feat(health-checks): enhance health check configuration and logging

- Added new health worker URL and token fields to the AppConfig interface, allowing for Cloudflare Worker integration.
- Updated health check routes to utilize the new worker configuration, enabling dynamic health checks via Cloudflare Workers.
- Introduced a health log endpoint for services, providing detailed logs of health probe results.
- Enhanced health check service logic to support both local and Cloudflare Worker providers, improving flexibility in health monitoring.
- Updated UI components to reflect changes in health check provider settings and display relevant health information.

This commit significantly improves the health check management capabilities, allowing for better integration with Cloudflare Workers and enhanced logging features.

.env.example

@@ -36,3 +36,10 @@ RUST_LOG=info
 
 # Certificate scheduler (cron)
 CERT_CHECK_CRON=0 0 */6 * * *
+
+# Local health-check engine (override in UI: Настройки → Health-check)
+# HEALTH_CHECK_CRON=0 */2 * * * *
+# HEALTH_DEGRADED_FAILURES=1
+# HEALTH_DOWN_FAILURES=2
+# HEALTH_SUCCESS_RECOVERIES=2
+# HEALTH_LATENCY_WARN_MS=1000

apps/api/src/app.ts

@@ -7,7 +7,6 @@ import {
 } from "@fastify/type-provider-zod";
 import type { AppConfig } from "./config.js";
 import { loadConfig } from "./config.js";
-import { repos } from "@cfdm/db";
 import authPlugin from "./plugins/auth.js";
 import cfClientPlugin from "./plugins/cf-client.js";
 import { requireAuth } from "./plugins/auth.js";
@@ -34,8 +33,10 @@ import { settingsRoutes } from "./routes/settings.js";
 import { integrationsVpsTrackerRoutes } from "./routes/integrations-vps-tracker.js";
 import { auditRoutes } from "./routes/audit.js";
 import * as certificateService from "./services/certificate-service.js";
-import * as healthCheckService from "./services/health-check-service.js";
-import * as serviceConfigService from "./services/service-config-service.js";
+import {
+  createHealthCheckTask,
+  scheduleHealthCheckJob,
+} from "./services/health-check-scheduler.js";
 import { AsyncTask, CronJob } from "toad-scheduler";
 
 export interface BuildAppOptions {
@@ -125,71 +126,11 @@ export async function buildApp(opts: BuildAppOptions = {}) {
       ),
     );
 
-    const healthTask = new AsyncTask(
-      "health-check",
-      async () => {
-        const thresholds = {
-          degradedFailures: config.healthDegradedFailures,
-          downFailures: config.healthDownFailures,
-          latencyWarnMs: config.healthLatencyWarnMs,
-          successRecoveries: config.healthSuccessRecoveries,
-        };
-        const n = await healthCheckService.runAllChecks(app.db, {
-          thresholds,
-          probeGapMs: config.healthProbeGapMs,
-          onStatusChange: async (target, prev, next) => {
-            try {
-              const label =
-                next === "up"
-                  ? "OK"
-                  : next === "degraded"
-                    ? "Slow"
-                    : next === "down"
-                      ? "Down"
-                      : "—";
-              repos.insertNotificationLog(
-                app.db,
-                "ip_health",
-                target.scope,
-                target.ref_id,
-                `${target.hostname || target.ip}: ${label}`,
-                `IP ${target.ip}: ${prev ?? "—"} → ${label}`,
-              );
-              await serviceConfigService.reconcileDnsForTarget(
-                app.db,
-                app.cf,
-                target.scope,
-                target.ref_id,
-              );
-            } catch (err) {
-              app.log.warn(
-                { err, scope: target.scope, refId: target.ref_id },
-                "health-check reconcile failed",
-              );
-            }
-          },
-        });
-        const monitors = await healthCheckService.runDomainMonitors(
-          app.db,
-          thresholds,
-        );
-        app.log.info(
-          { checked: n, monitors },
-          "health check completed",
-        );
-      },
-      (err) => {
-        app.log.warn({ err }, "health check failed");
-      },
-    );
-
-    app.scheduler.addCronJob(
-      new CronJob(
-        { cronExpression: config.healthCheckCron },
-        healthTask,
-        { preventOverrun: true },
-      ),
-    );
+    const healthTask = createHealthCheckTask(app, config);
+    scheduleHealthCheckJob(app, config, healthTask);
+    app.decorate("reloadHealthCheckJob", () => {
+      scheduleHealthCheckJob(app, config, healthTask);
+    });
   }
 
   return app;

apps/api/src/config.ts

@@ -17,6 +17,8 @@ export interface AppConfig {
   healthLatencyWarnMs: number;
   /** Min pause between probes to different physical targets (same IP is probed once). */
   healthProbeGapMs: number;
+  healthWorkerUrl: string;
+  healthWorkerToken: string;
   logLevel: string;
   /** Portal SSO — when true, require portal JWT with apps includes cfdm */
   authRequired: boolean;
@@ -61,6 +63,8 @@ export function loadConfig(): AppConfig {
     healthLatencyWarnMs:
       Number(process.env.HEALTH_LATENCY_WARN_MS ?? "1000") || 1000,
     healthProbeGapMs: Number(process.env.HEALTH_PROBE_GAP_MS ?? "2000") || 2000,
+    healthWorkerUrl: (process.env.HEALTH_WORKER_URL ?? "").trim(),
+    healthWorkerToken: (process.env.HEALTH_WORKER_TOKEN ?? "").trim(),
     logLevel: process.env.LOG_LEVEL ?? "info",
     authRequired: boolEnv(process.env.AUTH_REQUIRED, false),
     authIssuer:

apps/api/src/routes/health-check.ts

@@ -1,8 +1,12 @@
 import type { FastifyInstance } from "fastify";
 import { healthStatusQuerySchema } from "@cfdm/shared";
-import { repos } from "@cfdm/db";
+import { getAppSettings, repos } from "@cfdm/db";
 import * as healthCheckService from "../services/health-check-service.js";
 import * as serviceConfigService from "../services/service-config-service.js";
+import {
+  healthEngineFallbacksFromConfig,
+  resolveWorkerProbeConfig,
+} from "../services/health-check-scheduler.js";
 
 export async function healthCheckRoutes(app: FastifyInstance) {
   app.get("/health-status", async (request) => {
@@ -16,15 +20,20 @@ export async function healthCheckRoutes(app: FastifyInstance) {
 
   app.post("/health-check/run", async (request) => {
     const config = request.server.config;
+    const settings = getAppSettings(
+      request.server.db,
+      healthEngineFallbacksFromConfig(config),
+    );
     const thresholds = {
-      degradedFailures: config.healthDegradedFailures,
-      downFailures: config.healthDownFailures,
-      latencyWarnMs: config.healthLatencyWarnMs,
-      successRecoveries: config.healthSuccessRecoveries,
+      degradedFailures: settings.healthDegradedFailures,
+      downFailures: settings.healthDownFailures,
+      latencyWarnMs: settings.healthLatencyWarnMs,
+      successRecoveries: settings.healthSuccessRecoveries,
     };
     const checked = await healthCheckService.runAllChecks(request.server.db, {
       thresholds,
       probeGapMs: config.healthProbeGapMs,
+      worker: resolveWorkerProbeConfig(request.server.db, config),
       onStatusChange: async (target, prev, next) => {
         try {
           const label =

apps/api/src/routes/services.ts

@@ -4,6 +4,7 @@ import {
   changeDomainSchema,
   createServiceNodeSchema,
   reorderServicesSchema,
+  toggleServiceIpSchema,
   updateServiceConfigSchema,
   updateServiceNodeSchema,
 } from "@cfdm/shared";
@@ -64,6 +65,14 @@ export async function serviceRoutes(app: FastifyInstance) {
     return serviceConfig.getView(request.server.db, Number(id));
   });
 
+  app.get("/services/:id/health-log", async (request) => {
+    const { id } = request.params as { id: string };
+    repos.getService(request.server.db, Number(id));
+    return {
+      items: repos.listHealthProbeLogForService(request.server.db, Number(id)),
+    };
+  });
+
   app.get("/services/:id/overview", async (request) => {
     const { id } = request.params as { id: string };
     return nodeService.getOverview(request.server.db, Number(id));
@@ -191,4 +200,26 @@ export async function serviceRoutes(app: FastifyInstance) {
       body.enabled,
     );
   });
+
+  app.patch("/services/:id/ips/toggle", async (request) => {
+    const { id } = request.params as { id: string };
+    const body = toggleServiceIpSchema.parse(request.body);
+    const view = await serviceConfig.toggleServiceIp(
+      request.server.db,
+      request.server.cf,
+      Number(id),
+      body.ip,
+      body.enabled,
+    );
+    recordAudit(request.server, request, {
+      action: "service.ip.toggle",
+      targetType: "app_resource",
+      targetId: String(id),
+      summary: body.enabled
+        ? `Включён IP ${body.ip} сервиса «${view.name}»`
+        : `Выключен IP ${body.ip} сервиса «${view.name}»`,
+      details: { ip: body.ip, enabled: body.enabled },
+    });
+    return view;
+  });
 }

apps/api/src/routes/settings.ts

@@ -5,15 +5,46 @@ import {
   updateAppSettings,
 } from "@cfdm/db";
 import { pingVpsTracker } from "../services/vps-tracker-sync.js";
+import { AppError } from "../errors.js";
+import {
+  assertValidHealthCron,
+  healthEngineFallbacksFromConfig,
+} from "../services/health-check-scheduler.js";
 
