feat(health-checks): enhance health check functionality and add new routes

- Introduced origin health check routes and integrated them into the application.
- Updated health check configuration to include success recovery thresholds.
- Expanded error handling with new error codes for health check failures.
- Added new service routes for managing health checks, including creation and listing.
- Improved health check service logic to track consecutive successes and failures.

This commit enhances the health check capabilities, providing better monitoring and management of service health.

apps/api/src/services/change-domain-service.ts

@@ -0,0 +1,118 @@
+import type { Db } from "@cfdm/db";
+import { repos } from "@cfdm/db";
+import type { ChangeDomainInput } from "@cfdm/shared";
+import type { CloudflareClient } from "../lib/cf-client.js";
+import { AppError } from "../errors.js";
+import * as dnsService from "./dns-service.js";
+import { withBindingLock } from "./routing/index.js";
+import { applyBindingDesiredDns, fqdnToDisplay } from "./service-config-service.js";
+
+export interface ChangeDomainItem {
+  binding_id: number;
+  hostname: string;
+  from_fqdn: string;
+  to_fqdn: string;
+}
+
+export interface ChangeDomainPreview {
+  from_domain_id: number;
+  to_domain_id: number;
+  from_zone: string;
+  to_zone: string;
+  items: ChangeDomainItem[];
+  dry_run: boolean;
+  applied: boolean;
+  message: string;
+}
+
+export async function changeServiceDomain(
+  db: Db,
+  cf: CloudflareClient,
+  serviceId: number,
+  input: ChangeDomainInput,
+): Promise<ChangeDomainPreview> {
+  repos.getService(db, serviceId);
+  if (input.from_domain_id === input.to_domain_id) {
+    throw AppError.validation("укажите другой целевой домен");
+  }
+  const fromDomain = repos.getDomain(db, input.from_domain_id);
+  const toDomain = repos.getDomain(db, input.to_domain_id);
+  const bindings = repos
+    .listBindingsByService(db, serviceId)
+    .filter((b) => b.domain_id === input.from_domain_id);
+  const selected = input.hostnames?.length
+    ? bindings.filter((b) => input.hostnames!.includes(b.hostname))
+    : bindings;
+  if (selected.length === 0) {
+    throw AppError.validation("нет привязок для переноса");
+  }
+
+  const items: ChangeDomainItem[] = selected.map((binding) => ({
+    binding_id: binding.id,
+    hostname: binding.hostname,
+    from_fqdn: fqdnToDisplay(binding.hostname, fromDomain.zone_name),
+    to_fqdn: fqdnToDisplay(binding.hostname, toDomain.zone_name),
+  }));
+
+  const preview: ChangeDomainPreview = {
+    from_domain_id: fromDomain.id,
+    to_domain_id: toDomain.id,
+    from_zone: fromDomain.zone_name,
+    to_zone: toDomain.zone_name,
+    items,
+    dry_run: Boolean(input.dry_run),
+    applied: false,
+    message: `Перенос ${items.length} привязок ${fromDomain.zone_name} → ${toDomain.zone_name}`,
+  };
+
+  if (input.dry_run) return preview;
+
+  const createdRecordIds: number[] = [];
+  try {
+    for (const binding of selected) {
+      const existing = repos.findBinding(
+        db,
+        serviceId,
+        toDomain.id,
+        binding.hostname,
+      );
+      if (existing) {
+        throw AppError.conflict(
+          `привязка ${fqdnToDisplay(binding.hostname, toDomain.zone_name)} уже существует`,
+        );
+      }
+      await withBindingLock(binding.id, async () => {
+        repos.bumpBindingVersion(db, binding.id);
+        const ips = repos.listBindingIps(db, binding.id);
+        repos.updateBindingDomain(db, binding.id, toDomain.id, binding.hostname);
+        await applyBindingDesiredDns(db, cf, binding.id, ips);
+        const newRecords = repos.listRecordsForBinding(db, binding.id);
+        createdRecordIds.push(...newRecords.map((r) => r.id));
+
+        const oldRecords = newRecords.filter((r) => r.domain_id === fromDomain.id);
+        for (const record of oldRecords) {
+          repos.unlinkBindingRecord(db, binding.id, record.id);
+          try {
+            await dnsService.deleteRecord(db, cf, fromDomain.id, record.id);
+          } catch {
+            // best-effort cleanup of old zone
+          }
+        }
+      });
+    }
+  } catch (err) {
+    throw err instanceof AppError
+      ? err
+      : AppError.syncFailed(
+          err instanceof Error ? err.message : "не удалось перенести привязки",
+        );
+  }
+
+  void createdRecordIds;
+  return {
+    ...preview,
+    dry_run: false,
+    applied: true,
+    message: `Привязки перенесены в ${toDomain.zone_name}. Старые записи зоны удалены.`,
+  };
+}

