refactor(web): improve job kind handling in schedule components

- Removed hardcoded job kind checks in schedule components and replaced them with a utility function `isRefreshJobKind` for better maintainability. - Updated the `ui-labels` module to include additional job kinds and their corresponding labels. - Adjusted the `DashboardRecentJobsGrid`, `OperationsJobsGrid`, and `ScheduleJobsGrid` components to reflect these changes, enhancing the clarity and consistency of job kind representation.
fix(web): open module create in FormDrawer
2026-08-19 09:45:31 +07:00 · 2026-08-18 22:09:41 +07:00 · 2026-08-18 20:17:51 +07:00 · 2026-08-18 19:58:39 +07:00 · 2026-08-18 19:47:14 +07:00 · 2026-08-18 19:13:10 +07:00
31 changed files with 730 additions and 143 deletions
@@ -14,7 +14,11 @@ Job **changes** вычисляет флаги по путям в diff. Полн

 На **pull request** — **commitlint**. При изменении `deploy/docker/**` — job **docker-check** (`bake --print`, bake без `--push` если есть доступ к registry).

-Кэш зависимостей: `actions/cache` с ключом `sha256sum` lockfile (`go.sum` / `pnpm-lock.yaml`). `hashFiles` в Gitea не используем.
+Кэш зависимостей — нативный `actions/cache` (cache server act_runner), ключ `sha256sum` lockfile (не `hashFiles`). Пути **абсолютные** (`$HOME/.pnpm-store`, `go env GOMODCACHE` / `GOCACHE`): тильда `~` на Gitea часто не раскрывается и даёт вечный miss.
+
+Кэшируется целиком: pnpm store + `node_modules` + corepack; Go modules + GOCACHE + `golangci-lint` в `GOBIN`. При hit: `pnpm install --offline`, `go mod download` без сети. `setup-go cache:` и `golangci-lint-action` не используем — они завязаны на `hashFiles`.
+
+Если restore пишет `connect ECONNREFUSED` / `cache server not configured` — на runner включите cache server (см. ниже). Иначе каждый job снова качает пакеты (~минуты).

 Runner: `ubuntu-latest`, **bird2** из apt, Docker для **docker-check** (PR) и **publish** (CD).

@@ -24,7 +28,7 @@ Runner: `ubuntu-latest`, **bird2** из apt, Docker для **docker-check** (PR)

 1. `pnpm exec semantic-release` — тег `vX.Y.Z` на **текущий commit** (без дополнительного commit в main).
 2. Gitea Release + `CHANGELOG.md` как attachment (не в git).
-3. Зеркало base-образов в `evobgp-buildcache:base-*` (`deploy/docker/mirror-base-images.sh`).
+3. Зеркало base-образов в `evobgp-buildcache:base-*` (`deploy/docker/mirror-base-images.sh`; skip существующих тегов, `linux/amd64`, retry при 429).
 4. `docker buildx bake default --push` с `VERSION=X.Y.Z`, `pull=false`, named builder `evobgp` (`cleanup: false`).

