {
+  method?: string;
+  path?: string;
+  expected_codes?: string[];
+  header?: Record<string, string[]>;
+  port?: number;
+  follow_redirects?: boolean;
+  allow_insecure?: boolean;
+}
+
+export interface CfHealthCheckTcpConfig {
+  method?: "connection_established";
+  port?: number;
+}
+
+export interface CfHealthCheckPayload {
+  address: string;
+  name: string;
+  type?: "HTTP" | "HTTPS" | "TCP";
+  description?: string;
+  interval?: number;
+  timeout?: number;
+  retries?: number;
+  consecutive_fails?: number;
+  consecutive_successes?: number;
+  suspended?: boolean;
+  check_regions?: string[];
+  http_config?: CfHealthCheckHttpConfig;
+  tcp_config?: CfHealthCheckTcpConfig;
+}
+
+export function createHealthCheckAdapter(token: string) {
+  return {
+    async listHealthChecks(zoneId: string): Promise<CfHealthCheck[]> {
+      const response = await fetch(
+        `${CF_API_BASE}/zones/${zoneId}/healthchecks`,
+        {
+          headers: { Authorization: `Bearer ${token}` },
+          signal: AbortSignal.timeout(30_000),
+        },
+      );
+      return handleCfResponse(response, "list_healthchecks");
+    },
+
+    async getHealthCheck(zoneId: string, id: string): Promise<CfHealthCheck> {
+      const response = await fetch(
+        `${CF_API_BASE}/zones/${zoneId}/healthchecks/${id}`,
+        {
+          headers: { Authorization: `Bearer ${token}` },
+          signal: AbortSignal.timeout(30_000),
+        },
+      );
+      return handleCfResponse(response, "get_healthcheck");
+    },
+
+    async createHealthCheck(
+      zoneId: string,
+      payload: CfHealthCheckPayload,
+    ): Promise<CfHealthCheck> {
+      const response = await fetch(
+        `${CF_API_BASE}/zones/${zoneId}/healthchecks`,
+        {
+          method: "POST",
+          headers: {
+            Authorization: `Bearer ${token}`,
+            "Content-Type": "application/json",
+          },
+          body: JSON.stringify(payload),
+          signal: AbortSignal.timeout(30_000),
+        },
+      );
+      return handleCfResponse(response, "create_healthcheck");
+    },
+
+    async updateHealthCheck(
+      zoneId: string,
+      id: string,
+      payload: CfHealthCheckPayload,
+    ): Promise<CfHealthCheck> {
+      const response = await fetch(
+        `${CF_API_BASE}/zones/${zoneId}/healthchecks/${id}`,
+        {
+          method: "PUT",
+          headers: {
+            Authorization: `Bearer ${token}`,
+            "Content-Type": "application/json",
+          },
+          body: JSON.stringify(payload),
+          signal: AbortSignal.timeout(30_000),
+        },
+      );
+      return handleCfResponse(response, "update_healthcheck");
+    },
+
+    async deleteHealthCheck(zoneId: string, id: string): Promise<void> {
+      const response = await fetch(
+        `${CF_API_BASE}/zones/${zoneId}/healthchecks/${id}`,
+        {
+          method: "DELETE",
+          headers: { Authorization: `Bearer ${token}` },
+          signal: AbortSignal.timeout(30_000),
+        },
+      );
+      await handleCfResponse(response, "delete_healthcheck");
+    },
+  };
+}
@@ -0,0 +1,91 @@
+import type { CfDnsRecord } from "@cfdm/shared";
+import { AppError } from "../../errors.js";
+import { parseRetryAfter } from "../cf-retry.js";
+
+export const CF_API_BASE = "https://api.cloudflare.com/client/v4";
+
+export interface CfResponse<T> {
+  success: boolean;
+  result?: T;
+  errors?: Array<{ code: number; message: string }>;
+}
+
+export function mapCloudflareFailure(
+  operation: string,
+  status: number,
+  message: string,
+): AppError {
+  const lower = message.toLowerCase();
+  if (status === 401 || status === 403 || lower.includes("authentication")) {
+    return AppError.cloudflareAuthFailed(
+      "Cloudflare отклонил токен. Проверьте CLOUDFLARE_API_TOKEN.",
+    );
+  }
+  if (status === 429 || lower.includes("rate limit")) {
+    return AppError.rateLimited();
+  }
+  if (lower.includes("zone") && (lower.includes("not found") || status === 404)) {
+    return AppError.zoneNotFound();
+  }
+  if (
+    operation.includes("healthcheck") &&
+    (lower.includes("plan") ||
+      lower.includes("not entitled") ||
+      lower.includes("not allowed") ||
+      lower.includes("permission"))
+  ) {
+    return AppError.healthcheckCreateFailed(
+      "Cloudflare Health Checks недоступны для этой зоны. Используйте локальные проверки.",
+    );
+  }
+  if (operation.includes("dns") || operation.includes("dns_record")) {
+    return AppError.dnsUpdateFailed(`Не удалось обновить DNS в Cloudflare: ${message}`);
+  }
+  return AppError.cloudflare(`${operation}: ${message}`);
+}
+
+export async function handleCfResponse<T>(
+  response: Response,
+  operation: string,
+): Promise<T> {
+  if (response.status === 429) {
+    const wait = parseRetryAfter(response.headers) ?? 5000;
+    throw AppError.rateLimited(
+      `Cloudflare временно ограничил запросы. Повторите через ${Math.ceil(wait / 1000)} с.`,
+    );
+  }
+
+  const body = (await response.json()) as CfResponse<T>;
+  if (!body.success) {
+    const msg =
+      body.errors?.map((e) => e.message).join("; ") ?? "unknown cloudflare error";
+    throw mapCloudflareFailure(operation, response.status, msg);
+  }
+  if (body.result === undefined) {
+    throw mapCloudflareFailure(operation, response.status, "empty result");
+  }
+  return body.result;
+}
+
+export async function cfRequest<T>(
+  token: string,
+  path: string,
+  operation: string,
+  init: RequestInit = {},
+): Promise<T> {
+  const response = await fetch(`${CF_API_BASE}${path}`, {
+    ...init,
+    headers: {
+      Authorization: `Bearer ${token}`,
+      ...(init.body ? { "Content-Type": "application/json" } : {}),
+      ...init.headers,
+    },
+    signal: init.signal ?? AbortSignal.timeout(30_000),
+  });
+  if (response.status >= 500 || response.status === 429) {
+    throw mapCloudflareFailure(operation, response.status, String(response.status));
+  }
+  return handleCfResponse<T>(response, operation);
+}
+
+export type DnsRecordResult = CfDnsRecord;
@@ -0,0 +1,40 @@
+import type { CfZone } from "@cfdm/shared";
+import { withRetry } from "../cf-retry.js";
+import { CF_API_BASE, handleCfResponse, mapCloudflareFailure } from "./http.js";
+
+export function createZoneAdapter(token: string) {
+  return {
+    async listZones(): Promise<CfZone[]> {
+      return withRetry(async () => {
+        const all: CfZone[] = [];
+        let page = 1;
+        while (true) {
+          const url = new URL(`${CF_API_BASE}/zones`);