apps/api/src/services/change-ip-service.ts

@@ -0,0 +1,142 @@
+import type { Db } from "@cfdm/db";
+import { repos } from "@cfdm/db";
+import type { ChangeIpInput } from "@cfdm/shared";
+import type { CloudflareClient } from "../lib/cf-client.js";
+import { AppError } from "../errors.js";
+import { isValidIpv4 } from "../lib/validators.js";
+import { withBindingLock } from "./routing/index.js";
+import { applyBindingDesiredDns } from "./service-config-service.js";
+
+export interface ChangeIpPreview {
+  binding_id: number;
+  hostname: string;
+  zone_name: string;
+  from_ip: string;
+  to_ip: string;
+  dry_run: boolean;
+  applied: boolean;
+  message: string;
+}
+
+async function patchRecordContent(
+  db: Db,
+  cf: CloudflareClient,
+  domainId: number,
+  recordId: number,
+  content: string,
+): Promise<void> {
+  const domain = repos.getDomain(db, domainId);
+  const record = repos.getDnsRecord(db, domainId, recordId);
+  if (!record.cf_record_id) {
+    throw AppError.dnsUpdateFailed("у DNS-записи нет идентификатора Cloudflare");
+  }
+  try {
+    const patched = await cf.patchDnsRecord(domain.cf_zone_id, record.cf_record_id, {
+      content,
+    });
+    repos.updateDnsFields(
+      db,
+      record.id,
+      patched.type ?? record.record_type,
+      patched.name ?? record.name,
+      patched.content ?? content,
+      patched.ttl ?? record.ttl,
+      patched.proxied ?? record.proxied,
+      patched.priority ?? record.priority,
+      "synced",
+      patched.id ?? record.cf_record_id,
+      null,
+    );
+  } catch (err) {
+    if (err instanceof AppError) throw err;
+    throw AppError.dnsUpdateFailed(
+      err instanceof Error ? err.message : "не удалось обновить запись в Cloudflare",
+    );
+  }
+}
+
+export async function changeBindingIp(
+  db: Db,
+  cf: CloudflareClient,
+  bindingId: number,
+  input: ChangeIpInput,
+): Promise<ChangeIpPreview> {
+  const binding = repos.getBinding(db, bindingId);
+  const domain = repos.getDomain(db, binding.domain_id);
+  const current = repos.listBindingIpsWithMeta(db, bindingId);
+  if (current.length === 0) {
+    throw AppError.validation("у привязки нет IP для замены");
+  }
+
+  let fromIp = input.from_ip?.trim();
+  let toIp = input.to_ip?.trim();
+
+  if (input.node_id) {
+    const node = repos.getNode(db, input.node_id);
+    if (node.service_id !== binding.service_id) {
+      throw AppError.validation("нода не принадлежит сервису этой привязки");
+    }
+    toIp = node.address;
+  }
+
+  if (!fromIp) {
+    fromIp = current[0]!.ip;
+  }
+  if (!toIp) {
+    throw AppError.invalidIp("укажите новый IP или ноду");
+  }
+  if (!isValidIpv4(toIp)) {
+    throw AppError.invalidIp(`Некорректный IP-адрес: ${toIp}`);
+  }
+  if (!current.some((row) => row.ip === fromIp)) {
+    throw AppError.validation(`IP ${fromIp} нет в привязке`);
+  }
+
+  const preview: ChangeIpPreview = {
+    binding_id: bindingId,
+    hostname: binding.hostname,
+    zone_name: domain.zone_name,
+    from_ip: fromIp,
+    to_ip: toIp,
+    dry_run: Boolean(input.dry_run),
+    applied: false,
+    message: `${fromIp} → ${toIp}`,
+  };
+
+  if (input.dry_run || fromIp === toIp) {
+    return preview;
+  }
+
+  return withBindingLock(bindingId, async () => {
+    repos.bumpBindingVersion(db, bindingId);
+    const next = current.map((row) =>
+      row.ip === fromIp ? { ...row, ip: toIp } : row,
+    );
+    repos.replaceBindingIpsWithMeta(db, bindingId, next);
+
+    const records = repos.listRecordsForBinding(db, bindingId);
+    const match = records.find(
+      (record) =>
+        record.content === fromIp &&
+        (record.record_type.toUpperCase() === "A" ||
+          record.record_type.toUpperCase() === "AAAA"),
+    );
+    if (match) {
+      await patchRecordContent(db, cf, binding.domain_id, match.id, toIp);
+    } else {
+      await applyBindingDesiredDns(
+        db,
+        cf,
+        bindingId,
+        next.map((row) => row.ip),
+      );
+    }
+
+    return {
+      ...preview,
+      dry_run: false,
+      applied: true,
+      message: `Запись обновлена в Cloudflare (${fromIp} → ${toIp}). Распространение зависит от TTL.`,
+    };
+  });
+}

apps/api/src/services/dns-service.ts

@@ -1,6 +1,6 @@
 import type { Db } from "@cfdm/db";
 import { repos, type DnsListFilter } from "@cfdm/db";
-import type { CreateDnsRecordPayload, DnsRecord } from "@cfdm/shared";
+import type { CreateDnsRecordPayload, DnsRecord, PatchDnsRecordPayload } from "@cfdm/shared";
 import {
   SYNC_CONFLICT,
   SYNC_ERROR,
@@ -179,6 +179,52 @@ export async function update(
   return pushRecord(db, cf, domainId, domain.cf_zone_id, updated);
 }
 