 Если releasable-коммитов нет — semantic-release no-op, образы не публикуются.
@@ -58,3 +62,21 @@ docker pull git.shx.one/myuser/evobgp-api:1.2.3
 ```

 См. [deploy/docker/README.md](../deploy/docker/README.md), [docs/quickstart.md](../docs/quickstart.md).
+
+## act_runner: cache server
+
+`actions/cache` ходит в **встроенный cache server** runner (не GitHub `type=gha`). Кэш локален для этого runner.
+
+В `config.yaml` runner:
+
+```yaml
+cache:
+  enabled: true
+  dir: ""          # по умолчанию $HOME/.cache/actcache
+  host: ""         # IP, доступный из job-контейнера (не 0.0.0.0)
+  port: 8088
+```
+
+Если runner в Docker, а jobs — отдельные контейнеры: пробросьте порт и задайте `host` (LAN IP хоста) или `external_server: "http://<host>:8088/"`. Иначе restore — timeout/ECONNREFUSED и пакеты качаются снова.
+
+Не делайте `docker system prune -a` по cron: сотрётся и Docker-кэш FROM, и пользы от `cleanup: false` у buildx не будет.
@@ -39,18 +39,26 @@ jobs:
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: "22"
-      - name: Enable pnpm via corepack
-        run: corepack enable
+      - name: Export cache paths
+        run: sh scripts/ci/export-cache-env.sh
      - id: pnpm-hash
        run: echo "key=$(sha256sum pnpm-lock.yaml | awk '{print $1}')" >> "$GITHUB_OUTPUT"
-      - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+      - id: pnpm-cache
+        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
        with:
-          path: ~/.local/share/pnpm/store
+          path: |
+            ${{ env.PNPM_STORE_DIR }}
+            ${{ env.COREPACK_HOME }}
+            node_modules
+            apps/web/node_modules
+            packages/ui/node_modules
          key: pnpm-${{ runner.os }}-${{ steps.pnpm-hash.outputs.key }}
          restore-keys: |
            pnpm-${{ runner.os }}-
      - name: Install release tooling
-        run: pnpm install --frozen-lockfile
+        env:
+          PNPM_CACHE_HIT: ${{ steps.pnpm-cache.outputs.cache-hit }}
+        run: sh scripts/ci/pnpm-ci.sh
      - name: Verify releasable commit messages
        run: pnpm exec node scripts/commit/verify-release-commits.mjs
      - name: Semantic release
@@ -108,10 +116,9 @@ jobs:
          password: ${{ secrets.ACTIONS_PAT }}
      - name: Mirror base images into buildcache
        if: steps.rel.outputs.released == 'true'
-        id: mirror
-        continue-on-error: true
        env:
          REGISTRY: git.shx.one/${{ steps.meta.outputs.owner_lc }}
+          MIRROR_ENV_FILE: ${{ runner.temp }}/mirror-base.env
        run: sh deploy/docker/mirror-base-images.sh
      - name: Build and push images (bake)
        if: steps.rel.outputs.released == 'true'
@@ -126,16 +133,16 @@ jobs:
          CACHE_REF_WEB: git.shx.one/${{ steps.meta.outputs.owner_lc }}/evobgp-buildcache:web-buildcache
          CACHE_REF_BIRDC: git.shx.one/${{ steps.meta.outputs.owner_lc }}/evobgp-buildcache:birdc-buildcache
          BUILDX_BAKE_ENTITLEMENTS_FS: "0"
+          BUILDX_BAKE_FILE_RELATIVE_PATHS: "1"
+          MIRROR_ENV_FILE: ${{ runner.temp }}/mirror-base.env
+        working-directory: deploy/docker
        run: |
          set -euxo pipefail
-          cache="git.shx.one/${{ steps.meta.outputs.owner_lc }}/evobgp-buildcache"
-          if [ "${{ steps.mirror.outcome }}" = "success" ]; then
-            export BASE_GOLANG="${cache}:base-golang-1.24-alpine"
-            export BASE_DEBIAN="${cache}:base-debian-bookworm-slim"
-            export BASE_NODE="${cache}:base-node-22-alpine"
-            export BASE_NGINX="${cache}:base-nginx-1.27-alpine"
-            export BASE_UBUNTU="${cache}:base-ubuntu-noble"
-            export BASE_DISTROLESS="${cache}:base-distroless-static-debian12-nonroot"
+          if [ -f "${MIRROR_ENV_FILE}" ]; then
+            set -a
+            # shellcheck disable=SC1090
+            . "${MIRROR_ENV_FILE}"
+            set +a
          fi
          docker buildx bake --allow=fs.read="${{ github.workspace }}" \
-            -f deploy/docker/docker-bake.hcl default --push
+            -f docker-bake.hcl default --push
@@ -183,20 +183,28 @@ jobs:
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: "22"
-      - name: Enable pnpm via corepack
-        run: corepack enable
+      - name: Export cache paths
+        run: sh scripts/ci/export-cache-env.sh
      - id: pnpm-hash
        run: echo "key=$(sha256sum pnpm-lock.yaml | awk '{print $1}')" >> "$GITHUB_OUTPUT"
-      - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+      - id: pnpm-cache
+        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
        with:
-          path: ~/.local/share/pnpm/store
+          path: |
+            ${{ env.PNPM_STORE_DIR }}
+            ${{ env.COREPACK_HOME }}
+            node_modules
+            apps/web/node_modules
+            packages/ui/node_modules
          key: pnpm-${{ runner.os }}-${{ steps.pnpm-hash.outputs.key }}
          restore-keys: |
            pnpm-${{ runner.os }}-
      - name: pnpm install, Redocly, codegen check
+        env:
+          PNPM_CACHE_HIT: ${{ steps.pnpm-cache.outputs.cache-hit }}
        run: |
          set -euxo pipefail
-          pnpm install --frozen-lockfile
+          sh scripts/ci/pnpm-ci.sh
          pnpm exec redocly lint docs/openapi.yaml
          chmod +x scripts/check-openapi-gen.sh
          sh scripts/check-openapi-gen.sh
@@ -210,20 +218,28 @@ jobs:
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: "22"
-      - name: Enable pnpm via corepack
-        run: corepack enable
+      - name: Export cache paths
+        run: sh scripts/ci/export-cache-env.sh
      - id: pnpm-hash
        run: echo "key=$(sha256sum pnpm-lock.yaml | awk '{print $1}')" >> "$GITHUB_OUTPUT"
-      - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+      - id: pnpm-cache
+        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
        with:
-          path: ~/.local/share/pnpm/store
+          path: |
+            ${{ env.PNPM_STORE_DIR }}
+            ${{ env.COREPACK_HOME }}
+            node_modules
+            apps/web/node_modules
+            packages/ui/node_modules
          key: pnpm-${{ runner.os }}-${{ steps.pnpm-hash.outputs.key }}
          restore-keys: |
            pnpm-${{ runner.os }}-
      - name: pnpm install, typecheck, lint, test, build
+        env:
+          PNPM_CACHE_HIT: ${{ steps.pnpm-cache.outputs.cache-hit }}
        run: |
          set -euxo pipefail
-          pnpm install --frozen-lockfile
+          sh scripts/ci/pnpm-ci.sh
          pnpm --filter @evobgp/web run typecheck
          pnpm --filter @evobgp/web run lint
          pnpm --filter @evobgp/web run test
@@ -239,17 +255,29 @@ jobs:
        with:
          go-version: "1.24"
          cache: false
+      - name: Export cache paths
+        run: sh scripts/ci/export-cache-env.sh
      - id: go-hash
        run: echo "key=$(sha256sum go.sum | awk '{print $1}')" >> "$GITHUB_OUTPUT"
      - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
        with:
          path: |
-            ~/go/pkg/mod
-            ~/.cache/go-build
-          key: go-${{ runner.os }}-${{ steps.go-hash.outputs.key }}
+            ${{ env.GOMODCACHE }}
+            ${{ env.GOCACHE }}
+            ${{ env.GOBIN }}
+            ${{ env.GOLANGCI_LINT_CACHE }}
+          key: go-${{ runner.os }}-1.24-gl1.64.8-${{ steps.go-hash.outputs.key }}
          restore-keys: |
-            go-${{ runner.os }}-
+            go-${{ runner.os }}-1.24-gl1.64.8-
+            go-${{ runner.os }}-1.24-
+      - name: Download modules
+        env:
+          GOMODCACHE: ${{ env.GOMODCACHE }}
+          GOCACHE: ${{ env.GOCACHE }}
+        run: go mod download
      - name: Vet
+        env:
+          GOFLAGS: -mod=readonly
        run: go vet ./...
      - name: Lint httpapi (ERR-01 / ARCH-01)
        run: sh scripts/lint-httpapi.sh
@@ -258,13 +286,20 @@ jobs:
      - name: Validate remote speaker compose
        run: sh scripts/validate-remote-speaker-compose.sh
      - name: golangci-lint
-        uses: golangci/golangci-lint-action@55c2c1448f86e01eaae002a5a3a9624417608d84 # v6.5.2
-        with:
-          version: v1.64.8
-          skip-cache: true
+        env:
+          GOLANGCI_LINT_VERSION: v1.64.8
+        run: sh scripts/ci/golangci-lint.sh
      - name: Test
+        env:
+          GOFLAGS: -mod=readonly
+          GOMODCACHE: ${{ env.GOMODCACHE }}
+          GOCACHE: ${{ env.GOCACHE }}
        run: go test ./... -race -count=1
      - name: Build all commands
+        env:
+          GOFLAGS: -mod=readonly
+          GOMODCACHE: ${{ env.GOMODCACHE }}
+          GOCACHE: ${{ env.GOCACHE }}
        run: |
          set -euxo pipefail
          out="${RUNNER_TEMP}/evobgp-bin"
@@ -321,13 +356,19 @@ jobs:
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: "22"
-      - name: Enable pnpm via corepack
-        run: corepack enable
+      - name: Export cache paths
+        run: sh scripts/ci/export-cache-env.sh
      - id: pnpm-hash
        run: echo "key=$(sha256sum pnpm-lock.yaml | awk '{print $1}')" >> "$GITHUB_OUTPUT"
-      - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+      - id: pnpm-cache
+        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
        with:
-          path: ~/.local/share/pnpm/store
+          path: |
+            ${{ env.PNPM_STORE_DIR }}
+            ${{ env.COREPACK_HOME }}
+            node_modules
+            apps/web/node_modules
+            packages/ui/node_modules
          key: pnpm-${{ runner.os }}-${{ steps.pnpm-hash.outputs.key }}
          restore-keys: |
            pnpm-${{ runner.os }}-
@@ -335,9 +376,10 @@ jobs:
        env:
          BASE_SHA: ${{ inputs.base_sha }}
          HEAD_SHA: ${{ inputs.head_sha }}
+          PNPM_CACHE_HIT: ${{ steps.pnpm-cache.outputs.cache-hit }}
        run: |
          set -euxo pipefail
-          pnpm install --frozen-lockfile
+          sh scripts/ci/pnpm-ci.sh
          pnpm exec commitlint --from "$BASE_SHA" --to "$HEAD_SHA"

  docker-check:
@@ -366,12 +408,14 @@ jobs:
        working-directory: deploy/docker
        env:
          BUILDX_BAKE_ENTITLEMENTS_FS: "0"
+          BUILDX_BAKE_FILE_RELATIVE_PATHS: "1"
        run: docker buildx bake --allow=fs.read="${{ github.workspace }}" -f docker-bake.hcl --print default
      - name: bake (no push)
        if: inputs.allow_registry_login
        working-directory: deploy/docker
        env:
          BUILDX_BAKE_ENTITLEMENTS_FS: "0"
+          BUILDX_BAKE_FILE_RELATIVE_PATHS: "1"
          CACHE_REF_GO: git.shx.one/${{ github.repository_owner }}/evobgp-buildcache:go-buildcache
          CACHE_REF_WEB: git.shx.one/${{ github.repository_owner }}/evobgp-buildcache:web-buildcache
          CACHE_REF_BIRDC: git.shx.one/${{ github.repository_owner }}/evobgp-buildcache:birdc-buildcache
@@ -167,7 +167,7 @@ export function DashboardModulesGrid({
      description="Поиск, сортировка и быстрый переход к настройке"
      className="min-w-0"
      actions={
-        <Button variant="outline" size="sm" render={<Link to="/modules/new" />}>
+        <Button variant="outline" size="sm" render={<Link to="/modules" search={{ create: true }} />}>
          <PlusIcon />
          Создать
        </Button>
@@ -16,7 +16,8 @@ const ACTIONS: QuickActionItem[] = [
    id: 'new-module',
    title: 'Создать модуль',
    description: 'Новый модуль маршрутизации и источники префиксов.',
-    to: '/modules/new',
+    to: '/modules',
+    search: { create: true },