 export async function settingsRoutes(app: FastifyInstance) {
   app.get("/settings", async (request) => {
-    return getAppSettings(request.server.db);
+    return getAppSettings(
+      request.server.db,
+      healthEngineFallbacksFromConfig(request.server.config),
+    );
   });
 
   app.patch("/settings", async (request) => {
-    const body = appSettingsPatchSchema.parse(request.body);
-    return updateAppSettings(request.server.db, body);
+    const parsed = appSettingsPatchSchema.safeParse(request.body);
+    if (!parsed.success) {
+      throw AppError.validation(
+        parsed.error.issues[0]?.message ?? "некорректные настройки",
+      );
+    }
+    const body = parsed.data;
+    if (body.healthCheckCron) {
+      assertValidHealthCron(body.healthCheckCron);
+    }
+    const fallbacks = healthEngineFallbacksFromConfig(request.server.config);
+    const current = getAppSettings(request.server.db, fallbacks);
+    const nextDegraded =
+      body.healthDegradedFailures ?? current.healthDegradedFailures;
+    const nextDown = body.healthDownFailures ?? current.healthDownFailures;
+    if (nextDown < nextDegraded) {
+      throw AppError.validation(
+        "ошибок до down не меньше, чем до degraded",
+      );
+    }
+    const next = updateAppSettings(request.server.db, body, fallbacks);
+    if (body.healthCheckCron !== undefined) {
+      request.server.reloadHealthCheckJob?.();
+    }
+    return next;
   });
 
   app.post("/settings/vps-tracker/test", async (request) => {

apps/api/src/services/health-check-scheduler.ts

@@ -0,0 +1,150 @@
+import type { FastifyInstance } from "fastify";
+import { AsyncTask, CronJob } from "toad-scheduler";
+import {
+  getAppSettings,
+  getAppSettingsSecrets,
+  type HealthEngineFallbacks,
+} from "@cfdm/db";
+import { repos } from "@cfdm/db";
+import type { AppConfig } from "../config.js";
+import { AppError } from "../errors.js";
+import * as healthCheckService from "./health-check-service.js";
+import * as serviceConfigService from "./service-config-service.js";
+
+declare module "fastify" {
+  interface FastifyInstance {
+    reloadHealthCheckJob?: () => void;
+  }
+}
+
+export const HEALTH_CHECK_JOB_ID = "health-check";
+
+export function healthEngineFallbacksFromConfig(
+  config: AppConfig,
+): HealthEngineFallbacks {
+  return {
+    healthCheckCron: config.healthCheckCron,
+    healthDegradedFailures: config.healthDegradedFailures,
+    healthDownFailures: config.healthDownFailures,
+    healthLatencyWarnMs: config.healthLatencyWarnMs,
+    healthSuccessRecoveries: config.healthSuccessRecoveries,
+    healthWorkerUrl: config.healthWorkerUrl,
+    healthWorkerTokenSet: Boolean(config.healthWorkerToken),
+  };
+}
+
+export function resolveWorkerProbeConfig(
+  db: import("@cfdm/db").Db,
+  config: AppConfig,
+): { url: string; token: string } | null {
+  const settings = getAppSettings(db, healthEngineFallbacksFromConfig(config));
+  const secrets = getAppSettingsSecrets(db);
+  const url = settings.healthWorkerUrl.trim();
+  const token = (secrets.healthWorkerToken || config.healthWorkerToken).trim();
+  if (!url || !token) return null;
+  return { url, token };
+}
+
+export function assertValidHealthCron(expr: string): void {
+  const cronExpression = expr.trim();
+  const parts = cronExpression.split(/\s+/).filter(Boolean);
+  if (parts.length < 5 || parts.length > 6) {
+    throw AppError.validation("некорректное cron-выражение");
+  }
+  try {
+    const job = new CronJob(
+      { cronExpression },
+      new AsyncTask("validate-cron", async () => undefined),
+      { id: "validate-cron" },
+    );
+    job.stop();
+  } catch {
+    throw AppError.validation("некорректное cron-выражение");
+  }
+}
+
+export function createHealthCheckTask(
+  app: FastifyInstance,
+  config: AppConfig,
+): AsyncTask {
+  const fallbacks = healthEngineFallbacksFromConfig(config);
+  return new AsyncTask(
+    HEALTH_CHECK_JOB_ID,
+    async () => {
+      const settings = getAppSettings(app.db, fallbacks);
+      const thresholds = {
+        degradedFailures: settings.healthDegradedFailures,
+        downFailures: settings.healthDownFailures,
+        latencyWarnMs: settings.healthLatencyWarnMs,
+        successRecoveries: settings.healthSuccessRecoveries,
+      };
+      const n = await healthCheckService.runAllChecks(app.db, {
+        thresholds,
+        probeGapMs: config.healthProbeGapMs,
+        worker: resolveWorkerProbeConfig(app.db, config),
+        onStatusChange: async (target, prev, next) => {
+          try {
+            const label =
+              next === "up"
+                ? "OK"
+                : next === "degraded"
+                  ? "Slow"
+                  : next === "down"
+                    ? "Down"
+                    : "—";
+            repos.insertNotificationLog(
+              app.db,
+              "ip_health",
+              target.scope,
+              target.ref_id,
+              `${target.hostname || target.ip}: ${label}`,
+              `IP ${target.ip}: ${prev ?? "—"} → ${label}`,
+            );
+            await serviceConfigService.reconcileDnsForTarget(
+              app.db,
+              app.cf,
+              target.scope,
+              target.ref_id,
+            );
+          } catch (err) {
+            app.log.warn(
+              { err, scope: target.scope, refId: target.ref_id },
+              "health-check reconcile failed",
+            );
+          }
+        },
+      });
+      const monitors = await healthCheckService.runDomainMonitors(
+        app.db,
+        thresholds,
+      );
+      app.log.info({ checked: n, monitors }, "health check completed");
+    },
+    (err) => {
+      app.log.warn({ err }, "health check failed");
+    },
+  );
+}
+
+export function scheduleHealthCheckJob(
+  app: FastifyInstance,
+  config: AppConfig,
+  task: AsyncTask,
+): void {
+  const scheduler = app.scheduler;
+  if (!scheduler) return;
+  if (scheduler.existsById(HEALTH_CHECK_JOB_ID)) {
+    scheduler.removeById(HEALTH_CHECK_JOB_ID);
+  }
+  const settings = getAppSettings(
+    app.db,
+    healthEngineFallbacksFromConfig(config),
+  );
+  scheduler.addCronJob(
+    new CronJob(
+      { cronExpression: settings.healthCheckCron },
+      task,
+      { preventOverrun: true, id: HEALTH_CHECK_JOB_ID },
+    ),
+  );
+}

apps/api/src/services/health-check-service.ts

@@ -6,6 +6,11 @@ import { repos } from "@cfdm/db";
 import type { HealthCheckTarget, IpHealthState } from "@cfdm/shared";
 import { AppError } from "../errors.js";
 import { nextHealthState } from "./health/state-machine.js";
+import { LocalHealthCheckProvider } from "./health/local.js";
+import {
+  CloudflareWorkerHealthCheckProvider,
+  workerNotConfiguredResult,
+} from "./health/worker.js";
 
 export interface HealthCheckThresholds {
   degradedFailures: number;
@@ -18,6 +23,7 @@ export interface ProbeResult {
   ok: boolean;
   latencyMs: number;
   error: string | null;
+  colo?: string | null;
 }
 
 /** Bracket IPv6 for URL authority; leave IPv4/hostname as-is. */
@@ -261,6 +267,8 @@ export interface RunAllChecksOptions {
   thresholds: HealthCheckThresholds;
   /** Pause between unique physical probes (default 2000). Same IP is only probed once. */
   probeGapMs?: number;
+  /** Cloudflare Worker URL+token. Missing → cloudflare targets fail, never Local fallback. */
+  worker?: { url: string; token: string } | null;
   onStatusChange?: (
     target: HealthCheckTarget,
     prevState: IpHealthState | null,
@@ -277,21 +285,34 @@ function sleep(ms: number): Promise<void> {
  * so anti-bot / rate-limit on the origin is not tripped by back-to-back checks.
  */
 export function physicalProbeKey(target: HealthCheckTarget): string {
+  const kind = target.provider === "cloudflare" ? "cloudflare" : "local";
   const port = target.port ?? (target.type === "http" ? 80 : 80);
   const ip = String(target.ip || "").trim().toLowerCase();
   if (target.type === "http") {
     const path = (target.path?.trim() || "/") || "/";
     const expected = target.expected_status ?? "";
-    return `http|${ip}|${port}|${path}|${expected}`;
+    return `${kind}|http|${ip}|${port}|${path}|${expected}`;
   }
-  if (target.type === "tcp") return `tcp|${ip}|${port}`;
+  if (target.type === "tcp") return `${kind}|tcp|${ip}|${port}`;
   if (target.type === "ping") {
-    return `ping|${String(target.hostname || target.ip || "").trim().toLowerCase()}`;
+    return `${kind}|ping|${String(target.hostname || target.ip || "").trim().toLowerCase()}`;
   }
   if (target.type === "dns") {
-    return `dns|${String(target.hostname || target.ip || "").trim().toLowerCase()}`;
+    return `${kind}|dns|${String(target.hostname || target.ip || "").trim().toLowerCase()}`;
   }
-  return `${target.type}|${ip}|${port}`;
+  return `${kind}|${target.type}|${ip}|${port}`;
+}
+
+async function executeProbe(
+  target: HealthCheckTarget,
+  local: LocalHealthCheckProvider,
+  worker: CloudflareWorkerHealthCheckProvider | null,
+): Promise<ProbeResult> {
+  if (target.provider === "cloudflare") {
+    if (!worker) return workerNotConfiguredResult();
+    return worker.probe(target);
+  }
+  return local.probe(target);
 }
 