+export async function patchContent(
+  db: Db,
+  cf: CloudflareClient,
+  domainId: number,
+  recordId: number,
+  payload: PatchDnsRecordPayload,
+): Promise<DnsRecord> {
+  const domain = repos.getDomain(db, domainId);
+  const existing = repos.getDnsRecord(db, domainId, recordId);
+  if (!existing.cf_record_id) {
+    throw AppError.dnsUpdateFailed("у DNS-записи нет идентификатора Cloudflare");
+  }
+  try {
+    const cfRec = await cf.patchDnsRecord(
+      domain.cf_zone_id,
+      existing.cf_record_id,
+      payload,
+    );
+    repos.updateDnsFields(
+      db,
+      existing.id,
+      cfRec.type ?? existing.record_type,
+      cfRec.name ?? existing.name,
+      cfRec.content ?? existing.content,
+      cfRec.ttl ?? existing.ttl,
+      cfRec.proxied ?? existing.proxied,
+      cfRec.priority ?? existing.priority,
+      SYNC_SYNCED,
+      cfRec.id ?? existing.cf_record_id,
+      null,
+    );
+    return repos.getDnsRecord(db, domainId, existing.id);
+  } catch (e) {
+    repos.setDnsSyncStatus(
+      db,
+      existing.id,
+      SYNC_ERROR,
+      existing.cf_record_id,
+      e instanceof Error ? e.message : String(e),
+    );
+    throw e instanceof AppError
+      ? e
+      : AppError.dnsUpdateFailed(e instanceof Error ? e.message : String(e));
+  }
+}
+
 export async function deleteRecord(
   db: Db,
   cf: CloudflareClient,

apps/api/src/services/health-check-service.ts

@@ -5,11 +5,13 @@ import type { Db } from "@cfdm/db";
 import { repos } from "@cfdm/db";
 import type { HealthCheckTarget, IpHealthState } from "@cfdm/shared";
 import { AppError } from "../errors.js";
+import { nextHealthState } from "./health/state-machine.js";
 
 export interface HealthCheckThresholds {
   degradedFailures: number;
   downFailures: number;
   latencyWarnMs: number;
+  successRecoveries?: number;
 }
 
 export interface ProbeResult {
@@ -234,23 +236,25 @@ export async function probeTarget(
 function deriveState(
   ok: boolean,
   latencyMs: number,
-  prev: { consecutive_failures: number; status: string } | null,
+  prev: {
+    consecutive_failures: number;
+    consecutive_successes?: number;
+    status: string;
+  } | null,
   thresholds: HealthCheckThresholds,
-): { state: IpHealthState; failures: number } {
-  if (!ok) {
-    const failures = (prev?.consecutive_failures ?? 0) + 1;
-    if (failures >= thresholds.downFailures) {
-      return { state: "down", failures };
-    }
-    if (failures >= thresholds.degradedFailures) {
-      return { state: "degraded", failures };
-    }
-    return { state: "degraded", failures };
-  }
-  if (latencyMs > thresholds.latencyWarnMs) {
-    return { state: "degraded", failures: 0 };
-  }
-  return { state: "up", failures: 0 };
+): { state: IpHealthState; failures: number; successes: number; node: string } {
+  const next = nextHealthState(ok, latencyMs, prev, {
+    degradedFailures: thresholds.degradedFailures,
+    downFailures: thresholds.downFailures,
+    latencyWarnMs: thresholds.latencyWarnMs,
+    successRecoveries: thresholds.successRecoveries ?? 2,
+  });
+  return {
+    state: next.legacy,
+    failures: next.failures,
+    successes: next.successes,
+    node: next.node,
+  };
 }
 
 export interface RunAllChecksOptions {
@@ -324,12 +328,13 @@ export async function runAllChecks(
         target.ref_id,
         target.ip,
       );
-      const { state, failures } = deriveState(
+      const { state, failures, successes, node } = deriveState(
         result.ok,
         result.latencyMs,
         prev
           ? {
               consecutive_failures: prev.consecutive_failures,
+              consecutive_successes: prev.consecutive_successes,
               status: prev.status,
             }
           : null,
@@ -347,7 +352,18 @@ export async function runAllChecks(
         result.latencyMs,
         failures,
         result.error,
+        successes,
       );
+      const matchedNode = repos.findNodeByIp(db, target.ip);
+      if (matchedNode && matchedNode.enabled) {
+        repos.updateNode(db, matchedNode.id, {
+          health_status: node,
+          consecutive_failures: failures,
+          consecutive_successes: successes,
+          last_check_at: new Date().toISOString().replace("T", " ").slice(0, 19),
+          last_failure_reason: result.error,
+        });
+      }
       if (prevState !== state) {
         options.onStatusChange?.(target, prevState, state);
       }
@@ -402,6 +418,7 @@ export async function runDomainMonitors(
       result.latencyMs,
       {
         consecutive_failures: result.ok ? 0 : 1,
+        consecutive_successes: result.ok ? 1 : 0,
         status: prevStatus,
       },
       thresholds,

