feat(traffic): добавить карту и срезы IPFIX по странам и сессиям

Имена ifIndex пишутся по обоим ключам REST, дедуп 5-tuple по max байт, RIPEstat только из prefix-кэша, карта откуда-куда в Frame.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/(main)/data-collection/page.tsx

@@ -54,6 +54,7 @@ import {
   type SchedulerJobGridRow,
 } from "@/components/data-grids/data-collection-scheduler-data-grid"
 import { DataPageCard } from "@/components/data-page-card"
+import { NetflowSettingsPanel } from "@/components/traffic/netflow-settings-panel"
 import { cn } from "@/lib/utils"
 import {
   AlertCircleIcon,
@@ -1210,6 +1211,8 @@ export default function DataCollectionPage() {
                   </div>
               </DataPageCard>
 
+              {isLive ? <NetflowSettingsPanel backendUrl={backendUrl} enabled={isLive} /> : null}
+
               <OpsPanel
                 title="Журнал прогонов"
                 description="SQLite `scheduler_runs` — до 80 записей; раскройте строку для полей и текста ошибки."

app/(main)/traffic/page.tsx

@@ -11,13 +11,20 @@ import { StatusDot } from "@/components/status-dot"
 import { Flag } from "@/components/flag"
 import {
   RefreshCwIcon, DownloadIcon, TrendingUpIcon, TrendingDownIcon,
-  ArrowUpIcon, ArrowDownIcon, ActivityIcon, UsersIcon, CableIcon, ServerIcon, SearchIcon,
+  ArrowUpIcon, ArrowDownIcon, ActivityIcon, UsersIcon, CableIcon, ServerIcon, SearchIcon, GitBranchIcon, PlusIcon,
 } from "lucide-react"
 import { cn } from "@/lib/utils"
 import { fmtGB, fmtRate } from "@/lib/fmt-rate"
 import { useDataSource } from "@/lib/data-source"
 import { useTrafficLive } from "@/hooks/use-traffic-live"
+import { useFlowLive } from "@/hooks/use-flow-live"
 import { requestJson } from "@/shared/api/http-client"
+import { getFlowAnalytics, getFlowClients, getFlowExporters, getTrafficFlows } from "@/shared/api/traffic-flow"
+import { listServers } from "@/shared/api/servers"
+import { FlowOverlaySheet } from "@/components/traffic/flow-overlay-sheet"
+import { FlowAnalyticsDetail, FlowEntityCardView } from "@/components/traffic/flow-analytics-panel"
+import type { FlowAnalyticsDto, FlowEntityCard, FlowStatsDto } from "@mmapp/contracts/traffic-flow"
+import type { ServerRead } from "@mmapp/contracts/servers"
 import { Badge } from "@/components/reui/badge"
 import {
   IFACE_TYPE_LABEL,
@@ -43,6 +50,31 @@ function addSeries(a: number[], b: number[]): number[] {
   return a.map((v, i) => v + (b[i] ?? 0))
 }
 
+function flowIngestLine(stats: FlowStatsDto | null): string | null {
+  if (!stats) return null
+  const listener = stats.listenerBound
+    ? (stats.listenerAddress ?? "слушает")
+    : "не слушает"
+  const last = stats.lastDatagramAt
+    ? new Date(stats.lastDatagramAt).toLocaleString("ru-RU")
+    : "—"
+  const exporter = stats.lastExporterIp ? ` · ${stats.lastExporterIp}` : ""
+  const err = stats.lastError ? ` · ${stats.lastError}` : ""
+  return `Коллектор: ${listener} · пакеты ${stats.packetsReceived ?? 0} · последний ${last}${exporter}${err}`
+}
+
+function flowEmptyHint(stats: FlowStatsDto | null): string | undefined {
+  if (!stats) return undefined
+  if (stats.lastError) return stats.lastError
+  if (stats.packetsReceived) {
+    return `IPFIX приходит (${stats.lastExporterIp ?? "экспортёр"}), но сессии ещё не записаны.`
+  }
+  if (stats.listenerBound === false) {
+    return "Коллектор UDP не слушает. Подключите JH ещё раз — ingest включится автоматически."
+  }
+  return "IPFIX ещё не доходит до коллектора. На jump-host у target Src должен быть 0.0.0.0 (авто). На хосте MM проверьте bind 10.255.254.1:4739 после wg-flow."
+}
+
 // ─── data model ───────────────────────────────────────────────────────────────
 
 interface BoundIfaceTraffic {
@@ -53,6 +85,8 @@ interface BoundIfaceTraffic {
   userName: string
   interfaceName: string
   interfaceType: InterfaceType
+  peerPublicKey?: string
+  peerName?: string
   comment: string
   serverId: string
   serverName: string
@@ -141,6 +175,11 @@ function hashSeed(s: string): number {
   return Math.abs(h)
 }
 
+function boundIfaceLabel(c: Pick<BoundIfaceTraffic, "interfaceName" | "interfaceType" | "peerName">): string {
+  if (c.interfaceType === "wg" && c.peerName) return `${c.peerName} · ${c.interfaceName}`
+  return c.interfaceName
+}
+
 function mockBoundFromUsers(): BoundIfaceTraffic[] {
   return INIT_USERS.flatMap((u) =>
     u.bindings.map((b) => {
@@ -149,13 +188,15 @@ function mockBoundFromUsers(): BoundIfaceTraffic[] {
       const rxNow = offline ? 0 : 12 + (seed % 140)
       const txNow = offline ? 0 : 8 + (seed % 110)
       return {
-        id: `${b.userId}:${b.serverId}:${b.interfaceName}`,
+        id: `${b.userId}:${b.serverId}:${b.interfaceName}:${b.peerPublicKey ?? "_iface"}`,
         bindingId: b.id,
         userId: u.id,
         userLogin: u.login,
         userName: u.name,
         interfaceName: b.interfaceName,
         interfaceType: b.interfaceType,
+        peerPublicKey: b.peerPublicKey,
+        peerName: b.peerName,
         comment: b.comment,
         serverId: b.serverId,
         serverName: b.serverName,
@@ -267,7 +308,8 @@ const TRAFFIC_RANGE_LABELS: Record<Range, string> = {
   "24h": "24ч",
 }
 
-type GroupMode = "servers" | "users" | "ifaces"
+type GroupMode = "servers" | "users" | "ifaces" | "flows"
+type FlowScope = "servers" | "users"
 type SortField = "rx" | "tx" | "name" | "sessions"
 type SortDir   = "asc" | "desc"
 
@@ -397,7 +439,7 @@ function IfaceCard({ c, selected, onClick }: { c: BoundIfaceTraffic; selected: b
         <div className="flex items-center gap-1.5 min-w-0">
           <StatusDot status={c.status} />
           <div className="min-w-0">
-            <p className="text-xs font-mono font-medium truncate">{c.interfaceName}</p>
+            <p className="text-xs font-mono font-medium truncate">{boundIfaceLabel(c)}</p>
             <p className="text-[10px] text-muted-foreground truncate">{c.userLogin}</p>
           </div>
         </div>
@@ -435,7 +477,7 @@ function IfaceRow({ c, showServer = false }: { c: BoundIfaceTraffic; showServer?
       <StatusDot status={c.status} />
       <div className="flex-1 min-w-0">
         <div className="flex items-center gap-2 flex-wrap">
-          <span className="text-xs font-mono font-semibold">{c.interfaceName}</span>
+          <span className="text-xs font-mono font-semibold">{boundIfaceLabel(c)}</span>
           <Badge variant={TYPE_VARIANT[c.interfaceType]} size="sm">{IFACE_TYPE_LABEL[c.interfaceType]}</Badge>
           {showServer && (
             <span className="inline-flex items-center gap-1 text-[10px] font-mono text-muted-foreground bg-muted px-1.5 py-0.5 rounded">
@@ -652,7 +694,7 @@ function IfaceDetail({ sel, range, setRange }: { sel: BoundIfaceTraffic; range:
       <DetailHeader range={range} setRange={setRange}>
         <StatusDot status={sel.status} />
         <div className="leading-tight min-w-0">
-          <h2 className="text-base font-mono font-semibold">{sel.interfaceName}</h2>
+          <h2 className="text-base font-mono font-semibold">{boundIfaceLabel(sel)}</h2>
           <p className="text-xs text-muted-foreground truncate">{sel.comment || sel.userLogin}</p>
         </div>
         <Badge variant={TYPE_VARIANT[sel.interfaceType]} size="sm">{IFACE_TYPE_LABEL[sel.interfaceType]}</Badge>
@@ -692,13 +734,14 @@ const GROUP_MODES: Array<{ mode: GroupMode; icon: ReactNode; label: string }> =
   { mode: "servers", icon: <ServerIcon className="size-3" />, label: "Серверы" },
   { mode: "users",   icon: <UsersIcon  className="size-3" />, label: "Клиенты" },
   { mode: "ifaces",  icon: <CableIcon  className="size-3" />, label: "Интерфейсы" },
+  { mode: "flows",   icon: <GitBranchIcon className="size-3" />, label: "Потоки" },
 ]
 
 const SORT_FIELDS: Array<{ field: SortField; label: string; modesOnly?: GroupMode[] }> = [
   { field: "rx",       label: "RX" },
   { field: "tx",       label: "TX" },
   { field: "name",     label: "Имя" },
-  { field: "sessions", label: "Сессий", modesOnly: ["servers", "users"] },
+  { field: "sessions", label: "Сессий", modesOnly: ["servers", "users", "flows"] },
 ]
 
 export default function TrafficPage() {
@@ -722,6 +765,15 @@ export default function TrafficPage() {
   const [liveDetailServer, setLiveDetailServer] = useState<ServerTraffic | null>(null)
   const [liveUsers, setLiveUsers] = useState<UserTraffic[]>([])
   const [liveBoundIfaces, setLiveBoundIfaces] = useState<BoundIfaceTraffic[]>([])
+  const [flowStats, setFlowStats] = useState<FlowStatsDto | null>(null)
+  const [flowScope, setFlowScope] = useState<FlowScope>("servers")
+  const [flowExporters, setFlowExporters] = useState<FlowEntityCard[]>([])
+  const [flowClients, setFlowClients] = useState<FlowEntityCard[]>([])
+  const [flowAnalytics, setFlowAnalytics] = useState<FlowAnalyticsDto | null>(null)
+  const [flowIface, setFlowIface] = useState("__all__")
+  const [flowDedup, setFlowDedup] = useState(true)
+  const [overlayOpen, setOverlayOpen] = useState(false)
+  const [catalogServers, setCatalogServers] = useState<ServerRead[]>([])
   const effectiveMode: GroupMode = groupMode
   const { sample: liveSample, error: liveStreamError } = useTrafficLive({
     enabled: isLive && effectiveMode === "servers" && liveServers.some((s) => s.id === selectedId),
@@ -729,6 +781,16 @@ export default function TrafficPage() {
     serverId: selectedId,
     iface: selectedIface,
   })
+  const flowLiveEnabled = isLive && effectiveMode === "flows" && Boolean(selectedId)
+  const { sample: flowLiveSample, error: flowLiveError } = useFlowLive({
+    enabled: flowLiveEnabled,
+    backendUrl,
+    range,
+    serverId: flowScope === "servers" ? selectedId : undefined,
+    userId: flowScope === "users" ? selectedId : undefined,
+    iface: flowIface,
+    dedup: flowDedup,
+  })
 
   const toLiveServer = (s: LiveTrafficServer): ServerTraffic => {
     return {
@@ -812,6 +874,61 @@ export default function TrafficPage() {
     void loadLiveTraffic(range)
   }, [isLive, range, loadLiveTraffic])
 
+  const loadFlows = useCallback(async () => {
+    if (!isLive) return
+    setLiveBusy(true)
+    setLiveError(null)
+    try {
+      const [stats, exporters, clients] = await Promise.all([
+        getTrafficFlows(backendUrl, range),
+        getFlowExporters(backendUrl, range),
+        getFlowClients(backendUrl, range),
+      ])
+      setFlowStats(stats)
+      setFlowExporters(exporters.exporters)
+      setFlowClients(clients.clients)
+      setSelectedId((prev) => {
+        const list = flowScope === "users" ? clients.clients : exporters.exporters
+        if (list.some((x) => x.id === prev)) return prev
+        return list[0]?.id ?? ""
+      })
+    } catch (e) {
+      setLiveError(e instanceof Error ? e.message : "Не удалось загрузить потоки")
+    } finally {
+      setLiveBusy(false)
+    }
+  }, [isLive, backendUrl, range, flowScope])
+
+  useEffect(() => {
+    if (!isLive || effectiveMode !== "flows") return
+    void loadFlows()
+    const t = window.setInterval(() => { void loadFlows() }, 5000)
+    return () => window.clearInterval(t)
+  }, [isLive, effectiveMode, loadFlows])
+
+  useEffect(() => {
+    if (!isLive || effectiveMode !== "flows" || !selectedId) {
+      setFlowAnalytics(null)
+      return
+    }
+    void getFlowAnalytics(backendUrl, {
+      range,
+      serverId: flowScope === "servers" ? selectedId : undefined,
+      userId: flowScope === "users" ? selectedId : undefined,
+      iface: flowIface,
+      dedup: flowDedup,
+    }).then(setFlowAnalytics).catch(() => setFlowAnalytics(null))
+  }, [isLive, effectiveMode, selectedId, range, flowScope, flowIface, flowDedup, backendUrl])
+
+  useEffect(() => {
+    setFlowIface("__all__")
+  }, [selectedId, flowScope])
+
+  useEffect(() => {
+    if (!isLive) return
+    void listServers(backendUrl).then(setCatalogServers).catch(() => setCatalogServers([]))
+  }, [isLive, backendUrl])
+
   const activeServerTraffic = isLive ? liveServers : serverTraffic
   const activeUserTraffic = isLive ? liveUsers : userTraffic
   const activeBoundIfaces = isLive ? liveBoundIfaces : boundIfaces
@@ -854,7 +971,12 @@ export default function TrafficPage() {
     setGroupMode(next)
     if (next === "servers") setSelectedId(activeServerTraffic[0]?.id ?? "srv1")
     else if (next === "users") setSelectedId((isLive ? liveUsers : userTraffic)[0]?.id ?? "u1")
-    else setSelectedId((isLive ? liveBoundIfaces : boundIfaces)[0]?.id ?? "")
+    else if (next === "ifaces") setSelectedId((isLive ? liveBoundIfaces : boundIfaces)[0]?.id ?? "")
+    else if (next === "flows") {
+      setFlowScope("servers")
+      setFlowIface("__all__")
+      setSelectedId(flowExporters[0]?.id ?? "")
+    }
     setSortField("rx")
     setSortDir("desc")
     setSearch("")
@@ -897,6 +1019,7 @@ export default function TrafficPage() {
     return [...activeBoundIfaces]
       .filter(c => !q
         || c.interfaceName.toLowerCase().includes(q)
+        || (c.peerName ?? "").toLowerCase().includes(q)
         || c.comment.toLowerCase().includes(q)
         || c.userLogin.toLowerCase().includes(q))
       .sort((a, b) => {
@@ -908,6 +1031,22 @@ export default function TrafficPage() {
       })
   }, [sortField, sortDir, q, activeBoundIfaces])
 
+  const flowCards = flowScope === "users" ? flowClients : flowExporters
+  const sortedFlowCards = useMemo(() => {
+    return [...flowCards]
+      .filter((c) => !q || c.name.toLowerCase().includes(q) || c.subtitle.toLowerCase().includes(q) || c.site.toLowerCase().includes(q))
+      .sort((a, b) => {
+        let v = 0
+        if (sortField === "rx") v = a.rxNow - b.rxNow
+        else if (sortField === "tx") v = a.txNow - b.txNow
+        else if (sortField === "name") v = a.name.localeCompare(b.name)
+        else if (sortField === "sessions") v = a.sessions - b.sessions
+        return sortDir === "desc" ? -v : v
+      })
+  }, [flowCards, q, sortField, sortDir])
+  const selFlowCard = sortedFlowCards.find((c) => c.id === selectedId) ?? sortedFlowCards[0] ?? null
+  const displayedFlow = flowLiveSample ?? flowAnalytics
+
   const selServer = useMemo(() => activeServerTraffic.find(s => s.id === selectedId) ?? activeServerTraffic[0], [selectedId, activeServerTraffic])
   const detailServer = liveDetailServer?.id === selectedId ? liveDetailServer : selServer
   const selUser   = useMemo(() => activeUserTraffic.find(u => u.id === selectedId)   ?? activeUserTraffic[0],   [selectedId, activeUserTraffic])
@@ -924,6 +1063,71 @@ export default function TrafficPage() {
   const peakTx  = kpiSource.reduce((a, s) => Math.max(a, s.txPeak), 0)
 
   const visibleSortFields = SORT_FIELDS.filter(s => !s.modesOnly || s.modesOnly.includes(effectiveMode))
+  const ingestLine = flowIngestLine(flowStats)
+  const flowError = liveError || flowLiveError
+
+  const flowKpiItems = [
+    {
+      id: "exporters",
+      label: "Экспортёры",
+      value: String(flowExporters.length),
+      icon: <ServerIcon className="size-4" />,
+      iconClassName: "text-info",
+    },
+    {
+      id: "bps",
+      label: "Скорость",
+      value: displayedFlow ? fmtRate(displayedFlow.bpsNow / 1_000_000) : (flowStats ? fmtRate((flowStats.bytesPerMin * 8) / 1_000_000) : "—"),
+      hint: displayedFlow?.live ? "live" : undefined,
+      icon: <ActivityIcon className="size-4" />,
+      iconClassName: "text-success",
+    },
+    {
+      id: "src",
+      label: "Уник. src",
+      value: String(displayedFlow?.uniqueSrc ?? flowStats?.uniqueSrc ?? 0),
+      icon: <ArrowUpIcon className="size-4" />,
+      iconClassName: "text-muted-foreground",
+    },
+    {
+      id: "proto",
+      label: "Топ протокол",
+      value: displayedFlow?.topProto ?? flowStats?.topProto ?? "—",
+      icon: <GitBranchIcon className="size-4" />,
+      iconClassName: "text-warning",
+    },
+  ]
+
+  const counterKpiItems = [
+              {
+                id: "rx",
+                label: "RX сейчас",
+                value: fmtRate(totalRx),
+                icon: <ArrowDownIcon className="size-4" />,
+                iconClassName: "text-success",
+              },
+              {
+                id: "tx",
+                label: "TX сейчас",
+                value: fmtRate(totalTx),
+                icon: <ArrowUpIcon className="size-4" />,
+                iconClassName: "text-info",
+              },
+              {
+                id: "peak-rx",
+                label: "Пик RX",
+                value: fmtRate(peakRx),
+                icon: <TrendingUpIcon className="size-4" />,
+                iconClassName: "text-warning",
+              },
+              {
+                id: "peak-tx",
+                label: "Пик TX",
+                value: fmtRate(peakTx),
+                icon: <TrendingUpIcon className="size-4" />,
+                iconClassName: "text-warning",
+              },
+            ]
 
   return (
     <div className="flex flex-col h-full">
@@ -934,7 +1138,10 @@ export default function TrafficPage() {
             <Button
               variant="outline"
               size="sm"
-              onClick={() => { void loadLiveTraffic(range) }}
+              onClick={() => {
+                if (effectiveMode === "flows") void loadFlows()
+                else void loadLiveTraffic(range)
+              }}
               disabled={isLive && liveBusy}
             >
               <RefreshCwIcon className={cn("size-4", isLive && liveBusy && "animate-spin")} />Обновить
@@ -965,40 +1172,124 @@ export default function TrafficPage() {
         <div className="flex flex-col gap-5">
           <KpiStatGrid
             aria-label="Сводка трафика"
-            items={[
-              {
-                id: "rx",
-                label: "RX сейчас",
-                value: fmtRate(totalRx),
-                icon: <ArrowDownIcon className="size-4" />,
-                iconClassName: "text-success",
-              },
-              {
-                id: "tx",
-                label: "TX сейчас",
-                value: fmtRate(totalTx),
-                icon: <ArrowUpIcon className="size-4" />,
-                iconClassName: "text-info",
-              },
-              {
-                id: "peak-rx",
-                label: "Пик RX",
-                value: fmtRate(peakRx),
-                icon: <TrendingUpIcon className="size-4" />,
-                iconClassName: "text-warning",
-              },
-              {
-                id: "peak-tx",
-                label: "Пик TX",
-                value: fmtRate(peakTx),
-                icon: <TrendingUpIcon className="size-4" />,
-                iconClassName: "text-warning",
-              },
-            ]}
+            items={effectiveMode === "flows" ? flowKpiItems : counterKpiItems}
           />
 
-          <div className="grid grid-cols-[300px_1fr] gap-5 items-start">
-
+          {effectiveMode === "flows" ? (
+            <div className="flex flex-col gap-3">
+              <div className="flex items-center justify-between gap-2 flex-wrap">
+                <p className="text-xs text-muted-foreground font-mono truncate min-w-0">
+                  {ingestLine ?? "IPFIX коллектор"}
+                </p>
+                <Button size="sm" onClick={() => setOverlayOpen(true)} disabled={!isLive}>
+                  <PlusIcon className="size-4" />
+                  Подключить JH
+                </Button>
+              </div>
+              {flowError && (
+                <div className="text-xs text-destructive bg-destructive/10 border border-destructive/20 rounded-md px-3 py-2">
+                  {flowError}
+                </div>
+              )}
+              <div className="grid grid-cols-[300px_1fr] gap-5 items-start">
+                <div className="flex flex-col gap-3">
+                  <div className="flex gap-1">
+                    <button
+                      type="button"
+                      onClick={() => { setFlowScope("servers"); setFlowIface("__all__") }}
+                      className={cn(
+                        "text-[10px] px-2 py-0.5 rounded border transition-colors",
+                        flowScope === "servers"
+                          ? "border-primary bg-primary/10 text-primary font-medium"
+                          : "border-border text-muted-foreground hover:text-foreground",
+                      )}
+                    >
+                      Серверы
+                    </button>
+                    <button
+                      type="button"
+                      onClick={() => { setFlowScope("users"); setFlowIface("__all__") }}
+                      className={cn(
+                        "text-[10px] px-2 py-0.5 rounded border transition-colors",
+                        flowScope === "users"
+                          ? "border-primary bg-primary/10 text-primary font-medium"
+                          : "border-border text-muted-foreground hover:text-foreground",
+                      )}
+                    >
+                      Клиенты
+                    </button>
+                  </div>
+                  <div className="relative">
+                    <SearchIcon className="absolute left-2.5 top-1/2 -translate-y-1/2 size-3.5 text-muted-foreground pointer-events-none" />
+                    <input
+                      type="text"
+                      value={search}
+                      onChange={(e) => setSearch(e.target.value)}
+                      placeholder="Поиск…"
+                      className="w-full pl-8 pr-3 h-8 text-xs bg-muted/50 border border-border rounded-md outline-none focus:border-primary transition-colors"
+                    />
+                  </div>
+                  <div className="flex gap-1 flex-wrap">
+                    <span className="text-[10px] text-muted-foreground self-center mr-0.5">Сортировка:</span>
+                    {visibleSortFields.map(({ field, label }) => (
+                      <button
+                        key={field}
+                        type="button"
+                        onClick={() => toggleSort(field)}
+                        className={cn(
+                          "text-[10px] px-2 py-0.5 rounded border transition-colors",
+                          sortField === field
+                            ? "border-primary bg-primary/10 text-primary font-medium"
+                            : "border-border text-muted-foreground hover:text-foreground",
+                        )}
+                      >
+                        {label}{sortField === field ? (sortDir === "desc" ? " ↓" : " ↑") : ""}
+                      </button>
+                    ))}
+                  </div>
+                  <div className="flex flex-col gap-2">
+                    {sortedFlowCards.map((card) => (
+                      <FlowEntityCardView
+                        key={card.id}
+                        card={card}
+                        selected={card.id === (selFlowCard?.id ?? selectedId)}
+                        onClick={() => setSelectedId(card.id)}
+                      />
+                    ))}
+                    {sortedFlowCards.length === 0 ? (
+                      <p className="text-xs text-muted-foreground">
+                        {flowEmptyHint(flowStats) ?? "Нет экспортёров IPFIX. Подключите jump-host."}
+                      </p>
+                    ) : null}
+                  </div>
+                </div>
+                <Frame dense className="w-full flex flex-col">
+                  <FramePanel className="flex-1 px-5 pb-5 pt-5">
+                    <FlowAnalyticsDetail
+                      card={selFlowCard}
+                      analytics={displayedFlow}
+                      range={range}
+                      onRange={(r) => setRange(r as Range)}
+                      selectedIface={flowIface}
+                      onIface={setFlowIface}
+                      dedup={flowDedup}
+                      onDedup={setFlowDedup}
+                      liveHint={displayedFlow?.live ? "live" : undefined}
+                      emptyHint={flowEmptyHint(flowStats)}
+                    />
+                  </FramePanel>
+                </Frame>
+              </div>
+              <FlowOverlaySheet
+                open={overlayOpen}
+                onOpenChange={setOverlayOpen}
+                servers={catalogServers}
+                backendUrl={backendUrl}
+                onDone={() => { void loadFlows() }}
+              />
+            </div>
+          ) : (
+            <div className="grid grid-cols-[300px_1fr] gap-5 items-start">
             {/* ── left panel ── */}
             <div className="flex flex-col gap-3">
 
@@ -1117,6 +1408,7 @@ export default function TrafficPage() {
             </Frame>
 
           </div>
+          )}
         </div>
       </div>
     </div>

app/(main)/users/page.tsx

@@ -23,6 +23,7 @@ import { useDataSource } from "@/lib/data-source"
 import {
   ALL_SECTIONS,
   INIT_USERS,
+  bindingDiffKey,
   userInitials,
   type AppUser,
   type AppUserForm,
@@ -106,19 +107,21 @@ export default function UsersPage() {
   const activeCount = users.filter((u) => u.active).length
 
   const applyBindingsDiff = async (userId: string, next: AppUserForm["bindings"], prev: AppUser["bindings"]) => {
-    const nextKeys = new Set(next.map((b) => `${b.serverId}::${b.interfaceName}`))
-    const prevKeys = new Map(prev.map((b) => [`${b.serverId}::${b.interfaceName}`, b] as const))
+    const nextKeys = new Set(next.map(bindingDiffKey))
+    const prevKeys = new Map(prev.map((b) => [bindingDiffKey(b), b] as const))
     for (const b of prev) {
-      if (!nextKeys.has(`${b.serverId}::${b.interfaceName}`)) {
+      if (!nextKeys.has(bindingDiffKey(b))) {
         await deleteUserBinding(backendUrl, userId, b.id)
       }
     }
     for (const b of next) {
-      if (!prevKeys.has(`${b.serverId}::${b.interfaceName}`)) {
+      if (!prevKeys.has(bindingDiffKey(b))) {
         await createUserBinding(backendUrl, userId, {
           serverId: Number(b.serverId),
           interfaceName: b.interfaceName,
           interfaceType: b.interfaceType,
+          peerPublicKey: b.peerPublicKey,
+          peerName: b.peerName,
           comment: b.comment,
         })
       }

backend/package.json

@@ -14,6 +14,7 @@
     "test:auth": "tsx src/lib/permissions.test.ts && tsx src/plugins/auth.smoke.test.ts",
     "test:wireguard": "npx tsx src/services/wireguard-config.test.ts",
     "test:traffic-rate": "tsx src/services/traffic-rate.test.ts",
+    "test:traffic-flow": "tsx src/services/traffic-flow-parse.test.ts && tsx src/services/traffic-flow-map-exporter.test.ts && tsx src/services/traffic-flow-ifaces.test.ts && tsx src/services/traffic-flow-dedup.test.ts && tsx src/services/traffic-flow-classify.test.ts && tsx src/services/traffic-flow-ripe.test.ts && tsx src/services/traffic-flow-analytics.test.ts",
     "test:users": "tsx src/modules/users/iface-type.test.ts && tsx src/modules/users/bindings.test.ts"
   },
   "dependencies": {

backend/src/db/index.ts

@@ -106,6 +106,7 @@ CREATE TABLE IF NOT EXISTS traffic_samples (
   id INTEGER PRIMARY KEY AUTOINCREMENT,
   server_id INTEGER NOT NULL,
   interface_name TEXT NOT NULL,
+  peer_public_key TEXT NOT NULL DEFAULT '',
   sampled_at TEXT NOT NULL,
   rx_bytes INTEGER NOT NULL DEFAULT 0,
   tx_bytes INTEGER NOT NULL DEFAULT 0,
@@ -120,6 +121,63 @@ CREATE INDEX IF NOT EXISTS idx_traffic_samples_server_time
 CREATE INDEX IF NOT EXISTS idx_traffic_samples_server_iface_time
   ON traffic_samples(server_id, interface_name, sampled_at);
 
+CREATE TABLE IF NOT EXISTS traffic_flow_settings (
+  id INTEGER PRIMARY KEY,
+  enabled INTEGER NOT NULL DEFAULT 0,
+  collector_ip TEXT NOT NULL DEFAULT '10.255.254.1',
+  flow_listen_port INTEGER NOT NULL DEFAULT 4739,
+  wg_listen_port INTEGER NOT NULL DEFAULT 51821,
+  prefix TEXT NOT NULL DEFAULT '10.255.254.0/24',
+  public_endpoint TEXT NOT NULL DEFAULT '',
+  host_public_key TEXT NOT NULL DEFAULT '',
+  host_private_key TEXT NOT NULL DEFAULT '',
+  hub_server_id INTEGER,
+  retention_hours INTEGER NOT NULL DEFAULT 24,
+  top_n INTEGER NOT NULL DEFAULT 200,
+  last_datagram_at TEXT,
+  last_exporter_ip TEXT,
+  last_error TEXT,
+  packets_received INTEGER NOT NULL DEFAULT 0,
+  peers_json TEXT NOT NULL DEFAULT '[]',
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+
+CREATE TABLE IF NOT EXISTS flow_buckets (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  server_id INTEGER NOT NULL,
+  bucket_at TEXT NOT NULL,
+  src TEXT NOT NULL,
+  dst TEXT NOT NULL,
+  proto INTEGER NOT NULL DEFAULT 0,
+  src_port INTEGER NOT NULL DEFAULT 0,
+  dst_port INTEGER NOT NULL DEFAULT 0,
+  bytes INTEGER NOT NULL DEFAULT 0,
+  packets INTEGER NOT NULL DEFAULT 0,
+  in_iface TEXT NOT NULL DEFAULT '',
+  FOREIGN KEY (server_id) REFERENCES servers(id) ON DELETE CASCADE
+);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_flow_buckets_unique
+  ON flow_buckets(server_id, bucket_at, src, dst, proto, src_port, dst_port, in_iface);
+CREATE INDEX IF NOT EXISTS idx_flow_buckets_server_time
+  ON flow_buckets(server_id, bucket_at);
+
+CREATE TABLE IF NOT EXISTS flow_ip_meta (
+  prefix TEXT PRIMARY KEY,
+  asn INTEGER NOT NULL DEFAULT 0,
+  country TEXT NOT NULL DEFAULT '',
+  lat REAL,
+  lng REAL,
+  holder TEXT NOT NULL DEFAULT '',
+  ok INTEGER NOT NULL DEFAULT 1,
+  fetched_at TEXT NOT NULL
+);
+CREATE TABLE IF NOT EXISTS flow_asn_meta (
+  asn INTEGER PRIMARY KEY,
+  holder TEXT NOT NULL DEFAULT '',
+  fetched_at TEXT NOT NULL
+);
+
 CREATE TABLE IF NOT EXISTS uptime_settings (
   id INTEGER PRIMARY KEY,
   enabled INTEGER NOT NULL DEFAULT 1,
@@ -533,18 +591,80 @@ CREATE TABLE IF NOT EXISTS user_interface_bindings (
   server_id INTEGER NOT NULL,
   interface_name TEXT NOT NULL,
   interface_type TEXT NOT NULL DEFAULT 'other',
+  peer_public_key TEXT NOT NULL DEFAULT '',
+  peer_name TEXT NOT NULL DEFAULT '',
   comment TEXT NOT NULL DEFAULT '',
   created_at TEXT NOT NULL DEFAULT (datetime('now')),
   updated_at TEXT NOT NULL DEFAULT (datetime('now')),
   FOREIGN KEY (user_id) REFERENCES app_users(id) ON DELETE CASCADE,
   FOREIGN KEY (server_id) REFERENCES servers(id) ON DELETE CASCADE,
-  UNIQUE (server_id, interface_name)
+  UNIQUE (server_id, interface_name, peer_public_key)
 );
 CREATE INDEX IF NOT EXISTS idx_user_iface_bind_user
   ON user_interface_bindings(user_id);
 `)
 
 // Lightweight schema evolution for existing databases without migrations
+{
+  const sampleCols = sqlite.prepare(`PRAGMA table_info('traffic_samples')`).all() as Array<{ name?: string }>
+  if (!sampleCols.some((c) => c.name === "peer_public_key")) {
+    sqlite.exec(`ALTER TABLE traffic_samples ADD COLUMN peer_public_key TEXT NOT NULL DEFAULT ''`)
+  }
+}
+
+{
+  const bindCols = sqlite.prepare(`PRAGMA table_info('user_interface_bindings')`).all() as Array<{ name?: string }>
+  if (!bindCols.some((c) => c.name === "peer_public_key")) {
+    sqlite.exec(`ALTER TABLE user_interface_bindings ADD COLUMN peer_public_key TEXT NOT NULL DEFAULT ''`)
+  }
+  if (!bindCols.some((c) => c.name === "peer_name")) {
+    sqlite.exec(`ALTER TABLE user_interface_bindings ADD COLUMN peer_name TEXT NOT NULL DEFAULT ''`)
+  }
+
+  const indexes = sqlite.prepare(`PRAGMA index_list('user_interface_bindings')`).all() as Array<{
+    name?: string
+    unique?: number
+  }>
+  let hasPeerUnique = false
+  for (const idx of indexes) {
+    if (!idx.name || !idx.unique) continue
+    const info = sqlite.prepare(`PRAGMA index_info(${JSON.stringify(idx.name)})`).all() as Array<{ name?: string }>
+    const names = info.map((c) => c.name)
+    if (names.includes("server_id") && names.includes("interface_name") && names.includes("peer_public_key")) {
+      hasPeerUnique = true
+    }
+  }
+  if (!hasPeerUnique) {
+    sqlite.exec(`PRAGMA foreign_keys = OFF`)
+    sqlite.exec(`
+      CREATE TABLE user_interface_bindings_new (
+        id TEXT PRIMARY KEY,
+        user_id TEXT NOT NULL,
+        server_id INTEGER NOT NULL,
+        interface_name TEXT NOT NULL,
+        interface_type TEXT NOT NULL DEFAULT 'other',
+        peer_public_key TEXT NOT NULL DEFAULT '',
+        peer_name TEXT NOT NULL DEFAULT '',
+        comment TEXT NOT NULL DEFAULT '',
+        created_at TEXT NOT NULL DEFAULT (datetime('now')),
+        updated_at TEXT NOT NULL DEFAULT (datetime('now')),
+        FOREIGN KEY (user_id) REFERENCES app_users(id) ON DELETE CASCADE,
+        FOREIGN KEY (server_id) REFERENCES servers(id) ON DELETE CASCADE,
+        UNIQUE (server_id, interface_name, peer_public_key)
+      );
+      INSERT INTO user_interface_bindings_new
+        (id, user_id, server_id, interface_name, interface_type, peer_public_key, peer_name, comment, created_at, updated_at)
+      SELECT id, user_id, server_id, interface_name, interface_type,
+        COALESCE(peer_public_key, ''), COALESCE(peer_name, ''), comment, created_at, updated_at
+      FROM user_interface_bindings;
+      DROP TABLE user_interface_bindings;
+      ALTER TABLE user_interface_bindings_new RENAME TO user_interface_bindings;
+      CREATE INDEX IF NOT EXISTS idx_user_iface_bind_user ON user_interface_bindings(user_id);
+    `)
+    sqlite.exec(`PRAGMA foreign_keys = ON`)
+  }
+}
+
 const recursiveCols = sqlite.prepare(`PRAGMA table_info('recursive_routes')`).all() as Array<{ name?: string }>
 const hasCountryColumn = recursiveCols.some((c) => c.name === "country")
 if (!hasCountryColumn) {
@@ -611,6 +731,9 @@ if (!serverCols.some((c) => c.name === "lan_subnet")) {
 if (!serverCols.some((c) => c.name === "wan_uplinks")) {
   sqlite.exec(`ALTER TABLE servers ADD COLUMN wan_uplinks TEXT NOT NULL DEFAULT '[]'`)
 }
+if (!serverCols.some((c) => c.name === "mgmt_tunnel_ip")) {
+  sqlite.exec(`ALTER TABLE servers ADD COLUMN mgmt_tunnel_ip TEXT NOT NULL DEFAULT ''`)
+}
 
 const alertTgCols = sqlite.prepare(`PRAGMA table_info('alert_telegram_settings')`).all() as Array<{ name?: string }>
 if (!alertTgCols.some((c) => c.name === "message_thread_id")) {
@@ -656,6 +779,12 @@ SELECT 1, 1, 30, 14
 WHERE NOT EXISTS (SELECT 1 FROM traffic_settings WHERE id = 1);
 `)
 
+sqlite.exec(`
+INSERT INTO traffic_flow_settings (id, enabled, collector_ip, flow_listen_port, wg_listen_port, prefix)
+SELECT 1, 0, '10.255.254.1', 4739, 51821, '10.255.254.0/24'
+WHERE NOT EXISTS (SELECT 1 FROM traffic_flow_settings WHERE id = 1);
+`)
+
 sqlite.exec(`
 INSERT INTO uptime_settings (id, enabled, interval_sec, retention_days)
 SELECT 1, 1, 15, 14
@@ -692,6 +821,29 @@ SELECT 1, 'https://acme-v02.api.letsencrypt.org/directory', '', '', ''
 WHERE NOT EXISTS (SELECT 1 FROM acme_settings WHERE id = 1);
 `)
 