 export async function runAllChecks(
@@ -300,6 +321,11 @@ export async function runAllChecks(
 ): Promise<number> {
   const targets = repos.listHealthCheckTargets(db);
   const gapMs = Math.max(0, options.probeGapMs ?? 2000);
+  const local = new LocalHealthCheckProvider();
+  const worker =
+    options.worker?.url && options.worker.token
+      ? new CloudflareWorkerHealthCheckProvider(options.worker)
+      : null;
 
   const byPhysical = new Map<string, HealthCheckTarget[]>();
   for (const target of targets) {
@@ -319,7 +345,7 @@ export async function runAllChecks(
     // Prefer binding hostname for SNI when several scopes share one IP.
     const representative =
       group.find((t) => t.scope === "binding") ?? group[0]!;
-    const result = await probeTarget(representative);
+    const result = await executeProbe(representative, local, worker);
 
     for (const target of group) {
       const prev = repos.getIpHealthStatusRow(
@@ -343,6 +369,7 @@ export async function runAllChecks(
       const prevState: IpHealthState | null = prev
         ? (prev.status as IpHealthState)
         : null;
+      const provider = target.provider === "cloudflare" ? "cloudflare" : "local";
       repos.upsertIpHealthStatus(
         db,
         target.scope,
@@ -353,7 +380,19 @@ export async function runAllChecks(
         failures,
         result.error,
         successes,
+        { colo: result.colo ?? null, provider },
       );
+      repos.insertHealthProbeLog(db, {
+        scope: target.scope,
+        refId: target.ref_id,
+        ip: target.ip,
+        provider,
+        status: state,
+        ok: result.ok,
+        latencyMs: result.latencyMs,
+        colo: result.colo ?? null,
+        error: result.error,
+      });
       const matchedNode = repos.findNodeByIp(db, target.ip);
       if (matchedNode && matchedNode.enabled) {
         repos.updateNode(db, matchedNode.id, {
@@ -392,6 +431,7 @@ export async function runDomainMonitors(
       expected_status: monitor.expected_status,
       timeout_ms: monitor.timeout_ms,
       verify_tls: false,
+      provider: "local",
     };
     let result: ProbeResult;
     if (monitor.type === "http") {

apps/api/src/services/health/worker.ts

@@ -0,0 +1,93 @@
+import type { HealthCheckTarget } from "@cfdm/shared";
+import type { ProbeResult } from "../health-check-service.js";
+import type { HealthCheckProvider } from "./provider.js";
+
+export interface WorkerProbeConfig {
+  url: string;
+  token: string;
+}
+
+const WORKER_NOT_CONFIGURED = "Cloudflare Worker не настроен (URL и токен)";
+
+export class CloudflareWorkerHealthCheckProvider implements HealthCheckProvider {
+  readonly kind = "cloudflare" as const;
+
+  constructor(private readonly config: WorkerProbeConfig) {}
+
+  async probe(target: HealthCheckTarget): Promise<ProbeResult> {
+    const base = this.config.url.replace(/\/$/, "");
+    if (!base || !this.config.token) {
+      return {
+        ok: false,
+        latencyMs: 0,
+        error: WORKER_NOT_CONFIGURED,
+        colo: null,
+      };
+    }
+    const timeoutMs = Math.max(100, target.timeout_ms ?? 3000);
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs + 2500);
+    try {
+      const res = await fetch(`${base}/probe`, {
+        method: "POST",
+        headers: {
+          Authorization: `Bearer ${this.config.token}`,
+          "Content-Type": "application/json",
+        },
+        body: JSON.stringify({
+          type: target.type === "http" ? "http" : "tcp",
+          ip: target.ip,
+          hostname: target.hostname,
+          port: target.port ?? (target.type === "http" ? 80 : 80),
+          path: target.path ?? "/",
+          expected_status: target.expected_status,
+          timeout_ms: timeoutMs,
+          verify_tls: Boolean(target.verify_tls),
+          method: "GET",
+        }),
+        signal: controller.signal,
+      });
+      if (!res.ok) {
+        const text = await res.text().catch(() => "");
+        return {
+          ok: false,
+          latencyMs: 0,
+          error: `Worker HTTP ${res.status}${text ? `: ${text.slice(0, 180)}` : ""}`,
+          colo: null,
+        };
+      }
+      const body = (await res.json()) as {
+        ok?: boolean;
+        latencyMs?: number;
+        error?: string | null;
+        colo?: string | null;
+      };
+      const ok = Boolean(body.ok);
+      return {
+        ok,
+        latencyMs: typeof body.latencyMs === "number" ? body.latencyMs : 0,
+        error: ok ? null : (body.error ?? "probe failed"),
+        colo: body.colo ?? null,
+      };
+    } catch (err) {
+      const message =
+        err instanceof Error
+          ? err.name === "AbortError"
+            ? "Worker timeout"
+            : err.message
+          : "Worker probe failed";
+      return { ok: false, latencyMs: 0, error: message, colo: null };
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+}
+
+export function workerNotConfiguredResult(): ProbeResult {
+  return {
+    ok: false,
+    latencyMs: 0,
+    error: WORKER_NOT_CONFIGURED,
+    colo: null,
+  };
+}

apps/api/src/services/service-config-service.ts

@@ -50,6 +50,7 @@ export interface ServiceDomainInput {
   health_check_interval_sec?: number;
   health_check_timeout_ms?: number;
   health_check_verify_tls?: boolean;
+  health_check_provider?: "local" | "cloudflare";
 }
 
 export interface ToggleRequest {
@@ -70,6 +71,7 @@ export interface ServiceGroupBody {
   health_check_interval_sec?: number;
   health_check_timeout_ms?: number;
   health_check_verify_tls?: boolean;
+  health_check_provider?: "local" | "cloudflare";
 }
 
 export interface UpdateServiceGroupBody {
@@ -86,6 +88,7 @@ export interface UpdateServiceGroupBody {
   health_check_interval_sec?: number;
   health_check_timeout_ms?: number;
   health_check_verify_tls?: boolean;
+  health_check_provider?: "local" | "cloudflare";
 }
 
 export interface UpdateServiceConfigRequest {
@@ -242,7 +245,11 @@ async function collectKnownZones(
 
 async function buildView(db: Db, serviceId: number): Promise<ServiceView> {
   const service = repos.getService(db, serviceId);
-  const ips = repos.listServiceIps(db, serviceId);
+  const ipRows = repos.listServiceIpRows(db, serviceId);
+  const ips = ipRows.map((row) => row.ip);
+  const ip_enabled = Object.fromEntries(
+    ipRows.map((row) => [row.ip, row.enabled]),
+  );
   const bindings = repos.listBindingsByService(db, serviceId);
 
   const domainViews = bindings.map((binding) => {
@@ -287,6 +294,7 @@ async function buildView(db: Db, serviceId: number): Promise<ServiceView> {
       health_check_interval_sec: binding.health_check_interval_sec,
       health_check_timeout_ms: binding.health_check_timeout_ms,
       health_check_verify_tls: binding.health_check_verify_tls,
+      health_check_provider: binding.health_check_provider ?? "local",
       sync_status: aggregateSyncStatus(statuses),
     };
   });
@@ -304,9 +312,11 @@ async function buildView(db: Db, serviceId: number): Promise<ServiceView> {
     created_at: service.created_at,
     updated_at: service.updated_at,
     ips,
+    ip_enabled,
     domains: domainViews,
     health_status: "unknown",
     health_latency_ms: null,
+    ip_health: [],
   };
 }
 
@@ -314,16 +324,31 @@ function attachServiceHealth(
   db: Db,
   views: ServiceView[],
 ): ServiceView[] {
-  const healthByService = repos.aggregateIpHealthByServiceIds(
-    db,
-    views.map((v) => v.id),
-  );
+  const ids = views.map((v) => v.id);
+  const healthByService = repos.aggregateIpHealthByServiceIds(db, ids);
+  const ipHealthByService = repos.listIpHealthByServiceIds(db, ids);
   return views.map((view) => {
     const health = healthByService.get(view.id);
+    const byIp = new Map(
+      (ipHealthByService.get(view.id) ?? []).map((row) => [row.ip, row]),
+    );
+    const ip_health = (view.ips ?? []).map((ip) => {
+      const row = byIp.get(ip);
+      return {
+        ip,
+        status: row?.status ?? ("unknown" as const),
+        latency_ms: row?.latency_ms ?? null,
+        last_checked_at: row?.last_checked_at ?? null,
+        last_error: row?.last_error ?? null,
+        provider: row?.provider ?? "local",
+        colo: row?.colo ?? null,
+      };
+    });
     return {
       ...view,
       health_status: health?.health_status ?? "unknown",
       health_latency_ms: health?.health_latency_ms ?? null,
+      ip_health,
     };
   });
 }
@@ -372,7 +397,7 @@ export async function listGroupViews(db: Db): Promise<ServiceGroupsResponse> {
 
   const groupViews = groupViewsRaw.map((group) => {
     const services = group.services.map(
-      (s) => healthById.get(s.id) ?? { ...s, health_status: "unknown" as const, health_latency_ms: null },
+      (s) => healthById.get(s.id) ?? { ...s, health_status: "unknown" as const, health_latency_ms: null, ip_health: [], ip_enabled: {} },
     );
     const groupScopeHealth = groupHealthById.get(group.id);
     // Only enabled services feed the group badge — a disabled service with a
@@ -401,6 +426,8 @@ export async function listGroupViews(db: Db): Promise<ServiceGroupsResponse> {
         ...s,
         health_status: "unknown" as const,
         health_latency_ms: null,
+        ip_health: [],
+        ip_enabled: {},
       },
   );
 