apps/api/src/services/health/cloudflare.ts

@@ -0,0 +1,112 @@
+import type { Db } from "@cfdm/db";
+import { repos } from "@cfdm/db";
+import type { CfHealthCheck, HealthCheckTarget, OriginHealthCheck } from "@cfdm/shared";
+import type { CloudflareClient } from "../../lib/cf-client.js";
+import type { CfHealthCheckPayload } from "../../lib/cloudflare/healthcheck-service.js";
+import { AppError } from "../../errors.js";
+import type { ProbeResult } from "../health-check-service.js";
+import type { HealthCheckProvider } from "./provider.js";
+
+function toPayload(
+  check: OriginHealthCheck,
+  address: string,
+): CfHealthCheckPayload {
+  const type = (check.protocol || "TCP").toUpperCase() as "HTTP" | "HTTPS" | "TCP";
+  const payload: CfHealthCheckPayload = {
+    address,
+    name: check.name,
+    type,
+    interval: check.interval_sec,
+    timeout: check.timeout,
+    retries: check.retries,
+    consecutive_fails: check.consecutive_fails,
+    consecutive_successes: check.consecutive_successes,
+    suspended: check.suspended,
+  };
+  if (type === "HTTP" || type === "HTTPS") {
+    payload.http_config = {
+      method: check.method ?? "GET",
+      path: check.path ?? "/",
+      expected_codes: check.expected_status != null ? [String(check.expected_status)] : ["200"],
+    };
+  } else {
+    payload.tcp_config = { method: "connection_established" };
+  }
+  return payload;
+}
+
+export class CloudflareHealthCheckProvider implements HealthCheckProvider {
+  readonly kind = "cloudflare" as const;
+
+  constructor(
+    private readonly db: Db,
+    private readonly cf: CloudflareClient,
+  ) {}
+
+  async probe(target: HealthCheckTarget): Promise<ProbeResult> {
+    const node = repos.findNodeByIp(this.db, target.ip);
+    if (!node?.health_check_id) {
+      return { ok: false, latencyMs: 0, error: "нет Cloudflare Health Check" };
+    }
+    const check = repos.getHealthCheck(this.db, node.health_check_id);
+    if (!check.cf_zone_id || !check.cf_healthcheck_id) {
+      return { ok: false, latencyMs: 0, error: "Cloudflare Health Check не синхронизирован" };
+    }
+    try {
+      const remote = await this.cf.getHealthCheck(check.cf_zone_id, check.cf_healthcheck_id);
+      const status = (remote.status ?? "").toLowerCase();
+      const ok = status === "healthy" || status === "ok";
+      return {
+        ok,
+        latencyMs: 0,
+        error: ok ? null : remote.status ?? "unhealthy",
+      };
+    } catch (err) {
+      return {
+        ok: false,
+        latencyMs: 0,
+        error: err instanceof Error ? err.message : String(err),
+      };
+    }
+  }
+
+  async syncCreate(
+    check: OriginHealthCheck,
+    zoneId: string,
+    address: string,
+  ): Promise<CfHealthCheck> {
+    try {
+      const remote = await this.cf.createHealthCheck(zoneId, toPayload(check, address));
+      repos.updateHealthCheck(this.db, check.id, {
+        cf_healthcheck_id: remote.id,
+        cf_zone_id: zoneId,
+        provider: "cloudflare",
+      });
+      return remote;
+    } catch (err) {
+      if (err instanceof AppError) throw err;
+      throw AppError.healthcheckCreateFailed(
+        err instanceof Error ? err.message : "не удалось создать Cloudflare Health Check",
+      );
+    }
+  }
+
+  async syncUpdate(
+    check: OriginHealthCheck,
+    address: string,
+  ): Promise<CfHealthCheck> {
+    if (!check.cf_zone_id || !check.cf_healthcheck_id) {
+      throw AppError.healthcheckCreateFailed("Cloudflare Health Check не привязан к зоне");
+    }
+    return this.cf.updateHealthCheck(
+      check.cf_zone_id,
+      check.cf_healthcheck_id,
+      toPayload(check, address),
+    );
+  }
+
+  async syncDelete(check: OriginHealthCheck): Promise<void> {
+    if (!check.cf_zone_id || !check.cf_healthcheck_id) return;
+    await this.cf.deleteHealthCheck(check.cf_zone_id, check.cf_healthcheck_id);
+  }
+}

apps/api/src/services/health/local.ts

@@ -0,0 +1,11 @@
+import type { HealthCheckTarget } from "@cfdm/shared";
+import { probeTarget, type ProbeResult } from "../health-check-service.js";
+import type { HealthCheckProvider } from "./provider.js";
+
+export class LocalHealthCheckProvider implements HealthCheckProvider {
+  readonly kind = "local" as const;
+
+  probe(target: HealthCheckTarget): Promise<ProbeResult> {
+    return probeTarget(target);
+  }
+}

apps/api/src/services/health/provider.ts

@@ -0,0 +1,7 @@
+import type { HealthCheckTarget } from "@cfdm/shared";
+import type { ProbeResult } from "../health-check-service.js";
+
+export interface HealthCheckProvider {
+  readonly kind: "local" | "cloudflare";
+  probe(target: HealthCheckTarget): Promise<ProbeResult>;
+}