+{
+  const flowIndexes = sqlite.prepare(`PRAGMA index_list('flow_buckets')`).all() as Array<{
+    name?: string
+    unique?: number
+  }>
+  let hasIfaceUnique = false
+  for (const idx of flowIndexes) {
+    if (!idx.name || !idx.unique) continue
+    const info = sqlite.prepare(`PRAGMA index_info(${JSON.stringify(idx.name)})`).all() as Array<{ name?: string }>
+    const names = info.map((c) => c.name)
+    if (names.includes("in_iface") && names.includes("src") && names.includes("dst")) {
+      hasIfaceUnique = true
+    }
+  }
+  if (!hasIfaceUnique) {
+    sqlite.exec(`DROP INDEX IF EXISTS idx_flow_buckets_unique`)
+    sqlite.exec(`
+      CREATE UNIQUE INDEX IF NOT EXISTS idx_flow_buckets_unique
+        ON flow_buckets(server_id, bucket_at, src, dst, proto, src_port, dst_port, in_iface)
+    `)
+  }
+}
+
 const certIssueJobCols = sqlite.prepare(`PRAGMA table_info('certificate_issue_jobs')`).all() as Array<{ name?: string }>
 if (!certIssueJobCols.some((c) => c.name === "source")) {
   sqlite.exec(`ALTER TABLE certificate_issue_jobs ADD COLUMN source TEXT NOT NULL DEFAULT 'manual'`)

backend/src/db/schema.ts

@@ -32,6 +32,8 @@ export const servers = sqliteTable("servers", {
   lanSubnet: text("lan_subnet").notNull().default(""),
   /** JSON-массив WAN-аплинков [{ id, name, isp, iface, ip, maxDl, maxUl }, …] */
   wanUplinks: text("wan_uplinks").notNull().default("[]"),
+  /** Адрес в оверлее wg-flow (экспортёр IPFIX), например 10.255.254.5 */
+  mgmtTunnelIp: text("mgmt_tunnel_ip").notNull().default(""),
 
   createdAt: text("created_at").notNull().default(sql`(datetime('now'))`),
   updatedAt: text("updated_at").notNull().default(sql`(datetime('now'))`),
@@ -158,12 +160,72 @@ export const alertBgpPeerSamples = sqliteTable("alert_bgp_peer_samples", {
 
 // ── raw traffic samples (per server/interface/timepoint) ──────────────────────
 
+export const trafficFlowSettings = sqliteTable("traffic_flow_settings", {
+  id:              integer("id").primaryKey(),
+  enabled:         integer("enabled", { mode: "boolean" }).notNull().default(false),
+  collectorIp:     text("collector_ip").notNull().default("10.255.254.1"),
+  flowListenPort:  integer("flow_listen_port").notNull().default(4739),
+  wgListenPort:    integer("wg_listen_port").notNull().default(51821),
+  prefix:          text("prefix").notNull().default("10.255.254.0/24"),
+  publicEndpoint:  text("public_endpoint").notNull().default(""),
+  hostPublicKey:   text("host_public_key").notNull().default(""),
+  hostPrivateKey:  text("host_private_key").notNull().default(""),
+  hubServerId:     integer("hub_server_id"),
+  retentionHours:  integer("retention_hours").notNull().default(24),
+  topN:            integer("top_n").notNull().default(200),
+  lastDatagramAt:  text("last_datagram_at"),
+  lastExporterIp:  text("last_exporter_ip"),
+  lastError:       text("last_error"),
+  packetsReceived: integer("packets_received").notNull().default(0),
+  peersJson:       text("peers_json").notNull().default("[]"),
+  createdAt:       text("created_at").notNull().default(sql`(datetime('now'))`),
+  updatedAt:       text("updated_at").notNull().default(sql`(datetime('now'))`),
+})
+
+export const flowBuckets = sqliteTable("flow_buckets", {
+  id:        integer("id").primaryKey({ autoIncrement: true }),
+  serverId:  integer("server_id")
+               .notNull()
+               .references(() => servers.id, { onDelete: "cascade" }),
+  bucketAt:  text("bucket_at").notNull(),
+  src:       text("src").notNull(),
+  dst:       text("dst").notNull(),
+  proto:     integer("proto").notNull().default(0),
+  srcPort:   integer("src_port").notNull().default(0),
+  dstPort:   integer("dst_port").notNull().default(0),
+  bytes:     integer("bytes").notNull().default(0),
+  packets:   integer("packets").notNull().default(0),
+  inIface:   text("in_iface").notNull().default(""),
+}, (t) => [
+  uniqueIndex("idx_flow_buckets_unique").on(
+    t.serverId, t.bucketAt, t.src, t.dst, t.proto, t.srcPort, t.dstPort, t.inIface,
+  ),
+])
+
+export const flowIpMeta = sqliteTable("flow_ip_meta", {
+  prefix:    text("prefix").primaryKey(),
+  asn:       integer("asn").notNull().default(0),
+  country:   text("country").notNull().default(""),
+  lat:       real("lat"),
+  lng:       real("lng"),
+  holder:    text("holder").notNull().default(""),
+  ok:        integer("ok").notNull().default(1),
+  fetchedAt: text("fetched_at").notNull(),
+})
+
+export const flowAsnMeta = sqliteTable("flow_asn_meta", {
+  asn:       integer("asn").primaryKey(),
+  holder:    text("holder").notNull().default(""),
+  fetchedAt: text("fetched_at").notNull(),
+})
+
 export const trafficSamples = sqliteTable("traffic_samples", {
   id:            integer("id").primaryKey({ autoIncrement: true }),
   serverId:      integer("server_id")
                   .notNull()
                   .references(() => servers.id, { onDelete: "cascade" }),
   interfaceName: text("interface_name").notNull(),
+  peerPublicKey: text("peer_public_key").notNull().default(""),
   sampledAt:     text("sampled_at").notNull(),
   rxBytes:       integer("rx_bytes").notNull().default(0),
   txBytes:       integer("tx_bytes").notNull().default(0),
@@ -570,11 +632,13 @@ export const userInterfaceBindings = sqliteTable("user_interface_bindings", {
   interfaceType:  text("interface_type", { enum: ["ether", "gre", "wg", "other"] })
                     .notNull()
                     .default("other"),
+  peerPublicKey:  text("peer_public_key").notNull().default(""),
+  peerName:       text("peer_name").notNull().default(""),
   comment:        text("comment").notNull().default(""),
   createdAt:      text("created_at").notNull().default(sql`(datetime('now'))`),
   updatedAt:      text("updated_at").notNull().default(sql`(datetime('now'))`),
 }, (t) => [
-  uniqueIndex("idx_user_iface_bind_server_name").on(t.serverId, t.interfaceName),
+  uniqueIndex("idx_user_iface_bind_server_name_peer").on(t.serverId, t.interfaceName, t.peerPublicKey),
 ])
 
 export const internetPathSnapshots = sqliteTable("internet_path_snapshots", {
@@ -592,6 +656,10 @@ export type SnapshotInsert = typeof serverSnapshots.$inferInsert
 export type FilterRuleRow  = typeof filterRules.$inferSelect
 export type RecursiveRouteRow = typeof recursiveRoutes.$inferSelect
 export type TrafficSettingsRow = typeof trafficSettings.$inferSelect
+export type TrafficFlowSettingsRow = typeof trafficFlowSettings.$inferSelect
+export type FlowBucketRow = typeof flowBuckets.$inferSelect
+export type FlowIpMetaRow = typeof flowIpMeta.$inferSelect
+export type FlowAsnMetaRow = typeof flowAsnMeta.$inferSelect
 export type ServersApiPingSettingsRow = typeof serversApiPingSettings.$inferSelect
 export type TrafficSampleRow = typeof trafficSamples.$inferSelect
 export type UptimeSettingsRow = typeof uptimeSettings.$inferSelect

backend/src/index.ts

@@ -10,6 +10,7 @@ import execRoutes from "./routes/exec.js"
 import filtersRoutes from "./routes/filters.js"
 import recursiveRoutes from "./routes/recursive-routes.js"
 import trafficRoutes from "./routes/traffic.js"
+import trafficFlowRoutes from "./routes/traffic-flow.js"
 import serversApiPingRoutes from "./routes/servers-api-ping.js"
 import uptimeRoutes from "./routes/uptime.js"
 import networkRoutes from "./routes/network.js"
@@ -27,6 +28,7 @@ import wireguardRoutes from "./routes/wireguard.js"
 import firewallRoutes from "./routes/firewall.js"
 import usersRoutes from "./routes/users.js"
 import { refreshScheduler, stopScheduler } from "./services/scheduler.js"
+import { startTrafficFlowListener, stopTrafficFlowListener } from "./services/traffic-flow-ingest.js"
 
 export async function buildApp(opts?: {
   logger?: boolean
@@ -93,6 +95,7 @@ export async function buildApp(opts?: {
   await app.register(filtersRoutes, { prefix: "/api" })
   await app.register(recursiveRoutes, { prefix: "/api" })
   await app.register(trafficRoutes, { prefix: "/api" })
+  await app.register(trafficFlowRoutes, { prefix: "/api" })
   await app.register(serversApiPingRoutes, { prefix: "/api" })
   await app.register(uptimeRoutes, { prefix: "/api" })
   await app.register(networkRoutes, { prefix: "/api" })
@@ -112,8 +115,10 @@ export async function buildApp(opts?: {
 
   if (opts?.startScheduler !== false) {
     refreshScheduler()
+    startTrafficFlowListener()
     app.addHook("onClose", async () => {
       stopScheduler()
+      stopTrafficFlowListener()
     })
   }
 

backend/src/modules/users/bindings.test.ts

@@ -1,5 +1,6 @@
 import assert from "node:assert/strict"
 import Database from "better-sqlite3"
+import { normalizeBindingPeer, PeerBindError } from "./peer-bind.js"
 
 const sqlite = new Database(":memory:")
 sqlite.pragma("foreign_keys = ON")
@@ -29,12 +30,14 @@ CREATE TABLE user_interface_bindings (
   server_id INTEGER NOT NULL,
   interface_name TEXT NOT NULL,
   interface_type TEXT NOT NULL DEFAULT 'other',
+  peer_public_key TEXT NOT NULL DEFAULT '',
+  peer_name TEXT NOT NULL DEFAULT '',
   comment TEXT NOT NULL DEFAULT '',
   created_at TEXT NOT NULL DEFAULT (datetime('now')),
   updated_at TEXT NOT NULL DEFAULT (datetime('now')),
   FOREIGN KEY (user_id) REFERENCES app_users(id) ON DELETE CASCADE,
   FOREIGN KEY (server_id) REFERENCES servers(id) ON DELETE CASCADE,
-  UNIQUE (server_id, interface_name)
+  UNIQUE (server_id, interface_name, peer_public_key)
 );
 `)
 
@@ -55,8 +58,33 @@ assert.throws(
   "один интерфейс на сервере — один пользователь",
 )
 
+sqlite.prepare(`
+  INSERT INTO user_interface_bindings (id, user_id, server_id, interface_name, interface_type, peer_public_key, peer_name)
+  VALUES ('wg1', 'u1', 1, 'wg-server', 'wg', 'peer-key-aaa', 'phone')
+`).run()
+sqlite.prepare(`
+  INSERT INTO user_interface_bindings (id, user_id, server_id, interface_name, interface_type, peer_public_key, peer_name)
+  VALUES ('wg2', 'u2', 1, 'wg-server', 'wg', 'peer-key-bbb', 'laptop')
+`).run()
+assert.throws(
+  () => sqlite.prepare(`
+    INSERT INTO user_interface_bindings (id, user_id, server_id, interface_name, interface_type, peer_public_key)
+    VALUES ('wg3', 'u2', 1, 'wg-server', 'wg', 'peer-key-aaa')
+  `).run(),
+  /UNIQUE/i,
+  "один пир — один пользователь",
+)
+
+assert.throws(
+  () => normalizeBindingPeer("wg", ""),
+  (err: unknown) => err instanceof PeerBindError && err.status === 400,
+  "WG без ключа — 400",
+)
+assert.equal(normalizeBindingPeer("ether", "ignored"), "")
+assert.equal(normalizeBindingPeer("wg", " abc "), "abc")
+
 sqlite.prepare("DELETE FROM app_users WHERE id = 'u1'").run()
 const leftover = sqlite.prepare("SELECT COUNT(*) AS n FROM user_interface_bindings").get() as { n: number }
-assert.equal(leftover.n, 0, "каскад: привязки удаляются вместе с пользователем")
+assert.equal(leftover.n, 1, "каскад: привязки u1 удаляются, пир u2 остаётся")
 
 console.log("users bindings unique+cascade tests ok")

backend/src/modules/users/peer-bind.ts

@@ -0,0 +1,44 @@
+import type { InterfaceType } from "./iface-type.js"
+
+export class PeerBindError extends Error {
+  constructor(
+    message: string,
+    public readonly status: number,
+  ) {
+    super(message)
+    this.name = "PeerBindError"
+  }
+}
+
+export function truncPeerKey(key: string): string {
+  const k = key.trim()
+  if (k.length <= 20) return k
+  return `${k.slice(0, 8)}…${k.slice(-8)}`
+}
+
+export function peerDisplayName(opts: {
+  publicKey: string
+  name?: string | null
+  comment?: string | null
+}): string {
+  const name = (opts.name ?? "").trim()
+  if (name) return name
+  const comment = (opts.comment ?? "").trim()
+  if (comment) return comment
+  return truncPeerKey(opts.publicKey)
+}
+
+/** Ether/GRE — пустой ключ. WG — обязательный public-key. */
+export function normalizeBindingPeer(
+  type: InterfaceType,
+  peerPublicKey: string | undefined,
+): string {
+  const key = (peerPublicKey ?? "").trim()
+  if (type === "wg") {
+    if (!key) {
+      throw new PeerBindError("Для WireGuard укажите пир (public-key)", 400)
+    }
+    return key
+  }
+  return ""
+}

backend/src/modules/users/repository/users-repository.ts

@@ -46,9 +46,10 @@ export function getBindingRowById(id: string): BindingRow | undefined {
   return db.select().from(userInterfaceBindings).where(eq(userInterfaceBindings.id, id)).limit(1).all()[0]
 }
 
-export function getBindingByServerIface(
+export function getBindingByServerIfacePeer(
   serverId: number,
   interfaceName: string,
+  peerPublicKey = "",
 ): BindingRow | undefined {
   return db
     .select()
@@ -56,6 +57,7 @@ export function getBindingByServerIface(
     .where(and(
       eq(userInterfaceBindings.serverId, serverId),
       eq(userInterfaceBindings.interfaceName, interfaceName),
+      eq(userInterfaceBindings.peerPublicKey, peerPublicKey),
     ))
     .limit(1)
     .all()[0]

backend/src/modules/users/service/users-service.ts

@@ -18,7 +18,7 @@ import {
   createUserRow,
   deleteBindingRowById,
   deleteUserRowById,
-  getBindingByServerIface,
+  getBindingByServerIfacePeer,
   getBindingRowById,
   getUserRowById,
   getUserRowByLogin,
@@ -35,6 +35,12 @@ import {
   mapRosInterfaceType,
   parseRawInterfaces,
 } from "../iface-type.js"
+import {
+  normalizeBindingPeer,
+  PeerBindError,
+  peerDisplayName,
+} from "../peer-bind.js"
+import { listWireGuardPeersForCatalog } from "../../../services/wireguard-live.js"
 
 export class UsersServiceError extends Error {
   constructor(
@@ -80,6 +86,8 @@ function toBindingDto(row: BindingRow): UserBinding {
     serverCountry: meta.country,
     interfaceName: row.interfaceName,
     interfaceType: row.interfaceType,
+    peerPublicKey: row.peerPublicKey ?? "",
+    peerName: row.peerName ?? "",
     comment: row.comment,
     createdAt: row.createdAt,
     updatedAt: row.updatedAt,
@@ -179,11 +187,29 @@ export function addBinding(userId: string, input: UserBindingCreate): UserBindin
   if (!server) throw new UsersServiceError("Сервер не найден", 404)
   const ifaceName = input.interfaceName.trim()
   if (!ifaceName) throw new UsersServiceError("Имя интерфейса обязательно", 400)
-  const taken = getBindingByServerIface(input.serverId, ifaceName)
-  if (taken) {
-    throw new UsersServiceError("Интерфейс уже привязан к другому пользователю", 409)
-  }
   const type: InterfaceType = input.interfaceType ?? inferIfaceType(input.serverId, ifaceName)
+  let peerPublicKey = ""
+  try {
+    peerPublicKey = normalizeBindingPeer(type, input.peerPublicKey)
+  } catch (err) {
+    if (err instanceof PeerBindError) throw new UsersServiceError(err.message, err.status)
+    throw err
+  }
+  const peerName = type === "wg"
+    ? peerDisplayName({
+      publicKey: peerPublicKey,
+      name: input.peerName,
+    })
+    : ""
+  const taken = getBindingByServerIfacePeer(input.serverId, ifaceName, peerPublicKey)
+  if (taken) {
+    throw new UsersServiceError(
+      type === "wg"
+        ? "Этот пир уже привязан к другому пользователю"
+        : "Интерфейс уже привязан к другому пользователю",
+      409,
+    )
+  }
   const now = new Date().toISOString()
   try {
     const row = createBindingRow({
@@ -192,6 +218,8 @@ export function addBinding(userId: string, input: UserBindingCreate): UserBindin
       serverId: input.serverId,
       interfaceName: ifaceName,
       interfaceType: type,
+      peerPublicKey,
+      peerName,
       comment: (input.comment ?? "").trim(),
       createdAt: now,
       updatedAt: now,
@@ -199,7 +227,12 @@ export function addBinding(userId: string, input: UserBindingCreate): UserBindin
     return toBindingDto(row)
   } catch (err) {
     if (isUniqueConstraintError(err)) {
-      throw new UsersServiceError("Интерфейс уже привязан к другому пользователю", 409)
+      throw new UsersServiceError(
+        type === "wg"
+          ? "Этот пир уже привязан к другому пользователю"
+          : "Интерфейс уже привязан к другому пользователю",
+        409,
+      )
     }
     throw err
   }
@@ -220,7 +253,7 @@ function inferIfaceType(serverId: number, ifaceName: string): InterfaceType {
   return found?.type ?? "other"
 }
 
-export function listInterfaceCatalog(serverId: number): CatalogInterface[] {
+export async function listInterfaceCatalog(serverId: number): Promise<CatalogInterface[]> {
   const server = db.select().from(servers).where(eq(servers.id, serverId)).limit(1).all()[0]
   if (!server) throw new UsersServiceError("Сервер не найден", 404)
 
@@ -238,13 +271,14 @@ export function listInterfaceCatalog(serverId: number): CatalogInterface[] {
       const rows = db
         .select({
           interfaceName: trafficSamples.interfaceName,
+          peerPublicKey: trafficSamples.peerPublicKey,
           running: trafficSamples.running,
           disabled: trafficSamples.disabled,
         })
         .from(trafficSamples)
         .where(eq(trafficSamples.serverId, serverId))
         .all()
-        .filter((r) => r.interfaceName && !/^(lo|loopback)/i.test(r.interfaceName))
+        .filter((r) => r.interfaceName && !/^(lo|loopback)/i.test(r.interfaceName) && !(r.peerPublicKey ?? ""))
       const seen = new Set<string>()
       ifaces = []
       for (const r of rows) {
@@ -262,18 +296,47 @@ export function listInterfaceCatalog(serverId: number): CatalogInterface[] {
 
   const bindings = listBindingRows().filter((b) => b.serverId === serverId)
   const usersById = new Map(listUserRows().map((u) => [u.id, u]))
+  const hasWg = ifaces.some((i) => i.type === "wg")
+  const wgLive = hasWg
+    ? await listWireGuardPeersForCatalog(serverId)
+    : { peers: [] as Awaited<ReturnType<typeof listWireGuardPeersForCatalog>>["peers"] }
+  const peersByIface = new Map<string, typeof wgLive.peers>()
+  for (const peer of wgLive.peers) {
+    const list = peersByIface.get(peer.interfaceName) ?? []
+    list.push(peer)
+    peersByIface.set(peer.interfaceName, list)
+  }
 
   return ifaces.map((iface) => {
-    const bind = bindings.find((b) => b.interfaceName === iface.name)
-    const owner = bind ? usersById.get(bind.userId) : undefined
-    return {
+    const ifaceBind = bindings.find((b) => b.interfaceName === iface.name && !(b.peerPublicKey ?? ""))
+    const owner = ifaceBind ? usersById.get(ifaceBind.userId) : undefined
+    const base: CatalogInterface = {
       name: iface.name,
       type: iface.type,
       running: iface.running,
       disabled: iface.disabled,
-      boundUserId: bind?.userId ?? null,
+      boundUserId: ifaceBind?.userId ?? null,
       boundUserLogin: owner?.login ?? null,
     }
+    if (iface.type !== "wg") return base
+    const livePeers = peersByIface.get(iface.name) ?? []
+    return {
+      ...base,
+      peersError: wgLive.error,
+      peers: livePeers.map((p) => {
+        const bind = bindings.find((b) => b.interfaceName === iface.name && b.peerPublicKey === p.publicKey)
+        const peerOwner = bind ? usersById.get(bind.userId) : undefined
+        return {
+          publicKey: p.publicKey,
+          name: peerDisplayName({ publicKey: p.publicKey, name: p.name, comment: p.comment }),
+          comment: p.comment,
+          allowedIps: p.allowedIps,
+          latestHandshake: p.latestHandshake,
+          boundUserId: bind?.userId ?? null,
+          boundUserLogin: peerOwner?.login ?? null,
+        }
+      }),
+    }
   }).sort((a, b) => a.name.localeCompare(b.name))
 }
 

backend/src/routes/traffic-flow.ts

@@ -0,0 +1,209 @@
+import type { FastifyPluginAsyncZod } from "@fastify/type-provider-zod"
+import type { FastifyReply, FastifyRequest } from "fastify"
+import { env } from "../config.js"
+import {
+  trafficFlowOverlayRequestSchema,
+  trafficFlowSettingsPatchSchema,
+} from "@mmapp/contracts/traffic-flow"
+import {
+  ensureHostKeys,
+  getTrafficFlowSettingsRow,
+  toTrafficFlowSettingsDto,
+  updateTrafficFlowSettings,
+} from "../services/traffic-flow-settings.js"
+import {
+  getFlowListenerState,
+  startTrafficFlowListener,
+  listFlowTalkers,
+} from "../services/traffic-flow-ingest.js"
+import {
+  buildFlowAnalytics,
+  listFlowClients,
+  listFlowExporters,
+} from "../services/traffic-flow-analytics.js"
+import { applyFlowOverlay } from "../services/traffic-flow-overlay.js"
+import { listTrafficFlowHostFiles } from "../services/traffic-flow-host-files.js"
+
+const LIVE_TICK_MS = 2000
+
+function rangeToMinutes(range: string | undefined): number {
+  switch ((range ?? "5m").toLowerCase()) {
+    case "5m": return 5
+    case "15m": return 15
+    case "1h": return 60
+    case "4h": return 240
+    case "24h": return 1440
+    default: return 5
+  }
+}
+
+function parseId(raw: unknown): number | undefined {
+  if (raw == null || raw === "") return undefined
+  const n = Number.parseInt(String(raw), 10)
+  return Number.isFinite(n) ? n : undefined
+}
+
+function parseDedup(raw: unknown): boolean {
+  if (raw == null || raw === "") return true
+  const s = String(raw).toLowerCase()
+  return s !== "0" && s !== "false" && s !== "off"
+}
+
+function analyticsQuery(req: FastifyRequest) {
+  const q = req.query as { range?: string; serverId?: string; userId?: string; iface?: string; dedup?: string }
+  return {
+    minutes: rangeToMinutes(q.range),
+    serverId: parseId(q.serverId),
+    userId: q.userId?.trim() || undefined,
+    iface: q.iface?.trim() || undefined,
+    dedup: parseDedup(q.dedup),
+  }
+}
+
+async function sendFlowTalkers(req: FastifyRequest, reply: FastifyReply) {
+  const q = req.query as { range?: string }
+  return reply.send(listFlowTalkers(rangeToMinutes(q.range)))
+}
+
+function requestPublicHost(req: FastifyRequest): string {
+  const forwarded = req.headers["x-forwarded-host"]
+  const raw = Array.isArray(forwarded) ? forwarded[0] : forwarded
+  return raw || req.hostname || ""
+}
+
+async function applyOverlayHandler(req: FastifyRequest, reply: FastifyReply) {
+  const parsed = trafficFlowOverlayRequestSchema.safeParse(req.body ?? {})
+  if (!parsed.success) {
+    return reply.status(400).send({ error: "Некорректное тело запроса", details: parsed.error.flatten() })
+  }
+  try {
+    const result = await applyFlowOverlay(parsed.data.serverId, {
+      publicEndpoint: parsed.data.publicEndpoint,
+      requestHost: requestPublicHost(req),
+    })
+    return reply.send(result)
+  } catch (e) {
+    const status = (e as { statusCode?: number }).statusCode ?? 502
+    const msg = e instanceof Error ? e.message : String(e)
+    return reply.status(status).send({ error: msg })
+  }
+}
+
+function writeSse(raw: NodeJS.WritableStream, event: string, data: unknown) {
+  raw.write(`event: ${event}\ndata: ${JSON.stringify(data)}\n\n`)
+}
+
+function sleep(ms: number, signal: AbortSignal): Promise<void> {
+  return new Promise((resolve, reject) => {
+    if (signal.aborted) {
+      reject(new Error("aborted"))
+      return
+    }
+    const timer = setTimeout(() => {
+      signal.removeEventListener("abort", onAbort)
+      resolve()
+    }, ms)
+    const onAbort = () => {
+      clearTimeout(timer)
+      reject(new Error("aborted"))
+    }
+    signal.addEventListener("abort", onAbort, { once: true })
+  })
+}
+
+const trafficFlowRoutes: FastifyPluginAsyncZod = async (app) => {
+  app.get("/traffic/flow/settings", async (_req, reply) => {
+    return reply.send(toTrafficFlowSettingsDto(getFlowListenerState()))
+  })
+
+  app.put("/traffic/flow/settings", async (req, reply) => {
+    const parsed = trafficFlowSettingsPatchSchema.safeParse(req.body ?? {})
+    if (!parsed.success) {
+      return reply.status(400).send({ error: "Некорректное тело запроса", details: parsed.error.flatten() })
+    }
+    updateTrafficFlowSettings(parsed.data)
+    startTrafficFlowListener()
+    return reply.send({ ok: true, settings: toTrafficFlowSettingsDto(getFlowListenerState()) })
+  })
+
+  app.post("/traffic/flow/settings/generate-keys", async (_req, reply) => {
+    const result = ensureHostKeys()
+    return reply.send({
+      ok: true,
+      created: result.created,
+      publicKey: result.publicKey,
+      settings: toTrafficFlowSettingsDto(getFlowListenerState()),
+    })
+  })
+
+  app.get("/traffic/flow/host-files", async (_req, reply) => {
+    const row = getTrafficFlowSettingsRow()
+    if (!row.hostPrivateKey) ensureHostKeys()
+    return reply.send({ files: listTrafficFlowHostFiles() })
+  })
+
+  app.post("/traffic/flow/overlay", applyOverlayHandler)
+  app.post("/traffic/flow-overlay", applyOverlayHandler)
+
+  app.get("/traffic/flow", sendFlowTalkers)
+  app.get("/traffic/flows", sendFlowTalkers)
+
+  app.get("/traffic/flow/exporters", async (req, reply) => {
+    const q = req.query as { range?: string }
+    return reply.send(listFlowExporters(rangeToMinutes(q.range)))
+  })
+
+  app.get("/traffic/flow/clients", async (req, reply) => {
+    const q = req.query as { range?: string }
+    return reply.send(listFlowClients(rangeToMinutes(q.range)))
+  })
+
+  app.get("/traffic/flow/analytics", async (req, reply) => {
+    return reply.send(buildFlowAnalytics(analyticsQuery(req)))
+  })
+
+  app.get("/traffic/flow/live", async (req, reply) => {
+    const query = analyticsQuery(req)
+    const abort = new AbortController()
+    const onClose = () => abort.abort()
+    req.raw.on("close", onClose)
+
+    reply.hijack()
+    req.raw.setTimeout(0)
+    reply.raw.setTimeout(0)
+    const origin = typeof req.headers.origin === "string" ? req.headers.origin : ""
+    const allowed = env.CORS_ORIGIN
+    const sseHeaders: Record<string, string> = {
+      "Content-Type": "text/event-stream; charset=utf-8",
+      "Cache-Control": "no-cache, no-transform",
+      Connection: "keep-alive",
+      "X-Accel-Buffering": "no",
+    }
+    if (origin && (allowed === "*" || allowed === origin)) {
+      sseHeaders["Access-Control-Allow-Origin"] = origin
+      sseHeaders["Access-Control-Allow-Credentials"] = "true"
+      sseHeaders["Access-Control-Allow-Headers"] = "Authorization, Accept"
+      sseHeaders.Vary = "Origin"
+    }
+    reply.raw.writeHead(200, sseHeaders)
+    reply.raw.write(":\n\n")
+
+    try {
+      while (!abort.signal.aborted) {
+        writeSse(reply.raw, "sample", buildFlowAnalytics(query))
+        await sleep(LIVE_TICK_MS, abort.signal)
+      }
+    } catch {
+      /* abort / disconnect */
+    } finally {
+      req.raw.off("close", onClose)
+      try {
+        reply.raw.end()
+      } catch {
+        /* already closed */
+      }
+    }
+  })
+}
+
+export default trafficFlowRoutes

backend/src/routes/users.ts

@@ -39,7 +39,7 @@ const usersRoutes: FastifyPluginAsyncZod = async (app) => {
   }, async (req, reply) => {
     const q = req.query as { serverId: number }
     try {
-      return reply.send({ interfaces: listInterfaceCatalog(q.serverId) })
+      return reply.send({ interfaces: await listInterfaceCatalog(q.serverId) })
     } catch (err) {
       return sendServiceError(reply, err)
     }

backend/src/routes/wireguard.ts

@@ -21,6 +21,12 @@ import {
   getEnabledServerById,
   listWireGuardInterfaces,
 } from "../services/wireguard-live.js"
+import {
+  putIpAddress,
+  putWireguardInterface,
+  putWireguardPeer,
+  toRosBody,
+} from "../services/wireguard-ros.js"
 
 function serverIdParam(v: string): string {
   return decodeURIComponent(v)
@@ -30,14 +36,6 @@ function rosIdParam(v: string): string {
   return decodeURIComponent(v)
 }
 
-function toRosBody(obj: Record<string, string | undefined>): Record<string, string> {
-  const out: Record<string, string> = {}
-  for (const [k, v] of Object.entries(obj)) {
-    if (v !== undefined && v !== "") out[k] = v
-  }
-  return out
-}
-
 function peerToRosBody(p: Omit<WgCreatePeerRequest, "serverId" | "interfaceName"> & { interfaceName: string }) {
   return toRosBody({
     interface: p.interfaceName,
@@ -99,20 +97,17 @@ async function applyParsedConfig(
     comment: parsed.interface.comment,
     disabled: parsed.interface.disabled ? "yes" : undefined,
   })
-  await client.put("/interface/wireguard", ifaceBody)
+  await putWireguardInterface(client, ifaceBody)
 
   if (parsed.interface.address) {
-    await client.put("/ip/address", {
-      address: parsed.interface.address,
-      interface: name,
-    })
+    await putIpAddress(client, parsed.interface.address, name)
   }
 
   let peersCreated = 0
   for (const p of parsed.peers) {
     if (!p.publicKey) continue
-    await client.put(
-      "/interface/wireguard/peers",
+    await putWireguardPeer(
+      client,
       peerToRosBody({
         interfaceName: name,
         publicKey: p.publicKey,
@@ -164,30 +159,21 @@ const wireguardRoutes: FastifyPluginAsyncZod = async (app) => {
 
     const client = MikrotikClient.fromServer(server)
     try {
-      await client.put(
-        "/interface/wireguard",
-        toRosBody({
-          name: body.name,
-          "listen-port": String(body.listenPort),
-          mtu: String(body.mtu),
-          comment: body.comment,
-          "private-key": body.privateKey,
-          disabled: body.disabled ? "yes" : undefined,
-        }),
-      )
+      await putWireguardInterface(client, {
+        name: body.name,
+        "listen-port": String(body.listenPort),
+        mtu: String(body.mtu),
+        comment: body.comment,
+        "private-key": body.privateKey,
+        disabled: body.disabled ? "yes" : undefined,
+      })
 
       if (body.address) {
-        await client.put("/ip/address", {
-          address: body.address,
-          interface: body.name,
-        })
+        await putIpAddress(client, body.address, body.name)
       }
 
       if (body.peer) {
-        await client.put(
-          "/interface/wireguard/peers",
-          peerToRosBody({ ...body.peer, interfaceName: body.name }),
-        )
+        await putWireguardPeer(client, peerToRosBody({ ...body.peer, interfaceName: body.name }))
       }
 
       const list = await listWireGuardInterfaces({
@@ -255,7 +241,7 @@ const wireguardRoutes: FastifyPluginAsyncZod = async (app) => {
     if (!server) return reply.status(404).send({ error: "Сервер не найден" })
     const client = MikrotikClient.fromServer(server)
     try {
-      await client.put("/interface/wireguard/peers", peerToRosBody(body))
+      await putWireguardPeer(client, peerToRosBody(body))
       return reply.status(201).send({ ok: true })
     } catch (e) {
       const msg = e instanceof Error ? e.message : String(e)

backend/src/services/traffic-collector.ts

@@ -5,9 +5,12 @@ import type { TrafficRunSnapshot } from "../types/scheduler-run-snapshot.js"
 import { SCHEDULER_RUN_SNAPSHOT_VERSION } from "../types/scheduler-run-snapshot.js"
 import { MikrotikClient } from "./mikrotik.js"
 import { bpsToMbps, rateBpsFromDelta, shouldIncludeIface } from "./traffic-rate.js"
+import { rememberServerIfaces } from "./traffic-flow-ifindex.js"
 
 interface RosIfaceTraffic {
+  ".id"?: string
   name?: string
+  ifindex?: string
   running?: string
   disabled?: string
   "rx-byte"?: string
@@ -16,6 +19,38 @@ interface RosIfaceTraffic {
   "tx-bits-per-second"?: string
 }
 