@@ -1135,7 +1162,8 @@ export async function updateConfig(
         input.health_check_expected_status !== undefined ||
         input.health_check_interval_sec !== undefined ||
         input.health_check_timeout_ms !== undefined ||
-        input.health_check_verify_tls !== undefined
+        input.health_check_verify_tls !== undefined ||
+        input.health_check_provider !== undefined
       ) {
         repos.updateBindingLbConfig(db, binding.id, {
           lb_mode: input.lb_mode,
@@ -1147,6 +1175,7 @@ export async function updateConfig(
           health_check_interval_sec: input.health_check_interval_sec,
           health_check_timeout_ms: input.health_check_timeout_ms,
           health_check_verify_tls: input.health_check_verify_tls,
+          health_check_provider: input.health_check_provider,
         });
       }
 
@@ -1248,6 +1277,7 @@ export async function createGroup(
       health_check_interval_sec: body.health_check_interval_sec,
       health_check_timeout_ms: body.health_check_timeout_ms,
       health_check_verify_tls: body.health_check_verify_tls,
+      health_check_provider: body.health_check_provider,
     },
   );
 }
@@ -1284,6 +1314,7 @@ export async function updateGroup(
       health_check_interval_sec: body.health_check_interval_sec,
       health_check_timeout_ms: body.health_check_timeout_ms,
       health_check_verify_tls: body.health_check_verify_tls,
+      health_check_provider: body.health_check_provider,
     },
   );
   if (!domain && group.enabled) {
@@ -1332,6 +1363,59 @@ export async function toggleService(
   return enabledView!;
 }
 
+export async function toggleServiceIp(
+  db: Db,
+  cf: CloudflareClient,
+  serviceId: number,
+  ip: string,
+  enabled: boolean,
+): Promise<ServiceView> {
+  repos.getService(db, serviceId);
+  const pool = repos.listServiceIps(db, serviceId);
+  if (!pool.includes(ip)) {
+    throw AppError.validation(`IP ${ip} не входит в пул адресов сервиса`);
+  }
+
+  repos.setServiceIpEnabled(db, serviceId, ip, enabled);
+  const node = repos
+    .listNodes(db, serviceId)
+    .find((entry) => entry.address === ip);
+  if (node) {
+    repos.updateNode(db, node.id, { enabled });
+  }
+
+  const bindings = repos.listBindingsByService(db, serviceId);
+  for (const binding of bindings) {
+    if (binding.cname_target?.trim()) continue;
+    const current = repos.listBindingIpsWithMeta(db, binding.id);
+    const hasIp = current.some((entry) => entry.ip === ip);
+    if (enabled && !hasIp) {
+      repos.replaceBindingIpsWithMeta(db, binding.id, [
+        ...current,
+        { ip, weight: 1, priority: 1 },
+      ]);
+      continue;
+    }
+    if (!enabled && hasIp) {
+      repos.replaceBindingIpsWithMeta(
+        db,
+        binding.id,
+        current.filter((entry) => entry.ip !== ip),
+      );
+    }
+  }
+
+  const service = repos.getService(db, serviceId);
+  if (shouldPushDns(db, service)) {
+    await syncServiceBindingsToDns(db, cf, serviceId);
+    await syncGroupDomainForService(db, cf, serviceId);
+  }
+  void syncServiceToVpsTracker(db, serviceId);
+
+  const [view] = attachServiceHealth(db, [await buildView(db, serviceId)]);
+  return view!;
+}
+
 export async function toggleGroup(
   db: Db,
   cf: CloudflareClient,

apps/api/src/services/vps-tracker-sync.ts

@@ -43,8 +43,9 @@ function resolveIpsLocally(
   const binding = index.byFqdn.get(key);
   if (!binding) return [];
 
-  if (binding.target_ips.some(isIpLiteral)) {
-    return binding.target_ips.filter(isIpLiteral);
+  const ips = (binding.target_ips ?? []).filter(isIpLiteral);
+  if (ips.length > 0) {
+    return ips;
   }
 
   const cname = binding.cname_target?.trim();
@@ -79,7 +80,7 @@ export async function resolveBindingIpsForSync(
   index: BindingIpIndex,
   db?: Db,
 ): Promise<string[]> {
-  const directIps = binding.target_ips.filter(isIpLiteral);
+  const directIps = (binding.target_ips ?? []).filter(isIpLiteral);
   if (directIps.length > 0) {
     return [...directIps];
   }
@@ -124,7 +125,7 @@ export async function buildServiceSyncBindingsAsync(
   const serviceIps = repos.listServiceIps(db, serviceId);
   const allBindings = repos.listAllBindings(db);
   const index = buildBindingIndex(allBindings);
-  const bindings = repos.listBindingsByService(db, serviceId);
+  const bindings = allBindings.filter((row) => row.service_id === serviceId);
 
   const items: CfdmBindingSyncItem[] = [];
   for (const binding of bindings) {

apps/api/test/health-check.test.ts

@@ -56,6 +56,7 @@ describe("health-check probeTarget", () => {
       expected_status: null,
       timeout_ms: 1000,
       verify_tls: false,
+      provider: "local",
     };
     const result = await healthCheckService.probeTarget(target);
     expect(result.ok).toBe(true);
@@ -75,6 +76,7 @@ describe("health-check probeTarget", () => {
       expected_status: null,
       timeout_ms: 500,
       verify_tls: false,
+      provider: "local",
     };
     const result = await healthCheckService.probeTarget(target);
     expect(result.ok).toBe(false);
@@ -107,6 +109,7 @@ describe("health-check probeTarget", () => {
         expected_status: 200,
         timeout_ms: 1000,
         verify_tls: false,
+        provider: "local",
       };
       const bindingTarget: HealthCheckTarget = {
         ...groupTarget,
@@ -142,6 +145,7 @@ describe("health-check probeTarget", () => {
       expected_status: null,
       timeout_ms: 3000,
       verify_tls: false,
+      provider: "local",
     };
     const binding: HealthCheckTarget = {
       ...group,