    icon: <Plus aria-hidden />,
    iconClassName: 'text-primary',
  },
@@ -29,7 +29,6 @@ export function DashboardRecentJobsGrid({
        cell: ({ row }) => (
          <DataGridPrimaryCell
            title={jobKindRu(row.original.kind)}
-            accent="mono"
            subtitle={
              row.original.meta?.module_id
                ? (nameById.get(String(row.original.meta.module_id)) ?? undefined)
@@ -128,7 +128,7 @@ export function LookupAddStep({
        <AlertTitle>Нет подходящего модуля</AlertTitle>
        <AlertDescription>
          Создайте модуль типа {wantedType}, затем повторите добавление.{' '}
-          <Button variant="link" size="sm" className="h-auto p-0" render={<Link to="/modules/new" />}>
+          <Button variant="link" size="sm" className="h-auto p-0" render={<Link to="/modules" search={{ create: true }} />}>
            Перейти к модулям
          </Button>
        </AlertDescription>
@@ -0,0 +1,289 @@
+import { useEffect, useState } from 'react'
+import { toast } from 'sonner'
+
+import { Button } from '@evobgp/ui/components/button'
+import { Checkbox } from '@evobgp/ui/components/checkbox'
+import { Input } from '@evobgp/ui/components/input'
+import { Label } from '@evobgp/ui/components/label'
+
+import { FormDrawer } from '@/components/form-drawer'
+import { LoadingButton } from '@/components/loading-button'
+import { CommunitySelect } from '@/components/modules/community-select'
+import { SelectField } from '@/components/select-field'
+import { dohProfileShortLabel } from '@/lib/modules/helpers'
+import { dohPolicyRu, moduleTypeRu } from '@/lib/ui-labels'
+import { useCreateModuleMutation } from '@/queries/modules'
+import type {
+  BgpCommunity,
+  DohProfile,
+  DohResolverPolicy,
+  ModuleCreate,
+  ModuleRow,
+  ModuleType,
+} from '@/types/api'
+
+interface ModuleCreateDialogProps {
+  open: boolean
+  onOpenChange: (open: boolean) => void
+  communities: BgpCommunity[]
+  dohProfiles: DohProfile[]
+  onCreated?: (mod: ModuleRow) => void
+}
+
+/** @see https://reui.io/preview/base/form-7 */
+/** @see https://reui.io/preview/base/sheet-8 */
+
+const MODULE_TYPE_ITEMS: { value: ModuleType; label: string }[] = [
+  { value: 'IP_RANGES', label: moduleTypeRu('IP_RANGES') },
+  { value: 'AS_PREFIXES', label: moduleTypeRu('AS_PREFIXES') },
+  { value: 'CDN_CIDRS', label: moduleTypeRu('CDN_CIDRS') },
+  { value: 'DOMAINS', label: moduleTypeRu('DOMAINS') },
+]
+
+const DOH_POLICY_ITEMS: { value: DohResolverPolicy; label: string }[] = [
+  { value: 'primary_only', label: dohPolicyRu('primary_only') },
+  { value: 'failover', label: dohPolicyRu('failover') },
+  { value: 'union', label: dohPolicyRu('union') },
+]
+
+export function ModuleCreateDialog({
+  open,
+  onOpenChange,
+  communities,
+  dohProfiles,
+  onCreated,
+}: ModuleCreateDialogProps) {
+  const createMutation = useCreateModuleMutation()
+
+  const [type, setType] = useState<ModuleType>('IP_RANGES')
+  const [name, setName] = useState('')
+  const [enabled, setEnabled] = useState(true)
+  const [priority, setPriority] = useState('0')
+  const [refreshIntervalSec, setRefreshIntervalSec] = useState('')
+  const [cronExpr, setCronExpr] = useState('')
+  const [defaultCommunityId, setDefaultCommunityId] = useState<string | null>(null)
+  const [dohResolverPolicy, setDohResolverPolicy] = useState<DohResolverPolicy>('primary_only')
+  const [dohProfileIds, setDohProfileIds] = useState<string[]>([])
+
+  const isDomains = type === 'DOMAINS'
+
+  useEffect(() => {
+    if (!open) return
+    setType('IP_RANGES')
+    setName('')
+    setEnabled(true)
+    setPriority('0')
+    setRefreshIntervalSec('')
+    setCronExpr('')
+    setDefaultCommunityId(null)
+    setDohResolverPolicy('primary_only')
+    setDohProfileIds([])
+  }, [open])
+
+  function toggleDohProfile(id: string, checked: boolean) {
+    setDohProfileIds((prev) => {
+      if (checked) {
+        if (prev.includes(id)) return prev
+        return [...prev, id]
+      }
+      return prev.filter((x) => x !== id)
+    })
+  }
+
+  async function save() {
+    const trimmedName = name.trim()
+    if (!trimmedName) {
+      toast.error('Укажите название модуля')
+      return
+    }
+
+    const priorityNum = Number(priority)
+    if (!Number.isFinite(priorityNum) || !Number.isInteger(priorityNum)) {
+      toast.error('Приоритет должен быть целым числом')
+      return
+    }
+
+    let refresh: number | undefined
+    if (refreshIntervalSec.trim() !== '') {
+      const n = Number(refreshIntervalSec)
+      if (!Number.isFinite(n) || !Number.isInteger(n) || n < 0) {
+        toast.error('Интервал обновления должен быть целым числом ≥ 0')
+        return
+      }
+      refresh = n
+    }
+
+    const body: ModuleCreate = {
+      type,
+      name: trimmedName,
+      enabled,
+      priority: priorityNum,
+    }
+    if (refresh !== undefined) {
+      body.refresh_interval_sec = refresh
+    }
+    const cron = cronExpr.trim()
+    if (cron) {
+      body.cron_expr = cron
+    }
+    if (defaultCommunityId) {
+      body.default_community_id = defaultCommunityId
+    }
+    if (isDomains) {
+      body.doh_resolver_policy = dohResolverPolicy
+      body.doh_profile_ids = dohProfileIds
+    }
+
+    try {
+      const created = await createMutation.mutateAsync(body)
+      onOpenChange(false)
+      onCreated?.(created)
+    } catch {
+      // toast in mutation
+    }
+  }
+
+  return (
+    <FormDrawer
+      open={open}
+      onOpenChange={onOpenChange}
+      title="Новый модуль"
+      description="Тип задаётся один раз. Записи добавляются на карточке модуля."
+      className="sm:max-w-md"
+      footer={
+        <>
+          <Button variant="outline" type="button" onClick={() => onOpenChange(false)}>
+            Отмена
+          </Button>
+          <LoadingButton type="button" loading={createMutation.isPending} onClick={() => void save()}>
+            Создать
+          </LoadingButton>
+        </>
+      }
+    >
+      <SelectField
+        id="mod-create-type"
+        label="Тип"
+        items={MODULE_TYPE_ITEMS}
+        value={type}
+        onValueChange={(v) => {
+          if (v) setType(v)
+        }}
+      />
+
+      <div className="flex flex-col gap-2">
+        <Label htmlFor="mod-create-name">Название</Label>
+        <Input
+          id="mod-create-name"
+          value={name}
+          onChange={(e) => setName(e.target.value)}
+          placeholder="Имя модуля"
+        />
+      </div>
+
+      <div className="flex flex-row items-center justify-between gap-4 rounded-lg border border-border bg-muted/30 p-3">
+        <div className="grid min-w-0 flex-1 gap-1 pr-2">
+          <Label htmlFor="mod-create-enabled">Включён</Label>
+          <p className="text-xs text-muted-foreground">
+            Выключенный модуль не участвует в обновлении и применении.
+          </p>
+        </div>
+        <Checkbox
+          id="mod-create-enabled"
+          checked={enabled}
+          onCheckedChange={(v) => setEnabled(v === true)}
+        />
+      </div>
+
+      <div className="flex flex-col gap-2">
+        <Label htmlFor="mod-create-priority">Приоритет</Label>
+        <Input
+          id="mod-create-priority"
+          type="number"
+          value={priority}
+          onChange={(e) => setPriority(e.target.value)}
+        />
+      </div>
+
+      <div className="flex flex-col gap-2">
+        <Label htmlFor="mod-create-interval">Интервал обновления (сек)</Label>
+        <Input
+          id="mod-create-interval"
+          type="number"
+          min={0}
+          placeholder="пусто = по умолчанию"
+          value={refreshIntervalSec}
+          onChange={(e) => setRefreshIntervalSec(e.target.value)}
+        />
+      </div>
+
+      <div className="flex flex-col gap-2">
+        <Label htmlFor="mod-create-cron">Cron (опционально)</Label>
+        <Input
+          id="mod-create-cron"
+          placeholder="0 * * * *"
+          value={cronExpr}
+          onChange={(e) => setCronExpr(e.target.value)}
+        />
+      </div>
+
+      <CommunitySelect
+        id="mod-create-community"
+        label="Community по умолчанию"
+        value={defaultCommunityId}
+        onValueChange={setDefaultCommunityId}
+        communities={communities}
+        nullable
+      />
+
+      {isDomains ? (
+        <>
+          <SelectField
+            id="mod-create-doh-policy"
+            label="Политика DoH"
+            items={DOH_POLICY_ITEMS}
+            value={dohResolverPolicy}
+            onValueChange={(v) => {
+              if (v) setDohResolverPolicy(v)
+            }}
+          />
+
+          <div className="flex flex-col gap-2">
+            <Label>DoH профили</Label>
+            {dohProfiles.length === 0 ? (
+              <p className="text-muted-foreground text-sm">Нет профилей в справочнике</p>
+            ) : (
+              <div className="flex flex-col gap-2 rounded-lg border border-border p-3">
+                {dohProfiles.map((p) => {
+                  const checked = dohProfileIds.includes(p.id)
+                  return (
+                    <label
+                      key={p.id}
+                      htmlFor={`mod-create-doh-${p.id}`}
+                      className="flex cursor-pointer items-start gap-3"
+                    >
+                      <Checkbox
+                        id={`mod-create-doh-${p.id}`}
+                        checked={checked}
+                        onCheckedChange={(v) => toggleDohProfile(p.id, v === true)}
+                        className="mt-0.5"
+                      />
+                      <span className="flex min-w-0 flex-col gap-0.5">
+                        <span className="text-sm font-medium">
+                          {dohProfileShortLabel(p.id, dohProfiles)}
+                        </span>
+                        <span className="text-muted-foreground truncate text-xs" title={p.url}>
+                          {p.url}
+                        </span>
+                      </span>
+                    </label>
+                  )
+                })}
+              </div>
+            )}
+          </div>
+        </>
+      ) : null}
+    </FormDrawer>
+  )
+}
@@ -43,7 +43,6 @@ export function OperationsJobsGrid({
        cell: ({ row }) => (
          <DataGridPrimaryCell
            title={jobKindRu(row.original.kind)}
-            accent="mono"
            subtitle={
              row.original.meta?.module_id
                ? (nameById.get(String(row.original.meta.module_id)) ??
@@ -1,21 +1,28 @@
-import { Link } from '@tanstack/react-router'
 import { Boxes, Plus } from 'lucide-react'

 import { IllustratedEmptyState } from '@/components/patterns/illustrated-empty-state'
 import { Button } from '@evobgp/ui/components/button'

 /** empty-state-3 pattern for first module. */
-export function ProjectsEmptyState() {
+export function ProjectsEmptyState({
+  canCreate = true,
+  onCreate,
+}: {
+  canCreate?: boolean
+  onCreate?: () => void
+}) {
  return (
    <IllustratedEmptyState
      icon={Boxes}
      title="Создайте первый модуль"
      description="Модули задают источники префиксов: AS, CDN, домены и IP-диапазоны."
      action={
-        <Button size="sm" render={<Link to="/modules/new" />}>
-          <Plus />
-          Новый модуль
-        </Button>
+        canCreate && onCreate ? (
+          <Button size="sm" onClick={onCreate}>
+            <Plus />