+interface RosWgPeerTraffic {
+  interface?: string
+  name?: string
+  comment?: string
+  "public-key"?: string
+  rx?: string
+  tx?: string
+  disabled?: string
+}
+
+function waveKey(interfaceName: string, peerPublicKey = ""): string {
+  return `${interfaceName}\0${peerPublicKey}`
+}
+
+function sampleRate(
+  prevWave: Map<string, { rxBytes: number; txBytes: number; sampledAt: string }>,
+  key: string,
+  rxBytes: number,
+  txBytes: number,
+  nowMs: number,
+): { rxBps: number; txBps: number } {
+  const prev = prevWave.get(key)
+  const prevMs = prev ? Date.parse(prev.sampledAt) : NaN
+  const rxBps = prev && Number.isFinite(prevMs)
+    ? (rateBpsFromDelta(prev.rxBytes, rxBytes, prevMs, nowMs) ?? 0)
+    : 0
+  const txBps = prev && Number.isFinite(prevMs)
+    ? (rateBpsFromDelta(prev.txBytes, txBytes, prevMs, nowMs) ?? 0)
+    : 0
+  return { rxBps, txBps }
+}
+
 export interface TrafficCollectorState {
   running: boolean
   lastRunAt: string | null
@@ -63,6 +98,7 @@ function readPreviousWave(serverId: number): Map<string, { rxBytes: number; txBy
   const rows = db
     .select({
       interfaceName: trafficSamples.interfaceName,
+      peerPublicKey: trafficSamples.peerPublicKey,
       rxBytes: trafficSamples.rxBytes,
       txBytes: trafficSamples.txBytes,
       sampledAt: trafficSamples.sampledAt,
@@ -73,7 +109,7 @@ function readPreviousWave(serverId: number): Map<string, { rxBytes: number; txBy
       eq(trafficSamples.sampledAt, last.sampledAt),
     ))
     .all()
-  return new Map(rows.map((r) => [r.interfaceName, r]))
+  return new Map(rows.map((r) => [`${r.interfaceName}\0${r.peerPublicKey ?? ""}`, r]))
 }
 
 export async function collectTrafficOnce(): Promise<TrafficRunSnapshot> {
@@ -106,6 +142,7 @@ export async function collectTrafficOnce(): Promise<TrafficRunSnapshot> {
       try {
         const client = MikrotikClient.fromServer(srv)
         const ifaces = await client.get<RosIfaceTraffic[]>("/interface")
+        rememberServerIfaces(srv.id, ifaces)
         const prevWave = readPreviousWave(srv.id)
         const nowMs = Date.parse(now)
         let sumRxMbps = 0
@@ -116,14 +153,7 @@ export async function collectTrafficOnce(): Promise<TrafficRunSnapshot> {
           const txBytes = toNum(i["tx-byte"])
           const running = (i.running ?? "false") === "true"
           const disabled = (i.disabled ?? "false") === "true"
-          const prev = prevWave.get(interfaceName)
-          const prevMs = prev ? Date.parse(prev.sampledAt) : NaN
-          const rxBps = prev && Number.isFinite(prevMs)
-            ? (rateBpsFromDelta(prev.rxBytes, rxBytes, prevMs, nowMs) ?? 0)
-            : 0
-          const txBps = prev && Number.isFinite(prevMs)
-            ? (rateBpsFromDelta(prev.txBytes, txBytes, prevMs, nowMs) ?? 0)
-            : 0
+          const { rxBps, txBps } = sampleRate(prevWave, waveKey(interfaceName), rxBytes, txBytes, nowMs)
           if (shouldIncludeIface(interfaceName, running, disabled)) {
             sumRxMbps += bpsToMbps(rxBps)
             sumTxMbps += bpsToMbps(txBps)
@@ -131,6 +161,7 @@ export async function collectTrafficOnce(): Promise<TrafficRunSnapshot> {
           return {
             serverId: srv.id,
             interfaceName,
+            peerPublicKey: "",
             sampledAt: now,
             rxBytes,
             txBytes,
@@ -140,6 +171,39 @@ export async function collectTrafficOnce(): Promise<TrafficRunSnapshot> {
             disabled,
           }
         })
+        try {
+          const peers = await client.get<RosWgPeerTraffic[]>("/interface/wireguard/peers")
+          for (const p of peers) {
+            const interfaceName = (p.interface ?? "").trim()
+            const peerPublicKey = (p["public-key"] ?? "").trim()
+            if (!interfaceName || !peerPublicKey) continue
+            const rxBytes = toNum(p.rx)
+            const txBytes = toNum(p.tx)
+            const disabled = (p.disabled ?? "false") === "true" || p.disabled === "yes"
+            const running = !disabled
+            const { rxBps, txBps } = sampleRate(
+              prevWave,
+              waveKey(interfaceName, peerPublicKey),
+              rxBytes,
+              txBytes,
+              nowMs,
+            )
+            rows.push({
+              serverId: srv.id,
+              interfaceName,
+              peerPublicKey,
+              sampledAt: now,
+              rxBytes,
+              txBytes,
+              rxBps,
+              txBps,
+              running,
+              disabled,
+            })
+          }
+        } catch {
+          /* WG peers optional — iface samples already recorded */
+        }
         if (rows.length > 0) {
           db.insert(trafficSamples).values(rows).run()
         }

backend/src/services/traffic-flow-analytics.test.ts

@@ -0,0 +1,168 @@
+import assert from "node:assert/strict"
+import { rememberServerIfaces, resetIfaceCacheForTests } from "./traffic-flow-ifindex.js"
+import {
+  ingestParsedFlowsForServerForTests,
+  resetFlowRingsForTests,
+} from "./traffic-flow-ingest.js"
+import { buildFlowAnalytics } from "./traffic-flow-analytics.js"
+import { disableCatalogFetchForTests, resetFlowCatalogForTests, seedFlowCatalogForTests } from "./traffic-flow-classify.js"
+import {
+  disableRipeEnqueueForTests,
+  disableRipePersistForTests,
+  resetRipeCacheForTests,
+  seedRipeCacheForTests,
+} from "./traffic-flow-ripe.js"
+
+disableCatalogFetchForTests()
+resetFlowCatalogForTests()
+disableRipePersistForTests()
+resetRipeCacheForTests()
+disableRipeEnqueueForTests()
+resetIfaceCacheForTests()
+resetFlowRingsForTests()
+rememberServerIfaces(7, [
+  { ".id": "*2", name: "ether1" },
+  { ".id": "*A", name: "wg-flow" },
+])
+
+ingestParsedFlowsForServerForTests(7, [
+  {
+    src: "10.1.1.8",
+    dst: "8.8.8.8",
+    proto: 6,
+    srcPort: 51234,
+    dstPort: 443,
+    bytes: 12_000,
+    packets: 10,
+    inIface: "2",
+    outIface: "10",
+  },
+  {
+    src: "10.1.1.8",
+    dst: "1.1.1.1",
+    proto: 17,
+    srcPort: 53000,
+    dstPort: 53,
+    bytes: 800,
+    packets: 4,
+    inIface: "2",
+    outIface: "",
+  },
+])
+
+try {
+  const all = buildFlowAnalytics({ minutes: 5, serverId: 7 })
+  assert.equal(all.applications[0]?.label, "HTTPS")
+  assert.ok(all.protocols.some((p) => p.label === "TCP"))
+  assert.equal(all.ifaces[0]?.name, "ether1")
+  assert.notEqual(all.ifaces[0]?.name, "2")
+  const conv = all.conversationsList[0]
+  assert.ok(conv)
+  assert.equal(conv.inIface, "ether1")
+  assert.equal(conv.inIfaceIndex, "2")
+  assert.equal(conv.application, "HTTPS")
+  assert.ok(!/^\d+$/.test(conv.inIface))
+
+  const filtered = buildFlowAnalytics({ minutes: 5, serverId: 7, iface: "ether1" })
+  assert.ok(filtered.bytes >= 12_000)
+  assert.equal(filtered.ifaces[0]?.name, "ether1")
+
+  const miss = buildFlowAnalytics({ minutes: 5, serverId: 7, iface: "wg-flow" })
+  assert.equal(miss.conversations, 0)
+
+  const other = buildFlowAnalytics({ minutes: 5, serverId: 99 })
+  assert.equal(other.conversations, 0)
+} finally {
+  resetFlowRingsForTests()
+  resetIfaceCacheForTests()
+}
+
+resetFlowRingsForTests()
+resetIfaceCacheForTests()
+rememberServerIfaces(7, [
+  { ".id": "*2", name: "ether1" },
+  { ".id": "*A", name: "wg-flow" },
+])
+ingestParsedFlowsForServerForTests(7, [
+  {
+    src: "10.1.1.8",
+    dst: "8.8.8.8",
+    proto: 6,
+    srcPort: 51234,
+    dstPort: 443,
+    bytes: 12_000,
+    packets: 10,
+    inIface: "2",
+    outIface: "10",
+  },
+  {
+    src: "10.1.1.8",
+    dst: "8.8.8.8",
+    proto: 6,
+    srcPort: 51234,
+    dstPort: 443,
+    bytes: 9_000,
+    packets: 9,
+    inIface: "10",
+    outIface: "",
+  },
+])
+try {
+  const summed = buildFlowAnalytics({ minutes: 5, serverId: 7, dedup: false })
+  assert.equal(summed.bytes, 21_000)
+  assert.equal(summed.conversations, 2)
+  const deduped = buildFlowAnalytics({ minutes: 5, serverId: 7, dedup: true })
+  assert.equal(deduped.bytes, 12_000)
+  assert.equal(deduped.conversations, 1)
+  assert.equal(deduped.dedupApplied, true)
+  assert.equal(deduped.interfaces.length, 2)
+} finally {
+  resetFlowRingsForTests()
+  resetIfaceCacheForTests()
+}
+
+resetFlowRingsForTests()
+resetIfaceCacheForTests()
+disableRipeEnqueueForTests()
+seedRipeCacheForTests({
+  prefix: "8.8.8.0/24",
+  asn: 15169,
+  country: "US",
+  lat: 37.4,
+  lng: -122.1,
+  holder: "GOOGLE",
+  ok: true,
+  fetchedAt: Date.now(),
+})
+seedFlowCatalogForTests({
+  cidrs: [{ cidr: "8.8.8.0/24", purpose: "steam-gaming" }],
+})
+rememberServerIfaces(7, [{ ".id": "*2", name: "ether1" }])
+ingestParsedFlowsForServerForTests(7, [
+  {
+    src: "10.1.1.8",
+    dst: "8.8.8.8",
+    proto: 6,
+    srcPort: 51234,
+    dstPort: 443,
+    bytes: 12_000,
+    packets: 10,
+    inIface: "2",
+    outIface: "",
+  },
+])
+try {
+  const geo = buildFlowAnalytics({ minutes: 5, serverId: 7 })
+  assert.equal(geo.categories?.[0]?.label, "Игры")
+  assert.ok(geo.asns?.some((r) => r.label.includes("AS15169")))
+  assert.equal(geo.countries?.[0]?.id, "US")
+  assert.equal(geo.mapEdges?.[0]?.toCountry, "US")
+  assert.equal(geo.conversationsList[0]?.dstCountry, "US")
+} finally {
+  resetFlowRingsForTests()
+  resetIfaceCacheForTests()
+  resetRipeCacheForTests()
+  resetFlowCatalogForTests()
+}
+
+console.log("traffic-flow-analytics.test.ts: ok")

backend/src/services/traffic-flow-analytics.ts

@@ -0,0 +1,406 @@
+import { eq } from "drizzle-orm"
+import { db } from "../db/index.js"
+import { appUsers, servers, userInterfaceBindings } from "../db/schema.js"
+import type {
+  FlowAnalyticsDto,
+  FlowBreakdownRow,
+  FlowClientsDto,
+  FlowEntityCard,
+  FlowExportersDto,
+  FlowMapEdge,
+  FlowTalkerDto,
+} from "@mmapp/contracts/traffic-flow"
+import { protoName } from "./traffic-flow-parse.js"
+import {
+  getFlowListenerState,
+  getRingMbps,
+  listStoredFlowRows,
+  type PendingFlowRow,
+} from "./traffic-flow-ingest.js"
+import { resolveIfaceName } from "./traffic-flow-ifaces.js"
+import { getTrafficFlowSettingsRow, listHostPeers } from "./traffic-flow-settings.js"
+import { applicationName, flowRowMatchesFilter } from "./traffic-flow-apps.js"
+import { dedupFlowRowsMaxBytes, flowTupleKey } from "./traffic-flow-dedup.js"
+import { enqueueRipeMisses, lookupRipeCached } from "./traffic-flow-ripe.js"
+import { classifyFlowDst, refreshFlowCatalogInBackground } from "./traffic-flow-classify.js"
+
+export interface FlowAnalyticsQuery {
+  minutes: number
+  serverId?: number
+  userId?: string
+  iface?: string
+  /** Default true: один 5-tuple = max байт по ifaces. */
+  dedup?: boolean
+}
+
+function bpsToMbps(bps: number): number {
+  return bps / 1_000_000
+}
+
+function topN(map: Map<string, { bytes: number; packets: number }>, windowSec: number, n: number): FlowBreakdownRow[] {
+  const total = [...map.values()].reduce((a, v) => a + v.bytes, 0) || 1
+  return [...map.entries()]
+    .sort((a, b) => b[1].bytes - a[1].bytes)
+    .slice(0, n)
+    .map(([id, v]) => ({
+      id,
+      label: id,
+      bytes: v.bytes,
+      packets: v.packets,
+      bps: (v.bytes * 8) / windowSec,
+      percent: (v.bytes / total) * 100,
+    }))
+}
+
+function bump(map: Map<string, { bytes: number; packets: number }>, id: string, bytes: number, packets: number) {
+  const prev = map.get(id) ?? { bytes: 0, packets: 0 }
+  prev.bytes += bytes
+  prev.packets += packets
+  map.set(id, prev)
+}
+
+function userIfaceAllow(userId: string): Map<number, Set<string>> | null {
+  if (!userId) return null
+  const binds = db.select().from(userInterfaceBindings).where(eq(userInterfaceBindings.userId, userId)).all()
+  const allow = new Map<number, Set<string>>()
+  for (const b of binds) {
+    const set = allow.get(b.serverId) ?? new Set<string>()
+    set.add(b.interfaceName)
+    allow.set(b.serverId, set)
+  }
+  return allow
+}
+
+function seriesFromRows(rows: PendingFlowRow[], minutes: number): { rx: number[]; tx: number[] } {
+  const slots = Math.min(60, Math.max(5, minutes))
+  const slotMs = (minutes * 60_000) / slots
+  const start = Date.now() - minutes * 60_000
+  const rx = Array(slots).fill(0) as number[]
+  const tx = Array(slots).fill(0) as number[]
+  for (const r of rows) {
+    const t = Date.parse(r.bucketAt)
+    if (!Number.isFinite(t)) continue
+    const idx = Math.min(slots - 1, Math.max(0, Math.floor((t - start) / slotMs)))
+    rx[idx] += r.bytes
+  }
+  const slotSec = Math.max(1, slotMs / 1000)
+  return {
+    rx: rx.map((b) => bpsToMbps((b * 8) / slotSec)),
+    tx,
+  }
+}
+
+function snapshotStatus(serverId: number): FlowEntityCard["status"] {
+  void serverId
+  return "online"
+}
+
+function topLabel(map: Map<string, { bytes: number; packets: number }>, fallback = "—"): string {
+  let best = fallback
+  let bestBytes = 0
+  for (const [label, v] of map) {
+    if (v.bytes > bestBytes) {
+      bestBytes = v.bytes
+      best = label
+    }
+  }
+  return best
+}
+
+export function buildFlowAnalytics(q: FlowAnalyticsQuery): FlowAnalyticsDto {
+  const settings = getTrafficFlowSettingsRow()
+  const top = Math.min(50, Math.max(10, settings.topN))
+  const windowSec = Math.max(60, q.minutes * 60)
+  const sinceIso = new Date(Date.now() - q.minutes * 60_000).toISOString()
+  const raw = listStoredFlowRows(sinceIso)
+  const allow = q.userId ? userIfaceAllow(q.userId) : null
+  const serverRows = db.select().from(servers).all()
+  const nameById = new Map(serverRows.map((s) => [s.id, s.name || s.host]))
+  const countryById = new Map(serverRows.map((s) => [s.id, (s.country || "").toUpperCase() || "UN"]))
+  const ifaceFilter = q.iface && q.iface !== "__all__" ? q.iface : ""
+  const wantDedup = q.dedup !== false && !ifaceFilter
+
+  refreshFlowCatalogInBackground()
+
+  const applications = new Map<string, { bytes: number; packets: number }>()
+  const protocols = new Map<string, { bytes: number; packets: number }>()
+  const sources = new Map<string, { bytes: number; packets: number }>()
+  const destinations = new Map<string, { bytes: number; packets: number }>()
+  const ifacesMap = new Map<string, { bytes: number; packets: number; index: string }>()
+  const asns = new Map<string, { bytes: number; packets: number }>()
+  const countries = new Map<string, { bytes: number; packets: number }>()
+  const categories = new Map<string, { bytes: number; packets: number }>()
+  const services = new Map<string, { bytes: number; packets: number }>()
+  const conv = new Map<string, FlowTalkerDto & { rawBytes: number }>()
+  const edgeAcc = new Map<string, FlowMapEdge & { catBytes: Map<string, number> }>()
+  const srcs = new Set<string>()
+  const dsts = new Set<string>()
+  const matched: PendingFlowRow[] = []
+
+  for (const r of raw) {
+    const resolved = resolveIfaceName(r.serverId, r.inIface)
+    if (!flowRowMatchesFilter(r, resolved.name, q, allow)) continue
+    matched.push(r)
+
+    const ifaceKey = resolved.name
+    const prevIf = ifacesMap.get(ifaceKey) ?? { bytes: 0, packets: 0, index: resolved.index }
+    prevIf.bytes += r.bytes
+    prevIf.packets += r.packets
+    ifacesMap.set(ifaceKey, prevIf)
+  }
+
+  const working = wantDedup ? dedupFlowRowsMaxBytes(matched) : matched
+  const conversationsRaw = new Set(matched.map((r) => `${flowTupleKey(r)}|${r.inIface}`)).size
+
+  let totalBytes = 0
+  let totalPackets = 0
+  for (const r of working) {
+    const resolved = resolveIfaceName(r.serverId, r.inIface)
+    totalBytes += r.bytes
+    totalPackets += r.packets
+    srcs.add(r.src)
+    dsts.add(r.dst)
+    const app = applicationName(r.proto, r.dstPort, r.srcPort)
+    const ripe = lookupRipeCached(r.dst)
+    const classified = classifyFlowDst(r.dst, r.proto, r.dstPort, r.srcPort, ripe)
+    bump(applications, app, r.bytes, r.packets)
+    bump(protocols, protoName(r.proto), r.bytes, r.packets)
+    bump(sources, r.src, r.bytes, r.packets)
+    bump(destinations, r.dst, r.bytes, r.packets)
+    bump(categories, classified.category, r.bytes, r.packets)
+    bump(services, classified.service, r.bytes, r.packets)
+    if (ripe?.ok && ripe.asn) {
+      const asnLabel = ripe.holder ? `AS${ripe.asn} ${ripe.holder}` : `AS${ripe.asn}`
+      bump(asns, asnLabel, r.bytes, r.packets)
+    }
+    if (ripe?.ok && ripe.country && ripe.country !== "—") {
+      bump(countries, ripe.country, r.bytes, r.packets)
+    }
+
+    const ckey = wantDedup
+      ? flowTupleKey(r)
+      : `${flowTupleKey(r)}|${r.inIface}`
+    const prev = conv.get(ckey)
+    if (prev) {
+      prev.rawBytes += r.bytes
+      prev.bytes += r.bytes
+      prev.packets += r.packets
+    } else {
+      conv.set(ckey, {
+        serverId: String(r.serverId),
+        serverName: nameById.get(r.serverId) ?? String(r.serverId),
+        src: r.src,
+        dst: r.dst,
+        proto: r.proto,
+        protoName: protoName(r.proto),
+        srcPort: r.srcPort,
+        dstPort: r.dstPort,
+        bytes: r.bytes,
+        packets: r.packets,
+        bps: 0,
+        inIface: resolved.name,
+        inIfaceIndex: resolved.index,
+        application: app,
+        category: classified.category,
+        service: classified.service,
+        dstCountry: ripe?.country && ripe.country !== "—" ? ripe.country : undefined,
+        dstAsn: ripe?.asn || undefined,
+        rawBytes: r.bytes,
+      })
+    }
+
+    const toCountry = ripe?.ok && ripe.country && ripe.country !== "—" ? ripe.country : ""
+    if (toCountry) {
+      const fromCountry = countryById.get(r.serverId) || "UN"
+      const ekey = `${r.serverId}|${toCountry}`
+      let edge = edgeAcc.get(ekey)
+      if (!edge) {
+        edge = {
+          fromId: String(r.serverId),
+          fromLabel: nameById.get(r.serverId) ?? String(r.serverId),
+          fromCountry,
+          toCountry,
+          toAsn: ripe?.asn ?? 0,
+          category: classified.category,
+          bytes: 0,
+          bps: 0,
+          catBytes: new Map(),
+        }
+        edgeAcc.set(ekey, edge)
+      }
+      edge.bytes += r.bytes
+      if (ripe?.asn) edge.toAsn = ripe.asn
+      edge.catBytes.set(classified.category, (edge.catBytes.get(classified.category) ?? 0) + r.bytes)
+    }
+  }
+
+  enqueueRipeMisses(dsts)
+
+  const conversationsList = [...conv.values()]
+    .map((t) => ({ ...t, bps: (t.rawBytes * 8) / windowSec }))
+    .sort((a, b) => b.bytes - a.bytes)
+    .slice(0, top)
+    .map(({ rawBytes: _raw, ...rest }) => rest)
+
+  const topProto = topLabel(protocols)
+  const topCategory = topLabel(categories)
+
+  const ringServer = q.serverId ?? (matched[0]?.serverId ?? 0)
+  const ring = ringServer
+    ? getRingMbps(ringServer, ifaceFilter === "" ? "__all__" : (ifacesMap.get(ifaceFilter)?.index || ifaceFilter))
+    : { rx: Array(60).fill(0) as number[], tx: Array(60).fill(0) as number[], rxNow: 0, txNow: 0 }
+
+  const fromBuckets = seriesFromRows(matched, q.minutes)
+  const rxSeries = q.minutes <= 15 ? ring.rx : fromBuckets.rx
+  const txSeries = q.minutes <= 15 ? ring.tx : fromBuckets.tx
+
+  const ifaceRows = [...ifacesMap.entries()]
+    .sort((a, b) => b[1].bytes - a[1].bytes)
+    .map(([name, v]) => ({
+      name,
+      index: v.index,
+      bps: (v.bytes * 8) / windowSec,
+    }))
+
+  const ifaceRawBytes = [...ifacesMap.values()].reduce((a, v) => a + v.bytes, 0) || 1
+  const listener = getFlowListenerState()
+  const mapEdges: FlowMapEdge[] = [...edgeAcc.values()]
+    .map((e) => {
+      let cat = e.category
+      let catBest = 0
+      for (const [label, bytes] of e.catBytes) {
+        if (bytes > catBest) {
+          catBest = bytes
+          cat = label
+        }
+      }
+      return {
+        fromId: e.fromId,
+        fromLabel: e.fromLabel,
+        fromCountry: e.fromCountry,
+        toCountry: e.toCountry,
+        toAsn: e.toAsn,
+        category: cat,
+        bytes: e.bytes,
+        bps: (e.bytes * 8) / windowSec,
+      }
+    })
+    .sort((a, b) => b.bytes - a.bytes)
+    .slice(0, top)
+
+  return {
+    bpsNow: (ring.rxNow + ring.txNow) * 1_000_000 || (totalBytes * 8) / windowSec,
+    bytes: totalBytes,
+    packets: totalPackets,
+    conversations: conv.size,
+    conversationsRaw,
+    uniqueSrc: srcs.size,
+    uniqueDst: dsts.size,
+    topProto,
+    topCategory,
+    rxSeries,
+    txSeries,
+    applications: topN(applications, windowSec, top),
+    protocols: topN(protocols, windowSec, top),
+    sources: topN(sources, windowSec, top),
+    destinations: topN(destinations, windowSec, top),
+    interfaces: [...ifacesMap.entries()].map(([label, v]) => ({
+      id: label,
+      label,
+      bytes: v.bytes,
+      packets: v.packets,
+      bps: (v.bytes * 8) / windowSec,
+      percent: (v.bytes / ifaceRawBytes) * 100,
+    })).sort((a, b) => b.bytes - a.bytes),
+    asns: topN(asns, windowSec, top),
+    countries: topN(countries, windowSec, top),
+    categories: topN(categories, windowSec, top),
+    services: topN(services, windowSec, top),
+    mapEdges,
+    conversationsList,
+    ifaces: ifaceRows,
+    live: listener.bound,
+    dedupApplied: wantDedup,
+  }
+}
+
+function cardFromServer(
+  s: typeof servers.$inferSelect,
+  minutes: number,
+): FlowEntityCard {
+  const analytics = buildFlowAnalytics({ minutes, serverId: s.id })
+  const ring = getRingMbps(s.id, "__all__")
+  return {
+    id: String(s.id),
+    name: s.name || s.host,
+    subtitle: s.host,
+    site: s.site || "—",
+    country: s.country || "UN",
+    status: snapshotStatus(s.id),
+    rxNow: ring.rxNow || bpsToMbps(analytics.bpsNow),
+    txNow: ring.txNow,
+    sessions: analytics.conversations,
+    rxSeries: ring.rx.some((v) => v > 0) ? ring.rx : analytics.rxSeries,
+    txSeries: ring.tx,
+    bytes: analytics.bytes,
+  }
+}
+
+export function listFlowExporters(minutes: number): FlowExportersDto {
+  const settings = getTrafficFlowSettingsRow()
+  const sinceIso = new Date(Date.now() - minutes * 60_000).toISOString()
+  const rows = listStoredFlowRows(sinceIso)
+  const ids = new Set<number>()
+  for (const r of rows) ids.add(r.serverId)
+  for (const p of listHostPeers()) ids.add(p.serverId)
+  const serverRows = db.select().from(servers).all()
+  const exporters = serverRows
+    .filter((s) => ids.has(s.id))
+    .map((s) => cardFromServer(s, minutes))
+    .sort((a, b) => b.rxNow - a.rxNow)
+  const listener = getFlowListenerState()
+  return {
+    exporters,
+    lastExporterIp: settings.lastExporterIp ?? null,
+    lastError: settings.lastError || null,
+    packetsReceived: settings.packetsReceived,
+    lastDatagramAt: settings.lastDatagramAt ?? null,
+    listenerBound: listener.bound,
+    listenerAddress: listener.address,
+  }
+}
+
+export function listFlowClients(minutes: number): FlowClientsDto {
+  const users = db.select().from(appUsers).all()
+  const binds = db.select().from(userInterfaceBindings).all()
+  const byUser = new Map<string, typeof binds>()
+  for (const b of binds) {
+    const list = byUser.get(b.userId) ?? []
+    list.push(b)
+    byUser.set(b.userId, list)
+  }
+  const clients: FlowEntityCard[] = []
+  for (const u of users) {
+    const userBinds = byUser.get(u.id) ?? []
+    if (userBinds.length === 0) continue
+    const analytics = buildFlowAnalytics({ minutes, userId: u.id })
+    const firstServer = userBinds[0]?.serverId
+    const ring = firstServer ? getRingMbps(firstServer, "__all__") : { rx: Array(60).fill(0) as number[], tx: Array(60).fill(0) as number[], rxNow: 0, txNow: 0 }
+    clients.push({
+      id: u.id,
+      name: u.login,
+      subtitle: u.name || u.login,
+      site: `${userBinds.length} ifaces`,
+      country: "UN",
+      status: u.active ? "online" : "offline",
+      rxNow: bpsToMbps(analytics.bpsNow) || ring.rxNow,
+      txNow: ring.txNow,
+      sessions: analytics.conversations,
+      rxSeries: analytics.rxSeries,
+      txSeries: analytics.txSeries,
+      bytes: analytics.bytes,
+    })
+  }
+  clients.sort((a, b) => b.rxNow - a.rxNow)
+  return { clients }
+}

backend/src/services/traffic-flow-apps.ts

@@ -0,0 +1,79 @@
+import { protoName } from "./traffic-flow-parse.js"
+
+const WELL_KNOWN: Record<string, string> = {
+  "6:80": "HTTP",
+  "6:443": "HTTPS",
+  "6:8080": "HTTP-alt",
+  "6:8443": "HTTPS-alt",
+  "6:22": "SSH",
+  "6:21": "FTP",
+  "6:25": "SMTP",
+  "6:110": "POP3",
+  "6:143": "IMAP",
+  "6:993": "IMAPS",
+  "6:995": "POP3S",
+  "6:587": "SMTP",
+  "6:465": "SMTPS",
+  "6:3306": "MySQL",
+  "6:5432": "PostgreSQL",
+  "6:6379": "Redis",
+  "6:3389": "RDP",
+  "6:445": "SMB",
+  "6:139": "NetBIOS",
+  "6:179": "BGP",
+  "6:8291": "WinBox",
+  "6:8728": "ROS-API",
+  "6:8729": "ROS-API-SSL",
+  "17:53": "DNS",
+  "6:53": "DNS",
+  "17:123": "NTP",
+  "17:161": "SNMP",
+  "17:162": "SNMP-trap",
+  "17:500": "IKE",
+  "17:4500": "NAT-T",
+  "17:1194": "OpenVPN",
+  "17:51820": "WireGuard",
+  "17:4789": "VXLAN",
+  "17:4739": "IPFIX",
+  "17:2055": "NetFlow",
+  "17:67": "DHCP",
+  "17:68": "DHCP",
+  "17:69": "TFTP",
+  "17:1812": "RADIUS",
+  "1:0": "ICMP",
+  "47:0": "GRE",
+  "50:0": "ESP",
+  "89:0": "OSPF",
+}
+
+export function applicationName(proto: number, dstPort: number, srcPort = 0): string {
+  if (proto === 1) return "ICMP"
+  if (proto === 47) return "GRE"
+  if (proto === 50) return "ESP"
+  if (proto === 89) return "OSPF"
+  const dstKey = `${proto}:${dstPort}`
+  const srcKey = `${proto}:${srcPort}`
+  return WELL_KNOWN[dstKey] ?? WELL_KNOWN[srcKey] ?? `${protoName(proto)}/${dstPort || srcPort || "—"}`
+}
+
+export interface FlowMatchQuery {
+  serverId?: number
+  userId?: string
+  iface?: string
+}
+
+export function flowRowMatchesFilter(
+  row: { serverId: number; inIface: string },
+  resolvedName: string,
+  q: FlowMatchQuery,
+  allow: Map<number, Set<string>> | null,
+): boolean {
+  if (q.serverId != null && row.serverId !== q.serverId) return false
+  if (allow) {
+    const names = allow.get(row.serverId)
+    if (!names || !names.has(resolvedName)) return false
+  }
+  const iface = q.iface && q.iface !== "__all__" ? q.iface : ""
+  if (iface && resolvedName !== iface && row.inIface !== iface) return false
+  return true
+}

backend/src/services/traffic-flow-classify.test.ts

@@ -0,0 +1,20 @@
+import assert from "node:assert/strict"
+import { classifyFlowDst, disableCatalogFetchForTests, resetFlowCatalogForTests, seedFlowCatalogForTests } from "./traffic-flow-classify.js"
+
+disableCatalogFetchForTests()
+resetFlowCatalogForTests()
+seedFlowCatalogForTests({
+  cidrs: [{ cidr: "192.0.2.0/24", purpose: "steam-gaming" }],
+})
+
+const hit = classifyFlowDst("192.0.2.10", 6, 443, 50000, null)
+assert.equal(hit.category, "Игры")
+assert.equal(hit.service, "steam-gaming")
+
+const miss = classifyFlowDst("203.0.113.9", 17, 53, 53000, null)
+assert.equal(miss.category, "DNS")
+
+const cdn = classifyFlowDst("203.0.113.9", 6, 443, 1, { prefix: "203.0.113.0/24", asn: 13335, country: "US", lat: null, lng: null, holder: "CLOUDFLARENET", ok: true, fetchedAt: Date.now() })
+assert.equal(cdn.category, "CDN")
+
+console.log("traffic-flow-classify.test.ts: ok")

backend/src/services/traffic-flow-classify.ts

@@ -0,0 +1,140 @@
+import { db } from "../db/index.js"
+import { evobgpSettings } from "../db/schema.js"
+import { ipInCidrV4, parseCidrV4 } from "./traffic-flow-ip.js"
+import type { FlowIpMeta } from "./traffic-flow-ripe.js"
+import { applicationName } from "./traffic-flow-apps.js"
+
+export interface FlowClassification {
+  service: string
+  category: string
+}
+
+interface CatalogCidr {
+  cidr: string
+  purpose: string
+  prefixLen: number
+}
+
+const CATALOG_TTL_MS = 10 * 60_000
+let cidrs: CatalogCidr[] = []
+let asnPurpose = new Map<number, string>()
+let fetchedAt = 0
+let catalogFetchEnabled = true
+let inflight: Promise<void> | null = null
+
+export function disableCatalogFetchForTests(): void {
+  catalogFetchEnabled = false
+}
+
+export function resetFlowCatalogForTests(): void {
+  cidrs = []
+  asnPurpose = new Map()
+  fetchedAt = 0
+  inflight = null
+}
+
+export function seedFlowCatalogForTests(input: {
+  cidrs?: Array<{ cidr: string; purpose: string }>
+  asns?: Array<{ asn: number; purpose: string }>
+}): void {
+  cidrs = (input.cidrs ?? [])
+    .map((c) => ({ cidr: c.cidr, purpose: c.purpose, prefixLen: parseCidrV4(c.cidr)?.prefixLen ?? 0 }))
+    .sort((a, b) => b.prefixLen - a.prefixLen)
+  asnPurpose = new Map((input.asns ?? []).map((a) => [a.asn, a.purpose]))
+  fetchedAt = Date.now()
+}
+
+export function categoryFromPurpose(purpose: string, proto: number, dstPort: number, srcPort: number): string {
+  const p = purpose.toLowerCase()
+  if (/gaming|steam|epic|riot/.test(p)) return "Игры"
+  if (/streaming|youtube|netflix|twitch|video/.test(p)) return "Видео / стриминг"
+  if (/cdn|cloudflare|akamai|fastly/.test(p)) return "CDN"
+  if (/voip|discord|zoom/.test(p)) return "Голос"
+  const app = applicationName(proto, dstPort, srcPort)
+  if (app === "DNS" || app === "SSH" || app === "BGP") return app
+  return "Проче"
+}
+
+function matchCidr(ip: string): CatalogCidr | null {
+  for (const row of cidrs) {
+    if (ipInCidrV4(ip, row.cidr)) return row
+  }
+  return null
+}
+
+export function classifyFlowDst(
+  dst: string,
+  proto: number,
+  dstPort: number,
+  srcPort: number,
+  ripe: FlowIpMeta | null,
+): FlowClassification {
+  const hit = matchCidr(dst)
+  const asnName = ripe?.asn ? asnPurpose.get(ripe.asn) : undefined
+  const purpose = hit?.purpose || asnName || ripe?.holder || ""
+  const service = (hit?.purpose || asnName || ripe?.holder || "Проче").trim() || "Проче"
+  return {
+    service,
+    category: categoryFromPurpose(purpose, proto, dstPort, srcPort),
+  }
+}
+
+async function fetchCatalog(): Promise<void> {
+  if (!catalogFetchEnabled) return
+  if (Date.now() - fetchedAt < CATALOG_TTL_MS) return
+  if (inflight) return inflight
+  inflight = (async () => {
+    try {
+      const row = db.select().from(evobgpSettings).limit(1).all()[0]
+      if (!row?.enabled) return
+      const root = String(row.baseUrl ?? "").replace(/\/+$/, "")
+      const token = String(row.apiKey ?? "").replace(/^Bearer\s+/i, "").trim()
+      if (!root || !token) return
+      const ac = new AbortController()
+      const t = setTimeout(() => ac.abort(), 20_000)
+      try {
+        const res = await fetch(`${root}/v1/router-lists/catalog`, {
+          headers: { Authorization: `Bearer ${token}`, Accept: "application/json" },
+          signal: ac.signal,
+        })
+        if (!res.ok) return
+        const catalog = await res.json() as {
+          modules?: { items?: Array<{ id: string; name: string }> }
+          ip_ranges?: { items?: Array<{ module_id: string; entry: { prefix: string } }> }
+          asns?: { items?: Array<{ module_id: string; entry: { asn: number } }> }
+        }
+        const mods = new Map((catalog.modules?.items ?? []).map((m) => [m.id, m.name]))
+        const next: CatalogCidr[] = []
+        for (const item of catalog.ip_ranges?.items ?? []) {
+          const prefix = String(item.entry?.prefix ?? "").trim()
+          const purpose = mods.get(item.module_id) ?? ""
+          const parsed = parseCidrV4(prefix)
+          if (!prefix || !parsed) continue
+          next.push({ cidr: prefix, purpose, prefixLen: parsed.prefixLen })
+        }
+        next.sort((a, b) => b.prefixLen - a.prefixLen)
+        const nextAsn = new Map<number, string>()
+        for (const item of catalog.asns?.items ?? []) {
+          const purpose = mods.get(item.module_id)
+          const asn = Number(item.entry?.asn)
+          if (purpose && Number.isFinite(asn) && asn > 0) nextAsn.set(asn, purpose)
+        }
+        cidrs = next
+        asnPurpose = nextAsn
+        fetchedAt = Date.now()
+      } finally {
+        clearTimeout(t)
+      }
+    } catch {
+      /* catalog optional */
+    } finally {
+      inflight = null
+    }
+  })()
+  return inflight
+}
+
+/** Background refresh — analytics never awaits the HTTP. */
+export function refreshFlowCatalogInBackground(): void {
+  void fetchCatalog()
+}

backend/src/services/traffic-flow-dedup.test.ts

@@ -0,0 +1,25 @@
+import assert from "node:assert/strict"
+import { dedupFlowRowsMaxBytes, flowTupleKey } from "./traffic-flow-dedup.js"
+
+const a = {
+  serverId: 7,
+  src: "10.1.1.8",
+  dst: "8.8.8.8",
+  proto: 6,
+  srcPort: 1,
+  dstPort: 443,
+  inIface: "2",
+  bytes: 12_000,
+  packets: 10,
+}
+const b = { ...a, inIface: "10", bytes: 8_000, packets: 8 }
+const out = dedupFlowRowsMaxBytes([a, b])
+assert.equal(out.length, 1)
+assert.equal(out[0]?.bytes, 12_000)
+assert.equal(out[0]?.inIface, "2")
+assert.equal(flowTupleKey(a), flowTupleKey(b))
+
+const sameIface = dedupFlowRowsMaxBytes([a, { ...a, bytes: 3_000, packets: 2 }])
+assert.equal(sameIface[0]?.bytes, 15_000)
+
+console.log("traffic-flow-dedup.test.ts: ok")

backend/src/services/traffic-flow-dedup.ts

@@ -0,0 +1,44 @@
+export interface FlowTupleRow {
+  serverId: number
+  src: string
+  dst: string
+  proto: number
+  srcPort: number
+  dstPort: number
+  inIface: string
+  bytes: number
+  packets: number
+}
+
+export function flowTupleKey(r: Pick<FlowTupleRow, "serverId" | "src" | "dst" | "proto" | "srcPort" | "dstPort">): string {
+  return `${r.serverId}|${r.src}|${r.dst}|${r.proto}|${r.srcPort}|${r.dstPort}`
+}
+
+function ifaceKey(r: FlowTupleRow): string {
+  return `${flowTupleKey(r)}|${r.inIface}`
+}
+
+/**
+ * Один 5-tuple на двух ifIndex — это один поток: сначала сумма по бакетам/iface,
+ * затем max байт между интерфейсами (не sum).
+ */
+export function dedupFlowRowsMaxBytes<T extends FlowTupleRow>(rows: T[]): T[] {
+  const byIface = new Map<string, T>()
+  for (const row of rows) {
+    const key = ifaceKey(row)
+    const prev = byIface.get(key)
+    if (!prev) {
+      byIface.set(key, { ...row })
+      continue
+    }
+    prev.bytes += row.bytes
+    prev.packets += row.packets
+  }
+  const byTuple = new Map<string, T>()
+  for (const row of byIface.values()) {
+    const key = flowTupleKey(row)
+    const prev = byTuple.get(key)
+    if (!prev || row.bytes > prev.bytes) byTuple.set(key, row)
+  }
+  return [...byTuple.values()]
+}

backend/src/services/traffic-flow-host-files.ts

@@ -0,0 +1,113 @@
+import { generateNativeConf } from "./wireguard-config.js"
+import { getTrafficFlowSettingsRow, listHostPeers } from "./traffic-flow-settings.js"
+import type { TrafficFlowHostFile } from "@mmapp/contracts/traffic-flow"
+
+const COMPOSE_DIR = "/opt/cdn-mm"
+
+export function buildHostWgQuickConf(): string {
+  const row = getTrafficFlowSettingsRow()
+  const peers = listHostPeers()
+  return generateNativeConf({
+    name: "wg-flow",
+    mtu: 1420,
+    privateKey: row.hostPrivateKey || undefined,
+    address: `${row.collectorIp}/24`,
+    comment: "MikrotikManager traffic-flow collector",
+    peers: peers.map((p) => ({
+      publicKey: p.publicKey,
+      allowedIps: p.allowedIps,
+      comment: p.name,
+      endpoint: p.endpoint,
+      persistentKeepalive: p.endpoint ? 25 : undefined,
+    })),
+  })
+}
+
+export function buildHostComposeOverride(): string {
+  const row = getTrafficFlowSettingsRow()
+  return [
+    "# Docker Compose merge для /opt/cdn-mm",
+    "# Не править docker-compose.yml. Traefik не трогать.",
+    "# Сначала: wg-quick up wg-flow  (адрес " + row.collectorIp + ")",
+    "# затем: docker compose up -d --force-recreate backend",
+    "# Docker userland-proxy может SNAT UDP source в 172.x — ingest сопоставит единственный JH.",
+    "",
+    "services:",
+    "  backend:",
+    "    environment:",
+    "      FLOW_LISTEN_HOST: \"0.0.0.0\"",
+    "    ports:",
+    `      - "${row.collectorIp}:${row.flowListenPort}:${row.flowListenPort}/udp"`,
+    "",
+  ].join("\n")
+}
+
+export function buildHostLinuxInstallSh(): string {
+  const row = getTrafficFlowSettingsRow()
+  const conf = buildHostWgQuickConf().replace(/\s+$/, "") + "\n"
+  const override = buildHostComposeOverride()
+  const collector = row.collectorIp
+  const flowPort = row.flowListenPort
+
+  return `#!/usr/bin/env bash
+# WG-клиент на хосте /opt/cdn-mm → JH:13232, IPFIX в контейнер backend.
+# Запуск: sudo bash install-wg-flow.sh
+set -euo pipefail
+
+if [[ \${EUID:-$(id -u)} -ne 0 ]]; then
+  echo "Запустите от root: sudo bash $0" >&2
+  exit 1
+fi
+
+COLLECTOR_IP="${collector}"
+FLOW_PORT="${flowPort}"
+COMPOSE_DIR="${COMPOSE_DIR}"
+
+if ! command -v wg >/dev/null 2>&1; then
+  apt-get update
+  DEBIAN_FRONTEND=noninteractive apt-get install -y wireguard
+fi
+
+install -d -m 700 /etc/wireguard
+cat > /etc/wireguard/wg-flow.conf <<'WGEOF'
+${conf}WGEOF
+chmod 600 /etc/wireguard/wg-flow.conf
+
+systemctl enable --now wg-quick@wg-flow
+echo "=== wg show wg-flow ==="
+wg show wg-flow
+echo "=== адрес (ожидаем \${COLLECTOR_IP}/24) ==="
+ip -4 addr show dev wg-flow
+
+if [[ ! -d "\$COMPOSE_DIR" ]]; then
+  echo "Нет \$COMPOSE_DIR — положите override.yml туда вручную (вкладка compose)." >&2
+  exit 1
+fi
+
+cat > "\$COMPOSE_DIR/docker-compose.override.yml" <<'OVEOF'
+${override}OVEOF
+
+cd "\$COMPOSE_DIR"
+docker compose up -d --force-recreate backend
+
+echo "=== UDP \${FLOW_PORT} на хосте (ожидаем \${COLLECTOR_IP}:\${FLOW_PORT} docker-proxy) ==="
+ss -ulnp | grep -E "\${FLOW_PORT}" || true
+echo "=== PortBindings mmapp-backend ==="
+docker inspect -f '{{json .HostConfig.PortBindings}}' mmapp-backend
+echo "=== handshake (keepalive 25s к JH:13232) ==="
+wg show wg-flow
+
+# nft на хосте MM не трогаем. Bind только на COLLECTOR_IP, не 0.0.0.0.
+# Если backend стартовал до wg-flow: docker compose up -d --force-recreate backend
+
+echo "Готово. Traefik не трогали. UDP \${FLOW_PORT} только на \${COLLECTOR_IP}, не на 0.0.0.0."
+`
+}
+
+export function listTrafficFlowHostFiles(): TrafficFlowHostFile[] {
+  return [
+    { id: "linux", label: "Linux", filename: "install-wg-flow.sh", code: buildHostLinuxInstallSh() },
+    { id: "wg-quick", label: "wg-flow.conf", filename: "wg-flow.conf", code: buildHostWgQuickConf() },
+    { id: "compose", label: "compose", filename: "docker-compose.override.yml", code: buildHostComposeOverride() },
+  ]
+}