apps/api/test/health-worker.test.ts

@@ -0,0 +1,215 @@
+import { createServer, type Server as HttpServer } from "node:http";
+import { describe, expect, it } from "vitest";
+import { buildApp } from "../src/app.js";
+import { loadConfig } from "../src/config.js";
+import { repos, type Db } from "@cfdm/db";
+import * as healthCheckService from "../src/services/health-check-service.js";
+
+async function authHeaders(app: Awaited<ReturnType<typeof buildApp>>) {
+  const res = await app.inject({
+    method: "POST",
+    url: "/api/v1/auth/login",
+    payload: { username: "admin", password: "admin" },
+  });
+  expect(res.statusCode).toBe(200);
+  const { token } = res.json() as { token: string };
+  return { authorization: `Bearer ${token}` };
+}
+
+function startWorkerMock(handler: (req: {
+  url?: string;
+  headers: Record<string, string | string[] | undefined>;
+  body: string;
+}) => { status: number; json: unknown } | "hang"): Promise<{
+  server: HttpServer;
+  url: string;
+}> {
+  return new Promise((resolve) => {
+    const server = createServer((req, res) => {
+      const chunks: Buffer[] = [];
+      req.on("data", (chunk) => chunks.push(chunk as Buffer));
+      req.on("end", () => {
+        const result = handler({
+          url: req.url,
+          headers: req.headers,
+          body: Buffer.concat(chunks).toString("utf8"),
+        });
+        if (result === "hang") return;
+        res.writeHead(result.status, { "content-type": "application/json" });
+        res.end(JSON.stringify(result.json));
+      });
+    });
+    server.listen(0, "127.0.0.1", () => {
+      const address = server.address();
+      const port = typeof address === "object" && address ? address.port : 0;
+      resolve({ server, url: `http://127.0.0.1:${port}` });
+    });
+  });
+}
+
+async function seedBinding(
+  db: Db,
+  opts: { provider: "local" | "cloudflare"; ip: string },
+) {
+  const domain = repos.createDomain(db, null, "example.com", "zone-1");
+  const service = repos.createService(db, "Panel", "panel");
+  repos.setServiceEnabled(db, service.id, true);
+  repos.replaceServiceIps(db, service.id, [opts.ip]);
+  const binding = repos.insertBinding(db, domain.id, service.id, "panel", null);
+  repos.replaceBindingIpsWithMeta(db, binding.id, [
+    { ip: opts.ip, weight: 1, priority: 1 },
+  ]);
+  repos.updateBindingLbConfig(db, binding.id, {
+    health_check_enabled: true,
+    health_check_type: "tcp",
+    health_check_port: 1,
+    health_check_timeout_ms: 400,
+    health_check_provider: opts.provider,
+  });
+  return { service, binding, domain };
+}
+
+const thresholds = {
+  degradedFailures: 1,
+  downFailures: 2,
+  latencyWarnMs: 1000,
+  successRecoveries: 2,
+};
+
+describe("health-check XOR worker", () => {
+  it("lists only local providers when no cloudflare bindings", async () => {
+    const app = await buildApp({
+      config: { ...loadConfig(), staticDir: null },
+      memory: true,
+    });
+    await seedBinding(app.db, {
+      provider: "local",
+      ip: "10.0.0.1",
+    });
+    const targets = repos.listHealthCheckTargets(app.db);
+    expect(targets.length).toBeGreaterThan(0);
+    expect(targets.every((t) => t.provider === "local")).toBe(true);
+    expect(targets.some((t) => t.provider === "cloudflare")).toBe(false);
+    await app.close();
+  });
+
+  it("cloudflare without worker URL does not fall back to local", async () => {
+    const app = await buildApp({
+      config: { ...loadConfig(), staticDir: null },
+      memory: true,
+    });
+    const { binding } = await seedBinding(app.db, {
+      provider: "cloudflare",
+      ip: "127.0.0.1",
+    });
+    await healthCheckService.runAllChecks(app.db, {
+      thresholds,
+      probeGapMs: 0,
+      worker: null,
+    });
+    const row = repos.getIpHealthStatusRow(
+      app.db,
+      "binding",
+      binding.id,
+      "127.0.0.1",
+    );
+    expect(row?.last_error).toMatch(/Worker не настроен/i);
+    expect(row?.provider).toBe("cloudflare");
+    await app.close();
+  });
+
+  it("worker mock 200 writes colo and last_checked_at", async () => {
+    const mock = await startWorkerMock((req) => {
+      const auth = String(req.headers.authorization ?? "");
+      if (auth !== "Bearer secret") {
+        return { status: 401, json: { ok: false, error: "unauthorized" } };
+      }
+      return {
+        status: 200,
+        json: { ok: true, latencyMs: 42, error: null, colo: "AMS" },
+      };
+    });
+    const app = await buildApp({
+      config: { ...loadConfig(), staticDir: null },
+      memory: true,
+    });
+    const headers = await authHeaders(app);
+    const { service, binding } = await seedBinding(app.db, {
+      provider: "cloudflare",
+      ip: "203.0.113.10",
+    });
+    await healthCheckService.runAllChecks(app.db, {
+      thresholds,
+      probeGapMs: 0,
+      worker: { url: mock.url, token: "secret" },
+    });
+    const row = repos.getIpHealthStatusRow(
+      app.db,
+      "binding",
+      binding.id,
+      "203.0.113.10",
+    );
+    expect(row?.status).toBe("up");
+    expect(row?.colo).toBe("AMS");
+    expect(row?.last_checked_at).toBeTruthy();
+    expect(row?.provider).toBe("cloudflare");
+
+    const res = await app.inject({
+      method: "GET",
+      url: `/api/v1/services/${service.id}`,
+      headers,
+    });
+    expect(res.statusCode).toBe(200);
+    const body = res.json() as {
+      ip_health: Array<{
+        ip: string;
+        colo: string | null;
+        last_checked_at: string | null;
+        provider: string;
+      }>;
+    };
+    const ipRow = body.ip_health.find((item) => item.ip === "203.0.113.10");
+    expect(ipRow?.colo).toBe("AMS");
+    expect(ipRow?.last_checked_at).toBeTruthy();
+    expect(ipRow?.provider).toBe("cloudflare");
+
+    const logRes = await app.inject({
+      method: "GET",
+      url: `/api/v1/services/${service.id}/health-log`,
+      headers,
+    });
+    expect(logRes.statusCode).toBe(200);
+    const logBody = logRes.json() as { items: Array<{ colo: string | null }> };
+    expect(logBody.items[0]?.colo).toBe("AMS");
+
+    await new Promise<void>((resolve) => mock.server.close(() => resolve()));
+    await app.close();
+  });
+
+  it("worker timeout is recorded, not local probe", async () => {
+    const mock = await startWorkerMock(() => "hang");
+    const app = await buildApp({
+      config: { ...loadConfig(), staticDir: null },
+      memory: true,
+    });
+    const { binding } = await seedBinding(app.db, {
+      provider: "cloudflare",
+      ip: "203.0.113.20",
+    });
+    await healthCheckService.runAllChecks(app.db, {
+      thresholds,
+      probeGapMs: 0,
+      worker: { url: mock.url, token: "secret" },
+    });
+    const row = repos.getIpHealthStatusRow(
+      app.db,
+      "binding",
+      binding.id,
+      "203.0.113.20",
+    );
+    expect(row?.last_error).toMatch(/timeout|Worker/i);
+    expect(row?.provider).toBe("cloudflare");
+    await new Promise<void>((resolve) => mock.server.close(() => resolve()));
+    await app.close();
+  }, 15_000);
+});

apps/api/test/service-groups-health.test.ts

@@ -39,6 +39,7 @@ describe("service groups health enrichment", () => {
     const service = repos.createService(app.db, "Panel", "panel");
     repos.setServiceGroup(app.db, service.id, group.id);
     repos.setServiceEnabled(app.db, service.id, true);
+    repos.replaceServiceIps(app.db, service.id, ["1.2.3.4"]);
     const binding = repos.insertBinding(
       app.db,
       domain.id,
@@ -85,6 +86,11 @@ describe("service groups health enrichment", () => {
           id: number;
           health_status: string;
           health_latency_ms: number | null;
+          ip_health: Array<{
+            ip: string;
+            status: string;
+            latency_ms: number | null;
+          }>;
         }>;
       }>;
     };
@@ -92,6 +98,17 @@ describe("service groups health enrichment", () => {
     expect(groupView).toBeDefined();
     expect(groupView!.services[0]?.health_status).toBe("degraded");
     expect(groupView!.services[0]?.health_latency_ms).toBe(120);
+    expect(groupView!.services[0]?.ip_health).toEqual([
+      {
+        ip: "1.2.3.4",
+        status: "degraded",
+        latency_ms: 120,
+        last_checked_at: expect.any(String),
+        last_error: null,
+        provider: "local",
+        colo: null,
+      },
+    ]);
     // group worst = degraded (from service) over up (group scope)
     expect(groupView!.health_status).toBe("degraded");
 

apps/api/test/services-create-list.test.ts

@@ -165,4 +165,94 @@ describe("create service then list groups", () => {
 
     await app.close();
   });
+
+  it("PATCH /services/:id/ips/toggle keeps IP in pool and removes it from A-binding", async () => {
+    const app = await buildApp({
+      config: { ...loadConfig(), staticDir: null },
+      memory: true,
+    });
+    const headers = await authHeaders(app);
+    const cf = mockCf();
+
+    repos.createDomain(app.db, null, "example.com", "zone-1");
+    const group = repos.createServiceGroup(
+      app.db,
+      "VPN",
+      "vpn",
+      null,
+      "vpn.example.com",
+    );
+
+    const createRes = await app.inject({
+      method: "POST",
+      url: "/api/v1/services",
+      headers,
+      payload: {
+        name: "Panel",
+        slug: "panel-ip-toggle",
+        service_group_id: group.id,
+      },
+    });
+    expect(createRes.statusCode).toBe(200);
+    const created = createRes.json() as { id: number };
+
+    await updateConfig(app.db, cf, created.id, {
+      ips: ["1.2.3.4", "5.6.7.8"],
+      service_group_id: group.id,
+      domains: [
+        {
+          fqdn: "panel.example.com",
+          target_ips: ["1.2.3.4", "5.6.7.8"],
+          target_ip_weights: { "1.2.3.4": 1, "5.6.7.8": 1 },
+          target_ip_priorities: { "1.2.3.4": 1, "5.6.7.8": 1 },
+          lb_mode: "round_robin",
+          health_check_enabled: false,
+          health_check_type: "tcp",
+          health_check_port: 443,
+          health_check_path: null,
+          health_check_expected_status: null,
+          health_check_interval_sec: 30,
+          health_check_timeout_ms: 3000,
+          health_check_verify_tls: false,
+        },
+      ],
+    });
+
+    // HTTP toggle uses request.server.cf; disable DNS push so the test
+    // does not call the real Cloudflare client.
+    repos.setServiceEnabled(app.db, created.id, false);
+
+    const offRes = await app.inject({
+      method: "PATCH",
+      url: `/api/v1/services/${created.id}/ips/toggle`,
+      headers,
+      payload: { ip: "1.2.3.4", enabled: false },
+    });
+    expect(offRes.statusCode, JSON.stringify(offRes.json())).toBe(200);
+    const offView = offRes.json() as {
+      ips: string[];
+      ip_enabled: Record<string, boolean>;
+    };
+    expect(offView.ips).toEqual(expect.arrayContaining(["1.2.3.4", "5.6.7.8"]));
+    expect(offView.ip_enabled["1.2.3.4"]).toBe(false);
+    expect(offView.ip_enabled["5.6.7.8"]).toBe(true);
+
+    const binding = repos.listBindingsByService(app.db, created.id)[0]!;
+    expect(repos.listBindingIps(app.db, binding.id)).toEqual(["5.6.7.8"]);
+
+    const onRes = await app.inject({
+      method: "PATCH",
+      url: `/api/v1/services/${created.id}/ips/toggle`,
+      headers,
+      payload: { ip: "1.2.3.4", enabled: true },
+    });
+    expect(onRes.statusCode).toBe(200);
+    const onView = onRes.json() as { ip_enabled: Record<string, boolean> };
+    expect(onView.ip_enabled["1.2.3.4"]).toBe(true);
+    expect(repos.listBindingIps(app.db, binding.id)).toEqual(
+      expect.arrayContaining(["1.2.3.4", "5.6.7.8"]),
+    );
+
+    await app.close();
+  });
 });