+            Новый модуль
+          </Button>
+        ) : undefined
      }
    />
  )
@@ -16,7 +16,7 @@ import {
  SelectValue,
 } from '@evobgp/ui/components/select'
 import { cn } from '@evobgp/ui/lib/utils'
-import { jobKindRu } from '@/lib/ui-labels'
+import { isRefreshJobKind, jobKindRu } from '@/lib/ui-labels'
 import type { JobRow } from '@/types/api'

 import { ScheduleCalendarView } from './schedule-calendar-view'
@@ -34,7 +34,7 @@ function jobTimestamp(job: JobRow): string | undefined {
 }

 function matchesFilter(job: JobRow, filter: JobFilter): boolean {
-  if (filter === 'refresh') return job.kind === 'module_refresh'
+  if (filter === 'refresh') return isRefreshJobKind(job.kind)
  if (filter === 'failed')
    return ['failed', 'error', 'cancelled'].includes(job.status.toLowerCase())
  return true
@@ -4,6 +4,7 @@ import { FrameDataGrid } from '@/components/reui-kit'
 import { QueryState } from '@/components/query-state'
 import { TableSkeleton } from '@/components/skeletons'
 import { Tabs, TabsList, TabsTrigger } from '@evobgp/ui/components/tabs'
+import { isRefreshJobKind } from '@/lib/ui-labels'
 import type { JobRow } from '@/types/api'

 import { ScheduleJobsGrid } from './schedule-jobs-grid'
@@ -11,7 +12,7 @@ import { ScheduleJobsGrid } from './schedule-jobs-grid'
 type JobTab = 'all' | 'refresh' | 'failed'

 function filterJobs(items: JobRow[], tab: JobTab): JobRow[] {
-  if (tab === 'refresh') return items.filter((j) => j.kind === 'module_refresh')
+  if (tab === 'refresh') return items.filter((j) => isRefreshJobKind(j.kind))
  if (tab === 'failed')
    return items.filter((j) => ['failed', 'error', 'cancelled'].includes(j.status.toLowerCase()))
  return items
@@ -20,7 +21,7 @@ function filterJobs(items: JobRow[], tab: JobTab): JobRow[] {
 function tabCounts(items: JobRow[]) {
  return {
    all: items.length,
-    refresh: items.filter((j) => j.kind === 'module_refresh').length,
+    refresh: items.filter((j) => isRefreshJobKind(j.kind)).length,
    failed: items.filter((j) => ['failed', 'error', 'cancelled'].includes(j.status.toLowerCase()))
      .length,
  }
@@ -21,7 +21,7 @@ export function ScheduleJobsGrid({
      {
        accessorKey: 'kind',
        header: ({ column }) => <DataGridColumnHeader column={column} title="Вид" />,
-        cell: ({ row }) => <DataGridPrimaryCell title={jobKindRu(row.original.kind)} accent="mono" />,
+        cell: ({ row }) => <DataGridPrimaryCell title={jobKindRu(row.original.kind)} />,
        meta: { headerTitle: 'Вид' },
      },
      {
@@ -30,9 +30,28 @@ export function moduleTypeRu(type: string): string {

 const JOB_KIND_RU: Record<string, string> = {
  module_refresh: 'Обновление модуля',
+  tenant_refresh: 'Обновление тенанта',
+  peer_reconcile: 'Согласование пиров',
+  deploy_apply: 'Применение на спикеры',
  apply: 'Применение конфигурации',
+  revision_rollback: 'Откат ревизии',
  rollback: 'Откат ревизии',
  bird_reload: 'Перезагрузка BIRD',
+  postgres_metrics_refresh: 'Метрики PostgreSQL',
+  postgres_slow_query_aggregate: 'Медленные запросы PostgreSQL',
+  postgres_table_bloat_estimate: 'Bloat таблиц PostgreSQL',
+  postgres_index_usage_analyze: 'Использование индексов PostgreSQL',
+  postgres_autovacuum_lag_detect: 'Отставание autovacuum',
+  postgres_vacuum: 'VACUUM PostgreSQL',
+  postgres_vacuum_analyze: 'VACUUM ANALYZE PostgreSQL',
+  postgres_analyze: 'ANALYZE PostgreSQL',
+  postgres_reindex: 'REINDEX PostgreSQL',
+  postgres_cleanup: 'Очистка PostgreSQL',
+  maintenance_policy_run: 'Политика обслуживания',
+}
+
+export function isRefreshJobKind(kind: string): boolean {
+  return kind === 'module_refresh' || kind === 'tenant_refresh'
 }

 export function jobKindRu(kind: string): string {
@@ -4,6 +4,7 @@ import { toast } from 'sonner'
 import { apiJSON, apiMutate } from '@/lib/api-client'
 import { overviewKeys } from '@/queries/overview'
 import type {
+  ModuleCreate,
  ModulePatch,
  ModuleRow,
  ModulesResponse,
@@ -64,6 +65,18 @@ export function moduleEntriesQueryOptions(id: string, type: ModuleRow['type']) {
  })
 }

+export function useCreateModuleMutation() {
+  const qc = useQueryClient()
+  return useMutation({
+    mutationFn: (body: ModuleCreate) => apiMutate<ModuleRow>('/v1/modules', 'POST', body),
+    onSuccess: (data) => {
+      toast.success('Модуль создан')
+      invalidateModules(qc, data.id)
+    },
+    onError: (e) => toast.error(e instanceof Error ? e.message : 'Не удалось создать модуль'),
+  })
+}
+
 export function useUpdateModuleMutation() {
  const qc = useQueryClient()
  return useMutation({
@@ -1,4 +1,4 @@
-import { Link, createFileRoute } from '@tanstack/react-router'
+import { createFileRoute } from '@tanstack/react-router'
 import { useQuery } from '@tanstack/react-query'
 import { Plus, RefreshCw } from 'lucide-react'

@@ -6,18 +6,45 @@ import { Button } from '@evobgp/ui/components/button'

 import { FrameDataGrid } from '@/components/reui-kit'
 import { ProjectsEmptyState } from '@/components/patterns/projects-empty-state'
+import { ModuleCreateDialog } from '@/components/modules/module-create-dialog'
 import { ModulesListGrid } from '@/components/modules/modules-list-grid'
 import { PageHeader } from '@/components/page-header'
 import { QueryState } from '@/components/query-state'
 import { TableSkeleton } from '@/components/skeletons'
+import { sessionCanWriteModules } from '@/lib/auth'
+import { authSessionQueryOptions } from '@/queries/auth'
+import {
+  directoriesCommunitiesQueryOptions,
+  directoriesDohQueryOptions,
+} from '@/queries/directories'
 import { modulesListQueryOptions } from '@/queries/modules'

+function parseCreateFlag(value: unknown): boolean {
+  return value === true || value === '1' || value === 'true'
+}
+
 export const Route = createFileRoute('/_auth/modules/')({
  component: ModulesListComponent,
+  validateSearch: (search: Record<string, unknown>): { create?: boolean } => {
+    if (parseCreateFlag(search.create)) return { create: true }
+    return {}
+  },
 })

 function ModulesListComponent() {
+  const { create } = Route.useSearch()
+  const navigate = Route.useNavigate()
  const query = useQuery(modulesListQueryOptions())
+  const sessionQ = useQuery(authSessionQueryOptions())
+  const canWrite = sessionCanWriteModules(sessionQ.data)
+  const communitiesQ = useQuery(directoriesCommunitiesQueryOptions())
+  const dohQ = useQuery(directoriesDohQueryOptions())
+
+  const createOpen = canWrite && create === true
+
+  function setCreateOpen(open: boolean) {
+    void navigate({ search: open ? { create: true } : {}, replace: true })
+  }

  return (
    <div className="flex flex-col gap-6">
@@ -42,10 +69,12 @@ function ModulesListComponent() {
      <FrameDataGrid
        title="Все модули"
        actions={
-          <Button size="sm" render={<Link to="/modules/new" />}>
-            <Plus />
-            Создать
-          </Button>
+          canWrite ? (
+            <Button size="sm" onClick={() => setCreateOpen(true)}>
+              <Plus />
+              Создать
+            </Button>
+          ) : undefined
        }
      >
        <QueryState
@@ -54,7 +83,12 @@ function ModulesListComponent() {
          isError={query.isError}
          error={query.error}
          empty={query.data?.items?.length === 0}
-          emptyContent={<ProjectsEmptyState />}
+          emptyContent={
+            <ProjectsEmptyState
+              canCreate={canWrite}
+              onCreate={() => setCreateOpen(true)}
+            />
+          }
          skeleton={<TableSkeleton rows={6} cols={5} />}
          onRetry={() => query.refetch()}
        >
@@ -66,6 +100,16 @@ function ModulesListComponent() {
          )}
        </QueryState>
      </FrameDataGrid>
+
+      <ModuleCreateDialog
+        open={createOpen}
+        onOpenChange={setCreateOpen}
+        communities={communitiesQ.data?.items ?? []}
+        dohProfiles={dohQ.data?.items ?? []}
+        onCreated={(mod) => {
+          void navigate({ to: '/modules/$moduleId', params: { moduleId: mod.id } })
+        }}
+      />
    </div>
  )
 }
@@ -1,42 +1,7 @@
-import { createFileRoute, Link } from '@tanstack/react-router'
-import { Button } from '@evobgp/ui/components/button'
-import { PageHeader } from '@/components/page-header'
-import {
-  Frame,
-  FrameDescription,
-  FrameHeader,
-  FramePanel,
-  FrameTitle,
-} from '@/components/reui/frame'
+import { createFileRoute, redirect } from '@tanstack/react-router'

 export const Route = createFileRoute('/_auth/modules/new')({
-  component: NewModuleComponent,
+  beforeLoad: () => {
+    throw redirect({ to: '/modules', search: { create: true } })
+  },
 })
-
-function NewModuleComponent() {
-  return (
-    <div className="mx-auto flex max-w-3xl flex-col gap-6">
-      <PageHeader
-        title="Новый модуль"
-        description="Создание модуля — через API или будущая форма"
-      />
-      <Frame dense spacing="sm">
-        <FrameHeader>
-          <FrameTitle>Создание через API</FrameTitle>
-          <FrameDescription>
-            Форма в UI появится позже. Сейчас модуль можно создать запросом ниже.
-          </FrameDescription>
-        </FrameHeader>
-        <FramePanel className="flex flex-col gap-3 text-sm text-muted-foreground">
-          <pre className="overflow-x-auto rounded-md border bg-muted/40 p-3 font-mono text-xs">
-{`POST /v1/modules
-{ "type": "DOMAINS", "name": "Мой список" }`}
-          </pre>
-          <Button variant="outline" size="sm" className="self-start" render={<Link to="/modules" />}>
-            Назад к списку
-          </Button>
-        </FramePanel>
-      </Frame>
-    </div>
-  )
-}
@@ -14,8 +14,8 @@ BuildKit кэширует `/go/pkg/mod`, `~/.cache/go-build` и pnpm store че

 | Образ | Runtime base | Заметка |
 |-------|----------------|---------|
-| scheduler, ingest, render, deploy, node | `gcr.io/distroless/static-debian12:nonroot` | static Go (`CGO_ENABLED=0`), без shell |
-| api, all | `debian:bookworm-slim` + `birdc` | только клиент birdc, без демона `bird` |
+| scheduler, ingest, render | `gcr.io/distroless/static-debian12:nonroot` | static Go (`CGO_ENABLED=0`), без shell |
+| api, all, deploy, node | `debian:bookworm-slim` + `bird` + `birdc` | `bird -p` (parse-check) и `birdc`; демон не запускается |
 | agent | тот же Ubuntu+bird2, что bird2 | общие слои с `evobgp-bird2` |
 | bird2 | Ubuntu Noble + пакет bird2 | |
 | web, web-all | `nginx:1.27-alpine` | `worker_processes 1` |
@@ -27,7 +27,7 @@ BuildKit кэширует `/go/pkg/mod`, `~/.cache/go-build` и pnpm store че
 - `git.shx.one/<owner>/evobgp-buildcache:go-buildcache` — **запись** только из `go-build-all`
 - `git.shx.one/<owner>/evobgp-buildcache:web-buildcache` — **запись** только из `web-build`
 - `git.shx.one/<owner>/evobgp-buildcache:birdc-buildcache` — **запись** только из `go-birdc`
- `git.shx.one/<owner>/evobgp-buildcache:base-*` — зеркало FROM-образов (`mirror-base-images.sh`), без rebuild
+- `git.shx.one/<owner>/evobgp-buildcache:base-*` — зеркало FROM с **Docker Hub** (`docker.io/library/…`; distroless — `gcr.io`). Только `linux/amd64`; skip если тег уже в Gitea. Неуспешный copy не валит CD — bake берёт Docker Hub FROM для этой базы.

 `pull = false` в bake: не перекачивать FROM, если слой уже в builder. Не запускайте `docker system prune -a` на runner.

@@ -56,7 +56,7 @@ docker buildx bake --allow=fs.read=../.. -f docker-bake.hcl web-images
 docker buildx bake --allow=fs.read=../.. -f docker-bake.hcl --print default
 ```