backend/src/services/traffic-flow-ifaces.test.ts

@@ -0,0 +1,51 @@
+import assert from "node:assert/strict"
+import {
+  rememberServerIfaces,
+  resetIfaceCacheForTests,
+  resolveIfaceName,
+  rosIdToIfIndex,
+} from "./traffic-flow-ifindex.js"
+import { applicationName, flowRowMatchesFilter } from "./traffic-flow-apps.js"
+
+assert.equal(rosIdToIfIndex("*A"), 10)
+assert.equal(rosIdToIfIndex("*D"), 13)
+assert.equal(rosIdToIfIndex("*2"), 2)
+assert.equal(rosIdToIfIndex("*9"), 9)
+assert.equal(rosIdToIfIndex("0"), 0)
+assert.equal(rosIdToIfIndex(""), null)
+
+resetIfaceCacheForTests()
+rememberServerIfaces(7, [
+  { ".id": "*2", name: "ether1" },
+  { ".id": "*A", name: "wg-flow" },
+  { ".id": "*D", name: "bridge" },
+])
+assert.equal(resolveIfaceName(7, "2").name, "ether1")
+assert.equal(resolveIfaceName(7, "10").name, "wg-flow")
+assert.equal(resolveIfaceName(7, "13").name, "bridge")
+assert.equal(resolveIfaceName(7, "0").name, "—")
+assert.equal(resolveIfaceName(7, "ether1").name, "ether1")
+assert.equal(resolveIfaceName(7, "99").name, "#99")
+
+resetIfaceCacheForTests()
+rememberServerIfaces(8, [
+  { ifindex: "10", ".id": "*12", name: "gre1" },
+])
+assert.equal(rosIdToIfIndex("*12"), 18)
+assert.equal(resolveIfaceName(8, "10").name, "gre1")
+assert.equal(resolveIfaceName(8, "18").name, "gre1")
+
+assert.equal(applicationName(6, 443), "HTTPS")
+assert.equal(applicationName(17, 53), "DNS")
+assert.equal(applicationName(6, 22), "SSH")
+assert.equal(applicationName(17, 51820), "WireGuard")
+assert.equal(applicationName(6, 179), "BGP")
+
+const allow = new Map<number, Set<string>>([[7, new Set(["ether1", "wg-flow"])]])
+assert.equal(flowRowMatchesFilter({ serverId: 7, inIface: "2" }, "ether1", {}, allow), true)
+assert.equal(flowRowMatchesFilter({ serverId: 7, inIface: "2" }, "bridge", {}, allow), false)
+assert.equal(flowRowMatchesFilter({ serverId: 7, inIface: "2" }, "ether1", { iface: "ether1" }, allow), true)
+assert.equal(flowRowMatchesFilter({ serverId: 7, inIface: "2" }, "ether1", { iface: "wg-flow" }, allow), false)
+assert.equal(flowRowMatchesFilter({ serverId: 8, inIface: "2" }, "ether1", { serverId: 7 }, null), false)
+
+console.log("traffic-flow-ifaces.test.ts: ok")

backend/src/services/traffic-flow-ifaces.ts

@@ -0,0 +1,37 @@
+import { eq } from "drizzle-orm"
+import { db } from "../db/index.js"
+import { servers } from "../db/schema.js"
+import { MikrotikClient } from "./mikrotik.js"
+import {
+  ifaceCacheFresh,
+  rememberServerIfaces,
+  type RosIfaceIndexRow,
+} from "./traffic-flow-ifindex.js"
+
+export {
+  ifaceCacheFresh,
+  ifaceCacheHas,
+  rememberServerIfaces,
+  resetIfaceCacheForTests,
+  resolveIfaceName,
+  rosIdToIfIndex,
+} from "./traffic-flow-ifindex.js"
+
+const inflight = new Set<number>()
+
+export async function refreshServerIfaces(serverId: number, force = false): Promise<void> {
+  if (inflight.has(serverId)) return
+  if (!force && ifaceCacheFresh(serverId)) return
+  inflight.add(serverId)
+  try {
+    const row = db.select().from(servers).where(eq(servers.id, serverId)).limit(1).all()[0]
+    if (!row) return
+    const client = MikrotikClient.fromServer(row)
+    const ifaces = await client.get<RosIfaceIndexRow[]>("/interface")
+    rememberServerIfaces(serverId, Array.isArray(ifaces) ? ifaces : [])
+  } catch {
+    /* keep previous cache */
+  } finally {
+    inflight.delete(serverId)
+  }
+}

backend/src/services/traffic-flow-ifindex.ts

@@ -0,0 +1,58 @@
+export interface RosIfaceIndexRow {
+  ".id"?: string
+  name?: string
+  ifindex?: string
+}
+
+const cache = new Map<number, Map<number, string>>()
+const fetchedAt = new Map<number, number>()
+
+export const IFACE_CACHE_TTL_MS = 60_000
+
+/** RouterOS `.id` (`*A`) → SNMP ifIndex (10). */
+export function rosIdToIfIndex(id: string | undefined | null): number | null {
+  if (!id) return null
+  const raw = String(id).trim()
+  const hex = raw.startsWith("*") ? raw.slice(1) : raw
+  if (!hex || !/^[0-9a-fA-F]+$/.test(hex)) return null
+  const n = parseInt(hex, 16)
+  return Number.isFinite(n) ? n : null
+}
+
+export function rememberServerIfaces(serverId: number, rows: RosIfaceIndexRow[]): void {
+  const map = new Map<number, string>()
+  for (const row of rows) {
+    const name = String(row.name ?? "").trim()
+    if (!name) continue
+    const fromProp = Number.parseInt(String(row.ifindex ?? ""), 10)
+    const fromId = rosIdToIfIndex(row[".id"])
+    if (Number.isFinite(fromProp) && fromProp > 0) map.set(fromProp, name)
+    if (fromId != null && fromId > 0) map.set(fromId, name)
+  }
+  cache.set(serverId, map)
+  fetchedAt.set(serverId, Date.now())
+}
+
+export function resolveIfaceName(serverId: number, indexOrName: string): { name: string; index: string } {
+  const trimmed = String(indexOrName ?? "").trim()
+  if (!trimmed || trimmed === "0") return { name: "—", index: trimmed }
+  if (!/^\d+$/.test(trimmed)) return { name: trimmed, index: "" }
+  const idx = Number(trimmed)
+  const name = cache.get(serverId)?.get(idx)
+  if (name) return { name, index: trimmed }
+  return { name: `#${trimmed}`, index: trimmed }
+}
+
+export function ifaceCacheHas(serverId: number): boolean {
+  return cache.has(serverId)
+}
+
+export function ifaceCacheFresh(serverId: number, ttlMs = IFACE_CACHE_TTL_MS): boolean {
+  const prev = fetchedAt.get(serverId) ?? 0
+  return Boolean(prev && Date.now() - prev < ttlMs && cache.has(serverId))
+}
+
+export function resetIfaceCacheForTests(): void {
+  cache.clear()
+  fetchedAt.clear()
+}

backend/src/services/traffic-flow-ingest.ts

@@ -0,0 +1,451 @@
+import { createSocket, type Socket } from "node:dgram"
+import { desc, eq, gte, sql } from "drizzle-orm"
+import { db } from "../db/index.js"
+import { flowBuckets, servers } from "../db/schema.js"
+import type { FlowStatsDto, FlowTalkerDto } from "@mmapp/contracts/traffic-flow"
+import { parseFlowPacket, protoName, type ParsedFlow } from "./traffic-flow-parse.js"
+import { pickServerIdForExporter } from "./traffic-flow-map-exporter.js"
+import {
+  getTrafficFlowSettingsRow,
+  listHostPeers,
+  recordFlowListenerError,
+  recordFlowPacket,
+} from "./traffic-flow-settings.js"
+import { ifaceCacheFresh, refreshServerIfaces, resolveIfaceName } from "./traffic-flow-ifaces.js"
+import { applicationName } from "./traffic-flow-apps.js"
+
+export interface FlowListenerState {
+  bound: boolean
+  address: string | null
+}
+
+export interface PendingFlowRow {
+  serverId: number
+  bucketAt: string
+  src: string
+  dst: string
+  proto: number
+  srcPort: number
+  dstPort: number
+  bytes: number
+  packets: number
+  inIface: string
+  outIface: string
+}
+
+const TICK_MS = 2_000
+const RING_LEN = 60
+
+let socket: Socket | null = null
+let state: FlowListenerState = { bound: false, address: null }
+const pending = new Map<string, {
+  serverId: number
+  bucketAt: string
+  flow: ParsedFlow
+  bytes: number
+  packets: number
+}>()
+let flushTimer: ReturnType<typeof setInterval> | null = null
+
+const tickAccum = new Map<string, { inBytes: number; outBytes: number }>()
+const rings = new Map<string, { inBps: number[]; outBps: number[] }>()
+
+export function getFlowListenerState(): FlowListenerState {
+  return state
+}
+
+function minuteBucketIso(at = Date.now()): string {
+  const d = new Date(at)
+  d.setSeconds(0, 0)
+  return d.toISOString()
+}
+
+function ringKey(serverId: number, iface: string): string {
+  return `${serverId}\0${iface || "__all__"}`
+}
+
+function bumpTick(key: string, inBytes: number, outBytes: number): void {
+  const prev = tickAccum.get(key) ?? { inBytes: 0, outBytes: 0 }
+  prev.inBytes += inBytes
+  prev.outBytes += outBytes
+  tickAccum.set(key, prev)
+}
+
+function addToTick(serverId: number, inIface: string, outIface: string, bytes: number): void {
+  bumpTick(ringKey(serverId, "__all__"), bytes, 0)
+  if (inIface) bumpTick(ringKey(serverId, inIface), bytes, 0)
+  if (outIface && outIface !== inIface) bumpTick(ringKey(serverId, outIface), 0, bytes)
+}
+
+function emptyRing(): { inBps: number[]; outBps: number[] } {
+  return { inBps: Array(RING_LEN).fill(0), outBps: Array(RING_LEN).fill(0) }
+}
+
+export function rollFlowRings(): void {
+  const keys = new Set([...tickAccum.keys(), ...rings.keys()])
+  const sec = TICK_MS / 1000
+  for (const key of keys) {
+    const acc = tickAccum.get(key) ?? { inBytes: 0, outBytes: 0 }
+    tickAccum.delete(key)
+    const inBps = (acc.inBytes * 8) / sec
+    const outBps = (acc.outBytes * 8) / sec
+    let ring = rings.get(key)
+    if (!ring) {
+      ring = emptyRing()
+      rings.set(key, ring)
+    }
+    ring.inBps.push(inBps)
+    ring.inBps.shift()
+    ring.outBps.push(outBps)
+    ring.outBps.shift()
+  }
+}
+
+export function getRingMbps(serverId: number, iface = "__all__"): {
+  rx: number[]
+  tx: number[]
+  rxNow: number
+  txNow: number
+} {
+  const ring = rings.get(ringKey(serverId, iface))
+  const scale = 1_000_000
+  if (!ring) {
+    return { rx: Array(RING_LEN).fill(0), tx: Array(RING_LEN).fill(0), rxNow: 0, txNow: 0 }
+  }
+  return {
+    rx: ring.inBps.map((b) => b / scale),
+    tx: ring.outBps.map((b) => b / scale),
+    rxNow: (ring.inBps[RING_LEN - 1] ?? 0) / scale,
+    txNow: (ring.outBps[RING_LEN - 1] ?? 0) / scale,
+  }
+}
+
+function resolveServerId(exporterIp: string): number | null {
+  const settings = getTrafficFlowSettingsRow()
+  const rows = db.select({
+    id: servers.id,
+    host: servers.host,
+    mgmtTunnelIp: servers.mgmtTunnelIp,
+  }).from(servers).all()
+  const byTunnelIp = new Map<string, number>()
+  const hostIps = new Map<string, number>()
+  for (const row of rows) {
+    if (row.mgmtTunnelIp) byTunnelIp.set(row.mgmtTunnelIp, row.id)
+    if (/^\d{1,3}(?:\.\d{1,3}){3}$/.test(row.host)) hostIps.set(row.host, row.id)
+  }
+  return pickServerIdForExporter({
+    exporterIp,
+    overlayPrefix: settings.prefix,
+    byTunnelIp,
+    peers: listHostPeers(),
+    hostIps,
+  })
+}
+
+function queueFlows(exporterIp: string, flows: ParsedFlow[]): boolean {
+  const serverId = resolveServerId(exporterIp)
+  if (serverId == null) return false
+  const needsRefresh = !ifaceCacheFresh(serverId)
+    || flows.some((f) => resolveIfaceName(serverId, f.inIface).name.startsWith("#"))
+  if (needsRefresh) void refreshServerIfaces(serverId, true)
+  const bucketAt = minuteBucketIso()
+  for (const flow of flows) {
+    addToTick(serverId, flow.inIface, flow.outIface, flow.bytes)
+    const key = `${serverId}\0${bucketAt}\0${flow.src}\0${flow.dst}\0${flow.proto}\0${flow.srcPort}\0${flow.dstPort}\0${flow.inIface}`
+    const prev = pending.get(key)
+    if (prev) {
+      prev.bytes += flow.bytes
+      prev.packets += flow.packets
+    } else {
+      pending.set(key, {
+        serverId,
+        bucketAt,
+        flow: { ...flow },
+        bytes: flow.bytes,
+        packets: flow.packets,
+      })
+    }
+  }
+  return true
+}
+
+export function peekPendingFlows(): PendingFlowRow[] {
+  return [...pending.values()].map((row) => ({
+    serverId: row.serverId,
+    bucketAt: row.bucketAt,
+    src: row.flow.src || "0.0.0.0",
+    dst: row.flow.dst || "0.0.0.0",
+    proto: row.flow.proto,
+    srcPort: row.flow.srcPort,
+    dstPort: row.flow.dstPort,
+    bytes: row.bytes,
+    packets: row.packets,
+    inIface: row.flow.inIface,
+    outIface: row.flow.outIface,
+  }))
+}
+
+function flushPending() {
+  if (pending.size === 0) return
+  const settings = getTrafficFlowSettingsRow()
+  const topN = Math.max(20, settings.topN)
+  const cutoff = new Date(Date.now() - settings.retentionHours * 3600_000).toISOString()
+  const rows = [...pending.values()]
+  pending.clear()
+
+  for (const row of rows) {
+    try {
+      db.insert(flowBuckets).values({
+        serverId: row.serverId,
+        bucketAt: row.bucketAt,
+        src: row.flow.src || "0.0.0.0",
+        dst: row.flow.dst || "0.0.0.0",
+        proto: row.flow.proto,
+        srcPort: row.flow.srcPort,
+        dstPort: row.flow.dstPort,
+        bytes: row.bytes,
+        packets: row.packets,
+        inIface: row.flow.inIface,
+      }).onConflictDoUpdate({
+        target: [
+          flowBuckets.serverId,
+          flowBuckets.bucketAt,
+          flowBuckets.src,
+          flowBuckets.dst,
+          flowBuckets.proto,
+          flowBuckets.srcPort,
+          flowBuckets.dstPort,
+          flowBuckets.inIface,
+        ],
+        set: {
+          bytes: sql`${flowBuckets.bytes} + excluded.bytes`,
+          packets: sql`${flowBuckets.packets} + excluded.packets`,
+        },
+      }).run()
+    } catch {
+      // ignore single-row failures
+    }
+  }
+
+  db.delete(flowBuckets).where(sql`${flowBuckets.bucketAt} < ${cutoff}`).run()
+
+  const latest = db.select({ bucketAt: flowBuckets.bucketAt }).from(flowBuckets)
+    .orderBy(desc(flowBuckets.bucketAt)).limit(1).all()[0]?.bucketAt
+  if (!latest) return
+  const latestRows = db.select().from(flowBuckets).where(eq(flowBuckets.bucketAt, latest)).all()
+  const byServer = new Map<number, typeof latestRows>()
+  for (const r of latestRows) {
+    const list = byServer.get(r.serverId) ?? []
+    list.push(r)
+    byServer.set(r.serverId, list)
+  }
+  for (const list of byServer.values()) {
+    if (list.length <= topN) continue
+    list.sort((a, b) => b.bytes - a.bytes)
+    for (const d of list.slice(topN)) {
+      db.delete(flowBuckets).where(eq(flowBuckets.id, d.id)).run()
+    }
+  }
+}
+
+function onTick() {
+  rollFlowRings()
+  flushPending()
+}
+
+function onMessage(msg: Buffer, rinfo: { address: string }) {
+  try {
+    const flows = parseFlowPacket(msg, rinfo.address)
+    recordFlowPacket(rinfo.address)
+    if (!flows.length) return
+    if (!queueFlows(rinfo.address, flows)) {
+      recordFlowListenerError(
+        `IPFIX от ${rinfo.address}: нет jump-host с адресом wg-flow. Docker SNAT (172.x) при нескольких JH не различим.`,
+      )
+      return
+    }
+    recordFlowListenerError("")
+  } catch (e) {
+    recordFlowListenerError(e instanceof Error ? e.message : String(e))
+  }
+}
+
+export function stopTrafficFlowListener() {
+  if (flushTimer) {
+    clearInterval(flushTimer)
+    flushTimer = null
+  }
+  flushPending()
+  if (socket) {
+    try { socket.close() } catch { /* ignore */ }
+    socket = null
+  }
+  state = { bound: false, address: null }
+}
+
+export function startTrafficFlowListener() {
+  stopTrafficFlowListener()
+  const settings = getTrafficFlowSettingsRow()
+  if (!settings.enabled) {
+    state = { bound: false, address: null }
+    return
+  }
+  const host = process.env.FLOW_LISTEN_HOST?.trim() || settings.collectorIp || "127.0.0.1"
+  const port = settings.flowListenPort
+  const sock = createSocket("udp4")
+  sock.on("error", (err) => {
+    recordFlowListenerError(err.message)
+    state = { bound: false, address: null }
+  })
+  sock.on("message", onMessage)
+  sock.bind(port, host, () => {
+    state = { bound: true, address: `${host}:${port}` }
+    recordFlowListenerError("")
+  })
+  socket = sock
+  flushTimer = setInterval(onTick, TICK_MS)
+}
+
+export function listStoredFlowRows(sinceIso: string): PendingFlowRow[] {
+  const stored = db.select().from(flowBuckets).where(gte(flowBuckets.bucketAt, sinceIso)).all()
+  const merged = new Map<string, PendingFlowRow>()
+  for (const r of stored) {
+    const key = `${r.serverId}|${r.bucketAt}|${r.src}|${r.dst}|${r.proto}|${r.srcPort}|${r.dstPort}|${r.inIface}`
+    merged.set(key, {
+      serverId: r.serverId,
+      bucketAt: r.bucketAt,
+      src: r.src,
+      dst: r.dst,
+      proto: r.proto,
+      srcPort: r.srcPort,
+      dstPort: r.dstPort,
+      bytes: r.bytes,
+      packets: r.packets,
+      inIface: r.inIface,
+      outIface: "",
+    })
+  }
+  for (const p of peekPendingFlows()) {
+    if (p.bucketAt < sinceIso) continue
+    const key = `${p.serverId}|${p.bucketAt}|${p.src}|${p.dst}|${p.proto}|${p.srcPort}|${p.dstPort}|${p.inIface}`
+    const prev = merged.get(key)
+    if (prev) {
+      prev.bytes += p.bytes
+      prev.packets += p.packets
+    } else {
+      merged.set(key, { ...p })
+    }
+  }
+  return [...merged.values()]
+}
+
+export function listFlowTalkers(minutes = 5): FlowStatsDto {
+  const settings = getTrafficFlowSettingsRow()
+  const rangeStart = new Date(Date.now() - minutes * 60_000).toISOString()
+  const rows = listStoredFlowRows(rangeStart)
+  const serverRows = db.select().from(servers).all()
+  const nameById = new Map(serverRows.map((s) => [s.id, s.name || s.host]))
+  const agg = new Map<string, FlowTalkerDto & { rawBytes: number }>()
+  const protoBytes = new Map<number, number>()
+  const srcs = new Set<string>()
+  const dsts = new Set<string>()
+  const exporters = new Set<number>()
+  let totalBytes = 0
+  for (const r of rows) {
+    const resolved = resolveIfaceName(r.serverId, r.inIface)
+    const key = `${r.serverId}|${r.src}|${r.dst}|${r.proto}|${r.srcPort}|${r.dstPort}|${r.inIface}`
+    const prev = agg.get(key)
+    const bytes = r.bytes
+    totalBytes += bytes
+    srcs.add(r.src)
+    dsts.add(r.dst)
+    exporters.add(r.serverId)
+    protoBytes.set(r.proto, (protoBytes.get(r.proto) ?? 0) + bytes)
+    if (prev) {
+      prev.rawBytes += bytes
+      prev.bytes += bytes
+      prev.packets += r.packets
+    } else {
+      agg.set(key, {
+        serverId: String(r.serverId),
+        serverName: nameById.get(r.serverId) ?? String(r.serverId),
+        src: r.src,
+        dst: r.dst,
+        proto: r.proto,
+        protoName: protoName(r.proto),
+        srcPort: r.srcPort,
+        dstPort: r.dstPort,
+        bytes,
+        packets: r.packets,
+        bps: 0,
+        inIface: resolved.name,
+        inIfaceIndex: resolved.index,
+        application: applicationName(r.proto, r.dstPort, r.srcPort),
+        rawBytes: bytes,
+      })
+    }
+  }
+  const windowSec = Math.max(60, minutes * 60)
+  const talkers = [...agg.values()]
+    .map((t) => ({ ...t, bps: (t.rawBytes * 8) / windowSec }))
+    .sort((a, b) => b.bytes - a.bytes)
+    .slice(0, settings.topN)
+    .map(({ rawBytes: _raw, ...rest }) => rest)
+  let topProto = "—"
+  let topProtoBytes = 0
+  for (const [p, b] of protoBytes) {
+    if (b > topProtoBytes) {
+      topProtoBytes = b
+      topProto = protoName(p)
+    }
+  }
+  return {
+    exportersOnline: exporters.size,
+    bytesPerMin: minutes > 0 ? totalBytes / minutes : totalBytes,
+    uniqueSrc: srcs.size,
+    uniqueDst: dsts.size,
+    topProto,
+    talkers,
+    lastExporterIp: settings.lastExporterIp ?? null,
+    lastError: settings.lastError || null,
+    packetsReceived: settings.packetsReceived,
+    lastDatagramAt: settings.lastDatagramAt ?? null,
+    listenerBound: state.bound,
+    listenerAddress: state.address,
+  }
+}
+
+export function ingestParsedFlowsForTests(exporterIp: string, flows: ParsedFlow[]) {
+  queueFlows(exporterIp, flows)
+  rollFlowRings()
+  flushPending()
+}
+
+/** Кладёт потоки в pending без flush в SQLite — для юнит-тестов аналитики. */
+export function ingestParsedFlowsForServerForTests(serverId: number, flows: ParsedFlow[]) {
+  const bucketAt = minuteBucketIso()
+  for (const flow of flows) {
+    addToTick(serverId, flow.inIface, flow.outIface, flow.bytes)
+    const key = `${serverId}\0${bucketAt}\0${flow.src}\0${flow.dst}\0${flow.proto}\0${flow.srcPort}\0${flow.dstPort}\0${flow.inIface}`
+    const prev = pending.get(key)
+    if (prev) {
+      prev.bytes += flow.bytes
+      prev.packets += flow.packets
+    } else {
+      pending.set(key, {
+        serverId,
+        bucketAt,
+        flow: { ...flow },
+        bytes: flow.bytes,
+        packets: flow.packets,
+      })
+    }
+  }
+  rollFlowRings()
+}
+
+export function resetFlowRingsForTests() {
+  tickAccum.clear()
+  rings.clear()
+  pending.clear()
+}

backend/src/services/traffic-flow-ip.ts

@@ -0,0 +1,54 @@
+/** IPv4 helpers for RIPEstat prefix cache and EvoBGP CIDR match. */
+
+export function ipv4ToInt(ip: string): number | null {
+  const parts = String(ip ?? "").trim().split(".")
+  if (parts.length !== 4) return null
+  let n = 0
+  for (const p of parts) {
+    if (!/^\d+$/.test(p)) return null
+    const o = Number(p)
+    if (o < 0 || o > 255) return null
+    n = ((n << 8) >>> 0) + o
+  }
+  return n >>> 0
+}
+
+export function parseCidrV4(cidr: string): { net: number; mask: number; prefixLen: number } | null {
+  const raw = String(cidr ?? "").trim()
+  const [ip, lenRaw] = raw.split("/")
+  const addr = ipv4ToInt(ip ?? "")
+  const prefixLen = Number.parseInt(lenRaw ?? "", 10)
+  if (addr == null || !Number.isFinite(prefixLen) || prefixLen < 0 || prefixLen > 32) return null
+  const mask = prefixLen === 0 ? 0 : (0xffffffff << (32 - prefixLen)) >>> 0
+  return { net: (addr & mask) >>> 0, mask, prefixLen }
+}
+
+export function ipInCidrV4(ip: string, cidr: string): boolean {
+  const addr = ipv4ToInt(ip)
+  const parsed = parseCidrV4(cidr)
+  if (addr == null || !parsed) return false
+  return ((addr & parsed.mask) >>> 0) === parsed.net
+}
+
+export function isNonPublicIp(ip: string): boolean {
+  const trimmed = String(ip ?? "").trim()
+  if (!trimmed) return true
+  if (trimmed.includes(":")) {
+    const lower = trimmed.toLowerCase()
+    return lower === "::1" || lower.startsWith("fe80:") || lower.startsWith("fc") || lower.startsWith("fd") || lower === "::"
+  }
+  const n = ipv4ToInt(trimmed)
+  if (n == null) return true
+  const inRange = (cidr: string) => ipInCidrV4(trimmed, cidr)
+  return (
+    inRange("0.0.0.0/8")
+    || inRange("10.0.0.0/8")
+    || inRange("127.0.0.0/8")
+    || inRange("169.254.0.0/16")
+    || inRange("172.16.0.0/12")
+    || inRange("192.168.0.0/16")
+    || inRange("100.64.0.0/10")
+    || inRange("224.0.0.0/4")
+    || inRange("255.255.255.255/32")
+  )
+}

backend/src/services/traffic-flow-map-exporter.test.ts

@@ -0,0 +1,54 @@
+import assert from "node:assert/strict"
+import {
+  bareIpv4,
+  ipInCidr,
+  isNatMasqueradeExporter,
+  normalizeExporterIp,
+  pickServerIdForExporter,
+} from "./traffic-flow-map-exporter.js"
+
+assert.equal(normalizeExporterIp("::ffff:172.18.0.2"), "172.18.0.2")
+assert.equal(bareIpv4("10.255.254.3/32"), "10.255.254.3")
+assert.equal(ipInCidr("10.255.254.3", "10.255.254.0/24"), true)
+assert.equal(ipInCidr("172.18.0.2", "10.255.254.0/24"), false)
+assert.equal(isNatMasqueradeExporter("172.18.0.2", "10.255.254.0/24"), true)
+assert.equal(isNatMasqueradeExporter("10.255.254.3", "10.255.254.0/24"), false)
+assert.equal(isNatMasqueradeExporter("10.0.0.12", "10.255.254.0/24"), true)
+
+const byTunnel = new Map([["10.255.254.3", 7]])
+assert.equal(pickServerIdForExporter({
+  exporterIp: "10.255.254.3",
+  overlayPrefix: "10.255.254.0/24",
+  byTunnelIp: byTunnel,
+  peers: [],
+  hostIps: new Map(),
+}), 7)
+
+assert.equal(pickServerIdForExporter({
+  exporterIp: "172.18.0.2",
+  overlayPrefix: "10.255.254.0/24",
+  byTunnelIp: byTunnel,
+  peers: [{ serverId: 7, address: "10.255.254.3", allowedIps: ["10.255.254.3/32"] }],
+  hostIps: new Map(),
+}), 7)
+
+assert.equal(pickServerIdForExporter({
+  exporterIp: "172.18.0.2",
+  overlayPrefix: "10.255.254.0/24",
+  byTunnelIp: new Map([["10.255.254.3", 7], ["10.255.254.4", 8]]),
+  peers: [
+    { serverId: 7, address: "10.255.254.3", allowedIps: ["10.255.254.3/32"] },
+    { serverId: 8, address: "10.255.254.4", allowedIps: ["10.255.254.4/32"] },
+  ],
+  hostIps: new Map(),
+}), null)
+
+assert.equal(pickServerIdForExporter({
+  exporterIp: "94.142.140.141",
+  overlayPrefix: "10.255.254.0/24",
+  byTunnelIp: byTunnel,
+  peers: [],
+  hostIps: new Map([["94.142.140.141", 7]]),
+}), 7)
+
+console.log("traffic-flow-map-exporter.test.ts: ok")

backend/src/services/traffic-flow-map-exporter.ts

@@ -0,0 +1,82 @@
+export interface OverlayPeerRef {
+  serverId: number
+  address: string
+  allowedIps: string[]
+}
+
+export function normalizeExporterIp(ip: string): string {
+  const trimmed = ip.trim()
+  if (trimmed.toLowerCase().startsWith("::ffff:")) return trimmed.slice(7)
+  return trimmed
+}
+
+export function bareIpv4(value: string): string {
+  const raw = normalizeExporterIp(value).split("/")[0]?.trim() ?? ""
+  return raw
+}
+
+function ipv4ToInt(ip: string): number | null {
+  const parts = ip.split(".")
+  if (parts.length !== 4) return null
+  const n = parts.map((x) => Number(x))
+  if (n.some((x) => !Number.isInteger(x) || x < 0 || x > 255)) return null
+  return ((n[0]! << 24) | (n[1]! << 16) | (n[2]! << 8) | n[3]!) >>> 0
+}
+
+export function ipInCidr(ip: string, cidr: string): boolean {
+  const host = bareIpv4(ip)
+  const [base, bitsRaw] = cidr.split("/")
+  const bits = Number(bitsRaw ?? 32)
+  const a = ipv4ToInt(host)
+  const b = ipv4ToInt(bareIpv4(base ?? ""))
+  if (a == null || b == null || !Number.isFinite(bits) || bits < 0 || bits > 32) return false
+  const mask = bits === 0 ? 0 : (0xffffffff << (32 - bits)) >>> 0
+  return (a & mask) === (b & mask)
+}
+
+/** Docker userland-proxy / bridge SNAT, не адрес из оверлея wg-flow. */
+export function isNatMasqueradeExporter(ip: string, overlayPrefix: string): boolean {
+  const host = bareIpv4(ip)
+  if (!host) return false
+  if (ipInCidr(host, overlayPrefix)) return false
+  return ipInCidr(host, "10.0.0.0/8")
+    || ipInCidr(host, "172.16.0.0/12")
+    || ipInCidr(host, "192.168.0.0/16")
+    || ipInCidr(host, "127.0.0.0/8")
+}
+
+export function pickServerIdForExporter(opts: {
+  exporterIp: string
+  overlayPrefix: string
+  byTunnelIp: Map<string, number>
+  peers: OverlayPeerRef[]
+  hostIps: Map<string, number>
+}): number | null {
+  const exporter = bareIpv4(opts.exporterIp)
+  if (!exporter) return null
+
+  const exact = opts.byTunnelIp.get(exporter)
+  if (exact != null) return exact
+
+  for (const [ip, id] of opts.byTunnelIp) {
+    if (bareIpv4(ip) === exporter) return id
+  }
+
+  for (const peer of opts.peers) {
+    if (bareIpv4(peer.address) === exporter) return peer.serverId
+    if (peer.allowedIps.some((cidr) => ipInCidr(exporter, cidr) || bareIpv4(cidr) === exporter)) {
+      return peer.serverId
+    }
+  }
+
+  const byHost = opts.hostIps.get(exporter)
+  if (byHost != null) return byHost
+
+  if (!isNatMasqueradeExporter(exporter, opts.overlayPrefix)) return null
+
+  const tunnelIds = [...new Set(opts.byTunnelIp.values())]
+  if (tunnelIds.length === 1) return tunnelIds[0] ?? null
+  const peerIds = [...new Set(opts.peers.map((p) => p.serverId))]
+  if (peerIds.length === 1) return peerIds[0] ?? null
+  return null
+}