apps/api/test/settings-health.test.ts

@@ -0,0 +1,165 @@
+import { describe, expect, it } from "vitest";
+import { buildApp } from "../src/app.js";
+import { loadConfig } from "../src/config.js";
+
+async function authHeaders(app: Awaited<ReturnType<typeof buildApp>>) {
+  const res = await app.inject({
+    method: "POST",
+    url: "/api/v1/auth/login",
+    payload: { username: "admin", password: "admin" },
+  });
+  expect(res.statusCode).toBe(200);
+  const { token } = res.json() as { token: string };
+  return { authorization: `Bearer ${token}` };
+}
+
+describe("settings health engine", () => {
+  it("GET /api/v1/settings returns env fallbacks for health fields", async () => {
+    const app = await buildApp({
+      config: {
+        ...loadConfig(),
+        staticDir: null,
+        healthCheckCron: "*/30 * * * * *",
+        healthDegradedFailures: 3,
+        healthDownFailures: 4,
+        healthLatencyWarnMs: 1500,
+        healthSuccessRecoveries: 5,
+      },
+      memory: true,
+    });
+    const headers = await authHeaders(app);
+    const res = await app.inject({
+      method: "GET",
+      url: "/api/v1/settings",
+      headers,
+    });
+    expect(res.statusCode).toBe(200);
+    const body = res.json() as {
+      healthCheckCron: string;
+      healthDegradedFailures: number;
+      healthDownFailures: number;
+      healthLatencyWarnMs: number;
+      healthSuccessRecoveries: number;
+    };
+    expect(body.healthCheckCron).toBe("*/30 * * * * *");
+    expect(body.healthDegradedFailures).toBe(3);
+    expect(body.healthDownFailures).toBe(4);
+    expect(body.healthLatencyWarnMs).toBe(1500);
+    expect(body.healthSuccessRecoveries).toBe(5);
+    await app.close();
+  });
+
+  it("PATCH persists health engine settings", async () => {
+    const app = await buildApp({
+      config: { ...loadConfig(), staticDir: null },
+      memory: true,
+    });
+    const headers = await authHeaders(app);
+    const res = await app.inject({
+      method: "PATCH",
+      url: "/api/v1/settings",
+      headers,
+      payload: {
+        healthCheckCron: "0 */5 * * * *",
+        healthDegradedFailures: 2,
+        healthDownFailures: 4,
+        healthLatencyWarnMs: 800,
+        healthSuccessRecoveries: 3,
+      },
+    });
+    expect(res.statusCode).toBe(200);
+    const body = res.json() as {
+      healthCheckCron: string;
+      healthDegradedFailures: number;
+      healthDownFailures: number;
+      healthLatencyWarnMs: number;
+      healthSuccessRecoveries: number;
+    };
+    expect(body.healthCheckCron).toBe("0 */5 * * * *");
+    expect(body.healthDegradedFailures).toBe(2);
+    expect(body.healthDownFailures).toBe(4);
+    expect(body.healthLatencyWarnMs).toBe(800);
+    expect(body.healthSuccessRecoveries).toBe(3);
+
+    const again = await app.inject({
+      method: "GET",
+      url: "/api/v1/settings",
+      headers,
+    });
+    expect(again.json()).toMatchObject({
+      healthCheckCron: "0 */5 * * * *",
+      healthDegradedFailures: 2,
+      healthDownFailures: 4,
+      healthLatencyWarnMs: 800,
+      healthSuccessRecoveries: 3,
+    });
+    await app.close();
+  });
+
+  it("PATCH rejects invalid cron", async () => {
+    const app = await buildApp({
+      config: { ...loadConfig(), staticDir: null },
+      memory: true,
+    });
+    const headers = await authHeaders(app);
+    const res = await app.inject({
+      method: "PATCH",
+      url: "/api/v1/settings",
+      headers,
+      payload: { healthCheckCron: "not-a-cron" },
+    });
+    expect(res.statusCode).toBe(400);
+    expect(res.json()).toMatchObject({
+      error: { code: "VALIDATION_ERROR" },
+    });
+    await app.close();
+  });
+
+  it("PATCH rejects down < degraded", async () => {
+    const app = await buildApp({
+      config: { ...loadConfig(), staticDir: null },
+      memory: true,
+    });
+    const headers = await authHeaders(app);
+    const res = await app.inject({
+      method: "PATCH",
+      url: "/api/v1/settings",
+      headers,
+      payload: {
+        healthDegradedFailures: 5,
+        healthDownFailures: 2,
+      },
+    });
+    expect(res.statusCode).toBe(400);
+    await app.close();
+  });
+
+  it("PATCH worker URL; token is not returned in GET", async () => {
+    const app = await buildApp({
+      config: { ...loadConfig(), staticDir: null },
+      memory: true,
+    });
+    const headers = await authHeaders(app);
+    const res = await app.inject({
+      method: "PATCH",
+      url: "/api/v1/settings",
+      headers,
+      payload: {
+        healthWorkerUrl: "https://cfdm-health-probe.example.workers.dev",
+        healthWorkerToken: "super-secret",
+      },
+    });
+    expect(res.statusCode).toBe(200);
+    const body = res.json() as {
+      healthWorkerUrl: string;
+      healthWorkerTokenSet: boolean;
+      healthWorkerToken?: string;
+    };
+    expect(body.healthWorkerUrl).toBe(
+      "https://cfdm-health-probe.example.workers.dev",
+    );
+    expect(body.healthWorkerTokenSet).toBe(true);
+    expect(body.healthWorkerToken).toBeUndefined();
+    await app.close();
+  });
+});

apps/api/test/vps-tracker-sync.test.ts

@@ -134,6 +134,19 @@ describe("resolveBindingIpsForSync", () => {
     expect(ips).toEqual(["203.0.113.10"]);
   });
 
+  it("treats missing target_ips as empty instead of throwing", async () => {
+    const cname = binding({
+      id: 2,
+      hostname: "imsk",
+      zone_name: "rkns.top",
+      cname_target: "ihome.rkns.top",
+    });
+    delete (cname as { target_ips?: string[] }).target_ips;
+    const index = { byFqdn: new Map([["imsk.rkns.top", cname]]) };
+    const ips = await resolveBindingIpsForSync(cname, ["198.51.100.9"], index);
+    expect(ips).toEqual(["198.51.100.9"]);
+  });
+
   it("prefers service IPs over empty CNAME resolution chain", async () => {
     const cname = binding({
       id: 2,

apps/web/src/components/health-check-badge.tsx

@@ -54,6 +54,8 @@ interface HealthCheckBadgeProps {
   latencyMs?: number | null
   lastCheckedAt?: string | null
   lastError?: string | null
+  colo?: string | null
+  provider?: 'local' | 'cloudflare' | string | null
   title?: string
   showLatency?: boolean
   size?: 'xs' | 'sm'
@@ -65,6 +67,8 @@ export function HealthCheckBadge({
   latencyMs,
   lastCheckedAt,
   lastError,
+  colo,
+  provider,
   title,
   showLatency = false,
   size = 'sm',
@@ -79,6 +83,9 @@ export function HealthCheckBadge({
   tooltipParts.push(`Статус: ${label}`)
   if (latencyMs != null) tooltipParts.push(`Задержка: ${latencyMs} мс`)
   if (lastCheckedAt) tooltipParts.push(`Проверка: ${formatDate(lastCheckedAt)}`)
+  if (colo) tooltipParts.push(`Colo: ${colo}`)
+  if (provider === 'cloudflare') tooltipParts.push('Провайдер: Cloudflare Worker')
+  if (provider === 'local') tooltipParts.push('Провайдер: Local')
   if (lastError) tooltipParts.push(`Ошибка: ${lastError}`)
 
   return (

apps/web/src/components/health-check-config-fields.tsx

@@ -20,6 +20,7 @@ import { Switch } from '@cfdm/ui/components/switch'
 import { Button } from '@cfdm/ui/components/button'
 import { ButtonGroup } from '@cfdm/ui/components/button-group'
 import { FieldGroup } from '@cfdm/ui/components/field'
+import { Link } from '@tanstack/react-router'
 import { Alert, AlertDescription, AlertTitle } from '@/components/reui/alert'
 import { cn } from '@cfdm/ui/lib/utils'
 
@@ -189,7 +190,7 @@ export function HealthCheckConfigFields({
 
       <SettingRow
         title="Провайдер health-check"
-        description="Local TCP/HTTP или Cloudflare Health Checks API"
+        description="Откуда идёт проба: API CFDM или Cloudflare Worker (edge)"
         labelFor={`${idPrefix}-provider`}
         compact
         className={rowClass}
@@ -207,13 +208,29 @@ export function HealthCheckConfigFields({
       </SettingRow>
       {value.provider === 'cloudflare' ? (
         <Alert>
-          <AlertTitle>Cloudflare Health Checks</AlertTitle>
+          <AlertTitle>Cloudflare Worker</AlertTitle>
           <AlertDescription>
-            Поля соответствуют официальному API зоны. Если план не позволяет Health
-            Checks, API вернёт ошибку — останется Local. Workers не используются.
+            Проба с edge Cloudflare, не продукт Health Checks API (на Free его нет).
+            Регионы WNAM/WEU недоступны — в результате будет colo ближайшего POP
+            (например AMS). URL и токен Worker — в{' '}
+            <Link to="/settings/health" className="text-foreground underline">
+              Настройках → Health-check
+            </Link>
+            . Если Worker не задан, цель не пробируется как Local.
           </AlertDescription>
         </Alert>
-      ) : null}
+      ) : (
+        <Alert>
+          <AlertTitle>Local health-check</AlertTitle>
+          <AlertDescription>
+            Проба TCP/HTTP с сервера API. Cron и пороги Slow/Down — в{' '}
+            <Link to="/settings/health" className="text-foreground underline">
+              Настройках → Health-check
+            </Link>
+            . Интервал в карточке не используется.
+          </AlertDescription>
+        </Alert>
+      )}
 