+          url.searchParams.set("per_page", "50");
+          url.searchParams.set("page", String(page));
+          const response = await fetch(url, {
+            headers: { Authorization: `Bearer ${token}` },
+            signal: AbortSignal.timeout(30_000),
+          });
+          if (response.status >= 500 || response.status === 429) {
+            throw mapCloudflareFailure("list_zones", response.status, String(response.status));
+          }
+          const batch = await handleCfResponse<CfZone[]>(response, "list_zones");
+          if (batch.length === 0) break;
+          all.push(...batch);
+          if (batch.length < 50) break;
+          page += 1;
+        }
+        return all;
+      });
+    },
+
+    async getZone(zoneId: string): Promise<CfZone> {
+      const response = await fetch(`${CF_API_BASE}/zones/${zoneId}`, {
+        headers: { Authorization: `Bearer ${token}` },
+        signal: AbortSignal.timeout(30_000),
+      });
+      return handleCfResponse(response, "get_zone");
+    },
+  };
+}
@@ -94,14 +94,17 @@ const RULES: Rule[] = [
    methods: ["GET"],
    match: (p) =>
      p.startsWith("/api/v1/services") ||
-      p.startsWith("/api/v1/service-bindings"),
+      p.startsWith("/api/v1/service-bindings") ||
+      p.startsWith("/api/v1/health-checks") ||
+      p === "/api/v1/ops-summary",
    permission: "cfdm:services:read",
  },
  {
    methods: ["POST", "PUT", "PATCH", "DELETE"],
    match: (p) =>
      p.startsWith("/api/v1/services") ||
-      p.startsWith("/api/v1/service-bindings"),
+      p.startsWith("/api/v1/service-bindings") ||
+      p.startsWith("/api/v1/health-checks"),
    permission: "cfdm:services:write",
  },
  {
@@ -114,8 +117,7 @@ const RULES: Rule[] = [
    match: (p) =>
      p.startsWith("/api/v1/settings") ||
      p.startsWith("/api/v1/notifications") ||
-      p.startsWith("/api/v1/health-check") ||
-      p.startsWith("/api/v1/health-checks"),
+      p.startsWith("/api/v1/health-check"),
    permission: "cfdm:settings:admin",
  },
  {
@@ -20,6 +20,7 @@ export async function healthCheckRoutes(app: FastifyInstance) {
      degradedFailures: config.healthDegradedFailures,
      downFailures: config.healthDownFailures,
      latencyWarnMs: config.healthLatencyWarnMs,
+      successRecoveries: config.healthSuccessRecoveries,
    };
    const checked = await healthCheckService.runAllChecks(request.server.db, {
      thresholds,
@@ -0,0 +1,77 @@
+import type { FastifyInstance } from "fastify";
+import {
+  createOriginHealthCheckSchema,
+} from "@cfdm/shared";
+import * as originHealth from "../services/origin-health-check-service.js";
+import { recordAudit } from "../lib/audit.js";
+
+export async function originHealthCheckRoutes(app: FastifyInstance) {
+  app.get("/health-checks", async (request) => {
+    return originHealth.listOriginHealthChecks(request.server.db);
+  });
+
+  app.post("/health-checks", async (request) => {
+    const body = createOriginHealthCheckSchema.parse(request.body);
+    const check = await originHealth.createOriginHealthCheck(
+      request.server.db,
+      request.server.cf,
+      body,
+    );
+    recordAudit(request.server, request, {
+      action: "healthcheck.create",
+      targetType: "app_resource",
+      targetId: String(check.id),
+      summary: `Создан health check «${check.name}» (${check.provider})`,
+    });
+    return check;
+  });
+
+  app.get("/health-checks/:id", async (request) => {
+    const { id } = request.params as { id: string };
+    return originHealth.getOriginHealthCheck(request.server.db, Number(id));
+  });
+
+  app.patch("/health-checks/:id", async (request) => {
+    const { id } = request.params as { id: string };
+    const body = createOriginHealthCheckSchema.partial().parse(request.body);
+    const check = await originHealth.updateOriginHealthCheck(
+      request.server.db,
+      request.server.cf,
+      Number(id),
+      body,
+    );
+    recordAudit(request.server, request, {
+      action: "healthcheck.update",
+      targetType: "app_resource",
+      targetId: id,
+      summary: `Обновлён health check «${check.name}»`,
+    });
+    return check;
+  });
+
+  app.delete("/health-checks/:id", async (request) => {
+    const { id } = request.params as { id: string };
+    await originHealth.deleteOriginHealthCheck(
+      request.server.db,
+      request.server.cf,
+      Number(id),
+    );
+    recordAudit(request.server, request, {
+      action: "healthcheck.delete",
+      severity: "warning",
+      targetType: "app_resource",
+      targetId: id,
+      summary: `Удалён health check ${id}`,
+    });
+    return { deleted: true };
+  });
+
+  app.post("/health-checks/:id/sync", async (request) => {
+    const { id } = request.params as { id: string };
+    return originHealth.syncOriginHealthCheck(
+      request.server.db,
+      request.server.cf,
+      Number(id),
+    );
+  });
+}
@@ -1,6 +1,9 @@
 import type { FastifyInstance } from "fastify";
 import { z } from "zod";
+import { changeIpSchema } from "@cfdm/shared";
 import * as bindingService from "../services/binding-service.js";
+import * as changeIp from "../services/change-ip-service.js";
+import { recordAudit } from "../lib/audit.js";

 export async function serviceBindingRoutes(app: FastifyInstance) {
  const createSchema = z.object({
@@ -52,6 +55,27 @@ export async function serviceBindingRoutes(app: FastifyInstance) {
    return { deleted: true };
  });

+  app.post("/service-bindings/:id/change-ip", async (request) => {
+    const { id } = request.params as { id: string };
+    const body = changeIpSchema.parse(request.body);
+    const result = await changeIp.changeBindingIp(
+      request.server.db,
+      request.server.cf,
+      Number(id),
+      body,
+    );
+    if (result.applied) {
+      recordAudit(request.server, request, {
+        action: "binding.change_ip",
+        targetType: "app_resource",
+        targetId: id,
+        summary: `Сменён IP: ${result.message}`,
+        details: result,
+      });
+    }
+    return result;
+  });
+
  app.get("/domains/:id/service-bindings", async (request) => {
    const { id } = request.params as { id: string };
    return bindingService.listByDomain(request.server.db, Number(id));
@@ -1,8 +1,16 @@
 import type { FastifyInstance } from "fastify";
 import { z } from "zod";
-import { reorderServicesSchema, updateServiceConfigSchema } from "@cfdm/shared";
+import {
+  changeDomainSchema,
+  createServiceNodeSchema,
+  reorderServicesSchema,