backend/src/services/traffic-flow-overlay.ts

@@ -0,0 +1,289 @@
+import { eq } from "drizzle-orm"
+import { db } from "../db/index.js"
+import { servers } from "../db/schema.js"
+import type { TrafficFlowOverlayResult } from "@mmapp/contracts/traffic-flow"
+import { encodeRosId, MikrotikClient, MikrotikError } from "./mikrotik.js"
+import { getEnabledServerById, listWireGuardInterfaces } from "./wireguard-live.js"
+import {
+  asRosArray,
+  patchRosPath,
+  putIpAddress,
+  putWireguardInterface,
+  putWireguardPeer,
+  rosRowId,
+  toRosBody,
+} from "./wireguard-ros.js"
+import {
+  enableTrafficFlowIngest,
+  ensureHostKeys,
+  getTrafficFlowSettingsRow,
+  upsertHostPeer,
+} from "./traffic-flow-settings.js"
+import { startTrafficFlowListener } from "./traffic-flow-ingest.js"
+import { listTrafficFlowHostFiles } from "./traffic-flow-host-files.js"
+
+const IFACE_NAME = "wg-flow"
+const JH_LISTEN_PORT = 13232
+const WG_INPUT_COMMENT = "mm-wg-flow"
+
+export function allocateOverlayAddress(prefix: string, collectorIp: string, serverId: number, taken: Set<string>): string {
+  const [base] = prefix.split("/")
+  const parts = (base ?? "10.255.254.0").split(".").map((n) => Number.parseInt(n, 10))
+  const a = parts[0] || 10
+  const b = parts[1] || 255
+  const c = parts[2] || 254
+  const preferredLast = 2 + ((serverId - 1) % 250)
+  const candidates = [preferredLast, ...Array.from({ length: 253 }, (_, i) => 2 + ((preferredLast - 2 + i) % 253))]
+  for (const last of candidates) {
+    const ip = `${a}.${b}.${c}.${last}`
+    if (ip === collectorIp) continue
+    if (taken.has(ip)) continue
+    return ip
+  }
+  throw new Error("Нет свободных адресов в префиксе wg-flow")
+}
+
+function linuxPeerBlock(publicKey: string, address: string, comment: string, endpoint: string): string {
+  return [
+    `[Peer]`,
+    `PublicKey = ${publicKey}`,
+    `AllowedIPs = ${address}/32`,
+    `Endpoint = ${endpoint}:${JH_LISTEN_PORT}`,
+    `PersistentKeepalive = 25`,
+    comment ? `# ${comment}` : "",
+  ].filter(Boolean).join("\n")
+}
+
+async function findIface(client: MikrotikClient, name: string): Promise<Record<string, unknown> | undefined> {
+  const list = asRosArray<Record<string, unknown>>(await client.get("/interface/wireguard"))
+  return list.find((i) => String(i.name ?? "") === name)
+}
+
+async function findPeer(
+  client: MikrotikClient,
+  iface: string,
+  publicKey: string,
+): Promise<Record<string, unknown> | undefined> {
+  const list = asRosArray<Record<string, unknown>>(await client.get("/interface/wireguard/peers"))
+  return list.find((p) =>
+    String(p.interface ?? "") === iface && String(p["public-key"] ?? "") === publicKey,
+  )
+}
+
+async function findAddress(client: MikrotikClient, iface: string): Promise<Record<string, unknown> | undefined> {
+  const list = asRosArray<Record<string, unknown>>(await client.get("/ip/address"))
+  return list.find((a) => String(a.interface ?? "") === iface)
+}
+
+async function findRoute(client: MikrotikClient, dst: string): Promise<Record<string, unknown> | undefined> {
+  const list = asRosArray<Record<string, unknown>>(await client.get("/ip/route"))
+  return list.find((r) => String(r["dst-address"] ?? "") === dst)
+}
+
+async function ensureWgInputAccept(client: MikrotikClient, listenPort: number): Promise<boolean> {
+  const rules = asRosArray<Record<string, unknown>>(await client.get("/ip/firewall/filter"))
+  const existing = rules.find((r) => String(r.comment ?? "") === WG_INPUT_COMMENT)
+  if (existing) return false
+  await client.put("/ip/firewall/filter", toRosBody({
+    chain: "input",
+    protocol: "udp",
+    "dst-port": String(listenPort),
+    action: "accept",
+    comment: WG_INPUT_COMMENT,
+  }))
+  return true
+}
+
+/** Официальный авто-source UDP IPFIX, не фильтр 0.0.0.0/0. */
+export const FLOW_TARGET_SRC_AUTO = "0.0.0.0"
+
+async function ensureTrafficFlow(
+  client: MikrotikClient,
+  collectorIp: string,
+  port: number,
+): Promise<void> {
+  const body = toRosBody({
+    enabled: "yes",
+    interfaces: "all",
+    "active-flow-timeout": "1m",
+    "inactive-flow-timeout": "15s",
+  })
+  const rows = asRosArray<Record<string, unknown>>(await client.get("/ip/traffic-flow"))
+  const id = rows[0] ? rosRowId(rows[0]) : ""
+  if (id) {
+    await patchRosPath(client, `/ip/traffic-flow/${encodeRosId(id)}`, body)
+  } else {
+    await client.post("/ip/traffic-flow/set", body)
+  }
+
+  const targets = asRosArray<Record<string, unknown>>(await client.get("/ip/traffic-flow/target"))
+  const existing = targets.find((t) => String(t["dst-address"] ?? "") === collectorIp)
+  const targetBody = toRosBody({
+    "dst-address": collectorIp,
+    "src-address": FLOW_TARGET_SRC_AUTO,
+    port: String(port),
+    version: "ipfix",
+  })
+  if (existing) {
+    const targetId = rosRowId(existing)
+    if (targetId) await patchRosPath(client, `/ip/traffic-flow/target/${encodeRosId(targetId)}`, targetBody)
+    return
+  }
+  await client.put("/ip/traffic-flow/target", targetBody)
+}
+
+export function usablePublicHost(raw: string | undefined): string {
+  if (!raw) return ""
+  const host = raw.split(",")[0]?.trim().replace(/^\[/, "").replace(/\]:\d+$/, "").split(":")[0]?.trim() ?? ""
+  const lower = host.toLowerCase()
+  if (!host) return ""
+  if (lower === "localhost" || lower === "127.0.0.1" || lower === "::1" || lower === "0.0.0.0") return ""
+  if (lower.endsWith(".local") || lower.endsWith(".internal") || lower.endsWith(".lan")) return ""
+  if (/^(10\.|192\.168\.|172\.(1[6-9]|2\d|3[01])\.)/.test(host)) return ""
+  return host
+}
+
+export async function applyFlowOverlay(
+  serverIdRaw: string | number,
+  opts?: { publicEndpoint?: string; requestHost?: string },
+): Promise<TrafficFlowOverlayResult> {
+  const steps: string[] = []
+  const keys = ensureHostKeys()
+  const settings = getTrafficFlowSettingsRow()
+  const hostPublicKey = settings.hostPublicKey || keys.publicKey
+  if (!hostPublicKey) {
+    throw Object.assign(new Error("Не удалось создать ключи хоста MM"), { statusCode: 500 })
+  }
+
+  const server = getEnabledServerById(String(serverIdRaw))
+  if (!server || !server.enabled) {
+    throw Object.assign(new Error("Сервер не найден или выключен"), { statusCode: 404 })
+  }
+
+  const endpointHost = (opts?.publicEndpoint?.trim() || server.host.trim()).trim()
+  if (!endpointHost) {
+    throw Object.assign(new Error("Укажите публичный IP или DNS jump-host"), { statusCode: 400 })
+  }
+  const peerEndpoint = `${endpointHost}:${JH_LISTEN_PORT}`
+
+  const taken = new Set(
+    db.select({ ip: servers.mgmtTunnelIp }).from(servers).all()
+      .map((r) => r.ip)
+      .filter(Boolean),
+  )
+  const address = server.mgmtTunnelIp || allocateOverlayAddress(settings.prefix, settings.collectorIp, server.id, taken)
+  const client = MikrotikClient.fromServer(server)
+
+  try {
+    let iface = await findIface(client, IFACE_NAME)
+    if (!iface) {
+      await putWireguardInterface(client, {
+        name: IFACE_NAME,
+        "listen-port": String(JH_LISTEN_PORT),
+        mtu: "1420",
+        comment: "MikrotikManager traffic-flow overlay",
+      })
+      steps.push(`Создан интерфейс ${IFACE_NAME}`)
+      iface = await findIface(client, IFACE_NAME)
+    } else {
+      steps.push(`Интерфейс ${IFACE_NAME} уже есть`)
+    }
+
+    const addrRow = await findAddress(client, IFACE_NAME)
+    const mask = (settings.prefix.split("/")[1] || "24").replace(/\D/g, "") || "24"
+    const cidr = `${address}/${mask}`
+    if (!addrRow) {
+      await putIpAddress(client, cidr, IFACE_NAME)
+      steps.push(`Адрес ${cidr}`)
+    } else {
+      steps.push(`Адрес на ${IFACE_NAME} уже назначен`)
+    }
+
+    const peer = await findPeer(client, IFACE_NAME, hostPublicKey)
+    const peerBody = {
+      interface: IFACE_NAME,
+      "public-key": hostPublicKey,
+      "allowed-address": `${settings.collectorIp}/32`,
+      comment: "MM traffic-flow collector",
+      name: "mm-collector",
+    }
+    if (!peer) {
+      await putWireguardPeer(client, peerBody)
+      steps.push("Добавлен пир на pubkey хоста MM (сервер, без endpoint)")
+    } else {
+      const id = rosRowId(peer)
+      const hadEndpoint = Boolean(String(peer["endpoint-address"] ?? "").trim())
+      if (hadEndpoint && id) {
+        await client.delete(`/interface/wireguard/peers/${encodeURIComponent(id)}`)
+        await putWireguardPeer(client, peerBody)
+        steps.push("Пир пересоздан как сервер (endpoint снят)")
+      } else if (id) {
+        await patchRosPath(client, `/interface/wireguard/peers/${encodeURIComponent(id)}`, peerBody)
+        steps.push("Пир хоста MM обновлён")
+      }
+    }
+
+    const routeDst = `${settings.collectorIp}/32`
+    const route = await findRoute(client, routeDst)
+    if (!route) {
+      await client.put("/ip/route", toRosBody({
+        "dst-address": routeDst,
+        gateway: IFACE_NAME,
+        comment: "MM traffic-flow collector",
+      }))
+      steps.push(`Маршрут ${routeDst} через ${IFACE_NAME}`)
+    } else {
+      steps.push("Маршрут до collector уже есть")
+    }
+
+    if (await ensureWgInputAccept(client, JH_LISTEN_PORT)) {
+      steps.push(`Firewall input accept UDP ${JH_LISTEN_PORT}`)
+    } else {
+      steps.push("Firewall input WG уже есть")
+    }
+
+    await ensureTrafficFlow(client, settings.collectorIp, settings.flowListenPort)
+    steps.push(`Traffic Flow → ${settings.collectorIp}:${settings.flowListenPort} ipfix (src auto)`)
+
+    const listed = await listWireGuardInterfaces({ serverId: String(server.id), includePrivateKey: false })
+    const created = listed.interfaces.find((i) => i.name === IFACE_NAME)
+    const publicKey = created?.publicKey ?? ""
+    if (!publicKey) {
+      throw new Error("Не удалось прочитать public-key интерфейса wg-flow")
+    }
+
+    db.update(servers).set({
+      mgmtTunnelIp: address,
+      updatedAt: new Date().toISOString(),
+    }).where(eq(servers.id, server.id)).run()
+
+    upsertHostPeer({
+      serverId: server.id,
+      name: server.name || server.host,
+      publicKey,
+      allowedIps: [`${address}/32`],
+      address,
+      endpoint: peerEndpoint,
+    })
+
+    enableTrafficFlowIngest()
+    startTrafficFlowListener()
+    steps.push("Коллектор IPFIX на MM включён")
+
+    return {
+      ok: true,
+      serverId: server.id,
+      interfaceName: IFACE_NAME,
+      address,
+      publicKey,
+      linuxPeerBlock: linuxPeerBlock(publicKey, address, server.name || server.host, endpointHost),
+      trafficFlow: true,
+      steps,
+      hostFiles: listTrafficFlowHostFiles(),
+    }
+  } catch (e) {
+    const msg = e instanceof MikrotikError ? e.message : e instanceof Error ? e.message : String(e)
+    const err = Object.assign(new Error(`RouterOS: ${msg}`), { statusCode: 502 })
+    throw err
+  }
+}

backend/src/services/traffic-flow-parse.test.ts

@@ -0,0 +1,103 @@
+import assert from "node:assert/strict"
+import { parseFlowPacket, protoName, resetFlowTemplatesForTests } from "./traffic-flow-parse.js"
+import { allocateOverlayAddress, FLOW_TARGET_SRC_AUTO, usablePublicHost } from "./traffic-flow-overlay.js"
+
+function netflowV5One(): Buffer {
+  const buf = Buffer.alloc(24 + 48)
+  buf.writeUInt16BE(5, 0)
+  buf.writeUInt16BE(1, 2)
+  buf[24] = 10; buf[25] = 1; buf[26] = 1; buf[27] = 8
+  buf[28] = 8; buf[29] = 8; buf[30] = 8; buf[31] = 8
+  buf.writeUInt16BE(1, 24 + 12)
+  buf.writeUInt32BE(10, 24 + 16)
+  buf.writeUInt32BE(1500, 24 + 20)
+  buf.writeUInt16BE(443, 24 + 32)
+  buf.writeUInt16BE(443, 24 + 34)
+  buf.writeUInt8(6, 24 + 38)
+  return buf
+}
+
+resetFlowTemplatesForTests()
+const flows = parseFlowPacket(netflowV5One(), "10.255.254.5")
+assert.equal(flows.length, 1)
+assert.equal(flows[0]?.src, "10.1.1.8")
+assert.equal(flows[0]?.dst, "8.8.8.8")
+assert.equal(flows[0]?.proto, 6)
+assert.equal(flows[0]?.bytes, 1500)
+assert.equal(flows[0]?.inIface, "1")
+assert.equal(protoName(6), "TCP")
+assert.equal(parseFlowPacket(Buffer.from([0, 1]), "1.1.1.1").length, 0)
+
+const taken = new Set(["10.255.254.2"])
+assert.equal(allocateOverlayAddress("10.255.254.0/24", "10.255.254.1", 1, taken), "10.255.254.3")
+assert.equal(allocateOverlayAddress("10.255.254.0/24", "10.255.254.1", 2, new Set()), "10.255.254.3")
+
+assert.equal(usablePublicHost("localhost:8000"), "")
+assert.equal(usablePublicHost("127.0.0.1"), "")
+assert.equal(usablePublicHost("192.168.1.10"), "")
+assert.equal(usablePublicHost("mm.example.com:443"), "mm.example.com")
+assert.equal(usablePublicHost("203.0.113.10"), "203.0.113.10")
+assert.equal(FLOW_TARGET_SRC_AUTO, "0.0.0.0")
+
+resetFlowTemplatesForTests()
+{
+  const tpl = Buffer.alloc(16 + 16 + 20)
+  tpl.writeUInt16BE(10, 0)
+  tpl.writeUInt16BE(tpl.length, 2)
+  tpl.writeUInt16BE(2, 16)
+  tpl.writeUInt16BE(16, 18)
+  tpl.writeUInt16BE(256, 20)
+  tpl.writeUInt16BE(2, 22)
+  tpl.writeUInt16BE(8, 24)
+  tpl.writeUInt16BE(4, 26)
+  tpl.writeUInt16BE(12, 28)
+  tpl.writeUInt16BE(4, 30)
+  const data = Buffer.alloc(16 + 12)
+  data.writeUInt16BE(10, 0)
+  data.writeUInt16BE(data.length, 2)
+  data.writeUInt16BE(256, 16)
+  data.writeUInt16BE(12, 18)
+  data[20] = 10; data[21] = 1; data[22] = 1; data[23] = 8
+  data[24] = 8; data[25] = 8; data[26] = 8; data[27] = 8
+  const fromTpl = parseFlowPacket(tpl, "172.18.0.2")
+  assert.equal(fromTpl.length, 0)
+  const fromData = parseFlowPacket(data, "172.18.0.2")
+  assert.equal(fromData.length, 1)
+  assert.equal(fromData[0]?.src, "10.1.1.8")
+  assert.equal(fromData[0]?.dst, "8.8.8.8")
+}
+
+resetFlowTemplatesForTests()
+{
+  const tpl = Buffer.alloc(16 + 24)
+  tpl.writeUInt16BE(10, 0)
+  tpl.writeUInt16BE(tpl.length, 2)
+  tpl.writeUInt16BE(2, 16)
+  tpl.writeUInt16BE(24, 18)
+  tpl.writeUInt16BE(256, 20)
+  tpl.writeUInt16BE(4, 22)
+  tpl.writeUInt16BE(8, 24)
+  tpl.writeUInt16BE(4, 26)
+  tpl.writeUInt16BE(12, 28)
+  tpl.writeUInt16BE(4, 30)
+  tpl.writeUInt16BE(10, 32)
+  tpl.writeUInt16BE(4, 34)
+  tpl.writeUInt16BE(82, 36)
+  tpl.writeUInt16BE(6, 38)
+  const data = Buffer.alloc(16 + 22)
+  data.writeUInt16BE(10, 0)
+  data.writeUInt16BE(data.length, 2)
+  data.writeUInt16BE(256, 16)
+  data.writeUInt16BE(22, 18)
+  data[20] = 10; data[21] = 1; data[22] = 1; data[23] = 8
+  data[24] = 8; data[25] = 8; data[26] = 8; data[27] = 8
+  data.writeUInt32BE(13, 28)
+  data.write("ether1", 32)
+  parseFlowPacket(tpl, "10.255.254.3")
+  const named = parseFlowPacket(data, "10.255.254.3")
+  assert.equal(named.length, 1)
+  assert.equal(named[0]?.inIface, "ether1")
+  assert.equal(named[0]?.src, "10.1.1.8")
+}
+
+console.log("traffic-flow-parse.test.ts: ok")

backend/src/services/traffic-flow-parse.ts

@@ -0,0 +1,310 @@
+export interface ParsedFlow {
+  src: string
+  dst: string
+  proto: number
+  srcPort: number
+  dstPort: number
+  bytes: number
+  packets: number
+  inIface: string
+  outIface: string
+}
+
+interface FieldSpec {
+  type: number
+  length: number
+}
+
+interface Template {
+  fields: FieldSpec[]
+}
+
+const templatesByExporter = new Map<string, Map<number, Template>>()
+
+function ipv4(buf: Buffer, offset: number): string {
+  return `${buf[offset]}.${buf[offset + 1]}.${buf[offset + 2]}.${buf[offset + 3]}`
+}
+
+function ipv6(buf: Buffer, offset: number): string {
+  const parts: string[] = []
+  for (let i = 0; i < 8; i++) parts.push(buf.readUInt16BE(offset + i * 2).toString(16))
+  return parts.join(":")
+}
+
+const VAR_LEN = 0xffff
+
+function consumeField(
+  buf: Buffer,
+  off: number,
+  length: number,
+  limit: number,
+): { data: Buffer; next: number } | null {
+  if (length === VAR_LEN) {
+    if (off >= limit) return null
+    const first = buf[off]!
+    if (first < 255) {
+      const end = off + 1 + first
+      if (end > limit) return null
+      return { data: buf.subarray(off + 1, end), next: end }
+    }
+    if (off + 3 > limit) return null
+    const len = buf.readUInt16BE(off + 1)
+    const end = off + 3 + len
+    if (end > limit) return null
+    return { data: buf.subarray(off + 3, end), next: end }
+  }
+  const end = off + length
+  if (end > limit) return null
+  return { data: buf.subarray(off, end), next: end }
+}
+
+function fixedRecordSize(fields: FieldSpec[]): number | null {
+  let n = 0
+  for (const f of fields) {
+    if (f.length === VAR_LEN) return null
+    n += f.length
+  }
+  return n
+}
+
+function readUint(buf: Buffer, offset: number, length: number): number {
+  if (length === 1) return buf.readUInt8(offset)
+  if (length === 2) return buf.readUInt16BE(offset)
+  if (length === 4) return buf.readUInt32BE(offset)
+  if (length === 8) {
+    const big = buf.readBigUInt64BE(offset)
+    const n = Number(big)
+    return Number.isFinite(n) ? n : 0
+  }
+  let v = 0
+  for (let i = 0; i < length; i++) v = (v << 8) + buf[offset + i]
+  return v >>> 0
+}
+
+function parseNetflowV5(buf: Buffer): ParsedFlow[] {
+  if (buf.length < 24) return []
+  const count = buf.readUInt16BE(2)
+  const out: ParsedFlow[] = []
+  let off = 24
+  for (let i = 0; i < count && off + 48 <= buf.length; i++) {
+    out.push({
+      src: ipv4(buf, off),
+      dst: ipv4(buf, off + 4),
+      packets: buf.readUInt32BE(off + 16),
+      bytes: buf.readUInt32BE(off + 20),
+      srcPort: buf.readUInt16BE(off + 32),
+      dstPort: buf.readUInt16BE(off + 34),
+      proto: buf.readUInt8(off + 38),
+      inIface: String(buf.readUInt16BE(off + 12)),
+      outIface: String(buf.readUInt16BE(off + 14)),
+    })
+    off += 48
+  }
+  return out
+}
+
+function parseIpfixTemplates(exporter: string, buf: Buffer, setStart: number, setEnd: number, setId: number) {
+  let off = setStart + 4
+  const map = templatesByExporter.get(exporter) ?? new Map<number, Template>()
+  while (off + 4 <= setEnd) {
+    const templateId = buf.readUInt16BE(off)
+    const fieldCount = buf.readUInt16BE(off + 2)
+    off += 4
+    if (setId === 3) {
+      // options template: skip scope count
+      if (off + 2 > setEnd) break
+      off += 2
+    }
+    const fields: FieldSpec[] = []
+    for (let i = 0; i < fieldCount && off + 4 <= setEnd; i++) {
+      const type = buf.readUInt16BE(off)
+      const length = buf.readUInt16BE(off + 2)
+      off += 4
+      if (type & 0x8000) {
+        if (off + 4 > setEnd) break
+        off += 4
+      }
+      fields.push({ type: type & 0x7fff, length })
+    }
+    if (templateId >= 256) map.set(templateId, { fields })
+  }
+  templatesByExporter.set(exporter, map)
+}
+
+function recordFromFields(
+  fields: FieldSpec[],
+  buf: Buffer,
+  offset: number,
+  limit: number,
+): { flow: ParsedFlow; next: number } | null {
+  let off = offset
+  let src = ""
+  let dst = ""
+  let proto = 0
+  let srcPort = 0
+  let dstPort = 0
+  let bytes = 0
+  let packets = 0
+  let inIface = ""
+  let outIface = ""
+  let ifaceName = ""
+  for (const f of fields) {
+    const field = consumeField(buf, off, f.length, limit)
+    if (!field) return null
+    const { data } = field
+    switch (f.type) {
+      case 8:
+        if (data.length === 4) src = ipv4(data, 0)
+        break
+      case 12:
+        if (data.length === 4) dst = ipv4(data, 0)
+        break
+      case 27:
+        if (data.length === 16 && !src) src = ipv6(data, 0)
+        break
+      case 28:
+        if (data.length === 16 && !dst) dst = ipv6(data, 0)
+        break
+      case 225:
+        if (data.length === 4 && !src) src = ipv4(data, 0)
+        break
+      case 226:
+        if (data.length === 4 && !dst) dst = ipv4(data, 0)
+        break
+      case 4:
+        proto = readUint(data, 0, data.length)
+        break
+      case 7:
+        srcPort = readUint(data, 0, data.length)
+        break
+      case 11:
+        dstPort = readUint(data, 0, data.length)
+        break
+      case 1:
+        bytes = readUint(data, 0, data.length)
+        break
+      case 2:
+        packets = readUint(data, 0, data.length)
+        break
+      case 85:
+        if (!bytes) bytes = readUint(data, 0, data.length)
+        break
+      case 86:
+        if (!packets) packets = readUint(data, 0, data.length)
+        break
+      case 10:
+        inIface = String(readUint(data, 0, data.length))
+        break
+      case 14:
+        outIface = String(readUint(data, 0, data.length))
+        break
+      case 82:
+        ifaceName = data.toString("utf8").replace(/\0/g, "").trim()
+        break
+      default:
+        break
+    }
+    off = field.next
+  }
+  if (ifaceName) inIface = ifaceName
+  return { flow: { src, dst, proto, srcPort, dstPort, bytes, packets, inIface, outIface }, next: off }
+}
+
+function parseDataRecords(
+  tpl: Template,
+  buf: Buffer,
+  recOff: number,
+  setEnd: number,
+  out: ParsedFlow[],
+) {
+  const size = fixedRecordSize(tpl.fields)
+  while (recOff + 1 < setEnd) {
+    if (size != null && recOff + size > setEnd) break
+    const parsed = recordFromFields(tpl.fields, buf, recOff, setEnd)
+    if (!parsed) break
+    if (parsed.flow.src || parsed.flow.dst) out.push(parsed.flow)
+    if (parsed.next <= recOff) break
+    recOff = parsed.next
+  }
+}
+
+function parseIpfix(buf: Buffer, exporter: string): ParsedFlow[] {
+  if (buf.length < 16) return []
+  const total = buf.readUInt16BE(2)
+  const end = Math.min(buf.length, total)
+  let off = 16
+  const out: ParsedFlow[] = []
+  while (off + 4 <= end) {
+    const setId = buf.readUInt16BE(off)
+    const setLen = buf.readUInt16BE(off + 2)
+    if (setLen < 4 || off + setLen > end) break
+    const setEnd = off + setLen
+    if (setId === 2 || setId === 3) {
+      parseIpfixTemplates(exporter, buf, off, setEnd, setId)
+    } else if (setId >= 256) {
+      const tpl = templatesByExporter.get(exporter)?.get(setId)
+      if (tpl) parseDataRecords(tpl, buf, off + 4, setEnd, out)
+    }
+    off = setEnd
+  }
+  return out
+}
+
+function parseNetflowV9(buf: Buffer, exporter: string): ParsedFlow[] {
+  if (buf.length < 20) return []
+  const count = buf.readUInt16BE(2)
+  let off = 20
+  const out: ParsedFlow[] = []
+  const map = templatesByExporter.get(exporter) ?? new Map<number, Template>()
+  for (let s = 0; s < count && off + 4 <= buf.length; s++) {
+    const setId = buf.readUInt16BE(off)
+    const setLen = buf.readUInt16BE(off + 2)
+    if (setLen < 4 || off + setLen > buf.length) break
+    const setEnd = off + setLen
+    if (setId === 0) {
+      let tOff = off + 4
+      while (tOff + 4 <= setEnd) {
+        const templateId = buf.readUInt16BE(tOff)
+        const fieldCount = buf.readUInt16BE(tOff + 2)
+        tOff += 4
+        const fields: FieldSpec[] = []
+        for (let i = 0; i < fieldCount && tOff + 4 <= setEnd; i++) {
+          fields.push({ type: buf.readUInt16BE(tOff), length: buf.readUInt16BE(tOff + 2) })
+          tOff += 4
+        }
+        if (templateId >= 256) map.set(templateId, { fields })
+      }
+      templatesByExporter.set(exporter, map)
+    } else if (setId >= 256) {
+      const tpl = map.get(setId)
+      if (tpl) parseDataRecords(tpl, buf, off + 4, setEnd, out)
+    }
+    off = setEnd
+  }
+  return out
+}
+
+export function parseFlowPacket(buf: Buffer, exporterIp: string): ParsedFlow[] {
+  if (buf.length < 2) return []
+  const version = buf.readUInt16BE(0)
+  if (version === 5) return parseNetflowV5(buf)
+  if (version === 9) return parseNetflowV9(buf, exporterIp)
+  if (version === 10) return parseIpfix(buf, exporterIp)
+  return []
+}
+
+export function protoName(proto: number): string {
+  switch (proto) {
+    case 1: return "ICMP"
+    case 6: return "TCP"
+    case 17: return "UDP"
+    case 47: return "GRE"
+    case 50: return "ESP"
+    case 89: return "OSPF"
+    default: return String(proto)
+  }
+}
+
+export function resetFlowTemplatesForTests() {
+  templatesByExporter.clear()
+}

backend/src/services/traffic-flow-ripe.test.ts

@@ -0,0 +1,72 @@
+import assert from "node:assert/strict"
+import {
+  disableRipeEnqueueForTests,
+  disableRipePersistForTests,
+  enqueueRipeMisses,
+  flushRipeQueueForTests,
+  lookupRipeCached,
+  resetRipeCacheForTests,
+  ripeFetchCountForTests,
+  seedRipeCacheForTests,
+  setRipeFetchForTests,
+} from "./traffic-flow-ripe.js"
+
+disableRipePersistForTests()
+resetRipeCacheForTests()
+disableRipeEnqueueForTests()
+
+assert.equal(lookupRipeCached("10.1.1.8")?.ok, false)
+assert.equal(lookupRipeCached("192.168.0.1")?.ok, false)
+assert.equal(lookupRipeCached("100.64.1.2")?.ok, false)
+assert.equal(ripeFetchCountForTests(), 0)
+
+seedRipeCacheForTests({
+  prefix: "1.2.3.0/24",
+  asn: 64500,
+  country: "NL",
+  lat: 52.3,
+  lng: 4.9,
+  holder: "TEST",
+  ok: true,
+  fetchedAt: Date.now(),
+})
+assert.equal(lookupRipeCached("1.2.3.10")?.country, "NL")
+assert.equal(lookupRipeCached("1.2.3.10")?.asn, 64500)
+assert.equal(ripeFetchCountForTests(), 0)
+
+resetRipeCacheForTests()
+disableRipePersistForTests()
+setRipeFetchForTests(async (input) => {
+  const url = String(input)
+  const body = url.includes("network-info")
+    ? { data: { prefix: "8.8.8.0/24", asns: ["15169"] } }
+    : url.includes("maxmind-geo-lite")
+      ? { data: { located_resources: [{ locations: [{ country: "US", latitude: 37.4, longitude: -122.1 }] }] } }
+      : { data: { holder: "GOOGLE" } }
+  return new Response(JSON.stringify(body), { status: 200, headers: { "Content-Type": "application/json" } })
+})
+enqueueRipeMisses(["8.8.8.8"])
+await flushRipeQueueForTests()
+assert.equal(lookupRipeCached("8.8.8.8")?.country, "US")
+assert.equal(lookupRipeCached("8.8.8.10")?.prefix, "8.8.8.0/24")
+const afterFirst = ripeFetchCountForTests()
+assert.ok(afterFirst >= 2)
+enqueueRipeMisses(["8.8.8.10"])
+await flushRipeQueueForTests()
+assert.equal(ripeFetchCountForTests(), afterFirst)
+
+resetRipeCacheForTests()
+disableRipePersistForTests()
+setRipeFetchForTests(async () => {
+  throw new Error("timeout")
+})
+enqueueRipeMisses(["203.0.113.50"])
+await flushRipeQueueForTests()
+const neg = lookupRipeCached("203.0.113.50")
+assert.equal(neg?.ok, false)
+const afterNeg = ripeFetchCountForTests()
+enqueueRipeMisses(["203.0.113.50"])
+await flushRipeQueueForTests()
+assert.equal(ripeFetchCountForTests(), afterNeg)
+
+console.log("traffic-flow-ripe.test.ts: ok")

backend/src/services/traffic-flow-ripe.ts

@@ -0,0 +1,371 @@
+import { sqliteDatabase } from "../db/index.js"
+import { ipInCidrV4, ipv4ToInt, isNonPublicIp, parseCidrV4 } from "./traffic-flow-ip.js"
+
+export interface FlowIpMeta {
+  prefix: string
+  asn: number
+  country: string
+  lat: number | null
+  lng: number | null
+  holder: string
+  ok: boolean
+  fetchedAt: number
+}
+
+const HIT_TTL_MS = 24 * 60 * 60_000
+const NEG_TTL_MS = 6 * 60 * 60_000
+const MAX_NEW_PREFIX_PER_MIN = 30
+const CONCURRENCY = 3
+const RIPE_BASE = "https://stat.ripe.net/data"
+const UA = "MikrotikManager-flow/1.0"
+
+const mem = new Map<string, FlowIpMeta>()
+const asnHolder = new Map<number, { holder: string; fetchedAt: number }>()
+const inflight = new Map<string, Promise<FlowIpMeta | null>>()
+const queue: string[] = []
+const queued = new Set<string>()
+const recentFetches: number[] = []
+
+let persistEnabled = true
+let enqueueEnabled = true
+let loaded = false
+let workerRunning = false
+let fetchImpl: typeof fetch = globalThis.fetch.bind(globalThis)
+let fetchCount = 0
+
+export function disableRipePersistForTests(): void {
+  persistEnabled = false
+}
+
+export function disableRipeEnqueueForTests(): void {
+  enqueueEnabled = false
+}
+
+export function resetRipeCacheForTests(): void {
+  mem.clear()
+  asnHolder.clear()
+  inflight.clear()
+  queue.length = 0
+  queued.clear()
+  recentFetches.length = 0
+  loaded = persistEnabled ? false : true
+  workerRunning = false
+  fetchCount = 0
+  enqueueEnabled = true
+  fetchImpl = globalThis.fetch.bind(globalThis)
+}
+
+export function seedRipeCacheForTests(entry: FlowIpMeta): void {
+  mem.set(entry.prefix, { ...entry })
+  loaded = true
+}
+
+export function setRipeFetchForTests(fn: typeof fetch): void {
+  fetchImpl = fn
+  fetchCount = 0
+}
+
+export function ripeFetchCountForTests(): number {
+  return fetchCount
+}
+
+export async function flushRipeQueueForTests(timeoutMs = 4000): Promise<void> {
+  const start = Date.now()
+  while (Date.now() - start < timeoutMs) {
+    if (!queue.length && !inflight.size && !workerRunning) return
+    await new Promise((r) => setTimeout(r, 20))
+  }
+}
+
+function ttlMs(ok: boolean): number {
+  return ok ? HIT_TTL_MS : NEG_TTL_MS
+}
+
+function isFresh(entry: FlowIpMeta): boolean {
+  return Date.now() - entry.fetchedAt < ttlMs(entry.ok)
+}
+
+function loadSqlite(): void {
+  if (loaded || !persistEnabled) {
+    loaded = true
+    return
+  }
+  loaded = true
+  try {
+    const rows = sqliteDatabase.prepare(`
+      SELECT prefix, asn, country, lat, lng, holder, ok, fetched_at
+      FROM flow_ip_meta
+    `).all() as Array<{
+      prefix: string
+      asn: number | null
+      country: string
+      lat: number | null
+      lng: number | null
+      holder: string
+      ok: number
+      fetched_at: string
+    }>
+    for (const r of rows) {
+      const fetchedAt = Date.parse(r.fetched_at)
+      mem.set(r.prefix, {
+        prefix: r.prefix,
+        asn: Number(r.asn ?? 0) || 0,
+        country: r.country || "—",
+        lat: r.lat == null ? null : Number(r.lat),
+        lng: r.lng == null ? null : Number(r.lng),
+        holder: r.holder || "",
+        ok: r.ok !== 0,
+        fetchedAt: Number.isFinite(fetchedAt) ? fetchedAt : 0,
+      })
+    }
+    const asns = sqliteDatabase.prepare(`SELECT asn, holder, fetched_at FROM flow_asn_meta`).all() as Array<{
+      asn: number
+      holder: string
+      fetched_at: string
+    }>
+    for (const a of asns) {
+      const fetchedAt = Date.parse(a.fetched_at)
+      asnHolder.set(a.asn, { holder: a.holder || "", fetchedAt: Number.isFinite(fetchedAt) ? fetchedAt : 0 })
+    }
+  } catch {
+    /* table may not exist in isolated tests */
+  }
+}
+
+function persist(entry: FlowIpMeta): void {
+  if (!persistEnabled) return
+  try {
+    sqliteDatabase.prepare(`
+      INSERT INTO flow_ip_meta (prefix, asn, country, lat, lng, holder, ok, fetched_at)
+      VALUES (@prefix, @asn, @country, @lat, @lng, @holder, @ok, @fetchedAt)
+      ON CONFLICT(prefix) DO UPDATE SET
+        asn=excluded.asn, country=excluded.country, lat=excluded.lat, lng=excluded.lng,
+        holder=excluded.holder, ok=excluded.ok, fetched_at=excluded.fetched_at
+    `).run({
+      prefix: entry.prefix,
+      asn: entry.asn,
+      country: entry.country,
+      lat: entry.lat,
+      lng: entry.lng,
+      holder: entry.holder,
+      ok: entry.ok ? 1 : 0,
+      fetchedAt: new Date(entry.fetchedAt).toISOString(),
+    })
+  } catch {
+    /* ignore persist errors */
+  }
+}
+
+function persistAsn(asn: number, holder: string): void {
+  if (!persistEnabled || !asn) return
+  try {
+    sqliteDatabase.prepare(`
+      INSERT INTO flow_asn_meta (asn, holder, fetched_at)
+      VALUES (@asn, @holder, @fetchedAt)
+      ON CONFLICT(asn) DO UPDATE SET holder=excluded.holder, fetched_at=excluded.fetched_at
+    `).run({
+      asn,
+      holder,
+      fetchedAt: new Date().toISOString(),
+    })
+  } catch {
+    /* ignore */
+  }
+}
+
+function negative(prefix: string): FlowIpMeta {
+  return {
+    prefix,
+    asn: 0,
+    country: "—",
+    lat: null,
+    lng: null,
+    holder: "",
+    ok: false,
+    fetchedAt: Date.now(),
+  }
+}
+
+export function lookupRipeCached(ip: string): FlowIpMeta | null {
+  loadSqlite()
+  const trimmed = String(ip ?? "").trim()
+  if (!trimmed) return null
+  if (isNonPublicIp(trimmed)) {
+    return negative(`${trimmed.includes(":") ? trimmed : trimmed}/32`)
+  }
+  let best: FlowIpMeta | null = null
+  let bestLen = -1
+  for (const entry of mem.values()) {
+    if (!isFresh(entry)) continue
+    const parsed = parseCidrV4(entry.prefix)
+    if (!parsed) continue
+    if (!ipInCidrV4(trimmed, entry.prefix)) continue
+    if (parsed.prefixLen > bestLen) {
+      best = entry
+      bestLen = parsed.prefixLen
+    }
+  }
+  return best
+}
+
+async function ripeJson(path: string, resource: string): Promise<unknown> {
+  fetchCount += 1
+  const url = `${RIPE_BASE}/${path}/data.json?resource=${encodeURIComponent(resource)}`
+  const ac = new AbortController()
+  const t = setTimeout(() => ac.abort(), 12_000)
+  try {
+    const res = await fetchImpl(url, {
+      headers: { Accept: "application/json", "User-Agent": UA },
+      signal: ac.signal,
+    })
+    if (!res.ok) throw new Error(`HTTP ${res.status}`)
+    return await res.json()
+  } finally {
+    clearTimeout(t)
+  }
+}
+
+function pickPrefix(data: unknown): string {
+  const d = data as { data?: { prefix?: string } }
+  return String(d?.data?.prefix ?? "").trim()
+}
+
+function pickAsns(data: unknown): number {
+  const d = data as { data?: { asns?: unknown } }
+  const raw = d?.data?.asns
+  const first = Array.isArray(raw) ? raw[0] : raw
+  const n = Number.parseInt(String(first ?? "").replace(/^AS/i, ""), 10)
+  return Number.isFinite(n) ? n : 0
+}
+
+function pickGeo(data: unknown): { country: string; lat: number | null; lng: number | null } {
+  const d = data as {
+    data?: {
+      located_resources?: Array<{
+        locations?: Array<{ country?: string; latitude?: number; longitude?: number }>
+      }>
+    }
+  }
+  const loc = d?.data?.located_resources?.[0]?.locations?.[0]
+  const country = String(loc?.country ?? "").trim().toUpperCase()
+  const lat = loc?.latitude == null ? null : Number(loc.latitude)
+  const lng = loc?.longitude == null ? null : Number(loc.longitude)
+  return {
+    country: country || "—",
+    lat: Number.isFinite(lat) ? lat : null,
+    lng: Number.isFinite(lng) ? lng : null,
+  }
+}
+
+function pickHolder(data: unknown): string {
+  const d = data as { data?: { holder?: string } }
+  return String(d?.data?.holder ?? "").trim()
+}
+
+function allowNewPrefix(): boolean {
+  const now = Date.now()
+  while (recentFetches.length && now - recentFetches[0]! > 60_000) recentFetches.shift()
+  return recentFetches.length < MAX_NEW_PREFIX_PER_MIN
+}
+
+async function resolveIp(ip: string): Promise<FlowIpMeta | null> {
+  const cached = lookupRipeCached(ip)
+  if (cached) return cached
+  const pending = inflight.get(ip)
+  if (pending) return pending
+
+  const job = (async () => {
+    if (!allowNewPrefix()) return null
+    recentFetches.push(Date.now())
+    try {
+      const net = await ripeJson("network-info", ip)
+      const prefix = pickPrefix(net) || `${ip}/32`
+      const existing = mem.get(prefix)
+      if (existing && isFresh(existing)) return existing
+      const asn = pickAsns(net)
+      let geo = { country: "—", lat: null as number | null, lng: null as number | null }
+      try {
+        geo = pickGeo(await ripeJson("maxmind-geo-lite", prefix))
+      } catch {
+        /* best-effort */
+      }
+      let holder = asnHolder.get(asn)?.holder ?? ""
+      if (asn && (!holder || Date.now() - (asnHolder.get(asn)?.fetchedAt ?? 0) > HIT_TTL_MS)) {
+        try {
+          holder = pickHolder(await ripeJson("as-overview", `AS${asn}`))
+          asnHolder.set(asn, { holder, fetchedAt: Date.now() })
+          persistAsn(asn, holder)
+        } catch {
+          /* best-effort */
+        }
+      }
+      const entry: FlowIpMeta = {
+        prefix,
+        asn,
+        country: geo.country,
+        lat: geo.lat,
+        lng: geo.lng,
+        holder,
+        ok: Boolean(asn || (geo.country && geo.country !== "—")),
+        fetchedAt: Date.now(),
+      }
+      mem.set(prefix, entry)
+      persist(entry)
+      return entry
+    } catch {
+      const prefix = `${ip}/32`
+      const entry = negative(prefix)
+      mem.set(prefix, entry)
+      persist(entry)
+      return entry
+    } finally {
+      inflight.delete(ip)
+    }
+  })()
+
+  inflight.set(ip, job)
+  return job
+}
+
+async function runWorker(): Promise<void> {
+  if (workerRunning) return
+  workerRunning = true
+  try {
+    while (queue.length) {
+      const batch: string[] = []
+      while (batch.length < CONCURRENCY && queue.length) {
+        const ip = queue.shift()
+        if (!ip) break
+        queued.delete(ip)
+        if (lookupRipeCached(ip)) continue
+        if (ipv4ToInt(ip) == null && !ip.includes(":")) continue
+        batch.push(ip)
+      }
+      if (!batch.length) {
+        if (!allowNewPrefix()) {
+          await new Promise((r) => setTimeout(r, 1000))
+        }
+        continue
+      }
+      await Promise.all(batch.map((ip) => resolveIp(ip)))
+    }
+  } finally {
+    workerRunning = false
+    if (queue.length) void runWorker()
+  }
+}
+
+/** HTTP / SSE never await this — cache miss is filled on a later tick. */
+export function enqueueRipeMisses(ips: Iterable<string>): void {
+  if (!enqueueEnabled) return
+  loadSqlite()
+  for (const raw of ips) {
+    const ip = String(raw ?? "").trim()
+    if (!ip || isNonPublicIp(ip)) continue
+    if (lookupRipeCached(ip)) continue
+    if (queued.has(ip) || inflight.has(ip)) continue
+    queued.add(ip)
+    queue.push(ip)
+  }
+  if (queue.length) void runWorker()
+}