-В `docker-bake.hcl`: `context = "../.."` (корень репо), `dockerfile = "deploy/docker/…"` (путь от корня репо).
+В `docker-bake.hcl`: `context = "../.."` резолвится **от cwd** (каталог `deploy/docker/`). `dockerfile` — путь от этого context (корень репо). Из корня репо не вызывать bake с `-f deploy/docker/docker-bake.hcl`: получится `lstat ../../deploy`. Можно задать `BUILDX_BAKE_FILE_RELATIVE_PATHS=1`.

 Один образ (legacy, target `build-all`):

@@ -1,7 +1,7 @@
 # syntax=docker/dockerfile:1.7
 # BIRD из репозитория Ubuntu (Noble 24.04 LTS) — актуальнее пакета Debian bookworm.
 # Stage bird2-base общий с evobgp-agent (одинаковые слои на speaker-VPS).
-ARG BASE_UBUNTU=public.ecr.aws/docker/library/ubuntu:noble
+ARG BASE_UBUNTU=docker.io/library/ubuntu:noble

 FROM ${BASE_UBUNTU} AS bird2-base
 RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
@@ -1,5 +1,6 @@
 # Единая сборка образов EvoBGP (buildx bake: -f deploy/docker/docker-bake.hcl).
-# context = "../.." — корень репозитория (относительно этого файла).
+# context = "../.." — корень репо. Bake резолвит context от cwd (не от HCL),
+# поэтому вызов из deploy/docker/ либо BUILDX_BAKE_FILE_RELATIVE_PATHS=1.
 # Переменные Bake читаются из окружения (см. docs.docker.com/build/bake/variables/).

 variable "REGISTRY" {
@@ -39,11 +40,11 @@ variable "CACHE_REF_BIRDC" {
 }

 variable "BASE_GOLANG" {
-  default = "public.ecr.aws/docker/library/golang:1.24-alpine"
+  default = "docker.io/library/golang:1.24-alpine"
 }

 variable "BASE_DEBIAN" {
-  default = "public.ecr.aws/docker/library/debian:bookworm-slim"
+  default = "docker.io/library/debian:bookworm-slim"
 }

 variable "BASE_DISTROLESS" {
@@ -51,15 +52,15 @@ variable "BASE_DISTROLESS" {
 }

 variable "BASE_NODE" {
-  default = "public.ecr.aws/docker/library/node:22-alpine"
+  default = "docker.io/library/node:22-alpine"
 }

 variable "BASE_NGINX" {
-  default = "public.ecr.aws/docker/library/nginx:1.27-alpine"
+  default = "docker.io/library/nginx:1.27-alpine"
 }

 variable "BASE_UBUNTU" {
-  default = "public.ecr.aws/docker/library/ubuntu:noble"
+  default = "docker.io/library/ubuntu:noble"
 }

 function "go-cache-from" {
@@ -235,13 +236,13 @@ target "evobgp-render" {
 }

 target "evobgp-deploy" {
-  inherits = ["_go-runtime"]
+  inherits = ["_go-runtime-birdc"]
  args     = { BIN = "evobgp-deploy" }
  tags     = image-tags("evobgp-deploy")
 }

 target "evobgp-node" {
-  inherits = ["_go-runtime"]
+  inherits = ["_go-runtime-birdc"]
  args     = { BIN = "evobgp-node" }
  tags     = image-tags("evobgp-node")
 }
@@ -1,8 +1,8 @@
 # syntax=docker/dockerfile:1.7
 # React + Vite статическая панель EvoBGP + nginx.
 # Финальный stage `web` ожидает bake-контекст web-artifacts (= target:web-build).
-ARG BASE_NODE=public.ecr.aws/docker/library/node:22-alpine
-ARG BASE_NGINX=public.ecr.aws/docker/library/nginx:1.27-alpine
+ARG BASE_NODE=docker.io/library/node:22-alpine
+ARG BASE_NGINX=docker.io/library/nginx:1.27-alpine