+  updateServiceConfigSchema,
+  updateServiceNodeSchema,
+} from "@cfdm/shared";
 import { repos } from "@cfdm/db";
 import * as serviceConfig from "../services/service-config-service.js";
+import * as nodeService from "../services/node-service.js";
+import * as changeDomain from "../services/change-domain-service.js";
 import { recordAudit } from "../lib/audit.js";

 export async function serviceRoutes(app: FastifyInstance) {
@@ -56,6 +64,88 @@ export async function serviceRoutes(app: FastifyInstance) {
    return serviceConfig.getView(request.server.db, Number(id));
  });

+  app.get("/services/:id/overview", async (request) => {
+    const { id } = request.params as { id: string };
+    return nodeService.getOverview(request.server.db, Number(id));
+  });
+
+  app.get("/services/:id/nodes", async (request) => {
+    const { id } = request.params as { id: string };
+    return nodeService.listNodes(request.server.db, Number(id));
+  });
+
+  app.post("/services/:id/nodes", async (request) => {
+    const { id } = request.params as { id: string };
+    const body = createServiceNodeSchema.parse(request.body);
+    const node = nodeService.createNode(request.server.db, Number(id), body);
+    recordAudit(request.server, request, {
+      action: "node.create",
+      targetType: "app_resource",
+      targetId: String(node.id),
+      summary: `Добавлена нода ${node.address}`,
+      details: { service_id: Number(id), address: node.address },
+    });
+    return node;
+  });
+
+  app.patch("/services/:id/nodes/:nodeId", async (request) => {
+    const { id, nodeId } = request.params as { id: string; nodeId: string };
+    const body = updateServiceNodeSchema.parse(request.body);
+    const node = nodeService.updateNode(
+      request.server.db,
+      Number(id),
+      Number(nodeId),
+      body,
+    );
+    recordAudit(request.server, request, {
+      action: "node.update",
+      targetType: "app_resource",
+      targetId: String(node.id),
+      summary: `Обновлена нода ${node.address}`,
+      details: body,
+    });
+    return node;
+  });
+
+  app.delete("/services/:id/nodes/:nodeId", async (request) => {
+    const { id, nodeId } = request.params as { id: string; nodeId: string };
+    const node = repos.getNode(request.server.db, Number(nodeId));
+    nodeService.deleteNode(request.server.db, Number(id), Number(nodeId));
+    recordAudit(request.server, request, {
+      action: "node.delete",
+      severity: "warning",
+      targetType: "app_resource",
+      targetId: nodeId,
+      summary: `Удалена нода ${node.address}`,
+    });
+    return { deleted: true };
+  });
+
+  app.post("/services/:id/change-domain", async (request) => {
+    const { id } = request.params as { id: string };
+    const body = changeDomainSchema.parse(request.body);
+    const result = await changeDomain.changeServiceDomain(
+      request.server.db,
+      request.server.cf,
+      Number(id),
+      body,
+    );
+    if (result.applied) {
+      recordAudit(request.server, request, {
+        action: "service.change_domain",
+        targetType: "app_resource",
+        targetId: id,
+        summary: result.message,
+        details: result,
+      });
+    }
+    return result;
+  });
+
+  app.get("/ops-summary", async (request) => {
+    return nodeService.opsSummary(request.server.db);
+  });
+

  app.patch("/services/:id", async (request) => {
    const { id } = request.params as { id: string };
@@ -0,0 +1,118 @@
+import type { Db } from "@cfdm/db";
+import { repos } from "@cfdm/db";
+import type { ChangeDomainInput } from "@cfdm/shared";
+import type { CloudflareClient } from "../lib/cf-client.js";
+import { AppError } from "../errors.js";
+import * as dnsService from "./dns-service.js";
+import { withBindingLock } from "./routing/index.js";
+import { applyBindingDesiredDns, fqdnToDisplay } from "./service-config-service.js";
+
+export interface ChangeDomainItem {
+  binding_id: number;
+  hostname: string;
+  from_fqdn: string;
+  to_fqdn: string;
+}
+
+export interface ChangeDomainPreview {
+  from_domain_id: number;
+  to_domain_id: number;
+  from_zone: string;
+  to_zone: string;
+  items: ChangeDomainItem[];
+  dry_run: boolean;
+  applied: boolean;
+  message: string;
+}
+
+export async function changeServiceDomain(
+  db: Db,
+  cf: CloudflareClient,
+  serviceId: number,
+  input: ChangeDomainInput,
+): Promise<ChangeDomainPreview> {
+  repos.getService(db, serviceId);
+  if (input.from_domain_id === input.to_domain_id) {
+    throw AppError.validation("укажите другой целевой домен");
+  }
+  const fromDomain = repos.getDomain(db, input.from_domain_id);
+  const toDomain = repos.getDomain(db, input.to_domain_id);
+  const bindings = repos
+    .listBindingsByService(db, serviceId)
+    .filter((b) => b.domain_id === input.from_domain_id);
+  const selected = input.hostnames?.length
+    ? bindings.filter((b) => input.hostnames!.includes(b.hostname))
+    : bindings;
+  if (selected.length === 0) {
+    throw AppError.validation("нет привязок для переноса");
+  }
+
+  const items: ChangeDomainItem[] = selected.map((binding) => ({
+    binding_id: binding.id,
+    hostname: binding.hostname,
+    from_fqdn: fqdnToDisplay(binding.hostname, fromDomain.zone_name),
+    to_fqdn: fqdnToDisplay(binding.hostname, toDomain.zone_name),
+  }));
+
+  const preview: ChangeDomainPreview = {
+    from_domain_id: fromDomain.id,
+    to_domain_id: toDomain.id,
+    from_zone: fromDomain.zone_name,
+    to_zone: toDomain.zone_name,
+    items,
+    dry_run: Boolean(input.dry_run),
+    applied: false,
+    message: `Перенос ${items.length} привязок ${fromDomain.zone_name} → ${toDomain.zone_name}`,
+  };
+
+  if (input.dry_run) return preview;
+
+  const createdRecordIds: number[] = [];
+  try {
+    for (const binding of selected) {
+      const existing = repos.findBinding(
+        db,
+        serviceId,
+        toDomain.id,
+        binding.hostname,
+      );
+      if (existing) {
+        throw AppError.conflict(
+          `привязка ${fqdnToDisplay(binding.hostname, toDomain.zone_name)} уже существует`,
+        );
+      }
+      await withBindingLock(binding.id, async () => {
+        repos.bumpBindingVersion(db, binding.id);
+        const ips = repos.listBindingIps(db, binding.id);
+        repos.updateBindingDomain(db, binding.id, toDomain.id, binding.hostname);
+        await applyBindingDesiredDns(db, cf, binding.id, ips);
+        const newRecords = repos.listRecordsForBinding(db, binding.id);
+        createdRecordIds.push(...newRecords.map((r) => r.id));