apps/api/src/services/health/state-machine.ts

@@ -0,0 +1,75 @@
+import type { IpHealthState, NodeHealthState } from "@cfdm/shared";
+
+export interface HealthThresholds {
+  degradedFailures: number;
+  downFailures: number;
+  successRecoveries: number;
+  latencyWarnMs: number;
+}
+
+export interface HealthCounters {
+  status: string;
+  consecutive_failures: number;
+  consecutive_successes?: number;
+}
+
+export interface NextHealth {
+  legacy: IpHealthState;
+  node: NodeHealthState;
+  failures: number;
+  successes: number;
+}
+
+function wasHealthy(status: string | undefined): boolean {
+  return status === "up" || status === "healthy";
+}
+
+function wasUnhealthy(status: string | undefined): boolean {
+  return (
+    status === "down" ||
+    status === "unhealthy" ||
+    status === "checking" ||
+    status === "degraded"
+  );
+}
+
+export function nextHealthState(
+  ok: boolean,
+  latencyMs: number,
+  prev: HealthCounters | null,
+  thresholds: HealthThresholds,
+): NextHealth {
+  if (!ok) {
+    const failures = (prev?.consecutive_failures ?? 0) + 1;
+    if (failures >= thresholds.downFailures) {
+      return { legacy: "down", node: "unhealthy", failures, successes: 0 };
+    }
+    return { legacy: "degraded", node: "degraded", failures, successes: 0 };
+  }
+
+  if (latencyMs > thresholds.latencyWarnMs) {
+    return { legacy: "degraded", node: "degraded", failures: 0, successes: 0 };
+  }
+
+  if (!prev || wasHealthy(prev.status) || !wasUnhealthy(prev.status)) {
+    return {
+      legacy: "up",
+      node: "healthy",
+      failures: 0,
+      successes: (prev?.consecutive_successes ?? 0) + 1,
+    };
+  }
+
+  const successes = (prev.consecutive_successes ?? 0) + 1;
+  if (successes >= thresholds.successRecoveries) {
+    return { legacy: "up", node: "healthy", failures: 0, successes };
+  }
+  return { legacy: "unknown", node: "checking", failures: 0, successes };
+}
+
+export function toLegacyHealth(status: NodeHealthState | IpHealthState): IpHealthState {
+  if (status === "healthy" || status === "up") return "up";
+  if (status === "unhealthy" || status === "down") return "down";
+  if (status === "degraded") return "degraded";
+  return "unknown";
+}

apps/api/src/services/node-service.ts

@@ -0,0 +1,150 @@
+import type { Db } from "@cfdm/db";
+import { repos } from "@cfdm/db";
+import type {
+  CreateServiceNodeInput,
+  ServiceNode,
+  ServiceOverview,
+  UpdateServiceNodeInput,
+} from "@cfdm/shared";
+import { AppError } from "../errors.js";
+import { isValidIpv4 } from "../lib/validators.js";
+import { getView } from "./service-config-service.js";
+import { selectActiveIpsByMode } from "./routing/index.js";
+
+function assertAddress(address: string): void {
+  if (!isValidIpv4(address)) {
+    throw AppError.invalidIp(`Некорректный IP-адрес: ${address}`);
+  }
+}
+
+export function listNodes(db: Db, serviceId: number): ServiceNode[] {
+  repos.getService(db, serviceId);
+  return repos.listNodes(db, serviceId);
+}
+
+export function createNode(
+  db: Db,
+  serviceId: number,
+  input: CreateServiceNodeInput,
+): ServiceNode {
+  repos.getService(db, serviceId);
+  assertAddress(input.address);
+  try {
+    return repos.createNode(db, serviceId, {
+      address: input.address,
+      protocol: input.protocol,
+      port: input.port,
+      enabled: input.enabled,
+      priority: input.priority,
+      weight: input.weight,
+      health_check_id: input.health_check_id,
+    });
+  } catch (err) {
+    if (err instanceof Error && err.name === "ConflictError") {
+      throw AppError.conflict(err.message);
+    }
+    throw err;
+  }
+}
+
+export function updateNode(
+  db: Db,
+  serviceId: number,
+  nodeId: number,
+  patch: UpdateServiceNodeInput,
+): ServiceNode {
+  const node = repos.getNode(db, nodeId);
+  if (node.service_id !== serviceId) {
+    throw AppError.notFound(`node ${nodeId}`);
+  }
+  if (patch.address) assertAddress(patch.address);
+  return repos.updateNode(db, nodeId, patch);
+}
+
+export function deleteNode(db: Db, serviceId: number, nodeId: number): void {
+  const node = repos.getNode(db, nodeId);
+  if (node.service_id !== serviceId) {
+    throw AppError.notFound(`node ${nodeId}`);
+  }
+  repos.deleteNode(db, nodeId);
+}
+
+export async function getOverview(
+  db: Db,
+  serviceId: number,
+): Promise<ServiceOverview> {
+  const service = await getView(db, serviceId);
+  const nodes = repos.listNodes(db, serviceId);
+  const bindings = repos.listBindingsByService(db, serviceId);
+  const first = bindings[0];
+  const routing = first?.routing_strategy ?? first?.lb_mode ?? "round_robin";
+  const healthCheck =
+    nodes
+      .map((n) => n.health_check_id)
+      .find((id): id is number => id != null) != null
+      ? repos.getHealthCheck(
+          db,
+          nodes.find((n) => n.health_check_id != null)!.health_check_id!,
+        )
+      : null;
+
+  const active = new Set<string>();
+  for (const binding of bindings) {
+    const metas = repos.listBindingIpsWithMeta(db, binding.id);
+    const rows = metas.map((entry) => {
+      const status = repos.getIpHealthStatusRow(db, "binding", binding.id, entry.ip);
+      return {
+        ip: entry.ip,
+        weight: entry.weight,
+        priority: entry.priority,
+        health: status ? status.status : ("unknown" as const),
+      };
+    });
+    for (const ip of selectActiveIpsByMode(
+      {
+        lb_mode: binding.lb_mode,
+        health_check_enabled: binding.health_check_enabled,
+      },
+      rows,
+    )) {
+      active.add(ip);
+    }
+  }
+
+  return {
+    service,
+    nodes,
+    health_check: healthCheck,
+    routing_strategy: routing,
+    active_addresses: [...active],
+  };
+}
+
+export function opsSummary(db: Db) {
+  const allNodes = repos.listAllNodes(db);
+  const services = repos.listServices(db);
+  const domains = repos.listDomains(db);
+  const healthy = allNodes.filter(
+    (n) => n.health_status === "healthy" || n.health_status === "up",
+  ).length;
+  const unhealthy = allNodes.filter(
+    (n) => n.health_status === "unhealthy" || n.health_status === "down",
+  ).length;
+  const failoverActive = repos.listAllBindings(db).filter((binding) => {
+    if (binding.lb_mode !== "failover" || !binding.health_check_enabled) {
+      return false;
+    }
+    return binding.target_ips.some((ip) => {
+      const row = repos.getIpHealthStatusRow(db, "binding", binding.id, ip);
+      return row?.status === "down";
+    });
+  }).length;
+  return {
+    domains: domains.length,
+    services: services.length,
+    nodes: allNodes.length,
+    healthy,
+    unhealthy,
+    active_failovers: failoverActive,
+  };
+}