       <SettingRow
         title="Health-check"
@@ -322,83 +339,18 @@ export function HealthCheckConfigFields({
             </>
           ) : null}
 
-          <div className="grid grid-cols-2 gap-3">
-            <FormFieldSimple label="Интервал, сек" htmlFor={`${idPrefix}-interval`}>
-              <CompactNumberField
-                id={`${idPrefix}-interval`}
-                value={value.interval_sec}
-                min={5}
-                max={3600}
-                placeholder="30"
-                onValueChange={(next) =>
-                  patch({ interval_sec: next ?? 30 })
-                }
-              />
-            </FormFieldSimple>
-            <FormFieldSimple label="Таймаут, мс" htmlFor={`${idPrefix}-timeout`}>
-              <CompactNumberField
-                id={`${idPrefix}-timeout`}
-                value={value.timeout_ms}
-                min={100}
-                max={30000}
-                placeholder="3000"
-                onValueChange={(next) =>
-                  patch({ timeout_ms: next ?? 3000 })
-                }
-              />
-            </FormFieldSimple>
-          </div>
-          {value.provider === 'cloudflare' ? (
-            <div className="grid grid-cols-2 gap-3">
-              <FormFieldSimple
-                label="Retries"
-                htmlFor={`${idPrefix}-retries`}
-                hint="Cloudflare retries"
-              >
-                <CompactNumberField
-                  id={`${idPrefix}-retries`}
-                  value={value.retries ?? 2}
-                  min={0}
-                  max={10}
-                  placeholder="2"
-                  onValueChange={(retries) => patch({ retries: retries ?? 2 })}
-                />
-              </FormFieldSimple>
-              <FormFieldSimple
-                label="Successes"
-                htmlFor={`${idPrefix}-successes`}
-                hint="consecutive_successes"
-              >
-                <CompactNumberField
-                  id={`${idPrefix}-successes`}
-                  value={value.consecutive_successes ?? 2}
-                  min={1}
-                  max={20}
-                  placeholder="2"
-                  onValueChange={(consecutive_successes) =>
-                    patch({ consecutive_successes: consecutive_successes ?? 2 })
-                  }
-                />
-              </FormFieldSimple>
-            </div>
-          ) : null}
-          {value.provider === 'cloudflare' && isHttp ? (
-            <FormFieldSimple label="HTTP method" htmlFor={`${idPrefix}-method`}>
-              <Select
-                modal={false}
-                value={value.method ?? 'GET'}
-                onValueChange={(v) => patch({ method: v ?? 'GET' })}
-              >
-                <SelectTrigger id={`${idPrefix}-method`} className="w-full">
-                  <SelectValue />
-                </SelectTrigger>
-                <SelectContent>
-                  <SelectItem value="GET">GET</SelectItem>
-                  <SelectItem value="HEAD">HEAD</SelectItem>
-                </SelectContent>
-              </Select>
-            </FormFieldSimple>
-          ) : null}
+          <FormFieldSimple label="Таймаут, мс" htmlFor={`${idPrefix}-timeout`}>
+            <CompactNumberField
+              id={`${idPrefix}-timeout`}
+              value={value.timeout_ms}
+              min={100}
+              max={30000}
+              placeholder="3000"
+              onValueChange={(next) =>
+                patch({ timeout_ms: next ?? 3000 })
+              }
+            />
+          </FormFieldSimple>
         </div>
       ) : null}
     </FieldGroup>

apps/web/src/components/health/health-timeline.tsx

@@ -23,6 +23,8 @@ export interface HealthTimelineEvent {
   latency_ms?: number | null
   error?: string | null
   checked_at: string
+  colo?: string | null
+  provider?: string | null
 }
 
 interface HealthTimelineProps {
@@ -63,6 +65,8 @@ export function HealthTimeline({ events }: HealthTimelineProps) {
                 <HealthCheckBadge
                   status={event.status}
                   latencyMs={event.latency_ms}
+                  colo={event.colo}
+                  provider={event.provider}
                   size="xs"
                   showLatency
                 />

apps/web/src/components/kanban/service-kanban-card.tsx

@@ -3,7 +3,7 @@ import { MoreHorizontalIcon, PencilIcon, Trash2Icon } from 'lucide-react'
 import { Badge } from '@/components/reui/badge'
 import { HealthCheckBadge } from '@/components/health-check-badge'
 import { StatusBadge } from '@/components/status-badge'
-import { ServiceFqdnList } from '@/components/services/service-fqdn-list'
+import { ServiceFqdnList, ServiceIpList } from '@/components/services/service-fqdn-list'
 import type { ServiceView } from '@/lib/schemas'
 import { Button } from '@cfdm/ui/components/button'
 import {
@@ -78,7 +78,22 @@ export function ServiceKanbanCard({
       </ItemHeader>
 
       <ItemContent className="min-w-0 gap-2">
-        <ServiceFqdnList copyable service={service} />
+        <div className="flex min-w-0 flex-col gap-0.5">
+          <span className="text-muted-foreground text-xs">Общий домен</span>
+          <ServiceFqdnList
+            copyable
+            service={service}
+            emptyLabel="Не задан"
+          />
+        </div>
+        <div className="flex min-w-0 flex-col gap-0.5">
+          <span className="text-muted-foreground text-xs">IP</span>
+          <ServiceIpList
+            copyable
+            ips={service.ips ?? []}
+            ipHealth={service.ip_health ?? []}
+          />
+        </div>
       </ItemContent>
 
       <ItemFooter className="min-w-0 justify-between gap-2">

apps/web/src/components/layout/search-menu.tsx

@@ -3,6 +3,7 @@ import { Link, useNavigate } from '@tanstack/react-router'
 import {
   FolderTreeIcon,
   GlobeIcon,
+  HeartPulseIcon,
   LayoutDashboardIcon,
   SearchIcon,
   ServerIcon,
@@ -57,6 +58,12 @@ const NAV_ITEMS = [
     keywords: ['certificates', 'ssl', 'tls'],
     icon: ShieldCheckIcon,
   },
+  {
+    to: '/settings/health',
+    label: 'Health-check',
+    keywords: ['health', 'health-check', 'cron', 'пороги', 'настройки'],
+    icon: HeartPulseIcon,
+  },
   {
     to: '/settings/integrations',
     label: 'Настройки',

apps/web/src/components/layout/site-header.tsx

@@ -24,6 +24,7 @@ const routeTitles: Record<string, string> = {
   '/services': 'Сервисы',
   '/certificates': 'Сертификаты',
   '/settings/appearance': 'Внешний вид',
+  '/settings/health': 'Health-check',
   '/settings/integrations': 'Интеграции',
 }
 
@@ -64,6 +65,8 @@ function getBreadcrumbs(
       { label: 'Настройки', href: '/settings/appearance' },
       ...(pathname === '/settings/integrations'
         ? [{ label: 'Интеграции', href: pathname }]
+        : pathname === '/settings/health'
+          ? [{ label: 'Health-check', href: pathname }]
         : pathname === '/settings/appearance'
           ? [{ label: 'Внешний вид', href: pathname }]
           : []),

apps/web/src/components/reui-kit/settings-shell.tsx

@@ -1,6 +1,6 @@
 import type { ReactNode } from 'react'
 import { Link, Outlet, useRouterState } from '@tanstack/react-router'
-import { PaletteIcon, SettingsIcon } from 'lucide-react'
+import { HeartPulseIcon, PaletteIcon, SettingsIcon } from 'lucide-react'
 
 import { useIsMobile } from '@cfdm/ui/hooks/use-mobile'
 import { cn } from '@cfdm/ui/lib/utils'
@@ -21,6 +21,12 @@ const DEFAULT_TABS: SettingsTabConfig[] = [
     label: 'Внешний вид',
     icon: <PaletteIcon className="size-4" aria-hidden="true" />,
   },
+  {
+    id: 'health',
+    to: '/settings/health',
+    label: 'Health-check',
+    icon: <HeartPulseIcon className="size-4" aria-hidden="true" />,
+  },
   {
     id: 'integrations',
     to: '/settings/integrations',
@@ -37,7 +43,7 @@ interface SettingsShellProps {
 
 export function SettingsShell({
   title = 'Настройки',
-  description = 'Внешний вид и интеграции',
+  description = 'Внешний вид, health-check и интеграции',
   tabs = DEFAULT_TABS,
 }: SettingsShellProps) {
   const isMobile = useIsMobile()