+
+        const oldRecords = newRecords.filter((r) => r.domain_id === fromDomain.id);
+        for (const record of oldRecords) {
+          repos.unlinkBindingRecord(db, binding.id, record.id);
+          try {
+            await dnsService.deleteRecord(db, cf, fromDomain.id, record.id);
+          } catch {
+            // best-effort cleanup of old zone
+          }
+        }
+      });
+    }
+  } catch (err) {
+    throw err instanceof AppError
+      ? err
+      : AppError.syncFailed(
+          err instanceof Error ? err.message : "не удалось перенести привязки",
+        );
+  }
+
+  void createdRecordIds;
+  return {
+    ...preview,
+    dry_run: false,
+    applied: true,
+    message: `Привязки перенесены в ${toDomain.zone_name}. Старые записи зоны удалены.`,
+  };
+}
@@ -0,0 +1,142 @@
+import type { Db } from "@cfdm/db";
+import { repos } from "@cfdm/db";
+import type { ChangeIpInput } from "@cfdm/shared";
+import type { CloudflareClient } from "../lib/cf-client.js";
+import { AppError } from "../errors.js";
+import { isValidIpv4 } from "../lib/validators.js";
+import { withBindingLock } from "./routing/index.js";
+import { applyBindingDesiredDns } from "./service-config-service.js";
+
+export interface ChangeIpPreview {
+  binding_id: number;
+  hostname: string;
+  zone_name: string;
+  from_ip: string;
+  to_ip: string;
+  dry_run: boolean;
+  applied: boolean;
+  message: string;
+}
+
+async function patchRecordContent(
+  db: Db,
+  cf: CloudflareClient,
+  domainId: number,
+  recordId: number,
+  content: string,
+): Promise<void> {
+  const domain = repos.getDomain(db, domainId);
+  const record = repos.getDnsRecord(db, domainId, recordId);
+  if (!record.cf_record_id) {
+    throw AppError.dnsUpdateFailed("у DNS-записи нет идентификатора Cloudflare");
+  }
+  try {
+    const patched = await cf.patchDnsRecord(domain.cf_zone_id, record.cf_record_id, {
+      content,
+    });
+    repos.updateDnsFields(
+      db,
+      record.id,
+      patched.type ?? record.record_type,
+      patched.name ?? record.name,
+      patched.content ?? content,
+      patched.ttl ?? record.ttl,
+      patched.proxied ?? record.proxied,
+      patched.priority ?? record.priority,
+      "synced",
+      patched.id ?? record.cf_record_id,
+      null,
+    );
+  } catch (err) {
+    if (err instanceof AppError) throw err;
+    throw AppError.dnsUpdateFailed(
+      err instanceof Error ? err.message : "не удалось обновить запись в Cloudflare",
+    );
+  }
+}
+
+export async function changeBindingIp(
+  db: Db,
+  cf: CloudflareClient,
+  bindingId: number,
+  input: ChangeIpInput,
+): Promise<ChangeIpPreview> {
+  const binding = repos.getBinding(db, bindingId);
+  const domain = repos.getDomain(db, binding.domain_id);
+  const current = repos.listBindingIpsWithMeta(db, bindingId);
+  if (current.length === 0) {
+    throw AppError.validation("у привязки нет IP для замены");
+  }
+
+  let fromIp = input.from_ip?.trim();
+  let toIp = input.to_ip?.trim();
+
+  if (input.node_id) {
+    const node = repos.getNode(db, input.node_id);
+    if (node.service_id !== binding.service_id) {
+      throw AppError.validation("нода не принадлежит сервису этой привязки");
+    }
+    toIp = node.address;
+  }
+
+  if (!fromIp) {
+    fromIp = current[0]!.ip;
+  }
+  if (!toIp) {
+    throw AppError.invalidIp("укажите новый IP или ноду");
+  }
+  if (!isValidIpv4(toIp)) {
+    throw AppError.invalidIp(`Некорректный IP-адрес: ${toIp}`);
+  }
+  if (!current.some((row) => row.ip === fromIp)) {
+    throw AppError.validation(`IP ${fromIp} нет в привязке`);
+  }
+
+  const preview: ChangeIpPreview = {
+    binding_id: bindingId,
+    hostname: binding.hostname,
+    zone_name: domain.zone_name,
+    from_ip: fromIp,
+    to_ip: toIp,
+    dry_run: Boolean(input.dry_run),
+    applied: false,
+    message: `${fromIp} → ${toIp}`,
+  };
+
+  if (input.dry_run || fromIp === toIp) {
+    return preview;
+  }
+
+  return withBindingLock(bindingId, async () => {
+    repos.bumpBindingVersion(db, bindingId);
+    const next = current.map((row) =>
+      row.ip === fromIp ? { ...row, ip: toIp } : row,
+    );
+    repos.replaceBindingIpsWithMeta(db, bindingId, next);
+
+    const records = repos.listRecordsForBinding(db, bindingId);
+    const match = records.find(
+      (record) =>
+        record.content === fromIp &&
+        (record.record_type.toUpperCase() === "A" ||
+          record.record_type.toUpperCase() === "AAAA"),
+    );
+    if (match) {
+      await patchRecordContent(db, cf, binding.domain_id, match.id, toIp);
+    } else {
+      await applyBindingDesiredDns(
+        db,
+        cf,
+        bindingId,
+        next.map((row) => row.ip),
+      );
+    }
+
+    return {
+      ...preview,
+      dry_run: false,
+      applied: true,
+      message: `Запись обновлена в Cloudflare (${fromIp} → ${toIp}). Распространение зависит от TTL.`,
+    };
+  });
+}
@@ -1,6 +1,6 @@
 import type { Db } from "@cfdm/db";
 import { repos, type DnsListFilter } from "@cfdm/db";
-import type { CreateDnsRecordPayload, DnsRecord } from "@cfdm/shared";
+import type { CreateDnsRecordPayload, DnsRecord, PatchDnsRecordPayload } from "@cfdm/shared";
 import {
  SYNC_CONFLICT,
  SYNC_ERROR,
@@ -179,6 +179,52 @@ export async function update(
  return pushRecord(db, cf, domainId, domain.cf_zone_id, updated);
 }

+export async function patchContent(
+  db: Db,
+  cf: CloudflareClient,
+  domainId: number,
+  recordId: number,
+  payload: PatchDnsRecordPayload,
+): Promise<DnsRecord> {
+  const domain = repos.getDomain(db, domainId);
+  const existing = repos.getDnsRecord(db, domainId, recordId);
+  if (!existing.cf_record_id) {
+    throw AppError.dnsUpdateFailed("у DNS-записи нет идентификатора Cloudflare");
+  }
+  try {
+    const cfRec = await cf.patchDnsRecord(
+      domain.cf_zone_id,
+      existing.cf_record_id,
+      payload,
+    );
+    repos.updateDnsFields(
+      db,
+      existing.id,
+      cfRec.type ?? existing.record_type,
+      cfRec.name ?? existing.name,
+      cfRec.content ?? existing.content,
+      cfRec.ttl ?? existing.ttl,
+      cfRec.proxied ?? existing.proxied,
+      cfRec.priority ?? existing.priority,
+      SYNC_SYNCED,
+      cfRec.id ?? existing.cf_record_id,
+      null,
+    );
+    return repos.getDnsRecord(db, domainId, existing.id);
+  } catch (e) {
+    repos.setDnsSyncStatus(
+      db,
+      existing.id,
+      SYNC_ERROR,
+      existing.cf_record_id,
+      e instanceof Error ? e.message : String(e),