apps/api/src/services/origin-health-check-service.ts

@@ -0,0 +1,126 @@
+import type { Db } from "@cfdm/db";
+import { repos } from "@cfdm/db";
+import type {
+  CreateOriginHealthCheckInput,
+  OriginHealthCheck,
+} from "@cfdm/shared";
+import type { CloudflareClient } from "../lib/cf-client.js";
+import { AppError } from "../errors.js";
+import { CloudflareHealthCheckProvider } from "./health/cloudflare.js";
+
+export function listOriginHealthChecks(db: Db): OriginHealthCheck[] {
+  return repos.listHealthChecks(db);
+}
+
+export function getOriginHealthCheck(db: Db, id: number): OriginHealthCheck {
+  return repos.getHealthCheck(db, id);
+}
+
+export async function createOriginHealthCheck(
+  db: Db,
+  cf: CloudflareClient,
+  input: CreateOriginHealthCheckInput,
+): Promise<OriginHealthCheck> {
+  const protocol = (input.protocol ?? "tcp").toLowerCase();
+  const check = repos.createHealthCheck(db, {
+    provider: input.provider,
+    name: input.name,
+    cf_zone_id: input.cf_zone_id ?? null,
+    protocol,
+    path: input.path,
+    method: input.method,
+    timeout: input.timeout,
+    interval_sec: input.interval_sec,
+    retries: input.retries,
+    expected_status: input.expected_status,
+    consecutive_fails: input.consecutive_fails,
+    consecutive_successes: input.consecutive_successes,
+    suspended: input.suspended,
+  });
+
+  if (input.node_id) {
+    const node = repos.getNode(db, input.node_id);
+    repos.updateNode(db, node.id, { health_check_id: check.id });
+  }
+
+  if (input.provider === "cloudflare") {
+    const zoneId = input.cf_zone_id;
+    if (!zoneId) {
+      throw AppError.zoneNotFound("укажите зону Cloudflare для Health Check");
+    }
+    const address = input.node_id
+      ? repos.getNode(db, input.node_id).address
+      : check.name;
+    const provider = new CloudflareHealthCheckProvider(db, cf);
+    await provider.syncCreate(check, zoneId, address);
+    return repos.getHealthCheck(db, check.id);
+  }
+
+  return check;
+}
+
+export async function updateOriginHealthCheck(
+  db: Db,
+  cf: CloudflareClient,
+  id: number,
+  patch: Partial<CreateOriginHealthCheckInput>,
+): Promise<OriginHealthCheck> {
+  const current = repos.getHealthCheck(db, id);
+  const updated = repos.updateHealthCheck(db, id, {
+    provider: patch.provider,
+    name: patch.name,
+    cf_zone_id: patch.cf_zone_id,
+    protocol: patch.protocol?.toLowerCase(),
+    path: patch.path,
+    method: patch.method,
+    timeout: patch.timeout,
+    interval_sec: patch.interval_sec,
+    retries: patch.retries,
+    expected_status: patch.expected_status,
+    consecutive_fails: patch.consecutive_fails,
+    consecutive_successes: patch.consecutive_successes,
+    suspended: patch.suspended,
+  });
+  if (updated.provider === "cloudflare" && updated.cf_healthcheck_id) {
+    const address = repos.findNodeByIp(db, updated.name)?.address ?? updated.name;
+    const provider = new CloudflareHealthCheckProvider(db, cf);
+    await provider.syncUpdate(updated, address);
+  }
+  void current;
+  return repos.getHealthCheck(db, id);
+}
+
+export async function deleteOriginHealthCheck(
+  db: Db,
+  cf: CloudflareClient,
+  id: number,
+): Promise<void> {
+  const check = repos.getHealthCheck(db, id);
+  if (check.provider === "cloudflare") {
+    const provider = new CloudflareHealthCheckProvider(db, cf);
+    await provider.syncDelete(check);
+  }
+  repos.deleteHealthCheck(db, id);
+}
+
+export async function syncOriginHealthCheck(
+  db: Db,
+  cf: CloudflareClient,
+  id: number,
+): Promise<OriginHealthCheck> {
+  const check = repos.getHealthCheck(db, id);
+  if (check.provider !== "cloudflare") {
+    throw AppError.validation("синхронизация доступна только для Cloudflare Health Checks");
+  }
+  if (!check.cf_zone_id) {
+    throw AppError.zoneNotFound();
+  }
+  const provider = new CloudflareHealthCheckProvider(db, cf);
+  const address = repos.findNodeByIp(db, check.name)?.address ?? check.name;
+  if (check.cf_healthcheck_id) {
+    await provider.syncUpdate(check, address);
+  } else {
+    await provider.syncCreate(check, check.cf_zone_id, address);
+  }
+  return repos.getHealthCheck(db, id);
+}