backend/src/services/traffic-flow-settings.ts

@@ -0,0 +1,133 @@
+import { eq } from "drizzle-orm"
+import { db } from "../db/index.js"
+import { trafficFlowSettings } from "../db/schema.js"
+import type { FlowHostPeer, TrafficFlowSettingsDto, TrafficFlowSettingsPatch } from "@mmapp/contracts/traffic-flow"
+import { generateWireGuardKeyPair } from "./wg-keys.js"
+
+function nowIso() {
+  return new Date().toISOString()
+}
+
+function parsePeers(raw: string): FlowHostPeer[] {
+  try {
+    const parsed = JSON.parse(raw) as unknown
+    if (!Array.isArray(parsed)) return []
+    return parsed.filter((p): p is FlowHostPeer =>
+      p != null && typeof p === "object" && typeof (p as FlowHostPeer).publicKey === "string",
+    )
+  } catch {
+    return []
+  }
+}
+
+export function getTrafficFlowSettingsRow() {
+  const row = db.select().from(trafficFlowSettings).where(eq(trafficFlowSettings.id, 1)).limit(1).all()[0]
+  if (row) return row
+  const now = nowIso()
+  db.insert(trafficFlowSettings).values({
+    id: 1,
+    enabled: false,
+    collectorIp: "10.255.254.1",
+    flowListenPort: 4739,
+    wgListenPort: 51821,
+    prefix: "10.255.254.0/24",
+    createdAt: now,
+    updatedAt: now,
+  }).run()
+  return db.select().from(trafficFlowSettings).where(eq(trafficFlowSettings.id, 1)).limit(1).all()[0]
+}
+
+export function toTrafficFlowSettingsDto(
+  listener: { bound: boolean; address: string | null },
+): TrafficFlowSettingsDto {
+  const row = getTrafficFlowSettingsRow()
+  return {
+    enabled: row.enabled,
+    collectorIp: row.collectorIp,
+    flowListenPort: row.flowListenPort,
+    wgListenPort: row.wgListenPort,
+    prefix: row.prefix,
+    publicEndpoint: row.publicEndpoint,
+    hostPublicKey: row.hostPublicKey,
+    hasHostPrivateKey: Boolean(row.hostPrivateKey),
+    hubServerId: row.hubServerId ?? null,
+    retentionHours: row.retentionHours,
+    topN: row.topN,
+    lastDatagramAt: row.lastDatagramAt ?? null,
+    lastExporterIp: row.lastExporterIp ?? null,
+    lastError: row.lastError || null,
+    packetsReceived: row.packetsReceived,
+    listenerBound: listener.bound,
+    listenerAddress: listener.address,
+    peers: parsePeers(row.peersJson),
+  }
+}
+
+export function updateTrafficFlowSettings(patch: TrafficFlowSettingsPatch) {
+  const row = getTrafficFlowSettingsRow()
+  db.update(trafficFlowSettings).set({
+    enabled: patch.enabled ?? row.enabled,
+    collectorIp: patch.collectorIp ?? row.collectorIp,
+    flowListenPort: patch.flowListenPort ?? row.flowListenPort,
+    wgListenPort: patch.wgListenPort ?? row.wgListenPort,
+    prefix: patch.prefix ?? row.prefix,
+    publicEndpoint: patch.publicEndpoint ?? row.publicEndpoint,
+    hubServerId: patch.hubServerId === undefined ? row.hubServerId : patch.hubServerId,
+    retentionHours: patch.retentionHours ?? row.retentionHours,
+    topN: patch.topN ?? row.topN,
+    updatedAt: nowIso(),
+  }).where(eq(trafficFlowSettings.id, 1)).run()
+  return getTrafficFlowSettingsRow()
+}
+
+export function ensureHostKeys(): { publicKey: string; created: boolean } {
+  const row = getTrafficFlowSettingsRow()
+  if (row.hostPublicKey && row.hostPrivateKey) {
+    return { publicKey: row.hostPublicKey, created: false }
+  }
+  const keys = generateWireGuardKeyPair()
+  db.update(trafficFlowSettings).set({
+    hostPublicKey: keys.publicKey,
+    hostPrivateKey: keys.privateKey,
+    updatedAt: nowIso(),
+  }).where(eq(trafficFlowSettings.id, 1)).run()
+  return { publicKey: keys.publicKey, created: true }
+}
+
+export function upsertHostPeer(peer: FlowHostPeer) {
+  const row = getTrafficFlowSettingsRow()
+  const peers = parsePeers(row.peersJson).filter((p) => p.serverId !== peer.serverId)
+  peers.push(peer)
+  db.update(trafficFlowSettings).set({
+    peersJson: JSON.stringify(peers),
+    updatedAt: nowIso(),
+  }).where(eq(trafficFlowSettings.id, 1)).run()
+}
+
+export function recordFlowPacket(exporterIp: string) {
+  const row = getTrafficFlowSettingsRow()
+  db.update(trafficFlowSettings).set({
+    lastDatagramAt: nowIso(),
+    lastExporterIp: exporterIp,
+    packetsReceived: row.packetsReceived + 1,
+    updatedAt: nowIso(),
+  }).where(eq(trafficFlowSettings.id, 1)).run()
+}
+
+export function recordFlowListenerError(message: string) {
+  db.update(trafficFlowSettings).set({
+    lastError: message,
+    updatedAt: nowIso(),
+  }).where(eq(trafficFlowSettings.id, 1)).run()
+}
+
+export function enableTrafficFlowIngest() {
+  db.update(trafficFlowSettings).set({
+    enabled: true,
+    updatedAt: nowIso(),
+  }).where(eq(trafficFlowSettings.id, 1)).run()
+}
+
+export function listHostPeers(): FlowHostPeer[] {
+  return parsePeers(getTrafficFlowSettingsRow().peersJson)
+}

backend/src/services/traffic-rate.test.ts

@@ -97,4 +97,29 @@ const listed = buildTrafficFromSamples([...samples, ...wgSamples], start, end, [
 assert.equal(userAgg.rxNow, listed.rxNow, "сумма привязанных ifaces = фильтр по списку имён")
 assert.ok(userAgg.rxNow > built.rxNow, "агрегация пользователя больше одного iface")
 
+const peerA: TrafficSampleLike[] = [
+  { interfaceName: "wg-server", peerPublicKey: "peer-a", sampledAt: t0, rxBytes: 1_000_000, txBytes: 100_000, rxBps: 0, txBps: 0, running: true, disabled: false },
+  { interfaceName: "wg-server", peerPublicKey: "peer-a", sampledAt: t1, rxBytes: 1_000_000 + 3_750_000, txBytes: 100_000 + 375_000, rxBps: 0, txBps: 0, running: true, disabled: false },
+]
+const peerB: TrafficSampleLike[] = [
+  { interfaceName: "wg-server", peerPublicKey: "peer-b", sampledAt: t0, rxBytes: 500_000, txBytes: 50_000, rxBps: 0, txBps: 0, running: true, disabled: false },
+  { interfaceName: "wg-server", peerPublicKey: "peer-b", sampledAt: t1, rxBytes: 500_000 + 1_875_000, txBytes: 50_000 + 187_500, rxBps: 0, txBps: 0, running: true, disabled: false },
+]
+const ifaceWg: TrafficSampleLike[] = [
+  { interfaceName: "wg-server", sampledAt: t0, rxBytes: 10_000_000, txBytes: 2_000_000, rxBps: 0, txBps: 0, running: true, disabled: false },
+  { interfaceName: "wg-server", sampledAt: t1, rxBytes: 10_000_000 + 7_500_000, txBytes: 2_000_000 + 750_000, rxBps: 0, txBps: 0, running: true, disabled: false },
+]
+const mixed = [...peerA, ...peerB, ...ifaceWg]
+const rateA = buildTrafficFromSamples(mixed, start, end, "wg-server", "peer-a")
+const rateB = buildTrafficFromSamples(mixed, start, end, "wg-server", "peer-b")
+const rateIface = buildTrafficFromSamples(mixed, start, end, "wg-server")
+assert.ok(rateA.rxNow > 0 && rateB.rxNow > 0, "скорость по каждому пиру")
+assert.notEqual(rateA.rxNow, rateB.rxNow, "два пира одного iface — разный rate")
+assert.ok(rateIface.rxNow > rateA.rxNow, "iface-level не суммирует пиров")
+assert.equal(
+  buildTrafficFromSamples(mixed, start, end).rxNow,
+  rateIface.rxNow,
+  "режим сервера игнорирует семплы пиров",
+)
+
 console.log("traffic-rate tests ok")

backend/src/services/traffic-rate.ts

@@ -4,6 +4,7 @@ export const SERIES_POINTS = 60
 
 export interface TrafficSampleLike {
   interfaceName: string
+  peerPublicKey?: string
   sampledAt: string
   rxBytes: number
   txBytes: number
@@ -94,11 +95,16 @@ function parseIsoMs(iso: string): number {
   return Number.isFinite(t) ? t : 0
 }
 
+export function sampleSeriesKey(interfaceName: string, peerPublicKey = ""): string {
+  return `${interfaceName}\0${peerPublicKey}`
+}
+
 export function buildTrafficFromSamples(
   rows: TrafficSampleLike[],
   rangeStartMs: number,
   rangeEndMs: number,
   onlyInterface?: string | readonly string[],
+  peerPublicKey?: string,
 ): BuiltTrafficSeries {
   const empty: BuiltTrafficSeries = {
     rxNow: 0,
@@ -113,11 +119,12 @@ export function buildTrafficFromSamples(
   }
   if (rows.length === 0) return empty
 
-  const byIface = new Map<string, TrafficSampleLike[]>()
+  const bySeries = new Map<string, TrafficSampleLike[]>()
   for (const r of rows) {
-    const arr = byIface.get(r.interfaceName) ?? []
+    const peer = r.peerPublicKey ?? ""
+    const arr = bySeries.get(sampleSeriesKey(r.interfaceName, peer)) ?? []
     arr.push(r)
-    byIface.set(r.interfaceName, arr)
+    bySeries.set(sampleSeriesKey(r.interfaceName, peer), arr)
   }
 
   const allowList = Array.isArray(onlyInterface)
@@ -132,12 +139,20 @@ export function buildTrafficFromSamples(
   let txBytesDelta = 0
   let sessions = 0
 
-  for (const [name, arr] of byIface) {
+  for (const [key, arr] of bySeries) {
+    const sep = key.indexOf("\0")
+    const name = sep >= 0 ? key.slice(0, sep) : key
+    const peer = sep >= 0 ? key.slice(sep + 1) : ""
     if (allowList) {
       if (!allowList.includes(name)) continue
     } else if (isLoopbackName(name)) {
       continue
     }
+    if (peerPublicKey === undefined) {
+      if (peer !== "") continue
+    } else if (peer !== peerPublicKey) {
+      continue
+    }
 
     const sorted = [...arr].sort((a, b) => a.sampledAt.localeCompare(b.sampledAt))
     const last = sorted[sorted.length - 1]

backend/src/services/traffic-users.ts

@@ -17,6 +17,8 @@ export interface BoundIfaceTrafficDto {
   userName: string
   interfaceName: string
   interfaceType: string
+  peerPublicKey: string
+  peerName: string
   comment: string
   serverId: string
   serverName: string
@@ -77,22 +79,6 @@ export function buildUserTrafficList(rangeStartMs: number, rangeEndMs: number):
   return users.map((user) => {
     const parts: BuiltTrafficSeries[] = []
     const interfaces: BoundIfaceTrafficDto[] = []
-    const byServer = new Map<number, string[]>()
-    for (const b of user.bindings) {
-      const arr = byServer.get(b.serverId) ?? []
-      arr.push(b.interfaceName)
-      byServer.set(b.serverId, arr)
-    }
-
-    for (const [serverId, names] of byServer) {
-      let rows = sampleCache.get(serverId)
-      if (!rows) {
-        rows = readServerSamplesInRange(serverId, sinceIso)
-        sampleCache.set(serverId, rows)
-      }
-      const built = buildTrafficFromSamples(rows, rangeStartMs, rangeEndMs, names)
-      parts.push(built)
-    }
 
     for (const b of user.bindings) {
       let rows = sampleCache.get(b.serverId)
@@ -100,19 +86,25 @@ export function buildUserTrafficList(rangeStartMs: number, rangeEndMs: number):
         rows = readServerSamplesInRange(b.serverId, sinceIso)
         sampleCache.set(b.serverId, rows)
       }
-      const built = buildTrafficFromSamples(rows, rangeStartMs, rangeEndMs, b.interfaceName)
-      const last = [...rows.filter((r) => r.interfaceName === b.interfaceName)]
+      const peerKey = b.peerPublicKey ?? ""
+      const built = buildTrafficFromSamples(rows, rangeStartMs, rangeEndMs, b.interfaceName, peerKey)
+      parts.push(built)
+      const last = [...rows.filter((r) =>
+        r.interfaceName === b.interfaceName && (r.peerPublicKey ?? "") === peerKey,
+      )]
         .sort((a, c) => a.sampledAt.localeCompare(c.sampledAt))
         .at(-1)
       const running = Boolean(last?.running) && !last?.disabled
       interfaces.push({
-        id: `${b.userId}:${b.serverId}:${b.interfaceName}`,
+        id: `${b.userId}:${b.serverId}:${b.interfaceName}:${peerKey || "_iface"}`,
         bindingId: b.id,
         userId: user.id,
         userLogin: user.login,
         userName: user.name,
         interfaceName: b.interfaceName,
         interfaceType: b.interfaceType,
+        peerPublicKey: peerKey,
+        peerName: b.peerName ?? "",
         comment: b.comment,
         serverId: String(b.serverId),
         serverName: b.serverName,

backend/src/services/wg-keys.ts

@@ -0,0 +1,12 @@
+import { generateKeyPairSync } from "node:crypto"
+
+/** WireGuard Curve25519 keypair as RouterOS/wg-quick base64 (32 bytes). */
+export function generateWireGuardKeyPair(): { publicKey: string; privateKey: string } {
+  const { publicKey, privateKey } = generateKeyPairSync("x25519")
+  const pubDer = publicKey.export({ type: "spki", format: "der" })
+  const privDer = privateKey.export({ type: "pkcs8", format: "der" })
+  return {
+    publicKey: Buffer.from(pubDer.subarray(-32)).toString("base64"),
+    privateKey: Buffer.from(privDer.subarray(-32)).toString("base64"),
+  }
+}

backend/src/services/wireguard-config.ts

@@ -35,7 +35,7 @@ export type WgParsedConfig = {
 
 export type WgExportIface = {
   name: string
-  listenPort: number
+  listenPort?: number
   mtu: number
   comment?: string
   enabled?: boolean
@@ -258,7 +258,7 @@ export function generateNativeConf(iface: WgExportIface, opts?: { includePrivate
     lines.push(`# PrivateKey = <заполните приватный ключ с роутера>`)
   }
   if (iface.address) lines.push(`Address = ${iface.address}`)
-  lines.push(`ListenPort = ${iface.listenPort}`)
+  if (iface.listenPort) lines.push(`ListenPort = ${iface.listenPort}`)
   if (iface.mtu) lines.push(`MTU = ${iface.mtu}`)
   lines.push(``)
 
@@ -312,7 +312,7 @@ export function generateMikrotikRsc(iface: WgExportIface): string {
   lines.push(``)
   lines.push(`/interface wireguard add \\`)
   lines.push(`  name=${iface.name} \\`)
-  lines.push(`  listen-port=${iface.listenPort} \\`)
+  lines.push(`  listen-port=${iface.listenPort ?? 13231} \\`)
   lines.push(`  mtu=${iface.mtu} \\`)
   if (iface.privateKey) lines.push(`  private-key="${iface.privateKey}" \\`)
   if (iface.comment) lines.push(`  comment="${iface.comment.replace(/"/g, '\\"')}" \\`)

backend/src/services/wireguard-live.ts

@@ -211,4 +211,51 @@ export function getEnabledServerById(serverId: string | number): ServerRow | nul
   return db.select().from(servers).where(eq(servers.id, id)).limit(1).all()[0] ?? null
 }
 
+export type CatalogWgPeer = {
+  interfaceName: string
+  publicKey: string
+  name: string
+  comment: string
+  allowedIps: string[]
+  latestHandshake?: string
+  disabled: boolean
+}
+
+const WG_CATALOG_TIMEOUT_MS = 5_000
+
+export async function listWireGuardPeersForCatalog(serverId: number): Promise<{
+  peers: CatalogWgPeer[]
+  error?: string
+}> {
+  const row = getEnabledServerById(serverId)
+  if (!row) return { peers: [], error: "Сервер не найден" }
+  try {
+    const client = MikrotikClient.fromServer(row)
+    const peersRaw = await Promise.race([
+      client.get<RosWireGuardPeer[]>("/interface/wireguard/peers"),
+      new Promise<never>((_, reject) => {
+        setTimeout(() => reject(new Error("Таймаут RouterOS")), WG_CATALOG_TIMEOUT_MS)
+      }),
+    ])
+    const peers: CatalogWgPeer[] = peersRaw.flatMap((p, idx) => {
+      const mapped = mapPeer(p, idx)
+      const interfaceName = (p.interface ?? "").trim()
+      const publicKey = mapped.publicKey.trim()
+      if (!interfaceName || !publicKey) return []
+      return [{
+        interfaceName,
+        publicKey,
+        name: mapped.name ?? "",
+        comment: mapped.comment ?? "",
+        allowedIps: mapped.allowedIps,
+        latestHandshake: mapped.latestHandshake,
+        disabled: mapped.disabled === true,
+      }]
+    })
+    return { peers }
+  } catch (e) {
+    return { peers: [], error: e instanceof Error ? e.message : String(e) }
+  }
+}
+
 export { type RosWireGuard, type RosWireGuardPeer }

backend/src/services/wireguard-ros.ts

@@ -0,0 +1,50 @@
+import type { MikrotikClient } from "./mikrotik.js"
+
+/** Общие PUT iface / peer / address для `/wireguard` и traffic-flow overlay. */
+export function toRosBody(obj: Record<string, string | undefined>): Record<string, string> {
+  const out: Record<string, string> = {}
+  for (const [k, v] of Object.entries(obj)) {
+    if (v !== undefined && v !== "") out[k] = v
+  }
+  return out
+}
+
+export function asRosArray<T>(raw: unknown): T[] {
+  if (Array.isArray(raw)) return raw as T[]
+  if (raw && typeof raw === "object") return [raw as T]
+  return []
+}
+
+export function rosRowId(row: Record<string, unknown>): string {
+  return String(row[".id"] ?? row.id ?? "")
+}
+
+export async function putWireguardInterface(
+  client: MikrotikClient,
+  fields: Record<string, string | undefined>,
+): Promise<void> {
+  await client.put("/interface/wireguard", toRosBody(fields))
+}
+
+export async function putIpAddress(
+  client: MikrotikClient,
+  address: string,
+  iface: string,
+): Promise<void> {
+  await client.put("/ip/address", { address, interface: iface })
+}
+
+export async function putWireguardPeer(
+  client: MikrotikClient,
+  fields: Record<string, string | undefined>,
+): Promise<void> {
+  await client.put("/interface/wireguard/peers", toRosBody(fields))
+}
+
+export async function patchRosPath(
+  client: MikrotikClient,
+  path: string,
+  fields: Record<string, string | undefined>,
+): Promise<void> {
+  await client.patch(path, toRosBody(fields))
+}

components/data-grids/traffic-flows-data-grid.tsx

@@ -0,0 +1,129 @@
+"use client"
+
+import { useMemo } from "react"
+import { type ColumnDef, getCoreRowModel, useReactTable } from "@tanstack/react-table"
+import type { FlowTalkerDto } from "@mmapp/contracts/traffic-flow"
+import { DataGridShell } from "@/components/data-grids/shared/data-grid-shell"
+import {
+  DATA_GRID_CELL_PAD,
+  DATA_GRID_CELL_PAD_FIRST,
+  DATA_GRID_CELL_PAD_LAST,
+} from "@/components/data-grids/shared/data-grid-layout"
+import { fmtRate } from "@/lib/fmt-rate"
+import { cn } from "@/lib/utils"
+
+function formatBytes(n: number): string {
+  if (n >= 1_000_000_000) return `${(n / 1_000_000_000).toFixed(2)} ГБ`
+  if (n >= 1_000_000) return `${(n / 1_000_000).toFixed(1)} МБ`
+  if (n >= 1000) return `${(n / 1000).toFixed(1)} КБ`
+  return `${n} Б`
+}
+
+function TrafficFlowsDataGrid({
+  rows,
+  emptyHint,
+}: {
+  rows: FlowTalkerDto[]
+  emptyHint?: string
+}) {
+  const columns = useMemo<ColumnDef<FlowTalkerDto>[]>(
+    () => [
+      {
+        id: "server",
+        accessorKey: "serverName",
+        header: () => <span className="text-xs font-medium text-muted-foreground">JH</span>,
+        cell: ({ row }) => <span className="text-sm font-medium">{row.original.serverName}</span>,
+        meta: { headerClassName: DATA_GRID_CELL_PAD_FIRST, cellClassName: DATA_GRID_CELL_PAD_FIRST },
+      },
+      {
+        id: "src",
+        accessorKey: "src",
+        header: () => <span className="text-xs font-medium text-muted-foreground">Src</span>,
+        cell: ({ row }) => (
+          <span className="font-mono text-xs">
+            {row.original.src}
+            {row.original.srcPort ? `:${row.original.srcPort}` : ""}
+          </span>
+        ),
+        meta: { headerClassName: DATA_GRID_CELL_PAD, cellClassName: DATA_GRID_CELL_PAD },
+      },
+      {
+        id: "dst",
+        accessorKey: "dst",
+        header: () => <span className="text-xs font-medium text-muted-foreground">Dst</span>,
+        cell: ({ row }) => (
+          <span className="font-mono text-xs">
+            {row.original.dst}
+            {row.original.dstPort ? `:${row.original.dstPort}` : ""}
+          </span>
+        ),
+        meta: { headerClassName: DATA_GRID_CELL_PAD, cellClassName: DATA_GRID_CELL_PAD },
+      },
+      {
+        id: "app",
+        accessorFn: (r) => r.application ?? r.protoName,
+        header: () => <span className="text-xs font-medium text-muted-foreground">App</span>,
+        cell: ({ row }) => (
+          <span className="flex min-w-0 flex-col gap-0.5 text-xs">
+            <span>{row.original.application ?? row.original.protoName}</span>
+            {row.original.category || row.original.service ? (
+              <span className="text-[10px] text-muted-foreground truncate">
+                {[row.original.category, row.original.service].filter(Boolean).join(" · ")}
+              </span>
+            ) : null}
+          </span>
+        ),
+        meta: { headerClassName: DATA_GRID_CELL_PAD, cellClassName: DATA_GRID_CELL_PAD },
+      },
+      {
+        id: "proto",
+        accessorKey: "protoName",
+        header: () => <span className="text-xs font-medium text-muted-foreground">Proto</span>,
+        cell: ({ row }) => <span className="text-xs">{row.original.protoName}</span>,
+        meta: { headerClassName: DATA_GRID_CELL_PAD, cellClassName: DATA_GRID_CELL_PAD },
+      },
+      {
+        id: "rate",
+        accessorFn: (r) => r.bps,
+        header: () => <span className="text-xs font-medium text-muted-foreground">Скорость</span>,
+        cell: ({ row }) => <span className="text-xs tabular-nums">{fmtRate(row.original.bps / 1_000_000)}</span>,
+        meta: { headerClassName: DATA_GRID_CELL_PAD, cellClassName: DATA_GRID_CELL_PAD },
+      },
+      {
+        id: "bytes",
+        accessorKey: "bytes",
+        header: () => <span className="text-xs font-medium text-muted-foreground">Байты</span>,
+        cell: ({ row }) => <span className="text-xs tabular-nums">{formatBytes(row.original.bytes)}</span>,
+        meta: { headerClassName: DATA_GRID_CELL_PAD, cellClassName: DATA_GRID_CELL_PAD },
+      },
+      {
+        id: "iface",
+        accessorKey: "inIface",
+        header: () => <span className="text-xs font-medium text-muted-foreground">Iface</span>,
+        cell: ({ row }) => <span className="font-mono text-xs text-muted-foreground">{row.original.inIface || "—"}</span>,
+        meta: { headerClassName: DATA_GRID_CELL_PAD_LAST, cellClassName: cn(DATA_GRID_CELL_PAD_LAST) },
+      },
+    ],
+    [],
+  )
+
+  const table = useReactTable({
+    data: rows,
+    columns,
+    getCoreRowModel: getCoreRowModel(),
+    getRowId: (row, i) => `${row.serverId}-${row.src}-${row.dst}-${row.proto}-${row.srcPort}-${row.dstPort}-${i}`,
+  })
+
+  return (
+    <DataGridShell
+      table={table}
+      recordCount={rows.length}
+      emptyMessage={
+        emptyHint
+        || "Пока нет IPFIX. Поднимите wg-flow на хосте MM и подключите jump-host одним кликом."
+      }
+    />
+  )
+}
+
+export { TrafficFlowsDataGrid }

components/data-grids/users-expanded-detail.tsx

@@ -12,7 +12,7 @@ import {
   type AppUser,
   type InterfaceType,
 } from "@/lib/users"
-import { CableIcon, NetworkIcon, ShieldIcon } from "lucide-react"
+import { CableIcon, KeyRoundIcon, NetworkIcon, ShieldIcon } from "lucide-react"
 
 const TYPE_VARIANT: Record<InterfaceType, "outline" | "info-light" | "success-light" | "secondary"> = {
   ether: "outline",
@@ -87,23 +87,29 @@ function UsersExpandedDetail({
               <div className="grid grid-cols-2 sm:grid-cols-3 xl:grid-cols-5 gap-2">
                 {items.map((b) => {
                   const meta = TYPE_ICON[b.interfaceType]
-                  const Icon = meta.icon
+                  const Icon = b.interfaceType === "wg" && b.peerPublicKey ? KeyRoundIcon : meta.icon
+                  const iconClass = b.interfaceType === "wg" && b.peerPublicKey ? "text-success" : meta.className
                   return (
                     <div
                       key={b.id}
                       className="flex items-start gap-2 rounded-md border px-3 py-2.5"
                     >
-                      <IconTile variant="elevated" className={cn("size-10.5 shrink-0", meta.className)}>
+                      <IconTile variant="elevated" className={cn("size-10.5 shrink-0", iconClass)}>
                         <Icon />
                       </IconTile>
                       <div className="min-w-0">
                         <p className="text-xs font-mono font-medium leading-tight truncate">
-                          {b.interfaceName}
+                          {b.interfaceType === "wg" && (b.peerName || b.peerPublicKey)
+                            ? `${b.peerName || "peer"} · ${b.interfaceName}`
+                            : b.interfaceName}
                         </p>
                         <div className="flex flex-wrap items-center gap-1 mt-0.5">
                           <Badge variant={TYPE_VARIANT[b.interfaceType]} size="sm">
                             {IFACE_TYPE_LABEL[b.interfaceType]}
                           </Badge>
+                          {b.interfaceType === "wg" && !(b.peerPublicKey ?? "") ? (
+                            <Badge variant="warning-light" size="sm">весь интерфейс</Badge>
+                          ) : null}
                           {b.comment ? (
                             <span className="text-[10px] text-muted-foreground leading-tight truncate">
                               {b.comment}

components/reui-kit/code-export-sheet.tsx

@@ -60,10 +60,10 @@ function highlightLine(line: string): string {
   return "text-foreground/90"
 }
 
-function CodeBlock({ code }: { code: string }) {
+function CodeBlock({ code, className }: { code: string; className?: string }) {
   const lines = code.length ? code.split("\n") : [""]
   return (
-    <pre className="px-4 py-3.5 text-[12px] font-mono leading-[1.65] whitespace-pre-wrap break-all select-all">
+    <pre className={cn("px-4 py-3.5 text-[12px] font-mono leading-[1.65] whitespace-pre-wrap break-all select-all", className)}>
       {lines.map((line, i) => (
         <span key={i} className={cn("block", highlightLine(line))}>
           {line || " "}
@@ -281,4 +281,4 @@ function CodeExportSheet({
   )
 }
 
-export { CodeExportSheet, downloadText }
+export { CodeExportSheet, CodeBlock, downloadText }

components/traffic/flow-analytics-panel.tsx

@@ -0,0 +1,439 @@
+"use client"
+
+import { useMemo, useState } from "react"
+import { type ColumnDef, getCoreRowModel, useReactTable } from "@tanstack/react-table"
+import type { FlowAnalyticsDto, FlowBreakdownRow, FlowEntityCard } from "@mmapp/contracts/traffic-flow"
+import { ArrowDownIcon, ArrowUpIcon, GitBranchIcon, GlobeIcon, LayersIcon, UsersIcon } from "lucide-react"
+import { Badge } from "@/components/reui/badge"
+import { KpiStatGrid } from "@/components/reui-kit/kpi-stat-grid"
+import { TrafficRxTxChart } from "@/components/reui-kit/traffic-rx-tx-chart"
+import { Tabs, TabsContent, TabsList, TabsTrigger } from "@/components/ui/tabs"
+import { Switch } from "@/components/ui/switch"
+import { Label } from "@/components/ui/label"
+import { DataGridShell } from "@/components/data-grids/shared/data-grid-shell"
+import {
+  DATA_GRID_CELL_PAD,
+  DATA_GRID_CELL_PAD_FIRST,
+  DATA_GRID_CELL_PAD_LAST,
+} from "@/components/data-grids/shared/data-grid-layout"
+import { TrafficFlowsDataGrid } from "@/components/data-grids/traffic-flows-data-grid"
+import { FlowTrafficMap } from "@/components/traffic/flow-traffic-map"
+import { StatusDot } from "@/components/status-dot"
+import { Flag } from "@/components/flag"
+import { fmtRate } from "@/lib/fmt-rate"
+import { cn } from "@/lib/utils"
+
+function formatBytes(n: number): string {
+  if (n >= 1_000_000_000) return `${(n / 1_000_000_000).toFixed(2)} ГБ`
+  if (n >= 1_000_000) return `${(n / 1_000_000).toFixed(1)} МБ`
+  if (n >= 1000) return `${(n / 1000).toFixed(1)} КБ`
+  return `${n} Б`
+}
+
+const RANGE_KEYS = ["5m", "15m", "1h", "4h", "24h"] as const
+const RANGE_LABELS: Record<string, string> = {
+  "5m": "5м",
+  "15m": "15м",
+  "1h": "1ч",
+  "4h": "4ч",
+  "24h": "24ч",
+}
+
+function MiniAreaChart({ rx, tx, height = 44 }: { rx: number[]; tx: number[]; height?: number }) {
+  const W = 300
+  const H = height
+  const maxVal = Math.max(...rx, ...tx, 1) * 1.1
+  const xAt = (i: number) => (rx.length <= 1 ? 0 : (i / (rx.length - 1)) * W)
+  const yAt = (v: number) => H - (v / maxVal) * H
+  const area = (arr: number[]) => {
+    const pts = arr.map((v, i) => `${xAt(i).toFixed(1)},${yAt(v).toFixed(1)}`).join(" L ")
+    return `M 0,${H} L ${pts} L ${W},${H} Z`
+  }
+  const line = (arr: number[]) => arr.map((v, i) => `${xAt(i).toFixed(1)},${yAt(v).toFixed(1)}`).join(" ")
+  return (
+    <svg viewBox={`0 0 ${W} ${H}`} className="w-full h-11" preserveAspectRatio="none">
+      <path d={area(rx)} fill="var(--chart-rx)" fillOpacity="0.15" />
+      <polyline points={line(rx)} fill="none" stroke="var(--chart-rx)" strokeWidth="1.5" />
+      {tx.some((v) => v > 0) ? (
+        <polyline points={line(tx)} fill="none" stroke="var(--chart-tx)" strokeWidth="1.5" />
+      ) : null}
+    </svg>
+  )
+}
+
+export function FlowEntityCardView({
+  card,
+  selected,
+  onClick,
+}: {
+  card: FlowEntityCard
+  selected: boolean
+  onClick: () => void
+}) {
+  return (
+    <button
+      type="button"
+      onClick={onClick}
+      className={cn(
+        "text-left w-full rounded-lg border p-3 transition-colors hover:bg-muted/50",
+        selected ? "border-primary bg-primary/5" : "border-border bg-card",
+        card.status === "offline" && "opacity-60",
+      )}
+    >
+      <div className="flex items-center justify-between gap-2 mb-2">
+        <div className="flex items-center gap-1.5 min-w-0">
+          <StatusDot status={card.status} />
+          <span className="text-xs font-medium truncate">{card.name}</span>
+        </div>
+        <span className="text-[10px] font-mono text-muted-foreground shrink-0 flex items-center gap-1">
+          {card.country !== "UN" ? <Flag code={card.country} /> : null}
+          {card.site}
+        </span>
+      </div>
+      <MiniAreaChart rx={card.rxSeries} tx={card.txSeries} />
+      <div className="flex justify-between mt-2 gap-2">
+        <div className="flex items-center gap-1 text-[11px]">
+          <ArrowDownIcon className="size-3 text-success" />
+          <span className="font-mono font-medium text-success">{fmtRate(card.rxNow)}</span>
+        </div>
+        <div className="flex items-center gap-1 text-[11px]">
+          <ArrowUpIcon className="size-3 text-info" />
+          <span className="font-mono font-medium text-info">{fmtRate(card.txNow)}</span>
+        </div>
+        <div className="flex items-center gap-0.5 text-[10px] text-muted-foreground">
+          <GitBranchIcon className="size-3" />{card.sessions}
+        </div>
+      </div>
+    </button>
+  )
+}
+
+function FlowBreakdownGrid({
+  rows,
+  empty,
+  country,
+}: {
+  rows: FlowBreakdownRow[]
+  empty?: string
+  country?: boolean
+}) {
+  const columns = useMemo<ColumnDef<FlowBreakdownRow>[]>(
+    () => [
+      {
+        id: "label",
+        accessorKey: "label",
+        header: () => <span className="text-xs font-medium text-muted-foreground">Имя</span>,
+        cell: ({ row }) => (
+          <div className="flex min-w-0 flex-col gap-1">
+            <span className="flex items-center gap-1.5 text-sm font-medium truncate">
+              {country ? <Flag code={row.original.id} /> : null}
+              {row.original.label}
+            </span>
+            <div className="h-1 rounded-full bg-muted overflow-hidden">
+              <div
+                className="h-full bg-primary"
+                style={{ width: `${Math.min(100, row.original.percent)}%` }}
+              />
+            </div>
+          </div>
+        ),
+        meta: { headerClassName: DATA_GRID_CELL_PAD_FIRST, cellClassName: DATA_GRID_CELL_PAD_FIRST },
+      },
+      {
+        id: "share",
+        accessorKey: "percent",
+        header: () => <span className="text-xs font-medium text-muted-foreground">Доля</span>,
+        cell: ({ row }) => (
+          <span className="text-xs tabular-nums">{row.original.percent.toFixed(1)}%</span>
+        ),
+        meta: { headerClassName: DATA_GRID_CELL_PAD, cellClassName: DATA_GRID_CELL_PAD },
+      },
+      {
+        id: "rate",
+        accessorFn: (r) => r.bps,
+        header: () => <span className="text-xs font-medium text-muted-foreground">Скорость</span>,
+        cell: ({ row }) => (
+          <span className="text-xs tabular-nums">{fmtRate(row.original.bps / 1_000_000)}</span>
+        ),
+        meta: { headerClassName: DATA_GRID_CELL_PAD, cellClassName: DATA_GRID_CELL_PAD },
+      },
+      {
+        id: "bytes",
+        accessorKey: "bytes",
+        header: () => <span className="text-xs font-medium text-muted-foreground">Байты</span>,
+        cell: ({ row }) => (
+          <span className="text-xs tabular-nums">{formatBytes(row.original.bytes)}</span>
+        ),
+        meta: { headerClassName: DATA_GRID_CELL_PAD_LAST, cellClassName: DATA_GRID_CELL_PAD_LAST },
+      },
+    ],
+    [country],
+  )
+
+  const table = useReactTable({
+    data: rows,
+    columns,
+    getCoreRowModel: getCoreRowModel(),
+    getRowId: (row) => row.id,
+  })
+
+  return (
+    <DataGridShell table={table} recordCount={rows.length} emptyMessage={empty ?? "Нет данных за период"} />
+  )
+}
+
+export function FlowAnalyticsDetail({
+  card,
+  analytics,
+  range,
+  onRange,
+  selectedIface,
+  onIface,
+  dedup,
+  onDedup,
+  liveHint,
+  emptyHint,
+}: {
+  card: FlowEntityCard | null
+  analytics: FlowAnalyticsDto | null
+  range: string
+  onRange: (r: string) => void
+  selectedIface: string
+  onIface: (name: string) => void
+  dedup: boolean
+  onDedup: (value: boolean) => void
+  liveHint?: string
+  emptyHint?: string
+}) {
+  const [slice, setSlice] = useState("applications")
+  const [mapCountry, setMapCountry] = useState<string | null>(null)
+  const rxNow = analytics ? analytics.bpsNow / 1_000_000 : (card?.rxNow ?? 0)
+  const bytes = analytics?.bytes ?? card?.bytes ?? 0
+  const sessionRows = (analytics?.conversationsList ?? []).filter((row) =>
+    mapCountry ? row.dstCountry === mapCountry : true,
+  )
+
+  if (!card) {
+    return (
+      <p className="text-sm text-muted-foreground py-8 text-center">
+        Выберите сервер или клиента слева
+      </p>
+    )
+  }
+
+  return (
+    <>
+      <div className="flex items-start justify-between mb-3 gap-3">
+        <div className="flex items-center gap-2 flex-wrap min-w-0">
+          <StatusDot status={card.status} />
+          <h2 className="text-base font-semibold truncate">{card.name}</h2>
+          <span className="text-xs font-mono bg-muted px-1.5 py-0.5 rounded flex items-center gap-1">
+            {card.country !== "UN" ? <Flag code={card.country} /> : null}
+            {card.site}
+          </span>
+        </div>
+        <div className="flex items-center gap-3 shrink-0">
+          <div className="flex items-center gap-2">
+            <Switch
+              id="flow-dedup"
+              checked={dedup}
+              onCheckedChange={onDedup}
+            />
+            <Label htmlFor="flow-dedup" className="text-xs text-muted-foreground whitespace-nowrap">
+              Без дублей
+            </Label>
+          </div>
+          <div className="flex gap-1">
+            {RANGE_KEYS.map((r) => (
+              <button
+                key={r}
+                type="button"
+                onClick={() => onRange(r)}
+                className={cn(
+                  "h-7 px-2 text-xs rounded border transition-colors",
+                  range === r
+                    ? "border-primary bg-primary/10 text-primary font-medium"
+                    : "border-border text-muted-foreground hover:text-foreground",
+                )}
+              >
+                {RANGE_LABELS[r]}
+              </button>
+            ))}
+          </div>
+        </div>
+      </div>
+
+      {analytics?.ifaces && analytics.ifaces.length > 0 ? (
+        <div className="mb-3 pb-3 border-b">
+          <div className="flex items-center gap-2 flex-wrap">
+            <span className="text-[11px] text-muted-foreground mr-1">Интерфейс:</span>
+            <button
+              type="button"
+              onClick={() => onIface("__all__")}
+              className={cn(
+                "inline-flex items-center gap-1 rounded-full border px-2.5 py-0.5 text-[10px] font-medium transition-all",
+                selectedIface === "__all__"
+                  ? "bg-foreground text-background border-foreground"
+                  : "border-border text-muted-foreground hover:text-foreground hover:border-foreground/40",
+              )}
+            >
+              Все
+            </button>
+            {analytics.ifaces.map((iface) => {
+              const active = selectedIface === iface.name
+              return (
+                <button
+                  key={`${iface.name}:${iface.index}`}
+                  type="button"
+                  onClick={() => onIface(iface.name)}
+                  className={cn(
+                    "inline-flex items-center gap-1.5 rounded-full border px-2.5 py-0.5 text-[10px] font-medium transition-all",
+                    active
+                      ? "bg-foreground text-background border-foreground"
+                      : "border-border text-muted-foreground hover:text-foreground hover:border-foreground/40",
+                  )}
+                >
+                  {iface.name}
+                </button>
+              )
+            })}
+          </div>
+          <p className="text-[10px] text-muted-foreground mt-1.5">по iface, без дедупа</p>
+        </div>
+      ) : null}
+
+      <TrafficRxTxChart
+        rx={analytics?.rxSeries ?? card.rxSeries}
+        tx={analytics?.txSeries ?? card.txSeries}
+        range={range}
+      />
+
+      <div className="mt-4 pt-4 border-t">
+        <KpiStatGrid
+          aria-label="Скорость потоков"
+          items={[
+            {
+              id: "bps-now",
+              label: "Скорость сейчас",
+              value: fmtRate(rxNow),
+              hint: liveHint,
+              icon: <ArrowDownIcon className="size-4" />,
+              iconClassName: "text-success",
+            },
+            {
+              id: "bytes",
+              label: "Байт за период",
+              value: formatBytes(bytes),
+              icon: <ArrowUpIcon className="size-4" />,
+              iconClassName: "text-info",
+            },
+            {
+              id: "flows",
+              label: "Сессии",
+              value: String(analytics?.conversations ?? card.sessions),
+              hint: analytics?.conversationsRaw != null && analytics.conversationsRaw !== analytics.conversations
+                ? `до дедупа ${analytics.conversationsRaw}`
+                : undefined,
+              icon: <GitBranchIcon className="size-4" />,
+              iconClassName: "text-warning",
+            },
+            {
+              id: "uniq",
+              label: "Уник. src / dst",
+              value: `${analytics?.uniqueSrc ?? 0} / ${analytics?.uniqueDst ?? 0}`,
+              icon: <UsersIcon className="size-4" />,
+              iconClassName: "text-muted-foreground",
+            },
+            {
+              id: "category",
+              label: "Топ категория",
+              value: analytics?.topCategory ?? "—",
+              icon: <LayersIcon className="size-4" />,
+              iconClassName: "text-primary",
+            },
+          ]}
+        />
+      </div>
+
+      <div className="mt-4 pt-4 border-t flex flex-col gap-3">
+        <div className="flex items-center justify-between gap-2">
+          <p className="text-xs text-muted-foreground">Аналитика потребления</p>
+          {analytics?.live ? <Badge variant="success-light" size="sm">live</Badge> : null}
+        </div>
+        <Tabs value={slice} onValueChange={(v) => setSlice(String(v))} className="gap-3">
+          <TabsList variant="line" className="flex flex-wrap h-auto">
+            <TabsTrigger value="applications">Приложения</TabsTrigger>
+            <TabsTrigger value="categories">Категории</TabsTrigger>
+            <TabsTrigger value="services">Сервисы</TabsTrigger>
+            <TabsTrigger value="asns">ASN</TabsTrigger>
+            <TabsTrigger value="countries">Страны</TabsTrigger>
+            <TabsTrigger value="map">Карта</TabsTrigger>
+            <TabsTrigger value="protocols">Протоколы</TabsTrigger>
+            <TabsTrigger value="sources">Источники</TabsTrigger>
+            <TabsTrigger value="destinations">Назначения</TabsTrigger>
+            <TabsTrigger value="sessions">Сессии</TabsTrigger>
+            <TabsTrigger value="interfaces">Интерфейсы</TabsTrigger>
+          </TabsList>
+          <TabsContent value="applications">
+            <FlowBreakdownGrid rows={analytics?.applications ?? []} />
+          </TabsContent>
+          <TabsContent value="categories">
+            <FlowBreakdownGrid rows={analytics?.categories ?? []} />
+          </TabsContent>
+          <TabsContent value="services">
+            <FlowBreakdownGrid rows={analytics?.services ?? []} />
+          </TabsContent>
+          <TabsContent value="asns">
+            <FlowBreakdownGrid rows={analytics?.asns ?? []} />
+          </TabsContent>
+          <TabsContent value="countries">
+            <FlowBreakdownGrid rows={analytics?.countries ?? []} country />
+          </TabsContent>
+          <TabsContent value="map">
+            <FlowTrafficMap
+              edges={analytics?.mapEdges ?? []}
+              onSelectCountry={(iso) => {
+                setMapCountry(iso)
+                setSlice("sessions")
+              }}
+            />
+          </TabsContent>
+          <TabsContent value="protocols">
+            <FlowBreakdownGrid rows={analytics?.protocols ?? []} />
+          </TabsContent>
+          <TabsContent value="sources">
+            <FlowBreakdownGrid rows={analytics?.sources ?? []} />
+          </TabsContent>
+          <TabsContent value="destinations">
+            <FlowBreakdownGrid rows={analytics?.destinations ?? []} />
+          </TabsContent>
+          <TabsContent value="sessions">
+            {mapCountry ? (
+              <div className="flex items-center gap-2 mb-2">
+                <GlobeIcon className="size-3.5 text-muted-foreground" />
+                <span className="text-xs text-muted-foreground">фильтр страны {mapCountry}</span>
+                <button
+                  type="button"
+                  className="text-xs text-primary"
+                  onClick={() => setMapCountry(null)}
+                >
+                  сбросить
+                </button>
+              </div>
+            ) : null}
+            <TrafficFlowsDataGrid
+              rows={sessionRows}
+              emptyHint={emptyHint}
+            />
+          </TabsContent>
+          <TabsContent value="interfaces">
+            <FlowBreakdownGrid
+              rows={analytics?.interfaces ?? []}
+              empty="Нет данных по интерфейсам"
+            />
+          </TabsContent>
+        </Tabs>
+      </div>
+    </>
+  )
+}