+    );
+    throw e instanceof AppError
+      ? e
+      : AppError.dnsUpdateFailed(e instanceof Error ? e.message : String(e));
+  }
+}
+
 export async function deleteRecord(
  db: Db,
  cf: CloudflareClient,
@@ -5,11 +5,13 @@ import type { Db } from "@cfdm/db";
 import { repos } from "@cfdm/db";
 import type { HealthCheckTarget, IpHealthState } from "@cfdm/shared";
 import { AppError } from "../errors.js";
+import { nextHealthState } from "./health/state-machine.js";

 export interface HealthCheckThresholds {
  degradedFailures: number;
  downFailures: number;
  latencyWarnMs: number;
+  successRecoveries?: number;
 }

 export interface ProbeResult {
@@ -234,23 +236,25 @@ export async function probeTarget(
 function deriveState(
  ok: boolean,
  latencyMs: number,
-  prev: { consecutive_failures: number; status: string } | null,
+  prev: {
+    consecutive_failures: number;
+    consecutive_successes?: number;
+    status: string;
+  } | null,
  thresholds: HealthCheckThresholds,
-): { state: IpHealthState; failures: number } {
-  if (!ok) {
-    const failures = (prev?.consecutive_failures ?? 0) + 1;
-    if (failures >= thresholds.downFailures) {
-      return { state: "down", failures };
-    }
-    if (failures >= thresholds.degradedFailures) {
-      return { state: "degraded", failures };
-    }
-    return { state: "degraded", failures };
-  }
-  if (latencyMs > thresholds.latencyWarnMs) {
-    return { state: "degraded", failures: 0 };
-  }
-  return { state: "up", failures: 0 };
+): { state: IpHealthState; failures: number; successes: number; node: string } {
+  const next = nextHealthState(ok, latencyMs, prev, {
+    degradedFailures: thresholds.degradedFailures,
+    downFailures: thresholds.downFailures,
+    latencyWarnMs: thresholds.latencyWarnMs,
+    successRecoveries: thresholds.successRecoveries ?? 2,
+  });
+  return {
+    state: next.legacy,
+    failures: next.failures,
+    successes: next.successes,
+    node: next.node,
+  };
 }

 export interface RunAllChecksOptions {
@@ -324,12 +328,13 @@ export async function runAllChecks(
        target.ref_id,
        target.ip,
      );
-      const { state, failures } = deriveState(
+      const { state, failures, successes, node } = deriveState(
        result.ok,
        result.latencyMs,
        prev
          ? {
              consecutive_failures: prev.consecutive_failures,
+              consecutive_successes: prev.consecutive_successes,
              status: prev.status,
            }
          : null,
@@ -347,7 +352,18 @@ export async function runAllChecks(
        result.latencyMs,
        failures,
        result.error,
+        successes,
      );
+      const matchedNode = repos.findNodeByIp(db, target.ip);
+      if (matchedNode && matchedNode.enabled) {
+        repos.updateNode(db, matchedNode.id, {
+          health_status: node,
+          consecutive_failures: failures,
+          consecutive_successes: successes,
+          last_check_at: new Date().toISOString().replace("T", " ").slice(0, 19),
+          last_failure_reason: result.error,
+        });
+      }
      if (prevState !== state) {
        options.onStatusChange?.(target, prevState, state);
      }
@@ -402,6 +418,7 @@ export async function runDomainMonitors(
      result.latencyMs,
      {
        consecutive_failures: result.ok ? 0 : 1,
+        consecutive_successes: result.ok ? 1 : 0,
        status: prevStatus,
      },
      thresholds,
@@ -0,0 +1,112 @@
+import type { Db } from "@cfdm/db";
+import { repos } from "@cfdm/db";
+import type { CfHealthCheck, HealthCheckTarget, OriginHealthCheck } from "@cfdm/shared";
+import type { CloudflareClient } from "../../lib/cf-client.js";
+import type { CfHealthCheckPayload } from "../../lib/cloudflare/healthcheck-service.js";
+import { AppError } from "../../errors.js";
+import type { ProbeResult } from "../health-check-service.js";
+import type { HealthCheckProvider } from "./provider.js";
+
+function toPayload(
+  check: OriginHealthCheck,
+  address: string,
+): CfHealthCheckPayload {
+  const type = (check.protocol || "TCP").toUpperCase() as "HTTP" | "HTTPS" | "TCP";
+  const payload: CfHealthCheckPayload = {
+    address,
+    name: check.name,
+    type,
+    interval: check.interval_sec,
+    timeout: check.timeout,
+    retries: check.retries,
+    consecutive_fails: check.consecutive_fails,
+    consecutive_successes: check.consecutive_successes,
+    suspended: check.suspended,
+  };
+  if (type === "HTTP" || type === "HTTPS") {
+    payload.http_config = {
+      method: check.method ?? "GET",
+      path: check.path ?? "/",
+      expected_codes: check.expected_status != null ? [String(check.expected_status)] : ["200"],
+    };
+  } else {
+    payload.tcp_config = { method: "connection_established" };
+  }
+  return payload;
+}
+
+export class CloudflareHealthCheckProvider implements HealthCheckProvider {
+  readonly kind = "cloudflare" as const;
+
+  constructor(
+    private readonly db: Db,
+    private readonly cf: CloudflareClient,
+  ) {}
+
+  async probe(target: HealthCheckTarget): Promise<ProbeResult> {
+    const node = repos.findNodeByIp(this.db, target.ip);
+    if (!node?.health_check_id) {
+      return { ok: false, latencyMs: 0, error: "нет Cloudflare Health Check" };
+    }
+    const check = repos.getHealthCheck(this.db, node.health_check_id);
+    if (!check.cf_zone_id || !check.cf_healthcheck_id) {
+      return { ok: false, latencyMs: 0, error: "Cloudflare Health Check не синхронизирован" };
+    }
+    try {
+      const remote = await this.cf.getHealthCheck(check.cf_zone_id, check.cf_healthcheck_id);
+      const status = (remote.status ?? "").toLowerCase();
+      const ok = status === "healthy" || status === "ok";
+      return {
+        ok,
+        latencyMs: 0,
+        error: ok ? null : remote.status ?? "unhealthy",
+      };
+    } catch (err) {
+      return {
+        ok: false,
+        latencyMs: 0,
+        error: err instanceof Error ? err.message : String(err),
+      };
+    }
+  }
+
+  async syncCreate(
+    check: OriginHealthCheck,
+    zoneId: string,
+    address: string,
+  ): Promise<CfHealthCheck> {
+    try {
+      const remote = await this.cf.createHealthCheck(zoneId, toPayload(check, address));
+      repos.updateHealthCheck(this.db, check.id, {
+        cf_healthcheck_id: remote.id,
+        cf_zone_id: zoneId,
+        provider: "cloudflare",
+      });
+      return remote;
+    } catch (err) {
+      if (err instanceof AppError) throw err;