apps/api/src/services/routing/binding-lock.ts

@@ -0,0 +1,25 @@
+const locks = new Map<number, Promise<void>>();
+
+export async function withBindingLock<T>(
+  bindingId: number,
+  fn: () => Promise<T>,
+): Promise<T> {
+  const previous = locks.get(bindingId) ?? Promise.resolve();
+  let release!: () => void;
+  const current = new Promise<void>((resolve) => {
+    release = resolve;
+  });
+  locks.set(
+    bindingId,
+    previous.then(() => current).catch(() => current),
+  );
+  await previous.catch(() => undefined);
+  try {
+    return await fn();
+  } finally {
+    release();
+    if (locks.get(bindingId) === current) {
+      locks.delete(bindingId);
+    }
+  }
+}

apps/api/src/services/routing/failover.ts

@@ -0,0 +1,17 @@
+import type { LbIpRow } from "./types.js";
+import { isHealthy } from "./health.js";
+
+export function failoverDesired(rows: LbIpRow[]): string[] {
+  if (rows.length === 0) return [];
+  const healthy = rows.filter((r) => isHealthy(r.health));
+  const pool = healthy.length > 0 ? healthy : rows;
+  const sorted = [...pool].sort(
+    (a, b) => a.priority - b.priority || a.weight - b.weight,
+  );
+  const minPriority = sorted[0]!.priority;
+  const primaries = sorted.filter((r) => r.priority === minPriority);
+  if (healthy.length > 0) {
+    return primaries.map((r) => r.ip);
+  }
+  return [sorted[0]!.ip];
+}

apps/api/src/services/routing/health.ts

@@ -0,0 +1,5 @@
+import type { IpHealthState, NodeHealthState } from "@cfdm/shared";
+
+export function isHealthy(state: IpHealthState | NodeHealthState | string): boolean {
+  return state === "up" || state === "healthy";
+}

apps/api/src/services/routing/index.ts

@@ -0,0 +1,26 @@
+import type { LbMode } from "@cfdm/shared";
+import { failoverDesired } from "./failover.js";
+import { roundRobinDesired } from "./round-robin.js";
+import type { LbIpRow, LbTargetConfig } from "./types.js";
+
+export type { LbIpRow, LbTargetConfig } from "./types.js";
+export { isHealthy } from "./health.js";
+export { withBindingLock } from "./binding-lock.js";
+
+export function selectActiveIpsByMode(
+  config: LbTargetConfig,
+  rows: LbIpRow[],
+): string[] {
+  if (rows.length === 0) return [];
+  if (config.lb_mode === "failover") {
+    return failoverDesired(rows);
+  }
+  // weighted = round_robin on DNS (one A per IP)
+  return roundRobinDesired(rows);
+}
+
+export function strategyLabel(mode: LbMode): string {
+  if (mode === "failover") return "Failover";
+  if (mode === "weighted") return "Round Robin (weighted alias)";
+  return "Round Robin";
+}

apps/api/src/services/routing/round-robin.ts

@@ -0,0 +1,8 @@
+import type { LbIpRow } from "./types.js";
+import { isHealthy } from "./health.js";
+
+export function roundRobinDesired(rows: LbIpRow[]): string[] {
+  const healthy = rows.filter((r) => isHealthy(r.health));
+  const pool = healthy.length > 0 ? healthy : rows;
+  return pool.map((r) => r.ip);
+}

apps/api/src/services/routing/types.ts

@@ -0,0 +1,13 @@
+import type { IpHealthState, LbMode } from "@cfdm/shared";
+
+export interface LbTargetConfig {
+  lb_mode: LbMode;
+  health_check_enabled: boolean;
+}
+
+export interface LbIpRow {
+  ip: string;
+  weight: number;
+  priority: number;
+  health: IpHealthState;
+}