 FROM ${BASE_NODE} AS deps
 WORKDIR /repo
@@ -1,9 +1,9 @@
 # syntax=docker/dockerfile:1.7
 # Универсальная сборка бинарей cmd/* (ARG BIN) или всех сразу (target build-all).
-# Воркеры (runtime): distroless static. api/all (runtime-birdc): debian-slim + birdc.
+# Воркеры (runtime): distroless static. api/all/deploy/node (runtime-birdc): debian-slim + bird + birdc.
 # CI: docker buildx bake -f deploy/docker/docker-bake.hcl
-ARG BASE_GOLANG=public.ecr.aws/docker/library/golang:1.24-alpine
-ARG BASE_DEBIAN=public.ecr.aws/docker/library/debian:bookworm-slim
+ARG BASE_GOLANG=docker.io/library/golang:1.24-alpine
+ARG BASE_DEBIAN=docker.io/library/debian:bookworm-slim
 ARG BASE_DISTROLESS=gcr.io/distroless/static-debian12:nonroot

 FROM ${BASE_GOLANG} AS deps
@@ -57,14 +57,15 @@ RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
    && BIRD_VERSION="${BIRD_VERSION}" /tmp/bird-from-source.sh \
    && rm -f /tmp/bird-from-source.sh

-# scheduler / ingest / render / deploy / node — static Go, без shell.
+# scheduler / ingest / render — static Go, без shell.
 FROM ${BASE_DISTROLESS} AS runtime
 ARG BIN=evobgp-api
 COPY --from=build-all /out/${BIN} /usr/local/bin/evobgp
 EXPOSE 8080
 ENTRYPOINT ["/usr/local/bin/evobgp"]

-# api / all — birdc (readline + ncurses). Только клиент birdc, без демона bird.
+# api / all / deploy / node — bird -p (parse-check) + birdc configure.
+# Демон BIRD в этом контейнере не запускается; процесс bird — в образе evobgp-bird2.
 FROM ${BASE_DEBIAN} AS runtime-birdc
 RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
    --mount=type=cache,target=/var/lib/apt,sharing=locked \
@@ -74,6 +75,7 @@ RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
    && rm -rf /var/lib/apt/lists/*
 ARG BIN=evobgp-api
 COPY --from=build-all /out/${BIN} /usr/local/bin/evobgp
+COPY --from=birdc /usr/local/sbin/bird /usr/local/sbin/bird
 COPY --from=birdc /usr/local/sbin/birdc /usr/local/sbin/birdc
 EXPOSE 8080
 ENTRYPOINT ["/usr/local/bin/evobgp"]
@@ -2,27 +2,81 @@
 # Copy-by-digest зеркало базовых образов в Gitea Container Registry (без rebuild).
 # Требует: docker login в REGISTRY host, docker buildx.
 # REGISTRY=git.shx.one/<owner>  (без суффикса /evobgp-buildcache)
+#
+# Источник library-образов — Docker Hub (docker.io), не public.ecr.aws (429 Too Many Requests).
+# Если тег уже есть в Gitea — skip (без повторного pull).
+# Копируем только linux/amd64 — bake platforms совпадает, multi-arch индекс не нужен.
+# Шаг CD не должен падать: неуспешный copy оставляет bake на Docker Hub FROM для этой базы.
 set -eu
 REGISTRY="${REGISTRY:?REGISTRY required (git.shx.one/<owner>)}"
 CACHE_REPO="${REGISTRY}/evobgp-buildcache"
+ENV_FILE="${MIRROR_ENV_FILE:-}"
+PLATFORM="${MIRROR_PLATFORM:-linux/amd64}"
+RETRIES="${MIRROR_RETRIES:-4}"
+
+tmp="$(mktemp)"
+cleanup() { rm -f "$tmp"; }
+trap cleanup EXIT
+
+dest_exists() {
+  docker buildx imagetools inspect "$1" >/dev/null 2>&1
+}
+
+copy_retry() {
+  src="$1"
+  dest="$2"
+  n=0
+  while [ "$n" -lt "$RETRIES" ]; do
+    n=$((n + 1))
+    if docker buildx imagetools create --platform "$PLATFORM" --tag "$dest" "$src"; then
+      return 0
+    fi
+    delay=$((n * 25))
+    echo "mirror retry ${n}/${RETRIES}, sleep ${delay}s: ${dest}"
+    sleep "$delay"
+  done
+  return 1
+}

 mirror() {
  src="$1"
  tag="$2"
-  echo "mirror ${src} -> ${CACHE_REPO}:${tag}"
-  docker buildx imagetools create --tag "${CACHE_REPO}:${tag}" "${src}"
+  var="$3"
+  dest="${CACHE_REPO}:${tag}"
+  if dest_exists "$dest"; then
+    echo "skip (already in registry): ${dest}"
+    printf '%s=%s\n' "$var" "$dest" >>"$tmp"
+    return 0
+  fi
+  echo "mirror ${src} -> ${dest} (${PLATFORM})"
+  if copy_retry "$src" "$dest"; then
+    printf '%s=%s\n' "$var" "$dest" >>"$tmp"
+    return 0
+  fi
+  echo "warn: ${dest} not mirrored — bake uses Docker Hub FROM for ${var}"
+  return 0
 }

-mirror "public.ecr.aws/docker/library/golang:1.24-alpine" "base-golang-1.24-alpine"
-mirror "public.ecr.aws/docker/library/debian:bookworm-slim" "base-debian-bookworm-slim"
-mirror "public.ecr.aws/docker/library/node:22-alpine" "base-node-22-alpine"
-mirror "public.ecr.aws/docker/library/nginx:1.27-alpine" "base-nginx-1.27-alpine"
-mirror "public.ecr.aws/docker/library/ubuntu:noble" "base-ubuntu-noble"
-mirror "gcr.io/distroless/static-debian12:nonroot" "base-distroless-static-debian12-nonroot"
+mirror "docker.io/library/golang:1.24-alpine" "base-golang-1.24-alpine" BASE_GOLANG
+sleep 8
+mirror "docker.io/library/debian:bookworm-slim" "base-debian-bookworm-slim" BASE_DEBIAN
+sleep 8
+mirror "docker.io/library/node:22-alpine" "base-node-22-alpine" BASE_NODE
+sleep 8
+mirror "docker.io/library/nginx:1.27-alpine" "base-nginx-1.27-alpine" BASE_NGINX
+sleep 8
+mirror "docker.io/library/ubuntu:noble" "base-ubuntu-noble" BASE_UBUNTU
+sleep 8
+mirror "gcr.io/distroless/static-debian12:nonroot" "base-distroless-static-debian12-nonroot" BASE_DISTROLESS