+      throw AppError.healthcheckCreateFailed(
+        err instanceof Error ? err.message : "не удалось создать Cloudflare Health Check",
+      );
+    }
+  }
+
+  async syncUpdate(
+    check: OriginHealthCheck,
+    address: string,
+  ): Promise<CfHealthCheck> {
+    if (!check.cf_zone_id || !check.cf_healthcheck_id) {
+      throw AppError.healthcheckCreateFailed("Cloudflare Health Check не привязан к зоне");
+    }
+    return this.cf.updateHealthCheck(
+      check.cf_zone_id,
+      check.cf_healthcheck_id,
+      toPayload(check, address),
+    );
+  }
+
+  async syncDelete(check: OriginHealthCheck): Promise<void> {
+    if (!check.cf_zone_id || !check.cf_healthcheck_id) return;
+    await this.cf.deleteHealthCheck(check.cf_zone_id, check.cf_healthcheck_id);
+  }
+}
@@ -0,0 +1,11 @@
+import type { HealthCheckTarget } from "@cfdm/shared";
+import { probeTarget, type ProbeResult } from "../health-check-service.js";
+import type { HealthCheckProvider } from "./provider.js";
+
+export class LocalHealthCheckProvider implements HealthCheckProvider {
+  readonly kind = "local" as const;
+
+  probe(target: HealthCheckTarget): Promise<ProbeResult> {
+    return probeTarget(target);
+  }
+}
@@ -0,0 +1,7 @@
+import type { HealthCheckTarget } from "@cfdm/shared";
+import type { ProbeResult } from "../health-check-service.js";
+
+export interface HealthCheckProvider {
+  readonly kind: "local" | "cloudflare";
+  probe(target: HealthCheckTarget): Promise<ProbeResult>;
+}
@@ -0,0 +1,75 @@
+import type { IpHealthState, NodeHealthState } from "@cfdm/shared";
+
+export interface HealthThresholds {
+  degradedFailures: number;
+  downFailures: number;
+  successRecoveries: number;
+  latencyWarnMs: number;
+}
+
+export interface HealthCounters {
+  status: string;
+  consecutive_failures: number;
+  consecutive_successes?: number;
+}
+
+export interface NextHealth {
+  legacy: IpHealthState;
+  node: NodeHealthState;
+  failures: number;
+  successes: number;
+}
+
+function wasHealthy(status: string | undefined): boolean {
+  return status === "up" || status === "healthy";
+}
+
+function wasUnhealthy(status: string | undefined): boolean {
+  return (
+    status === "down" ||
+    status === "unhealthy" ||
+    status === "checking" ||
+    status === "degraded"
+  );
+}
+
+export function nextHealthState(
+  ok: boolean,
+  latencyMs: number,
+  prev: HealthCounters | null,
+  thresholds: HealthThresholds,
+): NextHealth {
+  if (!ok) {
+    const failures = (prev?.consecutive_failures ?? 0) + 1;
+    if (failures >= thresholds.downFailures) {
+      return { legacy: "down", node: "unhealthy", failures, successes: 0 };
+    }
+    return { legacy: "degraded", node: "degraded", failures, successes: 0 };
+  }
+
+  if (latencyMs > thresholds.latencyWarnMs) {
+    return { legacy: "degraded", node: "degraded", failures: 0, successes: 0 };
+  }
+
+  if (!prev || wasHealthy(prev.status) || !wasUnhealthy(prev.status)) {
+    return {
+      legacy: "up",
+      node: "healthy",
+      failures: 0,
+      successes: (prev?.consecutive_successes ?? 0) + 1,
+    };
+  }
+
+  const successes = (prev.consecutive_successes ?? 0) + 1;
+  if (successes >= thresholds.successRecoveries) {
+    return { legacy: "up", node: "healthy", failures: 0, successes };
+  }
+  return { legacy: "unknown", node: "checking", failures: 0, successes };
+}
+
+export function toLegacyHealth(status: NodeHealthState | IpHealthState): IpHealthState {
+  if (status === "healthy" || status === "up") return "up";
+  if (status === "unhealthy" || status === "down") return "down";
+  if (status === "degraded") return "degraded";
+  return "unknown";
+}
@@ -0,0 +1,150 @@
+import type { Db } from "@cfdm/db";
+import { repos } from "@cfdm/db";
+import type {
+  CreateServiceNodeInput,
+  ServiceNode,
+  ServiceOverview,
+  UpdateServiceNodeInput,
+} from "@cfdm/shared";
+import { AppError } from "../errors.js";
+import { isValidIpv4 } from "../lib/validators.js";
+import { getView } from "./service-config-service.js";
+import { selectActiveIpsByMode } from "./routing/index.js";
+
+function assertAddress(address: string): void {
+  if (!isValidIpv4(address)) {
+    throw AppError.invalidIp(`Некорректный IP-адрес: ${address}`);
+  }
+}
+
+export function listNodes(db: Db, serviceId: number): ServiceNode[] {
+  repos.getService(db, serviceId);
+  return repos.listNodes(db, serviceId);
+}
+
+export function createNode(
+  db: Db,
+  serviceId: number,
+  input: CreateServiceNodeInput,
+): ServiceNode {
+  repos.getService(db, serviceId);
+  assertAddress(input.address);
+  try {
+    return repos.createNode(db, serviceId, {
+      address: input.address,
+      protocol: input.protocol,
+      port: input.port,
+      enabled: input.enabled,
+      priority: input.priority,
+      weight: input.weight,
+      health_check_id: input.health_check_id,
+    });
+  } catch (err) {
+    if (err instanceof Error && err.name === "ConflictError") {
+      throw AppError.conflict(err.message);
+    }
+    throw err;
+  }
+}
+
+export function updateNode(
+  db: Db,
+  serviceId: number,
+  nodeId: number,
+  patch: UpdateServiceNodeInput,
+): ServiceNode {
+  const node = repos.getNode(db, nodeId);
+  if (node.service_id !== serviceId) {
+    throw AppError.notFound(`node ${nodeId}`);
+  }
+  if (patch.address) assertAddress(patch.address);
+  return repos.updateNode(db, nodeId, patch);
+}
+
+export function deleteNode(db: Db, serviceId: number, nodeId: number): void {
+  const node = repos.getNode(db, nodeId);
+  if (node.service_id !== serviceId) {
+    throw AppError.notFound(`node ${nodeId}`);
+  }
+  repos.deleteNode(db, nodeId);
+}
+
+export async function getOverview(
+  db: Db,
+  serviceId: number,
+): Promise<ServiceOverview> {
+  const service = await getView(db, serviceId);
+  const nodes = repos.listNodes(db, serviceId);
+  const bindings = repos.listBindingsByService(db, serviceId);
+  const first = bindings[0];
+  const routing = first?.routing_strategy ?? first?.lb_mode ?? "round_robin";
+  const healthCheck =
+    nodes
+      .map((n) => n.health_check_id)
+      .find((id): id is number => id != null) != null
+      ? repos.getHealthCheck(
+          db,
+          nodes.find((n) => n.health_check_id != null)!.health_check_id!,
+        )
+      : null;
+
+  const active = new Set<string>();
+  for (const binding of bindings) {
+    const metas = repos.listBindingIpsWithMeta(db, binding.id);
+    const rows = metas.map((entry) => {
+      const status = repos.getIpHealthStatusRow(db, "binding", binding.id, entry.ip);