components/traffic/flow-overlay-sheet.tsx

@@ -0,0 +1,229 @@
+"use client"
+
+import { useEffect, useMemo, useState } from "react"
+import { toast } from "sonner"
+import { FormField } from "@/components/form-kit"
+import { Alert, AlertDescription, AlertTitle } from "@/components/reui/alert"
+import { Frame, FramePanel } from "@/components/reui/frame"
+import { CodeBlock, downloadText } from "@/components/reui-kit/code-export-sheet"
+import { Button } from "@/components/ui/button"
+import { Input } from "@/components/ui/input"
+import { ScrollArea } from "@/components/ui/scroll-area"
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from "@/components/ui/select"
+import { Tabs, TabsList, TabsTrigger } from "@/components/ui/tabs"
+import {
+  Sheet, SheetContent, SheetHeader, SheetTitle,
+  SheetDescription, SheetFooter, SheetClose,
+} from "@/components/ui/sheet"
+import { applyTrafficFlowOverlay } from "@/shared/api/traffic-flow"
+import type { ServerRead } from "@mmapp/contracts/servers"
+import type { TrafficFlowOverlayResult } from "@mmapp/contracts/traffic-flow"
+import {
+  CheckIcon,
+  CopyIcon,
+  DownloadIcon,
+  InfoIcon,
+} from "lucide-react"
+
+function FlowOverlaySheet({
+  open,
+  onOpenChange,
+  servers,
+  backendUrl,
+  onDone,
+}: {
+  open: boolean
+  onOpenChange: (v: boolean) => void
+  servers: ServerRead[]
+  backendUrl: string
+  onDone?: (result: TrafficFlowOverlayResult) => void
+}) {
+  const jumpHosts = useMemo(
+    () => servers.filter((s) => s.enabled && s.type === "jump-host"),
+    [servers],
+  )
+  const [serverId, setServerId] = useState("")
+  const [endpoint, setEndpoint] = useState("")
+  const [busy, setBusy] = useState(false)
+  const [result, setResult] = useState<TrafficFlowOverlayResult | null>(null)
+  const [copied, setCopied] = useState(false)
+  const [tab, setTab] = useState("linux")
+
+  useEffect(() => {
+    if (!open) return
+    setResult(null)
+    setCopied(false)
+    setTab("linux")
+    const first = jumpHosts[0]
+    const nextId = first ? String(first.id) : ""
+    setServerId(nextId)
+    setEndpoint(first?.host ?? "")
+  }, [open, jumpHosts])
+
+  function handleServerChange(id: string) {
+    setServerId(id)
+    const selected = jumpHosts.find((s) => String(s.id) === id)
+    if (selected) setEndpoint(selected.host)
+  }
+
+  const formats = result?.hostFiles ?? []
+  const active = formats.find((f) => f.id === tab) ?? formats[0]
+  const selectedHost = jumpHosts.find((s) => String(s.id) === serverId)
+  const selectedLabel = selectedHost
+    ? `${selectedHost.name || selectedHost.host} (${selectedHost.host})`
+    : "Выберите сервер…"
+  const canSubmit = Boolean(serverId && endpoint.trim()) && !busy
+
+  async function handleSubmit() {
+    if (!serverId || !endpoint.trim()) return
+    setBusy(true)
+    try {
+      const res = await applyTrafficFlowOverlay(backendUrl, serverId, endpoint.trim())
+      setResult(res)
+      setTab(res.hostFiles[0]?.id ?? "linux")
+      toast.success(`wg-flow на ${res.address}`)
+      onDone?.(res)
+    } catch (e) {
+      toast.error(e instanceof Error ? e.message : "Не удалось подключить JH")
+    } finally {
+      setBusy(false)
+    }
+  }
+
+  function handleCopy() {
+    const code = active?.code ?? ""
+    if (!code) return
+    void navigator.clipboard.writeText(code).then(() => {
+      setCopied(true)
+      toast.success("Скопировано")
+      setTimeout(() => setCopied(false), 1800)
+    })
+  }
+
+  return (
+    <Sheet open={open} onOpenChange={onOpenChange}>
+      <SheetContent
+        side="right"
+        className="flex w-full flex-col gap-0 overflow-hidden p-0 sm:max-w-2xl"
+      >
+        <SheetHeader className="shrink-0 gap-1 border-b px-5 pt-5 pb-4 pr-12">
+          <SheetTitle className="text-base font-semibold tracking-tight">
+            Подключить jump-host
+          </SheetTitle>
+          <SheetDescription>
+            Создаст wg-flow на MikroTik (сервер, listen 13232) и выдаст готовый bash для Linux-хоста Docker MM (клиент).
+          </SheetDescription>
+        </SheetHeader>
+        <div className="flex min-h-0 flex-1 flex-col gap-4 overflow-y-auto px-5 py-4">
+          <FormField label="Jump-host" required>
+            <Select
+              value={serverId || undefined}
+              onValueChange={(v) => handleServerChange(String(v ?? ""))}
+            >
+              <SelectTrigger className="h-9 w-full min-w-0">
+                <SelectValue>{selectedLabel}</SelectValue>
+              </SelectTrigger>
+              <SelectContent align="start" className="min-w-(--anchor-width)">
+                {jumpHosts.map((s) => (
+                  <SelectItem key={s.id} value={String(s.id)}>
+                    {s.name || s.host} ({s.host})
+                  </SelectItem>
+                ))}
+              </SelectContent>
+            </Select>
+          </FormField>
+          <FormField
+            label="Публичный IP или DNS jump-host"
+            required
+            hint="Куда хост MM (wg-quick) стучится по UDP 13232. Не контейнер backend."
+          >
+            <Input
+              className="font-mono"
+              value={endpoint}
+              onChange={(e) => setEndpoint(e.target.value)}
+              placeholder="jh.example.com"
+              autoComplete="off"
+            />
+          </FormField>
+          {result ? (
+            <div className="flex min-h-0 flex-col gap-4">
+              <Alert variant="success">
+                <InfoIcon />
+                <AlertTitle>Linux-хост /opt/cdn-mm</AlertTitle>
+                <AlertDescription>
+                  Скопируйте вкладку Linux и выполните от root. WG — клиент к JH:13232; контейнер слушает только WG-IP:4739, не 0.0.0.0. Ключ не кладите в git.
+                </AlertDescription>
+              </Alert>
+              <ul className="flex flex-col gap-1.5">
+                {result.steps.map((s) => (
+                  <li key={s} className="flex items-start gap-2 text-sm">
+                    <CheckIcon className="mt-0.5 size-3.5 shrink-0 text-success" />
+                    <span>{s}</span>
+                  </li>
+                ))}
+              </ul>
+              {formats.length > 0 && active ? (
+                <div className="flex min-h-0 flex-col gap-3">
+                  <Tabs
+                    value={tab}
+                    onValueChange={(v) => {
+                      setTab(String(v))
+                      setCopied(false)
+                    }}
+                    className="shrink-0 gap-0"
+                  >
+                    <TabsList className="h-9 w-full">
+                      {formats.map((f) => (
+                        <TabsTrigger key={f.id} value={f.id} className="flex-1 px-2 text-xs sm:text-sm">
+                          {f.label}
+                        </TabsTrigger>
+                      ))}
+                    </TabsList>
+                  </Tabs>
+                  <Frame dense className="flex min-h-0 flex-col overflow-hidden">
+                    <FramePanel className="relative flex min-h-0 flex-col overflow-hidden p-0">
+                      <ScrollArea className="h-full min-h-0 max-h-[min(52vh,22rem)]">
+                        <CodeBlock code={active.code} className="whitespace-pre break-normal" />
+                      </ScrollArea>
+                    </FramePanel>
+                  </Frame>
+                  <div className="flex items-center justify-end gap-2">
+                    <Button
+                      type="button"
+                      variant="outline"
+                      size="sm"
+                      onClick={() => downloadText(active.filename, active.code)}
+                    >
+                      <DownloadIcon className="size-3.5" />
+                      Файл
+                    </Button>
+                    <Button type="button" size="sm" onClick={handleCopy}>
+                      {copied ? <CheckIcon className="size-3.5" /> : <CopyIcon className="size-3.5" />}
+                      {copied ? "Скопировано" : "Копировать"}
+                    </Button>
+                  </div>
+                </div>
+              ) : null}
+            </div>
+          ) : null}
+        </div>
+        <SheetFooter className="shrink-0 flex-row items-center justify-between gap-3 border-t px-5 py-3.5 sm:flex-row">
+          <SheetClose render={<Button type="button" variant="outline" className="shrink-0" />}>
+            Закрыть
+          </SheetClose>
+          <Button disabled={!canSubmit} onClick={() => { void handleSubmit() }}>
+            {busy ? "Подключение…" : "Подключить"}
+          </Button>
+        </SheetFooter>
+      </SheetContent>
+    </Sheet>
+  )
+}
+
+export { FlowOverlaySheet }

components/traffic/flow-traffic-map.tsx

@@ -0,0 +1,184 @@
+"use client"
+
+import { useMemo, useState } from "react"
+import { type ColumnDef, getCoreRowModel, useReactTable } from "@tanstack/react-table"
+import type { FlowMapEdge } from "@mmapp/contracts/traffic-flow"
+import { Frame, FramePanel } from "@/components/reui/frame"
+import { DataGridShell } from "@/components/data-grids/shared/data-grid-shell"
+import {
+  DATA_GRID_CELL_PAD,
+  DATA_GRID_CELL_PAD_FIRST,
+  DATA_GRID_CELL_PAD_LAST,
+} from "@/components/data-grids/shared/data-grid-layout"
+import { Flag } from "@/components/flag"
+import { fmtRate } from "@/lib/fmt-rate"
+
+const W = 640
+const H = 280
+const STROKES = [
+  "var(--chart-1)",
+  "var(--chart-2)",
+  "var(--chart-3)",
+  "var(--color-success)",
+  "var(--chart-5)",
+]
+
+function formatBytes(n: number): string {
+  if (n >= 1_000_000_000) return `${(n / 1_000_000_000).toFixed(2)} ГБ`
+  if (n >= 1_000_000) return `${(n / 1_000_000).toFixed(1)} МБ`
+  if (n >= 1000) return `${(n / 1000).toFixed(1)} КБ`
+  return `${n} Б`
+}
+
+function FlowTrafficMap({
+  edges,
+  onSelectCountry,
+}: {
+  edges: FlowMapEdge[]
+  onSelectCountry?: (country: string) => void
+}) {
+  const [hover, setHover] = useState<string | null>(null)
+
+  const layout = useMemo(() => {
+    const sources = [...new Map(edges.map((e) => [e.fromId, e])).values()]
+    const dests = [...new Map(edges.map((e) => [e.toCountry, e])).values()]
+    const srcY = (i: number) => sources.length <= 1 ? H / 2 : 36 + (i * (H - 72)) / Math.max(1, sources.length - 1)
+    const dstY = (i: number) => dests.length <= 1 ? H / 2 : 36 + (i * (H - 72)) / Math.max(1, dests.length - 1)
+    const srcPos = new Map(sources.map((s, i) => [s.fromId, { x: 88, y: srcY(i), label: s.fromLabel, country: s.fromCountry }]))
+    const dstPos = new Map(dests.map((d, i) => [d.toCountry, { x: 552, y: dstY(i), country: d.toCountry }]))
+    const maxBytes = Math.max(...edges.map((e) => e.bytes), 1)
+    return { srcPos, dstPos, maxBytes }
+  }, [edges])
+
+  const columns = useMemo<ColumnDef<FlowMapEdge>[]>(
+    () => [
+      {
+        id: "from",
+        accessorKey: "fromLabel",
+        header: () => <span className="text-xs font-medium text-muted-foreground">Источник</span>,
+        cell: ({ row }) => (
+          <span className="flex items-center gap-1.5 text-sm">
+            {row.original.fromCountry && row.original.fromCountry !== "UN"
+              ? <Flag code={row.original.fromCountry} />
+              : null}
+            {row.original.fromLabel}
+          </span>
+        ),
+        meta: { headerClassName: DATA_GRID_CELL_PAD_FIRST, cellClassName: DATA_GRID_CELL_PAD_FIRST },
+      },
+      {
+        id: "to",
+        accessorKey: "toCountry",
+        header: () => <span className="text-xs font-medium text-muted-foreground">Назначение</span>,
+        cell: ({ row }) => (
+          <span className="flex items-center gap-1.5 text-sm">
+            <Flag code={row.original.toCountry} />
+            {row.original.toCountry}
+            {row.original.toAsn ? <span className="font-mono text-[10px] text-muted-foreground">AS{row.original.toAsn}</span> : null}
+          </span>
+        ),
+        meta: { headerClassName: DATA_GRID_CELL_PAD, cellClassName: DATA_GRID_CELL_PAD },
+      },
+      {
+        id: "cat",
+        accessorKey: "category",
+        header: () => <span className="text-xs font-medium text-muted-foreground">Категория</span>,
+        cell: ({ row }) => <span className="text-xs">{row.original.category}</span>,
+        meta: { headerClassName: DATA_GRID_CELL_PAD, cellClassName: DATA_GRID_CELL_PAD },
+      },
+      {
+        id: "rate",
+        accessorFn: (r) => r.bps,
+        header: () => <span className="text-xs font-medium text-muted-foreground">Скорость</span>,
+        cell: ({ row }) => <span className="text-xs tabular-nums">{fmtRate(row.original.bps / 1_000_000)}</span>,
+        meta: { headerClassName: DATA_GRID_CELL_PAD, cellClassName: DATA_GRID_CELL_PAD },
+      },
+      {
+        id: "bytes",
+        accessorKey: "bytes",
+        header: () => <span className="text-xs font-medium text-muted-foreground">Байты</span>,
+        cell: ({ row }) => <span className="text-xs tabular-nums">{formatBytes(row.original.bytes)}</span>,
+        meta: { headerClassName: DATA_GRID_CELL_PAD_LAST, cellClassName: DATA_GRID_CELL_PAD_LAST },
+      },
+    ],
+    [],
+  )
+
+  const table = useReactTable({
+    data: edges,
+    columns,
+    getCoreRowModel: getCoreRowModel(),
+    getRowId: (row, i) => `${row.fromId}-${row.toCountry}-${i}`,
+  })
+
+  if (!edges.length) {
+    return (
+      <p className="text-sm text-muted-foreground py-8 text-center">
+        Страны подтянутся из кэша RIPEstat
+      </p>
+    )
+  }
+
+  return (
+    <div className="flex flex-col gap-3">
+      <Frame>
+        <FramePanel className="p-3">
+          <svg viewBox={`0 0 ${W} ${H}`} className="w-full h-[220px]" role="img" aria-label="Карта потоков откуда куда">
+            {edges.map((e, i) => {
+              const from = layout.srcPos.get(e.fromId)
+              const to = layout.dstPos.get(e.toCountry)
+              if (!from || !to) return null
+              const id = `${e.fromId}-${e.toCountry}`
+              const midX = (from.x + to.x) / 2
+              const d = `M ${from.x} ${from.y} C ${midX} ${from.y}, ${midX} ${to.y}, ${to.x} ${to.y}`
+              const sw = 1.25 + 7 * (e.bytes / layout.maxBytes)
+              const active = hover === id
+              return (
+                <path
+                  key={id}
+                  d={d}
+                  fill="none"
+                  stroke={STROKES[i % STROKES.length]}
+                  strokeWidth={active ? sw + 1.5 : sw}
+                  strokeOpacity={active ? 1 : 0.72}
+                  className="cursor-pointer"
+                  onMouseEnter={() => setHover(id)}
+                  onMouseLeave={() => setHover(null)}
+                  onClick={() => onSelectCountry?.(e.toCountry)}
+                >
+                  <title>
+                    {`${e.fromLabel} → ${e.toCountry} · ${e.category} · ${formatBytes(e.bytes)}`}
+                  </title>
+                </path>
+              )
+            })}
+            {[...layout.srcPos.values()].map((n) => (
+              <g key={`s-${n.label}`}>
+                <circle cx={n.x} cy={n.y} r="7" className="fill-primary" />
+                <text x={n.x - 14} y={n.y + 4} textAnchor="end" className="fill-foreground text-[11px]">
+                  {n.label}
+                </text>
+              </g>
+            ))}
+            {[...layout.dstPos.values()].map((n) => (
+              <g key={`d-${n.country}`}>
+                <circle cx={n.x} cy={n.y} r="7" className="fill-chart-2" />
+                <text x={n.x + 14} y={n.y + 4} className="fill-foreground text-[11px]">
+                  {n.country}
+                </text>
+              </g>
+            ))}
+          </svg>
+          {hover ? (
+            <p className="text-[11px] text-muted-foreground mt-1">
+              Нажмите дугу, чтобы отфильтровать сессии по стране назначения
+            </p>
+          ) : null}
+        </FramePanel>
+      </Frame>
+      <DataGridShell table={table} recordCount={edges.length} emptyMessage="Нет рёбер с известной страной" />
+    </div>
+  )
+}
+
+export { FlowTrafficMap }

components/traffic/netflow-settings-panel.tsx

@@ -0,0 +1,224 @@
+"use client"
+
+import { useCallback, useEffect, useState } from "react"
+import { toast } from "sonner"
+import { FormField, FormToggle } from "@/components/form-kit"
+import { Alert, AlertDescription, AlertTitle } from "@/components/reui/alert"
+import { Badge } from "@/components/reui/badge"
+import { OpsPanel } from "@/components/ops-panel"
+import { Button } from "@/components/ui/button"
+import { Input } from "@/components/ui/input"
+import { CodeExportSheet, type CodeExportFormat } from "@/components/reui-kit/code-export-sheet"
+import type { TrafficFlowSettingsDto } from "@mmapp/contracts/traffic-flow"
+import {
+  generateTrafficFlowKeys,
+  getTrafficFlowHostFiles,
+  getTrafficFlowSettings,
+  putTrafficFlowSettings,
+} from "@/shared/api/traffic-flow"
+import { KeyRoundIcon, DownloadIcon, InfoIcon } from "lucide-react"
+
+const HOST_STEPS = [
+  "На хосте Docker (не в контейнере mmapp-backend): apt install wireguard (или эквивалент).",
+  "Скачайте wg-flow.conf и положите в /etc/wireguard/wg-flow.conf.",
+  "wg-quick up wg-flow  (или systemctl enable --now wg-quick@wg-flow).",
+  "Firewall: разрешите UDP listen WireGuard. UDP 4739 наружу не открывайте.",
+  "В docker-compose у backend раскомментируйте bind IPFIX только на адресе wg-flow.",
+  "Проверка: wg show · ss -ulnp | grep 4739 · в этой панели — last datagram.",
+]
+
+function NetflowSettingsPanel({
+  backendUrl,
+  enabled,
+}: {
+  backendUrl: string
+  enabled: boolean
+}) {
+  const [settings, setSettings] = useState<TrafficFlowSettingsDto | null>(null)
+  const [busy, setBusy] = useState(false)
+  const [exportOpen, setExportOpen] = useState(false)
+  const [formats, setFormats] = useState<CodeExportFormat[]>([])
+  const [collectorIp, setCollectorIp] = useState("10.255.254.1")
+  const [flowPort, setFlowPort] = useState("4739")
+  const [wgPort, setWgPort] = useState("51821")
+  const [prefix, setPrefix] = useState("10.255.254.0/24")
+  const [endpoint, setEndpoint] = useState("")
+  const [retention, setRetention] = useState("24")
+  const [topN, setTopN] = useState("200")
+  const [ingestOn, setIngestOn] = useState(false)
+
+  const load = useCallback(async () => {
+    if (!enabled) return
+    const s = await getTrafficFlowSettings(backendUrl)
+    setSettings(s)
+    setCollectorIp(s.collectorIp)
+    setFlowPort(String(s.flowListenPort))
+    setWgPort(String(s.wgListenPort))
+    setPrefix(s.prefix)
+    setEndpoint(s.publicEndpoint)
+    setRetention(String(s.retentionHours))
+    setTopN(String(s.topN))
+    setIngestOn(s.enabled)
+  }, [backendUrl, enabled])
+
+  useEffect(() => {
+    void load().catch((e: unknown) => {
+      toast.error(e instanceof Error ? e.message : "Не удалось загрузить NetFlow")
+    })
+  }, [load])
+
+  async function handleSave() {
+    setBusy(true)
+    try {
+      const res = await putTrafficFlowSettings(backendUrl, {
+        enabled: ingestOn,
+        collectorIp,
+        flowListenPort: Number.parseInt(flowPort, 10) || 4739,
+        wgListenPort: Number.parseInt(wgPort, 10) || 51821,
+        prefix,
+        publicEndpoint: endpoint,
+        retentionHours: Number.parseInt(retention, 10) || 24,
+        topN: Number.parseInt(topN, 10) || 200,
+      })
+      setSettings(res.settings)
+      toast.success("Настройки NetFlow сохранены")
+    } catch (e) {
+      toast.error(e instanceof Error ? e.message : "Не удалось сохранить")
+    } finally {
+      setBusy(false)
+    }
+  }
+
+  async function handleKeys() {
+    setBusy(true)
+    try {
+      const res = await generateTrafficFlowKeys(backendUrl)
+      setSettings(res.settings)
+      toast.success(res.created ? "Ключи хоста созданы" : "Ключи уже есть")
+    } catch (e) {
+      toast.error(e instanceof Error ? e.message : "Не удалось сгенерировать ключи")
+    } finally {
+      setBusy(false)
+    }
+  }
+
+  async function handleExport() {
+    setBusy(true)
+    try {
+      const res = await getTrafficFlowHostFiles(backendUrl)
+      setFormats(res.files.map((f) => ({
+        id: f.id,
+        label: f.label,
+        filename: f.filename,
+        code: f.code,
+      })))
+      setExportOpen(true)
+      await load()
+    } catch (e) {
+      toast.error(e instanceof Error ? e.message : "Не удалось получить файлы")
+    } finally {
+      setBusy(false)
+    }
+  }
+
+  return (
+    <>
+      <OpsPanel
+        title="Traffic Flow / NetFlow (IPFIX)"
+        description="Дополнение к сбору счётчиков REST. Приём только через WireGuard на хосте Docker MM. Preview: https://reui.io/preview/base/settings-16"
+        headerRight={
+          <div className="flex items-center gap-2">
+            {settings?.listenerBound ? (
+              <Badge variant="success">listener {settings.listenerAddress}</Badge>
+            ) : (
+              <Badge variant="secondary">listener выкл</Badge>
+            )}
+          </div>
+        }
+        contentClassName="px-5 py-4 flex flex-col gap-4"
+      >
+        <Alert>
+          <InfoIcon />
+          <AlertTitle>Ключи и UDP 4739</AlertTitle>
+          <AlertDescription>
+            Приватный ключ хранится в SQLite панели, не коммитьте его. Порт IPFIX публикуйте только на адресе wg-flow, не на 0.0.0.0.
+          </AlertDescription>
+        </Alert>
+
+        <div className="flex items-center gap-3">
+          <FormToggle checked={ingestOn} onChange={setIngestOn} />
+          <span className="text-sm">Принимать IPFIX</span>
+        </div>
+
+        <div className="grid grid-cols-1 sm:grid-cols-2 gap-3">
+          <FormField label="Collector IP" hint="Адрес в туннеле, куда JH шлёт flow">
+            <Input className="font-mono" value={collectorIp} onChange={(e) => setCollectorIp(e.target.value)} />
+          </FormField>
+          <FormField label="Префикс overlay">
+            <Input className="font-mono" value={prefix} onChange={(e) => setPrefix(e.target.value)} />
+          </FormField>
+          <FormField label="UDP IPFIX">
+            <Input className="font-mono" value={flowPort} onChange={(e) => setFlowPort(e.target.value)} />
+          </FormField>
+          <FormField label="WG listen">
+            <Input className="font-mono" value={wgPort} onChange={(e) => setWgPort(e.target.value)} />
+          </FormField>
+          <FormField label="Публичный endpoint хоста MM" hint="IP или DNS, который видят JH" required>
+            <Input className="font-mono" value={endpoint} onChange={(e) => setEndpoint(e.target.value)} placeholder="203.0.113.10" />
+          </FormField>
+          <FormField label="Public key хоста">
+            <Input className="font-mono text-xs" readOnly value={settings?.hostPublicKey || "— сгенерируйте ключи —"} />
+          </FormField>
+          <FormField label="Хранение (часов)">
+            <Input value={retention} onChange={(e) => setRetention(e.target.value)} inputMode="numeric" />
+          </FormField>
+          <FormField label="Top-N разговоров">
+            <Input value={topN} onChange={(e) => setTopN(e.target.value)} inputMode="numeric" />
+          </FormField>
+        </div>
+
+        <p className="text-xs text-muted-foreground">
+          Last datagram:{" "}
+          {settings?.lastDatagramAt
+            ? new Date(settings.lastDatagramAt).toLocaleString("ru-RU")
+            : "—"}
+          {settings?.lastExporterIp ? ` · ${settings.lastExporterIp}` : ""}
+          {settings?.lastError ? ` · ${settings.lastError}` : ""}
+        </p>
+
+        <div className="rounded-md border px-4 py-3 flex flex-col gap-2">
+          <p className="text-sm font-medium">Туннель на сервере Docker MM</p>
+          <ol className="text-xs text-muted-foreground flex flex-col gap-1.5 list-decimal pl-4">
+            {HOST_STEPS.map((s) => (
+              <li key={s}>{s}</li>
+            ))}
+          </ol>
+        </div>
+
+        <div className="flex flex-wrap gap-2">
+          <Button size="sm" disabled={busy} onClick={() => { void handleSave() }}>
+            Сохранить NetFlow
+          </Button>
+          <Button size="sm" variant="outline" disabled={busy} onClick={() => { void handleKeys() }}>
+            <KeyRoundIcon className="size-4" />
+            Ключи хоста
+          </Button>
+          <Button size="sm" variant="outline" disabled={busy} onClick={() => { void handleExport() }}>
+            <DownloadIcon className="size-4" />
+            wg-quick / compose / firewall
+          </Button>
+        </div>
+      </OpsPanel>
+
+      <CodeExportSheet
+        open={exportOpen}
+        onClose={() => setExportOpen(false)}
+        title="Файлы для хоста Docker MM"
+        description="wg-quick, фрагмент compose и firewall. Хост, не контейнер backend."
+        formats={formats}
+      />
+    </>
+  )
+}
+
+export { NetflowSettingsPanel }

components/users/user-sheet.tsx

@@ -19,12 +19,23 @@ import {
   StepperTrigger,
 } from "@/components/reui/stepper"
 import { Badge } from "@/components/reui/badge"
+import { IconTile } from "@/components/reui/icon-tile"
+import { Frame, FramePanel } from "@/components/reui/frame"
+import {
+  Item,
+  ItemActions,
+  ItemContent,
+  ItemMedia,
+  ItemTitle,
+} from "@/components/ui/item"
 import { Flag } from "@/components/flag"
 import { StatusDot } from "@/components/status-dot"
 import { cn } from "@/lib/utils"
 import { listInterfaceCatalog } from "@/shared/api/users"
 import { TYPE_VARIANT } from "@/components/data-grids/users-expanded-detail"
 import {
+  bindingDiffKey,
+  bindingTitle,
   catalogForServer,
   defaultSections,
   defaultServers,
@@ -43,10 +54,28 @@ import {
   type UserServerOption,
 } from "@/lib/users"
 import {
-  LayoutDashboardIcon, EyeIcon, PlusIcon, ServerIcon, ShieldIcon,
-  TrashIcon, WrenchIcon,
+  CableIcon, ChevronDownIcon, EyeIcon, KeyRoundIcon, LayoutDashboardIcon,
+  NetworkIcon, PlusIcon, ServerIcon, ShieldIcon, TrashIcon, WrenchIcon,
 } from "lucide-react"
 
+const IFACE_TILE: Record<InterfaceType, { icon: typeof CableIcon; className: string }> = {
+  ether: { icon: CableIcon, className: "text-muted-foreground" },
+  gre: { icon: NetworkIcon, className: "text-info" },
+  wg: { icon: ShieldIcon, className: "text-success" },
+  other: { icon: CableIcon, className: "text-muted-foreground" },
+}
+
+type CatalogPick = {
+  interfaceName: string
+  peerPublicKey: string
+  peerName?: string
+  type: InterfaceType
+}
+
+function pickKey(p: CatalogPick): string {
+  return `${p.interfaceName}\0${p.peerPublicKey}`
+}
+
 const SECTION_GROUP_ICONS: Record<string, ReactNode> = {
   "Обзор": <LayoutDashboardIcon className="size-3" />,
   "Данные": <EyeIcon className="size-3" />,
@@ -124,7 +153,8 @@ function UserSheet({
   const [errors, setErrors] = useState<Partial<Record<keyof AppUserForm, string>>>({})
   const [catalogServerId, setCatalogServerId] = useState(servers[0]?.id ?? "")
   const [catalog, setCatalog] = useState<CatalogIface[]>([])
-  const [selectedNames, setSelectedNames] = useState<string[]>([])
+  const [selectedPicks, setSelectedPicks] = useState<CatalogPick[]>([])
+  const [expandedWg, setExpandedWg] = useState<string | null>(null)
   const [newComment, setNewComment] = useState("")
 
   useEffect(() => {
@@ -133,7 +163,8 @@ function UserSheet({
     setSheetStep(1)
     setErrors({})
     setCatalogServerId(servers[0]?.id ?? "")
-    setSelectedNames([])
+    setSelectedPicks([])
+    setExpandedWg(null)
     setNewComment("")
   }, [open, user, servers])
 
@@ -212,29 +243,32 @@ function UserSheet({
   const catalogSrv = servers.find((s) => s.id === catalogServerId)
 
   const addSelectedBindings = () => {
-    if (!catalogSrv || selectedNames.length === 0) return
-    const existing = new Set(form.bindings.map((b) => `${b.serverId}::${b.interfaceName}`))
+    if (!catalogSrv || selectedPicks.length === 0) return
+    const existing = new Set(form.bindings.map(bindingDiffKey))
     const next: InterfaceBinding[] = [...form.bindings]
-    for (const name of selectedNames) {
-      const key = `${catalogSrv.id}::${name}`
+    for (const pick of selectedPicks) {
+      const key = bindingDiffKey({
+        serverId: catalogSrv.id,
+        interfaceName: pick.interfaceName,
+        peerPublicKey: pick.peerPublicKey,
+      })
       if (existing.has(key)) continue
-      const iface = catalog.find((c) => c.name === name)
-      if (!iface) continue
-      if (iface.boundUserId && iface.boundUserId !== user?.id) continue
       next.push({
-        id: `pending-${catalogSrv.id}-${name}`,
+        id: `pending-${catalogSrv.id}-${pick.interfaceName}-${pick.peerPublicKey || "iface"}`,
         userId: user?.id ?? "",
         serverId: catalogSrv.id,
         serverName: catalogSrv.name,
         serverSite: catalogSrv.site,
         serverCountry: catalogSrv.country,
-        interfaceName: name,
-        interfaceType: iface.type,
+        interfaceName: pick.interfaceName,
+        interfaceType: pick.type,
+        peerPublicKey: pick.peerPublicKey || undefined,
+        peerName: pick.peerName,
         comment: newComment.trim(),
       })
     }
     setForm((f) => ({ ...f, bindings: next }))
-    setSelectedNames([])
+    setSelectedPicks([])
     setNewComment("")
   }
 
@@ -242,15 +276,26 @@ function UserSheet({
     setForm((f) => ({ ...f, bindings: f.bindings.filter((b) => b.id !== id) }))
   }
 