-echo "BASE_GOLANG=${CACHE_REPO}:base-golang-1.24-alpine"
-echo "BASE_DEBIAN=${CACHE_REPO}:base-debian-bookworm-slim"
-echo "BASE_NODE=${CACHE_REPO}:base-node-22-alpine"
-echo "BASE_NGINX=${CACHE_REPO}:base-nginx-1.27-alpine"
-echo "BASE_UBUNTU=${CACHE_REPO}:base-ubuntu-noble"
-echo "BASE_DISTROLESS=${CACHE_REPO}:base-distroless-static-debian12-nonroot"
+echo "----- mirrored BASE_* -----"
+cat "$tmp"
+if [ -n "$ENV_FILE" ]; then
+  env_dir="$(dirname "$ENV_FILE")"
+  if [ -d "$env_dir" ]; then
+    cp "$tmp" "$ENV_FILE"
+    echo "wrote ${ENV_FILE}"
+  else
+    echo "warn: MIRROR_ENV_FILE dir missing (${env_dir}) — skip write"
+  fi
+fi
@@ -39,7 +39,7 @@ docker login git.shx.one

 | Образ | Назначение | Страница пакета (пример) | Pull |
 |--------|------------|--------------------------|------|
-| `evobgp-api` | HTTP API (с `birdc` в образе) | [packages/…/evobgp-api](https://git.shx.one/denozord/-/packages/container/evobgp-api/latest) | `docker pull git.shx.one/denozord/evobgp-api:latest` |
+| `evobgp-api` | HTTP API (с `bird`/`birdc` в образе для parse-check) | [packages/…/evobgp-api](https://git.shx.one/denozord/-/packages/container/evobgp-api/latest) | `docker pull git.shx.one/denozord/evobgp-api:latest` |
 | `evobgp-all` | Монолит microVPS: API + in-process воркеры scheduler/ingest/render/deploy | [packages/…/evobgp-all](https://git.shx.one/denozord/-/packages/container/evobgp-all/latest) | `docker pull git.shx.one/denozord/evobgp-all:latest` |
 | `evobgp-scheduler` | Планировщик (reference) | [packages/…/evobgp-scheduler](https://git.shx.one/denozord/-/packages/container/evobgp-scheduler/latest) | `docker pull git.shx.one/denozord/evobgp-scheduler:latest` |
 | `evobgp-ingest` | Ingest CDN / ETag | [packages/…/evobgp-ingest](https://git.shx.one/denozord/-/packages/container/evobgp-ingest/latest) | `docker pull git.shx.one/denozord/evobgp-ingest:latest` |
@@ -10,6 +10,7 @@ import (
 func TestParallelModuleRefresh_CoalescesDeployApply(t *testing.T) {
 	t.Setenv("EVOBGP_ASN_RESOLVE", "0")
 	t.Setenv("EVOBGP_BIRD_ACTIVE_DIR", "") // skip bird binary path in deploy_apply
+	t.Setenv("EVOBGP_JOB_MAX_CONCURRENT", "8")

 	m := store.NewMemory()
 	m.SeedDemo()
@@ -35,8 +36,15 @@ func TestParallelModuleRefresh_CoalescesDeployApply(t *testing.T) {
 		t.Fatal(err)
 	}

+	// Hold workers until both jobs are enqueued so inflightRefresh=2 before either
+	// finishModuleRefreshSuccess. Otherwise a fast ingest can finalize+deploy before
+	// the second Enqueue — sequential refreshes correctly produce two deploy_apply jobs.
+	start := make(chan struct{})
 	wk := &Worker{Store: m}
-	reg := NewRegistry(wk.Process)
+	reg := NewRegistry(func(j *Job) {
+		<-start
+		wk.Process(j)
+	})
 	wk.Registry = reg

 	mid1 := modIP
@@ -47,6 +55,7 @@ func TestParallelModuleRefresh_CoalescesDeployApply(t *testing.T) {
 	if _, _, err := reg.Enqueue(tenant, KindModuleRefresh, nil, &mid2, map[string]any{"module_id": mod2.ID}); err != nil {
 		t.Fatal(err)
 	}
+	close(start)

 	waitSucceededJobsByKindCount(t, reg, tenant, KindModuleRefresh, 2)

@@ -414,6 +414,9 @@ func (m *Memory) ListModules(tenantID string) []*Module {
 		}
 		return out[i].Name < out[j].Name
 	})
+	for i := range out {
+		out[i] = cloneModule(out[i])
+	}
 	return out
 }

@@ -446,7 +449,7 @@ func (m *Memory) GetModule(tenantID, moduleID string) (*Module, error) {
 	if mod.TenantID != tenantID {
 		return nil, ErrTenantScope
 	}
-	return mod, nil
+	return cloneModule(mod), nil
 }

 func (m *Memory) GetRevision(tenantID, revisionID string) (*Revision, error) {
@@ -684,3 +687,24 @@ func (m *Memory) ListRevisions(tenantID, moduleID string, cursor string, limit i
 	}
 	return page, nextCursor, hasMore
 }
+
+func cloneStringPtr(s *string) *string {
+	if s == nil {
+		return nil
+	}
+	v := *s
+	return &v
+}
+
+func cloneModule(m *Module) *Module {
+	if m == nil {
+		return nil
+	}
+	cp := *m
+	cp.DefaultCommunityID = cloneStringPtr(m.DefaultCommunityID)
+	cp.DohProfileID = cloneStringPtr(m.DohProfileID)
+	cp.DohProfileIDs = append([]string(nil), m.DohProfileIDs...)
+	cp.LastRefreshedAt = cloneTime(m.LastRefreshedAt)
+	cp.DeletedAt = cloneTime(m.DeletedAt)
+	return &cp
+}
@@ -38,7 +38,7 @@ func (m *Memory) CreateModule(tenantID string, in *Module) (*Module, error) {
 	}
 	NormalizeModuleDoh(mod)
 	m.modules[id] = mod
-	return mod, nil
+	return cloneModule(mod), nil
 }

 func (m *Memory) UpdateModule(tenantID, moduleID string, patch *ModulePatch) (*Module, error) {
@@ -74,12 +74,14 @@ func (m *Memory) UpdateModule(tenantID, moduleID string, patch *ModulePatch) (*M
 			mod.DefaultCommunityID = &v
 		}
 	}
-	ApplyModuleDohPatch(mod, patch)
+	if patch.DohProfileIDs != nil || patch.DohProfileID != nil || patch.DohResolverPolicy != nil {
+		ApplyModuleDohPatch(mod, patch)
+	}
 	if patch.LastRefreshedAt != nil {
 		t := patch.LastRefreshedAt.UTC()
 		mod.LastRefreshedAt = &t
 	}
-	return mod, nil
+	return cloneModule(mod), nil
 }