+      return {
+        ip: entry.ip,
+        weight: entry.weight,
+        priority: entry.priority,
+        health: status ? status.status : ("unknown" as const),
+      };
+    });
+    for (const ip of selectActiveIpsByMode(
+      {
+        lb_mode: binding.lb_mode,
+        health_check_enabled: binding.health_check_enabled,
+      },
+      rows,
+    )) {
+      active.add(ip);
+    }
+  }
+
+  return {
+    service,
+    nodes,
+    health_check: healthCheck,
+    routing_strategy: routing,
+    active_addresses: [...active],
+  };
+}
+
+export function opsSummary(db: Db) {
+  const allNodes = repos.listAllNodes(db);
+  const services = repos.listServices(db);
+  const domains = repos.listDomains(db);
+  const healthy = allNodes.filter(
+    (n) => n.health_status === "healthy" || n.health_status === "up",
+  ).length;
+  const unhealthy = allNodes.filter(
+    (n) => n.health_status === "unhealthy" || n.health_status === "down",
+  ).length;
+  const failoverActive = repos.listAllBindings(db).filter((binding) => {
+    if (binding.lb_mode !== "failover" || !binding.health_check_enabled) {
+      return false;
+    }
+    return binding.target_ips.some((ip) => {
+      const row = repos.getIpHealthStatusRow(db, "binding", binding.id, ip);
+      return row?.status === "down";
+    });
+  }).length;
+  return {
+    domains: domains.length,
+    services: services.length,
+    nodes: allNodes.length,
+    healthy,
+    unhealthy,
+    active_failovers: failoverActive,
+  };
+}
@@ -0,0 +1,126 @@
+import type { Db } from "@cfdm/db";
+import { repos } from "@cfdm/db";
+import type {
+  CreateOriginHealthCheckInput,
+  OriginHealthCheck,
+} from "@cfdm/shared";
+import type { CloudflareClient } from "../lib/cf-client.js";
+import { AppError } from "../errors.js";
+import { CloudflareHealthCheckProvider } from "./health/cloudflare.js";
+
+export function listOriginHealthChecks(db: Db): OriginHealthCheck[] {
+  return repos.listHealthChecks(db);
+}
+
+export function getOriginHealthCheck(db: Db, id: number): OriginHealthCheck {
+  return repos.getHealthCheck(db, id);
+}
+
+export async function createOriginHealthCheck(
+  db: Db,
+  cf: CloudflareClient,
+  input: CreateOriginHealthCheckInput,
+): Promise<OriginHealthCheck> {
+  const protocol = (input.protocol ?? "tcp").toLowerCase();
+  const check = repos.createHealthCheck(db, {
+    provider: input.provider,
+    name: input.name,
+    cf_zone_id: input.cf_zone_id ?? null,
+    protocol,
+    path: input.path,
+    method: input.method,
+    timeout: input.timeout,
+    interval_sec: input.interval_sec,
+    retries: input.retries,
+    expected_status: input.expected_status,
+    consecutive_fails: input.consecutive_fails,
+    consecutive_successes: input.consecutive_successes,
+    suspended: input.suspended,
+  });
+
+  if (input.node_id) {
+    const node = repos.getNode(db, input.node_id);
+    repos.updateNode(db, node.id, { health_check_id: check.id });
+  }
+
+  if (input.provider === "cloudflare") {
+    const zoneId = input.cf_zone_id;
+    if (!zoneId) {
+      throw AppError.zoneNotFound("укажите зону Cloudflare для Health Check");
+    }
+    const address = input.node_id
+      ? repos.getNode(db, input.node_id).address
+      : check.name;
+    const provider = new CloudflareHealthCheckProvider(db, cf);
+    await provider.syncCreate(check, zoneId, address);
+    return repos.getHealthCheck(db, check.id);
+  }
+
+  return check;
+}
+
+export async function updateOriginHealthCheck(
+  db: Db,
+  cf: CloudflareClient,
+  id: number,
+  patch: Partial<CreateOriginHealthCheckInput>,
+): Promise<OriginHealthCheck> {
+  const current = repos.getHealthCheck(db, id);
+  const updated = repos.updateHealthCheck(db, id, {
+    provider: patch.provider,
+    name: patch.name,
+    cf_zone_id: patch.cf_zone_id,
+    protocol: patch.protocol?.toLowerCase(),
+    path: patch.path,
+    method: patch.method,
+    timeout: patch.timeout,
+    interval_sec: patch.interval_sec,
+    retries: patch.retries,
+    expected_status: patch.expected_status,
+    consecutive_fails: patch.consecutive_fails,
+    consecutive_successes: patch.consecutive_successes,
+    suspended: patch.suspended,
+  });
+  if (updated.provider === "cloudflare" && updated.cf_healthcheck_id) {
+    const address = repos.findNodeByIp(db, updated.name)?.address ?? updated.name;
+    const provider = new CloudflareHealthCheckProvider(db, cf);
+    await provider.syncUpdate(updated, address);
+  }
+  void current;
+  return repos.getHealthCheck(db, id);
+}
+
+export async function deleteOriginHealthCheck(
+  db: Db,
+  cf: CloudflareClient,
+  id: number,
+): Promise<void> {
+  const check = repos.getHealthCheck(db, id);
+  if (check.provider === "cloudflare") {
+    const provider = new CloudflareHealthCheckProvider(db, cf);
+    await provider.syncDelete(check);
+  }
+  repos.deleteHealthCheck(db, id);
+}
+
+export async function syncOriginHealthCheck(
+  db: Db,
+  cf: CloudflareClient,
+  id: number,
+): Promise<OriginHealthCheck> {
+  const check = repos.getHealthCheck(db, id);
+  if (check.provider !== "cloudflare") {
+    throw AppError.validation("синхронизация доступна только для Cloudflare Health Checks");
+  }
+  if (!check.cf_zone_id) {
+    throw AppError.zoneNotFound();
+  }
+  const provider = new CloudflareHealthCheckProvider(db, cf);
+  const address = repos.findNodeByIp(db, check.name)?.address ?? check.name;
+  if (check.cf_healthcheck_id) {
+    await provider.syncUpdate(check, address);
+  } else {
+    await provider.syncCreate(check, check.cf_zone_id, address);
+  }
+  return repos.getHealthCheck(db, id);
+}
@@ -0,0 +1,25 @@
+const locks = new Map<number, Promise<void>>();
+
+export async function withBindingLock<T>(
+  bindingId: number,
+  fn: () => Promise<T>,
+): Promise<T> {
+  const previous = locks.get(bindingId) ?? Promise.resolve();
+  let release!: () => void;
+  const current = new Promise<void>((resolve) => {
+    release = resolve;
+  });
+  locks.set(
+    bindingId,
+    previous.then(() => current).catch(() => current),
+  );
+  await previous.catch(() => undefined);
+  try {
+    return await fn();
+  } finally {
+    release();
+    if (locks.get(bindingId) === current) {
+      locks.delete(bindingId);
+    }
+  }
+}
@@ -0,0 +1,17 @@
+import type { LbIpRow } from "./types.js";
+import { isHealthy } from "./health.js";
+
+export function failoverDesired(rows: LbIpRow[]): string[] {
+  if (rows.length === 0) return [];
+  const healthy = rows.filter((r) => isHealthy(r.health));