apps/api/src/services/service-config-service.ts

@@ -24,6 +24,15 @@ import { isValidIpv4 } from "../lib/validators.js";
 import * as dnsService from "./dns-service.js";
 import * as domainService from "./domain-service.js";
 import { syncServiceToVpsTracker } from "./vps-tracker-sync.js";
+import {
+  selectActiveIpsByMode,
+  withBindingLock,
+  type LbIpRow,
+  type LbTargetConfig,
+} from "./routing/index.js";
+
+export type { LbIpRow, LbTargetConfig };
+export { selectActiveIpsByMode };
 
 export interface ServiceDomainInput {
   fqdn: string;
@@ -137,54 +146,6 @@ function aggregateSyncStatus(statuses: string[]): string | null {
   return statuses[0] ?? null;
 }
 
-function isHealthy(state: IpHealthState): boolean {
-  return state === "up" || state === "unknown";
-}
-
-export interface LbTargetConfig {
-  lb_mode: LbMode;
-  health_check_enabled: boolean;
-}
-
-export interface LbIpRow {
-  ip: string;
-  weight: number;
-  priority: number;
-  health: IpHealthState;
-}
-
-export function selectActiveIpsByMode(
-  config: LbTargetConfig,
-  rows: LbIpRow[],
-): string[] {
-  if (rows.length === 0) return [];
-
-  const healthy = rows.filter((r) => isHealthy(r.health));
-  const pool = healthy.length > 0 ? healthy : rows;
-
-  if (config.lb_mode === "failover") {
-    const sorted = [...pool].sort(
-      (a, b) => a.priority - b.priority || a.weight - b.weight,
-    );
-    const minPriority = sorted[0]!.priority;
-    const primaries = sorted.filter((r) => r.priority === minPriority);
-    if (healthy.length > 0) {
-      return primaries.map((r) => r.ip);
-    }
-    return [sorted[0]!.ip];
-  }
-
-  if (config.lb_mode === "weighted") {
-    // Cloudflare не допускает дублирования A-записей с одинаковым name+content,
-    // поэтому weighted на уровне DNS реализован как RR по одному A на IP.
-    // Веса сохраняются в БД и используются для приоритизации/отображения;
-    // точное weighted-распределение требует CF Load Balancer (см. README).
-    return pool.map((r) => r.ip);
-  }
-
-  return pool.map((r) => r.ip);
-}
-
 function getBindingLbState(
   db: Db,
   bindingId: number,
@@ -1411,6 +1372,25 @@ export function reorderServices(
   repos.reorderServices(db, groupId, serviceIds);
 }
 
+export async function applyBindingDesiredDns(
+  db: Db,
+  cf: CloudflareClient,
+  bindingId: number,
+  desiredIps: string[],
+): Promise<void> {
+  const binding = repos.getBinding(db, bindingId);
+  const cnameTarget = binding.cname_target?.trim() || null;
+  await syncBindingDns(
+    db,
+    cf,
+    binding.id,
+    binding.domain_id,
+    binding.hostname,
+    desiredIps,
+    cnameTarget,
+  );
+}
+
 export async function reconcileDnsForTarget(
   db: Db,
   cf: CloudflareClient,
@@ -1418,26 +1398,28 @@ export async function reconcileDnsForTarget(
   refId: number,
 ): Promise<void> {
   if (scope === "binding") {
-    const binding = repos.getBinding(db, refId);
-    if (!binding.health_check_enabled) return;
-    const service = repos.getService(db, binding.service_id);
-    if (!shouldPushDns(db, service)) return;
-    const cnameTarget = binding.cname_target?.trim() || null;
-    if (cnameTarget) return;
-    const ips = repos.listServiceIps(db, service.id);
-    const targetIps = repos.listBindingIps(db, binding.id);
-    validateTargetIpsInPool(targetIps, ips);
-    const activeIps = computeActiveIps(db, "binding", refId);
-    const desiredIps = activeIps.length > 0 ? activeIps : targetIps;
-    await syncBindingDns(
-      db,
-      cf,
-      binding.id,
-      binding.domain_id,
-      binding.hostname,
-      desiredIps,
-      null,
-    );
+    await withBindingLock(refId, async () => {
+      const binding = repos.getBinding(db, refId);
+      if (!binding.health_check_enabled) return;
+      const service = repos.getService(db, binding.service_id);
+      if (!shouldPushDns(db, service)) return;
+      const cnameTarget = binding.cname_target?.trim() || null;
+      if (cnameTarget) return;
+      const ips = repos.listServiceIps(db, service.id);
+      const targetIps = repos.listBindingIps(db, binding.id);
+      validateTargetIpsInPool(targetIps, ips);
+      const activeIps = computeActiveIps(db, "binding", refId);
+      const desiredIps = activeIps.length > 0 ? activeIps : targetIps;
+      await syncBindingDns(
+        db,
+        cf,
+        binding.id,
+        binding.domain_id,
+        binding.hostname,
+        desiredIps,
+        null,
+      );
+    });
     return;
   }