 func (m *Memory) SoftDeleteModule(tenantID, moduleID string) error {
@@ -0,0 +1,44 @@
+#!/usr/bin/env sh
+# Абсолютные пути для actions/cache: на act_runner «~» часто не раскрывается → cache miss.
+set -eu
+: "${GITHUB_ENV:?GITHUB_ENV required (Gitea/GitHub Actions)}"
+
+HOME_DIR="${HOME:-}"
+if [ -z "$HOME_DIR" ]; then
+  HOME_DIR="$(getent passwd "$(id -u)" 2>/dev/null | cut -d: -f6 || true)"
+fi
+HOME_DIR="${HOME_DIR:-/root}"
+
+if command -v go >/dev/null 2>&1; then
+  GOMODCACHE="$(go env GOMODCACHE)"
+  GOCACHE="$(go env GOCACHE)"
+  GOPATH="$(go env GOPATH)"
+else
+  GOMODCACHE="${HOME_DIR}/go/pkg/mod"
+  GOCACHE="${HOME_DIR}/.cache/go-build"
+  GOPATH="${HOME_DIR}/go"
+fi
+
+PNPM_STORE_DIR="${HOME_DIR}/.pnpm-store"
+COREPACK_HOME="${HOME_DIR}/.cache/node/corepack"
+GOBIN="${GOPATH}/bin"
+GOLANGCI_LINT_CACHE="${HOME_DIR}/.cache/golangci-lint"
+
+mkdir -p "$PNPM_STORE_DIR" "$COREPACK_HOME" "$GOMODCACHE" "$GOCACHE" "$GOBIN" "$GOLANGCI_LINT_CACHE"
+
+{
+  echo "HOME_DIR=${HOME_DIR}"
+  echo "PNPM_STORE_DIR=${PNPM_STORE_DIR}"
+  echo "COREPACK_HOME=${COREPACK_HOME}"
+  echo "GOMODCACHE=${GOMODCACHE}"
+  echo "GOCACHE=${GOCACHE}"
+  echo "GOPATH=${GOPATH}"
+  echo "GOBIN=${GOBIN}"
+  echo "GOLANGCI_LINT_CACHE=${GOLANGCI_LINT_CACHE}"
+} >> "$GITHUB_ENV"
+
+echo "cache-env HOME_DIR=${HOME_DIR}"
+echo "cache-env PNPM_STORE_DIR=${PNPM_STORE_DIR}"
+echo "cache-env GOMODCACHE=${GOMODCACHE}"
+echo "cache-env GOCACHE=${GOCACHE}"
+echo "cache-env GOBIN=${GOBIN}"
@@ -0,0 +1,20 @@
+#!/usr/bin/env sh
+# Бинарь golangci-lint в GOBIN (кэш actions/cache), без goinstall и без hashFiles.
+set -eu
+VER="${GOLANGCI_LINT_VERSION:-v1.64.8}"
+: "${GOBIN:?GOBIN required — run scripts/ci/export-cache-env.sh after setup-go}"
+
+mkdir -p "$GOBIN"
+export PATH="${GOBIN}:${PATH}"
+if [ -n "${GOLANGCI_LINT_CACHE:-}" ]; then
+  mkdir -p "$GOLANGCI_LINT_CACHE"
+  export GOLANGCI_LINT_CACHE
+fi
+
+if [ ! -x "${GOBIN}/golangci-lint" ]; then
+  echo "install golangci-lint ${VER} -> ${GOBIN}"
+  curl -sSfL "https://raw.githubusercontent.com/golangci/golangci-lint/${VER}/install.sh" \
+    | sh -s -- -b "$GOBIN" "$VER"
+fi
+golangci-lint version
+golangci-lint run
@@ -0,0 +1,21 @@
+#!/usr/bin/env sh
+# pnpm install из кэша Gitea (store + node_modules). Без повторного download при hit.
+set -eu
+: "${PNPM_STORE_DIR:?PNPM_STORE_DIR required — run scripts/ci/export-cache-env.sh first}"
+
+export COREPACK_HOME="${COREPACK_HOME:-${HOME:-/root}/.cache/node/corepack}"
+mkdir -p "$PNPM_STORE_DIR" "$COREPACK_HOME"
+corepack enable
+pnpm config set store-dir "$PNPM_STORE_DIR"
+
+echo "pnpm store: $(pnpm store path)"
+echo "PNPM_CACHE_HIT=${PNPM_CACHE_HIT:-}"
+
+if [ "${PNPM_CACHE_HIT:-}" = "true" ]; then
+  if pnpm install --frozen-lockfile --offline; then
+    echo "pnpm install --offline (cache hit)"
+    exit 0
+  fi
+  echo "offline install failed — prefer-offline"
+fi
+pnpm install --frozen-lockfile --prefer-offline
Author	SHA1	Message	Date
Denozordec	e6e319a275	refactor(web): improve job kind handling in schedule components CD / quality (push) Successful in 1m49s Details quality / changes (push) Successful in 9s Details quality / openapi (push) Successful in 25s Details quality / web (push) Successful in 1m6s Details quality / go (push) Skipped Details quality / bird2 (push) Skipped Details quality / commitlint (push) Skipped Details quality / docker-check (push) Skipped Details CD / publish (push) Successful in 3m2s Details - Removed hardcoded job kind checks in schedule components and replaced them with a utility function `isRefreshJobKind` for better maintainability. - Updated the `ui-labels` module to include additional job kinds and their corresponding labels. - Adjusted the `DashboardRecentJobsGrid`, `OperationsJobsGrid`, and `ScheduleJobsGrid` components to reflect these changes, enhancing the clarity and consistency of job kind representation.	2026-08-19 09:45:31 +07:00
DenozordecandCursor	869b13cb57	fix(web): open module create in FormDrawer quality / changes (push) Successful in 8s Details quality / go (push) Skipped Details quality / bird2 (push) Skipped Details quality / commitlint (push) Skipped Details quality / docker-check (push) Skipped Details quality / openapi (push) Successful in 22s Details quality / web (push) Successful in 56s Details CD / quality (push) Successful in 1m30s Details CD / publish (push) Successful in 2m53s Details Создание модуля перенесено в боковую Sheet, как community и редактирование. /modules/new и быстрые ссылки открывают список с ?create=true. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-08-18 22:09:41 +07:00
DenozordecandCursor	e190785d4f	feat(web): add module create form on /modules/new quality / commitlint (push) Skipped Details quality / changes (push) Successful in 6s Details quality / go (push) Skipped Details quality / bird2 (push) Skipped Details quality / docker-check (push) Skipped Details quality / openapi (push) Successful in 22s Details quality / web (push) Successful in 58s Details CD / quality (push) Successful in 1m30s Details CD / publish (push) Successful in 3m1s Details Форма POST /v1/modules вместо заглушки: тип, название, расписание и DoH для DOMAINS. После 201 переход на карточку; кнопка «Создать» только при bgp:modules:write. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-08-18 20:17:51 +07:00
Denozordec	3fd05ff833	fix(tests): improve concurrency handling in worker tests and enhance module cloning quality / commitlint (push) Skipped Details quality / changes (push) Successful in 8s Details quality / openapi (push) Skipped Details quality / web (push) Skipped Details quality / docker-check (push) Skipped Details quality / go (push) Successful in 1m14s Details quality / bird2 (push) Successful in 18s Details CD / quality (push) Successful in 1m47s Details CD / publish (push) Successful in 2m53s Details - Added environment variable `EVOBGP_JOB_MAX_CONCURRENT` to control job concurrency in tests. - Modified worker test to ensure proper synchronization of job processing by holding workers until both jobs are enqueued. - Updated memory store methods to return cloned module instances, preventing unintended mutations of original modules during operations.	2026-08-18 19:58:39 +07:00
Denozordec	e7f24f0be4	feat(docker): update runtime configurations and documentation for evobgp components quality / commitlint (push) Skipped Details quality / changes (push) Successful in 7s Details quality / openapi (push) Skipped Details quality / web (push) Skipped Details quality / docker-check (push) Skipped Details quality / go (push) Failing after 44s Details quality / bird2 (push) Skipped Details CD / quality (push) Failing after 55s Details CD / publish (push) Skipped Details - Changed the inheritance for `evobgp-deploy` and `evobgp-node` targets to use `_go-runtime-birdc`, reflecting the inclusion of the `bird` and `birdc` components. - Updated README and Dockerfile comments to clarify the runtime environments for various evobgp components, specifying the use of `bird` and `birdc` for parse-check functionality. - Adjusted quickstart documentation to accurately describe the `evobgp-api` image, highlighting the inclusion of `bird` and `birdc` for enhanced functionality.	2026-08-18 19:47:14 +07:00
Denozordec	1bfe460e4b	feat(ci): enhance caching strategy and update workflows for pnpm and Go quality / commitlint (push) Skipped Details quality / changes (push) Successful in 8s Details quality / docker-check (push) Skipped Details quality / openapi (push) Successful in 25s Details quality / web (push) Successful in 1m16s Details quality / go (push) Successful in 2m46s Details quality / bird2 (push) Successful in 17s Details CD / quality (push) Successful in 5m0s Details CD / publish (push) Successful in 4m22s Details - Updated CI workflows to export cache paths for pnpm and Go, improving cache efficiency and reducing package download times. - Replaced corepack enable step with cache path exports in multiple workflows. - Adjusted cache paths to utilize environment variables for better flexibility and clarity. - Enhanced README documentation to reflect changes in caching mechanisms and runner configurations.	2026-08-18 19:13:10 +07:00
Denozordec	e55d2c5aba	feat(docker): enable relative path support for Docker bake configurations quality / commitlint (push) Skipped Details quality / changes (push) Successful in 7s Details quality / docker-check (push) Skipped Details quality / openapi (push) Successful in 28s Details quality / web (push) Successful in 1m2s Details quality / go (push) Successful in 1m6s Details quality / bird2 (push) Successful in 17s Details CD / quality (push) Successful in 3m12s Details CD / publish (push) Successful in 5m44s Details - Added `BUILDX_BAKE_FILE_RELATIVE_PATHS` environment variable to CI workflows to support relative paths in Docker bake commands. - Updated `docker-bake.hcl` comments to clarify context resolution from the current working directory. - Revised README documentation to reflect changes in context resolution and usage of the new environment variable.	2026-08-18 18:45:51 +07:00
Denozordec	f63e9b5fd0	fix(docker): update base image references to Docker Hub quality / commitlint (push) Skipped Details quality / changes (push) Successful in 8s Details quality / openapi (push) Skipped Details quality / web (push) Skipped Details quality / docker-check (push) Skipped Details quality / go (push) Successful in 57s Details quality / bird2 (push) Successful in 15s Details CD / quality (push) Successful in 1m27s Details CD / publish (push) Failing after 4m13s Details - Changed base image references in `docker-bake.hcl`, Dockerfiles, and `mirror-base-images.sh` from public ECR to Docker Hub to avoid 429 errors and improve reliability. - Updated README documentation to reflect the new source for base images, clarifying the mirroring process and behavior when tags already exist.	2026-08-18 18:30:22 +07:00
Denozordec	0148d4ca37	feat(docker): enhance base image mirroring process and update documentation quality / commitlint (push) Skipped Details quality / changes (push) Successful in 8s Details quality / docker-check (push) Skipped Details quality / openapi (push) Successful in 40s Details quality / web (push) Successful in 1m27s Details quality / go (push) Successful in 1m4s Details quality / bird2 (push) Successful in 18s Details CD / quality (push) Successful in 3m45s Details CD / publish (push) Canceled after 10m39s Details - Updated `mirror-base-images.sh` to skip existing tags in Gitea and retry on 429 errors, improving efficiency and reducing unnecessary requests. - Modified CI workflow to utilize a temporary environment file for mirrored base images, ensuring better handling of existing images. - Enhanced README documentation to reflect changes in the mirroring process and clarify the behavior when tags already exist.	2026-08-18 18:22:26 +07:00