+  const pool = healthy.length > 0 ? healthy : rows;
+  const sorted = [...pool].sort(
+    (a, b) => a.priority - b.priority || a.weight - b.weight,
+  );
+  const minPriority = sorted[0]!.priority;
+  const primaries = sorted.filter((r) => r.priority === minPriority);
+  if (healthy.length > 0) {
+    return primaries.map((r) => r.ip);
+  }
+  return [sorted[0]!.ip];
+}
@@ -0,0 +1,5 @@
+import type { IpHealthState, NodeHealthState } from "@cfdm/shared";
+
+export function isHealthy(state: IpHealthState | NodeHealthState | string): boolean {
+  return state === "up" || state === "healthy";
+}
@@ -0,0 +1,26 @@
+import type { LbMode } from "@cfdm/shared";
+import { failoverDesired } from "./failover.js";
+import { roundRobinDesired } from "./round-robin.js";
+import type { LbIpRow, LbTargetConfig } from "./types.js";
+
+export type { LbIpRow, LbTargetConfig } from "./types.js";
+export { isHealthy } from "./health.js";
+export { withBindingLock } from "./binding-lock.js";
+
+export function selectActiveIpsByMode(
+  config: LbTargetConfig,
+  rows: LbIpRow[],
+): string[] {
+  if (rows.length === 0) return [];
+  if (config.lb_mode === "failover") {
+    return failoverDesired(rows);
+  }
+  // weighted = round_robin on DNS (one A per IP)
+  return roundRobinDesired(rows);
+}
+
+export function strategyLabel(mode: LbMode): string {
+  if (mode === "failover") return "Failover";
+  if (mode === "weighted") return "Round Robin (weighted alias)";
+  return "Round Robin";
+}
@@ -0,0 +1,8 @@
+import type { LbIpRow } from "./types.js";
+import { isHealthy } from "./health.js";
+
+export function roundRobinDesired(rows: LbIpRow[]): string[] {
+  const healthy = rows.filter((r) => isHealthy(r.health));
+  const pool = healthy.length > 0 ? healthy : rows;
+  return pool.map((r) => r.ip);
+}
@@ -0,0 +1,13 @@
+import type { IpHealthState, LbMode } from "@cfdm/shared";
+
+export interface LbTargetConfig {
+  lb_mode: LbMode;
+  health_check_enabled: boolean;
+}
+
+export interface LbIpRow {
+  ip: string;
+  weight: number;
+  priority: number;
+  health: IpHealthState;
+}
@@ -24,6 +24,15 @@ import { isValidIpv4 } from "../lib/validators.js";
 import * as dnsService from "./dns-service.js";
 import * as domainService from "./domain-service.js";
 import { syncServiceToVpsTracker } from "./vps-tracker-sync.js";
+import {
+  selectActiveIpsByMode,
+  withBindingLock,
+  type LbIpRow,
+  type LbTargetConfig,
+} from "./routing/index.js";
+
+export type { LbIpRow, LbTargetConfig };
+export { selectActiveIpsByMode };

 export interface ServiceDomainInput {
  fqdn: string;
@@ -137,54 +146,6 @@ function aggregateSyncStatus(statuses: string[]): string | null {
  return statuses[0] ?? null;
 }

-function isHealthy(state: IpHealthState): boolean {
-  return state === "up" || state === "unknown";
-}
-
-export interface LbTargetConfig {
-  lb_mode: LbMode;
-  health_check_enabled: boolean;
-}
-
-export interface LbIpRow {
-  ip: string;
-  weight: number;
-  priority: number;
-  health: IpHealthState;
-}
-
-export function selectActiveIpsByMode(
-  config: LbTargetConfig,
-  rows: LbIpRow[],
-): string[] {
-  if (rows.length === 0) return [];
-
-  const healthy = rows.filter((r) => isHealthy(r.health));
-  const pool = healthy.length > 0 ? healthy : rows;
-
-  if (config.lb_mode === "failover") {
-    const sorted = [...pool].sort(
-      (a, b) => a.priority - b.priority || a.weight - b.weight,
-    );
-    const minPriority = sorted[0]!.priority;
-    const primaries = sorted.filter((r) => r.priority === minPriority);
-    if (healthy.length > 0) {
-      return primaries.map((r) => r.ip);
-    }
-    return [sorted[0]!.ip];
-  }
-
-  if (config.lb_mode === "weighted") {
-    // Cloudflare не допускает дублирования A-записей с одинаковым name+content,
-    // поэтому weighted на уровне DNS реализован как RR по одному A на IP.
-    // Веса сохраняются в БД и используются для приоритизации/отображения;
-    // точное weighted-распределение требует CF Load Balancer (см. README).
-    return pool.map((r) => r.ip);
-  }
-
-  return pool.map((r) => r.ip);
-}
-
 function getBindingLbState(
  db: Db,
  bindingId: number,
@@ -1411,6 +1372,25 @@ export function reorderServices(
  repos.reorderServices(db, groupId, serviceIds);
 }

+export async function applyBindingDesiredDns(
+  db: Db,
+  cf: CloudflareClient,
+  bindingId: number,
+  desiredIps: string[],
+): Promise<void> {
+  const binding = repos.getBinding(db, bindingId);
+  const cnameTarget = binding.cname_target?.trim() || null;
+  await syncBindingDns(
+    db,
+    cf,
+    binding.id,
+    binding.domain_id,
+    binding.hostname,
+    desiredIps,
+    cnameTarget,
+  );
+}
+
 export async function reconcileDnsForTarget(
  db: Db,
  cf: CloudflareClient,
@@ -1418,26 +1398,28 @@ export async function reconcileDnsForTarget(
  refId: number,
 ): Promise<void> {
  if (scope === "binding") {
-    const binding = repos.getBinding(db, refId);
-    if (!binding.health_check_enabled) return;
-    const service = repos.getService(db, binding.service_id);
-    if (!shouldPushDns(db, service)) return;
-    const cnameTarget = binding.cname_target?.trim() || null;
-    if (cnameTarget) return;
-    const ips = repos.listServiceIps(db, service.id);
-    const targetIps = repos.listBindingIps(db, binding.id);
-    validateTargetIpsInPool(targetIps, ips);
-    const activeIps = computeActiveIps(db, "binding", refId);
-    const desiredIps = activeIps.length > 0 ? activeIps : targetIps;
-    await syncBindingDns(
-      db,
-      cf,
-      binding.id,
-      binding.domain_id,
-      binding.hostname,
-      desiredIps,
-      null,
-    );
+    await withBindingLock(refId, async () => {
+      const binding = repos.getBinding(db, refId);
+      if (!binding.health_check_enabled) return;
+      const service = repos.getService(db, binding.service_id);
+      if (!shouldPushDns(db, service)) return;
+      const cnameTarget = binding.cname_target?.trim() || null;
+      if (cnameTarget) return;
+      const ips = repos.listServiceIps(db, service.id);
+      const targetIps = repos.listBindingIps(db, binding.id);
+      validateTargetIpsInPool(targetIps, ips);
+      const activeIps = computeActiveIps(db, "binding", refId);
+      const desiredIps = activeIps.length > 0 ? activeIps : targetIps;
+      await syncBindingDns(
+        db,
+        cf,
+        binding.id,
+        binding.domain_id,
+        binding.hostname,
+        desiredIps,
+        null,
+      );
+    });
    return;
  }