-  const toggleName = (name: string) => {
-    setSelectedNames((prev) => prev.includes(name) ? prev.filter((n) => n !== name) : [...prev, name])
+  const togglePick = (pick: CatalogPick) => {
+    setSelectedPicks((prev) => {
+      const key = pickKey(pick)
+      return prev.some((p) => pickKey(p) === key)
+        ? prev.filter((p) => pickKey(p) !== key)
+        : [...prev, pick]
+    })
   }
 
   const alreadyBoundHere = useMemo(
-    () => new Set(form.bindings.filter((b) => b.serverId === catalogServerId).map((b) => b.interfaceName)),
+    () => new Set(
+      form.bindings
+        .filter((b) => b.serverId === catalogServerId)
+        .map((b) => `${b.interfaceName}\0${b.peerPublicKey ?? ""}`),
+    ),
     [form.bindings, catalogServerId],
   )
 
+  const selectedPickKeys = useMemo(() => new Set(selectedPicks.map(pickKey)), [selectedPicks])
+
   return (
     <Sheet open={open} onOpenChange={(v) => { if (!v) onClose() }}>
       <SheetContent side="right" className="w-full sm:max-w-lg flex flex-col gap-0 p-0">
@@ -411,7 +456,7 @@ function UserSheet({
 
             <StepperContent value={4} className="flex flex-col">
               <p className="text-[11px] text-muted-foreground py-2.5 border-b">
-                Привязка интерфейсов сервера. Один интерфейс — один пользователь.
+                Ethernet и GRE — целиком. WireGuard — только пир (public-key).
               </p>
 
               <div className="py-3 flex flex-col gap-3 border-b">
@@ -419,56 +464,178 @@ function UserSheet({
                 <select
                   className="h-8 rounded-md border bg-background px-2 text-xs font-mono"
                   value={catalogServerId}
-                  onChange={(e) => { setCatalogServerId(e.target.value); setSelectedNames([]) }}
+                  onChange={(e) => { setCatalogServerId(e.target.value); setSelectedPicks([]); setExpandedWg(null) }}
                 >
                   {servers.map((s) => (
                     <option key={s.id} value={s.id}>{s.name} · {s.site}</option>
                   ))}
                 </select>
-                <div className="flex flex-col gap-1 rounded-md border border-input bg-background px-2 py-1.5 max-h-48 overflow-y-auto">
-                  {catalog.length === 0 && (
-                    <p className="text-[11px] text-muted-foreground py-1">Нет интерфейсов в каталоге</p>
-                  )}
-                  {catalog.map((iface) => {
-                    const taken = Boolean(iface.boundUserId && iface.boundUserId !== user?.id)
-                    const mine = alreadyBoundHere.has(iface.name)
-                    const disabled = taken || mine
-                    return (
-                      <label
-                        key={iface.name}
-                        className={cn(
-                          "flex items-center gap-2 py-0.5 text-xs",
-                          disabled ? "opacity-50 cursor-not-allowed" : "cursor-pointer",
-                        )}
-                      >
-                        <input
-                          type="checkbox"
-                          disabled={disabled}
-                          checked={selectedNames.includes(iface.name)}
-                          onChange={() => toggleName(iface.name)}
-                          className="rounded border-input accent-primary"
-                        />
-                        <span className="font-mono">{iface.name}</span>
-                        <Badge variant={TYPE_VARIANT[iface.type as InterfaceType]} size="sm">
-                          {IFACE_TYPE_LABEL[iface.type as InterfaceType]}
-                        </Badge>
-                        {taken && (
-                          <span className="text-[10px] text-muted-foreground ml-auto">{iface.boundUserLogin}</span>
-                        )}
-                        {mine && !taken && (
-                          <span className="text-[10px] text-muted-foreground ml-auto">уже привязан</span>
-                        )}
-                      </label>
-                    )
-                  })}
-                </div>
+                <Frame dense spacing="sm">
+                  <FramePanel className="max-h-64 overflow-y-auto p-1.5">
+                    {catalog.length === 0 && (
+                      <p className="px-2 py-3 text-center text-[11px] text-muted-foreground">Нет интерфейсов в каталоге</p>
+                    )}
+                    <div className="flex flex-col gap-0.5">
+                      {catalog.map((iface) => {
+                        const tile = IFACE_TILE[iface.type]
+                        const Icon = tile.icon
+                        if (iface.type === "wg") {
+                          const open = expandedWg === iface.name
+                          const legacyTaken = Boolean(iface.boundUserId && iface.boundUserId !== user?.id)
+                          const legacyMine = alreadyBoundHere.has(`${iface.name}\0`)
+                          return (
+                            <div key={iface.name} className="flex flex-col gap-0.5">
+                              <Item
+                                size="xs"
+                                variant={open ? "muted" : "default"}
+                                render={<button type="button" onClick={() => setExpandedWg(open ? null : iface.name)} />}
+                                className="h-11 min-h-11 flex-nowrap rounded-md py-0"
+                              >
+                                <ItemMedia>
+                                  <IconTile variant="elevated" className={cn("size-10.5 shrink-0", tile.className)}>
+                                    <Icon />
+                                  </IconTile>
+                                </ItemMedia>
+                                <ItemContent className="min-w-0">
+                                  <ItemTitle className="max-w-full min-w-0 gap-1.5 font-mono text-[11px]">
+                                    <span className="min-w-0 truncate">{iface.name}</span>
+                                    <Badge variant={TYPE_VARIANT.wg} size="sm">WireGuard</Badge>
+                                  </ItemTitle>
+                                </ItemContent>
+                                <ItemActions>
+                                  {legacyMine ? (
+                                    <Badge variant="warning-light" size="xs">весь интерфейс</Badge>
+                                  ) : null}
+                                  <ChevronDownIcon className={cn("size-3.5 text-muted-foreground transition-transform", open && "rotate-180")} />
+                                </ItemActions>
+                              </Item>
+                              {open ? (
+                                <div className="ml-4 flex flex-col gap-0.5 border-l pl-2">
+                                  {iface.peersError ? (
+                                    <p className="px-2 py-1.5 text-[11px] text-muted-foreground">Не удалось загрузить пиры</p>
+                                  ) : null}
+                                  {(iface.peers ?? []).length === 0 && !iface.peersError ? (
+                                    <p className="px-2 py-1.5 text-[11px] text-muted-foreground">Нет пиров на интерфейсе</p>
+                                  ) : null}
+                                  {(iface.peers ?? []).map((peer) => {
+                                    const pick: CatalogPick = {
+                                      interfaceName: iface.name,
+                                      peerPublicKey: peer.publicKey,
+                                      peerName: peer.name,
+                                      type: "wg",
+                                    }
+                                    const taken = Boolean(peer.boundUserId && peer.boundUserId !== user?.id)
+                                    const mine = alreadyBoundHere.has(`${iface.name}\0${peer.publicKey}`)
+                                    const disabled = taken || mine || legacyTaken
+                                    const selected = selectedPickKeys.has(pickKey(pick))
+                                    return (
+                                      <Item
+                                        key={peer.publicKey}
+                                        size="xs"
+                                        variant={selected ? "muted" : "default"}
+                                        render={
+                                          <button
+                                            type="button"
+                                            disabled={disabled}
+                                            onClick={() => togglePick(pick)}
+                                          />
+                                        }
+                                        className={cn(
+                                          "h-11 min-h-11 flex-nowrap rounded-md py-0",
+                                          selected && "ring-1 ring-border",
+                                          disabled && "cursor-not-allowed opacity-50",
+                                        )}
+                                      >
+                                        <ItemMedia>
+                                          <IconTile variant="elevated" className="size-10.5 shrink-0 text-success">
+                                            <KeyRoundIcon />
+                                          </IconTile>
+                                        </ItemMedia>
+                                        <ItemContent className="min-w-0">
+                                          <ItemTitle className="max-w-full min-w-0 gap-1.5 font-mono text-[11px]">
+                                            <span className="min-w-0 truncate">{peer.name || peer.publicKey}</span>
+                                            {peer.latestHandshake ? (
+                                              <Badge variant="success-light" size="xs">handshake</Badge>
+                                            ) : null}
+                                          </ItemTitle>
+                                        </ItemContent>
+                                        <ItemActions>
+                                          {taken ? (
+                                            <span className="max-w-28 truncate text-[10px] text-muted-foreground">{peer.boundUserLogin}</span>
+                                          ) : mine ? (
+                                            <span className="text-[10px] text-muted-foreground">уже привязан</span>
+                                          ) : selected ? (
+                                            <Badge variant="secondary" size="xs">Выбран</Badge>
+                                          ) : null}
+                                        </ItemActions>
+                                      </Item>
+                                    )
+                                  })}
+                                </div>
+                              ) : null}
+                            </div>
+                          )
+                        }
+
+                        const pick: CatalogPick = { interfaceName: iface.name, peerPublicKey: "", type: iface.type }
+                        const taken = Boolean(iface.boundUserId && iface.boundUserId !== user?.id)
+                        const mine = alreadyBoundHere.has(`${iface.name}\0`)
+                        const disabled = taken || mine
+                        const selected = selectedPickKeys.has(pickKey(pick))
+                        return (
+                          <Item
+                            key={iface.name}
+                            size="xs"
+                            variant={selected ? "muted" : "default"}
+                            render={
+                              <button
+                                type="button"
+                                disabled={disabled}
+                                onClick={() => togglePick(pick)}
+                              />
+                            }
+                            className={cn(
+                              "h-11 min-h-11 flex-nowrap rounded-md py-0",
+                              selected && "ring-1 ring-border",
+                              disabled && "cursor-not-allowed opacity-50",
+                            )}
+                          >
+                            <ItemMedia>
+                              <IconTile variant="elevated" className={cn("size-10.5 shrink-0", tile.className)}>
+                                <Icon />
+                              </IconTile>
+                            </ItemMedia>
+                            <ItemContent className="min-w-0">
+                              <ItemTitle className="max-w-full min-w-0 gap-1.5 font-mono text-[11px]">
+                                {iface.running ? <StatusDot status="online" /> : <StatusDot status="offline" />}
+                                <span className="min-w-0 truncate">{iface.name}</span>
+                                <Badge variant={TYPE_VARIANT[iface.type]} size="sm">
+                                  {IFACE_TYPE_LABEL[iface.type]}
+                                </Badge>
+                              </ItemTitle>
+                            </ItemContent>
+                            <ItemActions>
+                              {taken ? (
+                                <span className="max-w-28 truncate text-[10px] text-muted-foreground">{iface.boundUserLogin}</span>
+                              ) : mine ? (
+                                <span className="text-[10px] text-muted-foreground">уже привязан</span>
+                              ) : selected ? (
+                                <Badge variant="secondary" size="xs">Выбран</Badge>
+                              ) : null}
+                            </ItemActions>
+                          </Item>
+                        )
+                      })}
+                    </div>
+                  </FramePanel>
+                </Frame>
                 <Input
                   className="h-8 text-xs"
                   placeholder="Комментарий (необязательно)"
                   value={newComment}
                   onChange={(e) => setNewComment(e.target.value)}
                 />
-                <Button size="sm" disabled={selectedNames.length === 0} onClick={addSelectedBindings}>
+                <Button size="sm" disabled={selectedPicks.length === 0} onClick={addSelectedBindings}>
                   <PlusIcon className="size-3.5" />Привязать
                 </Button>
               </div>
@@ -480,8 +647,11 @@ function UserSheet({
                 {form.bindings.map((b) => (
                   <div key={b.id} className="flex items-center gap-2 py-1">
                     <Flag code={b.serverCountry} size={12} />
-                    <span className="font-mono text-xs truncate">{b.interfaceName}</span>
+                    <span className="font-mono text-xs truncate">{bindingTitle(b)}</span>
                     <Badge variant={TYPE_VARIANT[b.interfaceType]} size="sm">{IFACE_TYPE_LABEL[b.interfaceType]}</Badge>
+                    {b.interfaceType === "wg" && !(b.peerPublicKey ?? "") ? (
+                      <Badge variant="warning-light" size="sm">весь интерфейс</Badge>
+                    ) : null}
                     <span className="text-[10px] text-muted-foreground truncate">{b.serverName}</span>
                     <Button
                       size="sm"

deploy/docker-compose.cdn-mm.yml

@@ -134,6 +134,11 @@ services:
       AUTH_JWT_SECRET: ${AUTH_JWT_SECRET:?set AUTH_JWT_SECRET in .env}
       AUTH_ISSUER: ${AUTH_ISSUER:-https://auth.shnt.top}
       AUTH_PORTAL_URL: ${AUTH_PORTAL_URL:-https://auth.shnt.top}
+      # IPFIX: внутри контейнера слушать все iface; на хосте bind только WG-IP после wg-quick@wg-flow
+      FLOW_LISTEN_HOST: "0.0.0.0"
+    # Сначала wg-quick@wg-flow (адрес 10.255.254.1), затем recreate backend.
+    ports:
+      - "10.255.254.1:4739:4739/udp"
     volumes:
       - ./data/mm:/app/data
     networks:

deploy/docker-compose.yml

@@ -5,8 +5,12 @@ services:
     restart: unless-stopped
     ports:
       - "8000:8000"
+      # IPFIX: только на WG-адресе хоста после `wg-quick up wg-flow`, не 0.0.0.0
+      # - "10.255.254.1:4739:4739/udp"
     environment:
       CORS_ORIGIN: ${CORS_ORIGIN:-http://localhost:3000}
+      # Внутри контейнера слушаем все интерфейсы; на хосте UDP 4739 публикуется только на WG-IP
+      FLOW_LISTEN_HOST: "0.0.0.0"
     volumes:
       - /opt/mmapp/data:/app/data
     labels:

hooks/use-flow-live.ts

@@ -0,0 +1,92 @@
+"use client"
+
+import { useEffect, useState } from "react"
+import type { FlowAnalyticsDto } from "@mmapp/contracts/traffic-flow"
+import { resolveApiUrl, withAuthHeaders } from "@/shared/api/http-client"
+import { flowQuery } from "@/shared/api/traffic-flow"
+
+function parseSseBlock(block: string): { event: string; data: string } {
+  let event = "message"
+  const dataLines: string[] = []
+  for (const line of block.split("\n")) {
+    if (line.startsWith("event:")) event = line.slice(6).trim()
+    else if (line.startsWith("data:")) dataLines.push(line.slice(5).trim())
+  }
+  return { event, data: dataLines.join("\n") }
+}
+
+export function useFlowLive(opts: {
+  enabled: boolean
+  backendUrl: string
+  range: string
+  serverId?: string
+  userId?: string
+  iface?: string
+  dedup?: boolean
+}): { sample: FlowAnalyticsDto | null; error: string | null } {
+  const [sample, setSample] = useState<FlowAnalyticsDto | null>(null)
+  const [error, setError] = useState<string | null>(null)
+
+  useEffect(() => {
+    if (!opts.enabled) {
+      setSample(null)
+      setError(null)
+      return
+    }
+
+    const ac = new AbortController()
+    setSample(null)
+    setError(null)
+    const path = `/api/traffic/flow/live${flowQuery({
+      range: opts.range,
+      serverId: opts.serverId,
+      userId: opts.userId,
+      iface: opts.iface,
+      dedup: opts.dedup,
+    })}`
+    const url = resolveApiUrl(opts.backendUrl, path)
+
+    let buf = ""
+
+    void (async () => {
+      try {
+        const res = await fetch(url, {
+          headers: withAuthHeaders({ Accept: "text/event-stream" }),
+          signal: ac.signal,
+          credentials: "include",
+        })
+        if (!res.ok || !res.body) {
+          setError(`live HTTP ${res.status}`)
+          return
+        }
+        const reader = res.body.getReader()
+        const decoder = new TextDecoder()
+        while (!ac.signal.aborted) {
+          const { done, value } = await reader.read()
+          if (done) break
+          buf += decoder.decode(value, { stream: true })
+          const parts = buf.split("\n\n")
+          buf = parts.pop() ?? ""
+          for (const raw of parts) {
+            if (!raw.trim() || raw.trim().startsWith(":")) continue
+            const ev = parseSseBlock(raw)
+            if (ev.event === "sample" && ev.data) {
+              setSample(JSON.parse(ev.data) as FlowAnalyticsDto)
+              setError(null)
+            } else if (ev.event === "error" && ev.data) {
+              const parsed = JSON.parse(ev.data) as { error?: string }
+              setError(parsed.error ?? "live error")
+            }
+          }
+        }
+      } catch (e) {
+        if (ac.signal.aborted) return
+        setError(e instanceof Error ? e.message : "live error")
+      }
+    })()
+
+    return () => ac.abort()
+  }, [opts.enabled, opts.backendUrl, opts.range, opts.serverId, opts.userId, opts.iface, opts.dedup])
+
+  return { sample, error }
+}

lib/users.ts

@@ -15,9 +15,32 @@ export interface InterfaceBinding {
   serverCountry: string
   interfaceName: string
   interfaceType: InterfaceType
+  peerPublicKey?: string
+  peerName?: string
   comment: string
 }
 
+export interface CatalogPeer {
+  publicKey: string
+  name: string
+  comment: string
+  allowedIps: string[]
+  latestHandshake?: string
+  boundUserId: string | null
+  boundUserLogin: string | null
+}
+
+export interface CatalogIface {
+  name: string
+  type: InterfaceType
+  running: boolean
+  disabled: boolean
+  boundUserId: string | null
+  boundUserLogin: string | null
+  peers?: CatalogPeer[]
+  peersError?: string
+}
+
 export interface AppUserForm {
   name: string
   login: string
@@ -43,15 +66,6 @@ export interface AppUser {
   bindings: InterfaceBinding[]
 }
 
-export interface CatalogIface {
-  name: string
-  type: InterfaceType
-  running: boolean
-  disabled: boolean
-  boundUserId: string | null
-  boundUserLogin: string | null
-}
-
 export interface UserServerOption {
   id: string
   name: string
@@ -138,17 +152,39 @@ export const MOCK_IFACE_CATALOG: Record<string, CatalogIface[]> = {
     { name: "gre-datacenter", type: "gre", running: true, disabled: false, boundUserId: "u1", boundUserLogin: "a.korotaev@company.io" },
     { name: "gre-spb-branch", type: "gre", running: true, disabled: false, boundUserId: "u2", boundUserLogin: "d.fedorov@company.io" },
     { name: "gre-retail-01", type: "gre", running: false, disabled: false, boundUserId: "u4", boundUserLogin: "i.petrov@company.io" },
-    { name: "wg-msk-spb", type: "wg", running: true, disabled: false, boundUserId: "u1", boundUserLogin: "a.korotaev@company.io" },
+    {
+      name: "wg-msk-spb", type: "wg", running: true, disabled: false, boundUserId: null, boundUserLogin: null,
+      peers: [
+        { publicKey: "mockPeerKeyAAAA0123456789", name: "phone-ak", comment: "", allowedIps: ["10.8.0.2/32"], boundUserId: "u1", boundUserLogin: "a.korotaev@company.io" },
+        { publicKey: "mockPeerKeyBBBB0123456789", name: "laptop-ak", comment: "", allowedIps: ["10.8.0.3/32"], boundUserId: null, boundUserLogin: null, latestHandshake: "12s" },
+      ],
+    },
   ],
   srv7: [
     { name: "ether1", type: "ether", running: true, disabled: false, boundUserId: null, boundUserLogin: null },
     { name: "gre-office-msk", type: "gre", running: true, disabled: false, boundUserId: "u1", boundUserLogin: "a.korotaev@company.io" },
     { name: "gre-warehouse", type: "gre", running: false, disabled: false, boundUserId: "u1", boundUserLogin: "a.korotaev@company.io" },
     { name: "gre-spb-branch", type: "gre", running: true, disabled: false, boundUserId: "u2", boundUserLogin: "d.fedorov@company.io" },
-    { name: "wg-lab", type: "wg", running: true, disabled: false, boundUserId: null, boundUserLogin: null },
+    {
+      name: "wg-lab", type: "wg", running: true, disabled: false, boundUserId: null, boundUserLogin: null,
+      peers: [
+        { publicKey: "mockPeerKeyLABB0123456789", name: "lab-peer", comment: "", allowedIps: ["10.9.0.2/32"], boundUserId: null, boundUserLogin: null },
+      ],
+    },
   ],
 }
 
+export function bindingDiffKey(b: Pick<InterfaceBinding, "serverId" | "interfaceName" | "peerPublicKey">): string {
+  return `${b.serverId}::${b.interfaceName}::${b.peerPublicKey ?? ""}`
+}
+
+export function bindingTitle(b: Pick<InterfaceBinding, "interfaceName" | "interfaceType" | "peerName" | "peerPublicKey">): string {
+  if (b.interfaceType === "wg" && (b.peerName || b.peerPublicKey)) {
+    return `${b.peerName || "peer"} · ${b.interfaceName}`
+  }
+  return b.interfaceName
+}
+
 function bind(
   id: string,
   userId: string,
@@ -156,6 +192,7 @@ function bind(
   interfaceName: string,
   interfaceType: InterfaceType,
   comment: string,
+  peer?: { publicKey: string; name: string },
 ): InterfaceBinding {
   const srv = servers.find((s) => s.id === serverId)
   return {
@@ -167,6 +204,8 @@ function bind(
     serverCountry: srv?.country ?? "UN",
     interfaceName,
     interfaceType,
+    peerPublicKey: peer?.publicKey,
+    peerName: peer?.name,
     comment,
   }
 }
@@ -180,7 +219,7 @@ export const INIT_USERS: AppUser[] = [
       bind("b1", "u1", "srv1", "ether1", "ether", "Uplink MSK"),
       bind("b2", "u1", "srv1", "gre-office-msk", "gre", "Офис MSK"),
       bind("b3", "u1", "srv1", "gre-datacenter", "gre", "ЦОД"),
-      bind("b4", "u1", "srv1", "wg-msk-spb", "wg", "Overlay SPB"),
+      bind("b4", "u1", "srv1", "wg-msk-spb", "wg", "Overlay SPB", { publicKey: "mockPeerKeyAAAA0123456789", name: "phone-ak" }),
       bind("b5", "u1", "srv7", "gre-office-msk", "gre", "Офис LAB"),
       bind("b6", "u1", "srv7", "gre-warehouse", "gre", "Склад"),
     ],
@@ -213,8 +252,34 @@ export const INIT_USERS: AppUser[] = [
 export function catalogForServer(serverId: string, users: AppUser[]): CatalogIface[] {
   const base = MOCK_IFACE_CATALOG[serverId] ?? []
   return base.map((iface) => {
+    if (iface.type === "wg") {
+      const peers = (iface.peers ?? []).map((peer) => {
+        const owner = users.find((u) =>
+          u.bindings.some((b) =>
+            b.serverId === serverId
+            && b.interfaceName === iface.name
+            && (b.peerPublicKey ?? "") === peer.publicKey,
+          ),
+        )
+        if (!owner) return { ...peer, boundUserId: null, boundUserLogin: null }
+        return { ...peer, boundUserId: owner.id, boundUserLogin: owner.email || owner.login }
+      })
+      const legacy = users.find((u) =>
+        u.bindings.some((b) =>
+          b.serverId === serverId
+          && b.interfaceName === iface.name
+          && !(b.peerPublicKey ?? ""),
+        ),
+      )
+      return {
+        ...iface,
+        boundUserId: legacy?.id ?? null,
+        boundUserLogin: legacy ? (legacy.email || legacy.login) : null,
+        peers,
+      }
+    }
     const owner = users.find((u) =>
-      u.bindings.some((b) => b.serverId === serverId && b.interfaceName === iface.name),
+      u.bindings.some((b) => b.serverId === serverId && b.interfaceName === iface.name && !(b.peerPublicKey ?? "")),
     )
     if (!owner) return { ...iface, boundUserId: null, boundUserLogin: null }
     return { ...iface, boundUserId: owner.id, boundUserLogin: owner.email || owner.login }

packages/contracts/package.json

@@ -41,6 +41,10 @@
     "./users": {
       "types": "./dist/users.d.ts",
       "default": "./dist/users.js"
+    },
+    "./traffic-flow": {
+      "types": "./dist/traffic-flow.d.ts",
+      "default": "./dist/traffic-flow.js"
     }
   },
   "dependencies": {

packages/contracts/src/index.ts

@@ -5,3 +5,4 @@ export * from "./certificates.js"
 export * from "./backups.js"
 export * from "./wireguard.js"
 export * from "./users.js"
+export * from "./traffic-flow.js"

packages/contracts/src/traffic-flow.ts

@@ -0,0 +1,201 @@
+import { z } from "zod"
+
+export const flowHostPeerSchema = z.object({
+  serverId: z.number().int().positive(),
+  name: z.string(),
+  publicKey: z.string().min(1),
+  allowedIps: z.array(z.string().min(1)).min(1),
+  address: z.string().min(1),
+  endpoint: z.string().optional(),
+})
+
+export const trafficFlowSettingsDtoSchema = z.object({
+  enabled: z.boolean(),
+  collectorIp: z.string().min(1),
+  flowListenPort: z.number().int().positive(),
+  wgListenPort: z.number().int().positive(),
+  prefix: z.string().min(1),
+  publicEndpoint: z.string(),
+  hostPublicKey: z.string(),
+  hasHostPrivateKey: z.boolean(),
+  hubServerId: z.number().int().positive().nullable(),
+  retentionHours: z.number().int().positive(),
+  topN: z.number().int().positive(),
+  lastDatagramAt: z.string().nullable(),
+  lastExporterIp: z.string().nullable(),
+  lastError: z.string().nullable(),
+  packetsReceived: z.number().int().nonnegative(),
+  listenerBound: z.boolean(),
+  listenerAddress: z.string().nullable(),
+  peers: z.array(flowHostPeerSchema),
+})
+
+export const trafficFlowSettingsPatchSchema = z.object({
+  enabled: z.boolean().optional(),
+  collectorIp: z.string().min(1).optional(),
+  flowListenPort: z.number().int().positive().optional(),
+  wgListenPort: z.number().int().positive().optional(),
+  prefix: z.string().min(1).optional(),
+  publicEndpoint: z.string().optional(),
+  hubServerId: z.number().int().positive().nullable().optional(),
+  retentionHours: z.number().int().positive().optional(),
+  topN: z.number().int().positive().max(1000).optional(),
+})
+
+export const trafficFlowOverlayRequestSchema = z.object({
+  serverId: z.union([z.string(), z.number()]),
+  publicEndpoint: z.string().optional(),
+})
+
+export const trafficFlowHostFileSchema = z.object({
+  id: z.string(),
+  label: z.string(),
+  filename: z.string(),
+  code: z.string(),
+})
+
+export const trafficFlowOverlayResultSchema = z.object({
+  ok: z.boolean(),
+  serverId: z.number().int(),
+  interfaceName: z.string(),
+  address: z.string(),
+  publicKey: z.string(),
+  linuxPeerBlock: z.string(),
+  trafficFlow: z.boolean(),
+  steps: z.array(z.string()),
+  hostFiles: z.array(trafficFlowHostFileSchema),
+})
+
+export const flowTalkerDtoSchema = z.object({
+  serverId: z.string(),
+  serverName: z.string(),
+  src: z.string(),
+  dst: z.string(),
+  proto: z.number().int(),
+  protoName: z.string(),
+  srcPort: z.number().int(),
+  dstPort: z.number().int(),
+  bytes: z.number().nonnegative(),
+  packets: z.number().nonnegative(),
+  bps: z.number().nonnegative(),
+  inIface: z.string(),
+  inIfaceIndex: z.string().optional(),
+  application: z.string().optional(),
+  category: z.string().optional(),
+  service: z.string().optional(),
+  dstCountry: z.string().optional(),
+  dstAsn: z.number().int().optional(),
+})
+
+export const flowStatsDtoSchema = z.object({
+  exportersOnline: z.number().int().nonnegative(),
+  bytesPerMin: z.number().nonnegative(),
+  uniqueSrc: z.number().int().nonnegative(),
+  uniqueDst: z.number().int().nonnegative(),
+  topProto: z.string(),
+  talkers: z.array(flowTalkerDtoSchema),
+  lastExporterIp: z.string().nullable().optional(),
+  lastError: z.string().nullable().optional(),
+  packetsReceived: z.number().int().nonnegative().optional(),
+  lastDatagramAt: z.string().nullable().optional(),
+  listenerBound: z.boolean().optional(),
+  listenerAddress: z.string().nullable().optional(),
+})
+
+export type FlowHostPeer = z.infer<typeof flowHostPeerSchema>
+export type TrafficFlowSettingsDto = z.infer<typeof trafficFlowSettingsDtoSchema>
+export type TrafficFlowSettingsPatch = z.infer<typeof trafficFlowSettingsPatchSchema>
+export type TrafficFlowOverlayResult = z.infer<typeof trafficFlowOverlayResultSchema>
+export type TrafficFlowHostFile = z.infer<typeof trafficFlowHostFileSchema>
+export const flowBreakdownRowSchema = z.object({
+  id: z.string(),
+  label: z.string(),
+  bytes: z.number().nonnegative(),
+  packets: z.number().nonnegative(),
+  bps: z.number().nonnegative(),
+  percent: z.number().nonnegative(),
+})
+
+export const flowIfaceChipSchema = z.object({
+  name: z.string(),
+  index: z.string(),
+  bps: z.number().nonnegative(),
+})
+
+export const flowEntityCardSchema = z.object({
+  id: z.string(),
+  name: z.string(),
+  subtitle: z.string(),
+  site: z.string(),
+  country: z.string(),
+  status: z.enum(["online", "offline", "degraded"]),
+  rxNow: z.number(),
+  txNow: z.number(),
+  sessions: z.number().int().nonnegative(),
+  rxSeries: z.array(z.number()),
+  txSeries: z.array(z.number()),
+  bytes: z.number().nonnegative(),
+})
+
+export const flowMapEdgeSchema = z.object({
+  fromId: z.string(),
+  fromLabel: z.string(),
+  fromCountry: z.string(),
+  toCountry: z.string(),
+  toAsn: z.number().int().nonnegative(),
+  category: z.string(),
+  bytes: z.number().nonnegative(),
+  bps: z.number().nonnegative(),
+})
+
+export const flowAnalyticsDtoSchema = z.object({
+  bpsNow: z.number().nonnegative(),
+  bytes: z.number().nonnegative(),
+  packets: z.number().nonnegative(),
+  conversations: z.number().int().nonnegative(),
+  conversationsRaw: z.number().int().nonnegative().optional(),
+  uniqueSrc: z.number().int().nonnegative(),
+  uniqueDst: z.number().int().nonnegative(),
+  topProto: z.string(),
+  topCategory: z.string().optional(),
+  rxSeries: z.array(z.number()),
+  txSeries: z.array(z.number()),
+  applications: z.array(flowBreakdownRowSchema),
+  protocols: z.array(flowBreakdownRowSchema),
+  sources: z.array(flowBreakdownRowSchema),
+  destinations: z.array(flowBreakdownRowSchema),
+  interfaces: z.array(flowBreakdownRowSchema),
+  asns: z.array(flowBreakdownRowSchema).optional(),
+  countries: z.array(flowBreakdownRowSchema).optional(),
+  categories: z.array(flowBreakdownRowSchema).optional(),
+  services: z.array(flowBreakdownRowSchema).optional(),
+  mapEdges: z.array(flowMapEdgeSchema).optional(),
+  conversationsList: z.array(flowTalkerDtoSchema),
+  ifaces: z.array(flowIfaceChipSchema),
+  live: z.boolean(),
+  dedupApplied: z.boolean().optional(),
+})
+
+export const flowExportersDtoSchema = z.object({
+  exporters: z.array(flowEntityCardSchema),
+  lastExporterIp: z.string().nullable().optional(),
+  lastError: z.string().nullable().optional(),
+  packetsReceived: z.number().int().nonnegative().optional(),
+  lastDatagramAt: z.string().nullable().optional(),
+  listenerBound: z.boolean().optional(),
+  listenerAddress: z.string().nullable().optional(),
+})
+
+export const flowClientsDtoSchema = z.object({
+  clients: z.array(flowEntityCardSchema),
+})
+
+export type FlowTalkerDto = z.infer<typeof flowTalkerDtoSchema>
+export type FlowStatsDto = z.infer<typeof flowStatsDtoSchema>
+export type FlowBreakdownRow = z.infer<typeof flowBreakdownRowSchema>
+export type FlowIfaceChip = z.infer<typeof flowIfaceChipSchema>
+export type FlowEntityCard = z.infer<typeof flowEntityCardSchema>
+export type FlowMapEdge = z.infer<typeof flowMapEdgeSchema>
+export type FlowAnalyticsDto = z.infer<typeof flowAnalyticsDtoSchema>
+export type FlowExportersDto = z.infer<typeof flowExportersDtoSchema>
+export type FlowClientsDto = z.infer<typeof flowClientsDtoSchema>

packages/contracts/src/users.ts

@@ -23,6 +23,8 @@ export const userBindingSchema = z.object({
   serverCountry: z.string(),
   interfaceName: z.string().min(1),
   interfaceType: interfaceTypeSchema,
+  peerPublicKey: z.string().default(""),
+  peerName: z.string().default(""),
   comment: z.string(),
   createdAt: z.string(),
   updatedAt: z.string(),
@@ -71,6 +73,8 @@ export const userBindingCreateSchema = z.object({
   serverId: z.coerce.number().int().positive(),
   interfaceName: z.string().min(1),
   interfaceType: interfaceTypeSchema.optional(),
+  peerPublicKey: z.string().optional(),
+  peerName: z.string().optional(),
   comment: z.string().optional(),
 })
 
@@ -78,6 +82,16 @@ export const interfaceCatalogQuerySchema = z.object({
   serverId: z.coerce.number().int().positive(),
 })
 
+export const catalogPeerSchema = z.object({
+  publicKey: z.string(),
+  name: z.string(),
+  comment: z.string(),
+  allowedIps: z.array(z.string()),
+  latestHandshake: z.string().optional(),
+  boundUserId: z.string().nullable(),
+  boundUserLogin: z.string().nullable(),
+})
+
 export const catalogInterfaceSchema = z.object({
   name: z.string(),
   type: interfaceTypeSchema,
@@ -85,6 +99,8 @@ export const catalogInterfaceSchema = z.object({
   disabled: z.boolean(),
   boundUserId: z.string().nullable(),
   boundUserLogin: z.string().nullable(),
+  peers: z.array(catalogPeerSchema).optional(),
+  peersError: z.string().optional(),
 })
 
 export const appUserListSchema = z.array(appUserReadSchema)
@@ -99,4 +115,5 @@ export type AppUserRead = z.infer<typeof appUserReadSchema>
 export type AppUserCreate = z.infer<typeof appUserCreateSchema>
 export type AppUserUpdate = z.infer<typeof appUserUpdateSchema>
 export type UserBindingCreate = z.infer<typeof userBindingCreateSchema>
+export type CatalogPeer = z.infer<typeof catalogPeerSchema>
 export type CatalogInterface = z.infer<typeof catalogInterfaceSchema>

shared/api/traffic-flow.ts

@@ -0,0 +1,90 @@
+import type {
+  FlowAnalyticsDto,
+  FlowClientsDto,
+  FlowExportersDto,
+  FlowStatsDto,
+  TrafficFlowHostFile,
+  TrafficFlowOverlayResult,
+  TrafficFlowSettingsDto,
+  TrafficFlowSettingsPatch,
+} from "@mmapp/contracts/traffic-flow"
+import { requestJson } from "@/shared/api/http-client"
+
+export type { TrafficFlowHostFile }
+
+export async function getTrafficFlowSettings(baseUrl: string): Promise<TrafficFlowSettingsDto> {
+  return requestJson<TrafficFlowSettingsDto>(baseUrl, "/api/traffic/flow/settings")
+}
+
+export async function putTrafficFlowSettings(
+  baseUrl: string,
+  patch: TrafficFlowSettingsPatch,
+): Promise<{ ok: boolean; settings: TrafficFlowSettingsDto }> {
+  return requestJson(baseUrl, "/api/traffic/flow/settings", {
+    method: "PUT",
+    body: JSON.stringify(patch),
+  })
+}
+
+export async function generateTrafficFlowKeys(baseUrl: string): Promise<{
+  ok: boolean
+  created: boolean
+  publicKey: string
+  settings: TrafficFlowSettingsDto
+}> {
+  return requestJson(baseUrl, "/api/traffic/flow/settings/generate-keys", { method: "POST" })
+}
+
+export async function getTrafficFlowHostFiles(baseUrl: string): Promise<{ files: TrafficFlowHostFile[] }> {
+  return requestJson(baseUrl, "/api/traffic/flow/host-files")
+}
+
+export async function applyTrafficFlowOverlay(
+  baseUrl: string,
+  serverId: string | number,
+  publicEndpoint?: string,
+): Promise<TrafficFlowOverlayResult> {
+  return requestJson(baseUrl, "/api/traffic/flow-overlay", {
+    method: "POST",
+    body: JSON.stringify({ serverId, publicEndpoint }),
+  })
+}
+
+export async function getTrafficFlows(baseUrl: string, range = "5m"): Promise<FlowStatsDto> {
+  return requestJson<FlowStatsDto>(baseUrl, `/api/traffic/flows?range=${encodeURIComponent(range)}`)
+}
+
+function flowQuery(params: {
+  range?: string
+  serverId?: string
+  userId?: string
+  iface?: string
+  dedup?: boolean
+}): string {
+  const q = new URLSearchParams()
+  if (params.range) q.set("range", params.range)
+  if (params.serverId) q.set("serverId", params.serverId)
+  if (params.userId) q.set("userId", params.userId)
+  if (params.iface && params.iface !== "__all__") q.set("iface", params.iface)
+  if (params.dedup === false) q.set("dedup", "0")
+  else if (params.dedup === true) q.set("dedup", "1")
+  const s = q.toString()
+  return s ? `?${s}` : ""
+}
+
+export async function getFlowExporters(baseUrl: string, range = "5m"): Promise<FlowExportersDto> {
+  return requestJson<FlowExportersDto>(baseUrl, `/api/traffic/flow/exporters?range=${encodeURIComponent(range)}`)
+}
+
+export async function getFlowClients(baseUrl: string, range = "5m"): Promise<FlowClientsDto> {
+  return requestJson<FlowClientsDto>(baseUrl, `/api/traffic/flow/clients?range=${encodeURIComponent(range)}`)
+}
+
+export async function getFlowAnalytics(
+  baseUrl: string,
+  params: { range?: string; serverId?: string; userId?: string; iface?: string; dedup?: boolean },
+): Promise<FlowAnalyticsDto> {
+  return requestJson<FlowAnalyticsDto>(baseUrl, `/api/traffic/flow/analytics${flowQuery(params)}`)
+}
+
+export { flowQuery }

shared/api/users.ts

@@ -28,6 +28,8 @@ export function toFrontendBinding(b: UserBinding): InterfaceBinding {
     serverCountry: b.serverCountry,
     interfaceName: b.interfaceName,
     interfaceType: b.interfaceType,
+    peerPublicKey: b.peerPublicKey || undefined,
+    peerName: b.peerName || undefined,
     comment: b.comment,
   }
 }