apps/web/src/components/service-edit-sheet.tsx

@@ -1,8 +1,6 @@
 import { useEffect, useMemo, useState } from 'react'
-import { Link2Icon, PlusIcon, Trash2Icon } from 'lucide-react'
+import { PlusIcon, Trash2Icon } from 'lucide-react'
 import { ConfirmDialog } from '@/components/confirm-dialog'
-import { CountedLineTabs } from '@/components/counted-line-tabs'
-import { EmptyState } from '@/components/empty-state'
 import { TaggedInput, isValidIpv4 } from '@/components/tagged-input'
 import { ServiceBindingIpInput } from '@/components/service-binding-ip-input'
 import {
@@ -38,7 +36,6 @@ import {
   ItemGroup,
 } from '@cfdm/ui/components/item'
 import { LoadingButton } from '@/components/loading-button'
-import { TabsContent } from '@cfdm/ui/components/tabs'
 import {
   Select,
   SelectContent,
@@ -46,7 +43,6 @@ import {
   SelectTrigger,
   SelectValue,
 } from '@cfdm/ui/components/select'
-import { Separator } from '@cfdm/ui/components/separator'
 
 interface BindingHealthConfig {
   enabled: boolean
@@ -114,7 +110,7 @@ function toBindingDrafts(service: ServiceView): ServiceBindingDraft[] {
       interval_sec: binding.health_check_interval_sec,
       timeout_ms: binding.health_check_timeout_ms,
       verify_tls: binding.health_check_verify_tls ?? false,
-      provider: 'local',
+      provider: binding.health_check_provider === 'cloudflare' ? 'cloudflare' : 'local',
     },
     target_ip_weights: binding.target_ip_weights ?? {},
     target_ip_priorities: binding.target_ip_priorities ?? {},
@@ -142,6 +138,7 @@ function buildDomainsPayload(bindings: ServiceBindingDraft[]) {
             health_check_interval_sec: binding.health.interval_sec,
             health_check_timeout_ms: binding.health.timeout_ms,
             health_check_verify_tls: binding.health.verify_tls,
+            health_check_provider: binding.health.provider,
           }
         : {
             fqdn: binding.fqdn.trim(),
@@ -157,10 +154,38 @@ function buildDomainsPayload(bindings: ServiceBindingDraft[]) {
             health_check_interval_sec: binding.health.interval_sec,
             health_check_timeout_ms: binding.health.timeout_ms,
             health_check_verify_tls: binding.health.verify_tls,
+            health_check_provider: binding.health.provider,
           },
     )
 }
 
+function emptyBindingDraft(fqdn = ''): ServiceBindingDraft {
+  return {
+    fqdn,
+    record_type: 'A',
+    target_ips: [],
+    target_cname: '',
+    lb_mode: 'round_robin',
+    health: { ...defaultHealth },
+    target_ip_weights: {},
+    target_ip_priorities: {},
+  }
+}
+
+function withPoolIps(draft: ServiceBindingDraft, pool: string[]): ServiceBindingDraft {
+  if (draft.record_type !== 'A' || draft.target_ips.length > 0 || pool.length === 0) {
+    return draft
+  }
+  return {
+    ...draft,
+    target_ips: pool,
+    target_ip_weights: Object.fromEntries(pool.map((ip) => [ip, draft.target_ip_weights[ip] ?? 1])),
+    target_ip_priorities: Object.fromEntries(
+      pool.map((ip) => [ip, draft.target_ip_priorities[ip] ?? 1]),
+    ),
+  }
+}
+
 export function ServiceEditSheet({
   mode,
   service,
@@ -179,10 +204,10 @@ export function ServiceEditSheet({
   const [slug, setSlug] = useState('')
   const [serviceGroupId, setServiceGroupId] = useState('none')
   const [ips, setIps] = useState<string[]>([])
+  const [commonFqdn, setCommonFqdn] = useState('')
   const [bindings, setBindings] = useState<ServiceBindingDraft[]>([])
   const [lbWeight, setLbWeight] = useState(1)
   const [lbPriority, setLbPriority] = useState(1)
-  const [activeTab, setActiveTab] = useState('general')
 
   const groupItems = useMemo(
     () => [
@@ -192,16 +217,8 @@ export function ServiceEditSheet({
     [groups],
   )
 
-  const selectedGroup = useMemo(() => {
-    if (serviceGroupId === 'none') return null
-    return groups.find((g) => String(g.id) === serviceGroupId) ?? null
-  }, [groups, serviceGroupId])
-
-  const groupHasDomain = Boolean(selectedGroup?.domain?.trim())
-
   useEffect(() => {
     if (!open) return
-    setActiveTab('general')
     if (mode === 'edit' && service) {
       setName(service.name)
       setSlug(service.slug)
@@ -209,7 +226,9 @@ export function ServiceEditSheet({
         service.service_group_id != null ? String(service.service_group_id) : 'none',
       )
       setIps(service.ips ?? [])
-      setBindings(toBindingDrafts(service))
+      const drafts = toBindingDrafts(service)
+      setBindings(drafts)
+      setCommonFqdn(drafts[0]?.fqdn ?? '')
       setLbWeight(service.lb_weight ?? 1)
       setLbPriority(service.lb_priority ?? 1)
       return
@@ -221,6 +240,7 @@ export function ServiceEditSheet({
         defaultGroupId != null ? String(defaultGroupId) : 'none',
       )
       setIps([])
+      setCommonFqdn('')
       setBindings([])
       setLbWeight(1)
       setLbPriority(1)
@@ -232,23 +252,28 @@ export function ServiceEditSheet({
     [knownDomains],
   )
 
-  function handleAddBinding() {
-    setBindings((current) => [
-      ...current,
-      {
-        fqdn: '',
-        record_type: 'A',
-        target_ips: [],
-        target_cname: '',
-        lb_mode: 'round_robin',
-        health: { ...defaultHealth },
-        target_ip_weights: {},
-        target_ip_priorities: {},
-      },
-    ])
+  const extraBindings = bindings.slice(1)
+
+  function handleCommonFqdnChange(value: string) {
+    setCommonFqdn(value)
+    setBindings((current) => {
+      if (current.length === 0) return current
+      return current.map((item, i) => (i === 0 ? { ...item, fqdn: value } : item))
+    })
   }
 
-  function handleRemoveBinding(index: number) {
+  function handleAddExtraBinding() {
+    setBindings((current) => {
+      const extra = withPoolIps(emptyBindingDraft(), ips)
+      if (current.length === 0) {
+        return [emptyBindingDraft(commonFqdn), extra]
+      }
+      return [...current, extra]
+    })
+  }
+
+  function handleRemoveExtraBinding(extraIndex: number) {
+    const index = extraIndex + 1
     setBindings((current) => current.filter((_, i) => i !== index))
   }
 
@@ -298,69 +323,75 @@ export function ServiceEditSheet({
     )
   }
 
-  function handleBindingMetaChange(
-    index: number,
-    ip: string,
-    meta: { weight?: number; priority?: number },
-  ) {
-    setBindings((current) =>
-      current.map((item, i) => {
-        if (i !== index) return item
-        const weights = { ...item.target_ip_weights }
-        const priorities = { ...item.target_ip_priorities }
-        if (meta.weight !== undefined) weights[ip] = meta.weight
-        if (meta.priority !== undefined) priorities[ip] = meta.priority
-        return { ...item, target_ip_weights: weights, target_ip_priorities: priorities }
-      }),
-    )
+  function healthFromConfig(next: LbAndHealthConfig): BindingHealthConfig {
+    return {
+      enabled: next.enabled,
+      type: next.type,
+      port: next.port,
+      path: next.path,
+      expected_status: next.expected_status,
+      interval_sec: next.interval_sec,
+      timeout_ms: next.timeout_ms,
+      verify_tls: next.verify_tls,
+      provider: next.provider,
+    }
   }
 
-  function handleBindingHealthChange(index: number, next: LbAndHealthConfig) {
-    setBindings((current) =>
-      current.map((item, i) =>
-        i === index
-          ? {
-              ...item,
-              lb_mode: next.lb_mode,
-              health: {
-                enabled: next.enabled,
-                type: next.type,
-                port: next.port,
-                path: next.path,
-                expected_status: next.expected_status,
-                interval_sec: next.interval_sec,
-                timeout_ms: next.timeout_ms,
-                verify_tls: next.verify_tls,
-                provider: next.provider ?? 'local',
-              },
-            }
-          : item,
-      ),
-    )
+  function handlePrimaryHealthChange(next: LbAndHealthConfig) {
+    const health = healthFromConfig(next)
+    setBindings((current) => {
+      if (current.length === 0) {
+        return [
+          {
+            ...withPoolIps(emptyBindingDraft(commonFqdn), ips),
+            lb_mode: next.lb_mode,
+            health,
+          },
+        ]
+      }
+      return current.map((item, index) =>
+        index === 0 ? { ...item, lb_mode: next.lb_mode, health } : item,
+      )
+    })
+  }
+
+  const primaryHealthValue: LbAndHealthConfig = {
+    lb_mode: bindings[0]?.lb_mode ?? 'round_robin',
+    ...(bindings[0]?.health ?? defaultHealth),
   }
 
   function resolveServiceGroupId(): number | null {
     return serviceGroupId === 'none' ? null : Number(serviceGroupId)
   }
 
+  function syncCommonDomain(current: ServiceBindingDraft[]): ServiceBindingDraft[] {
+    const trimmed = commonFqdn.trim()
+    if (!trimmed) return current
+    if (current.length === 0) {
+      return [withPoolIps(emptyBindingDraft(trimmed), ips)]
+    }
+    return current.map((item, index) => {
+      if (index !== 0) return item
+      return withPoolIps({ ...item, fqdn: trimmed }, ips)
+    })
+  }
+
   function handleSubmit() {
-    const domains = buildDomainsPayload(bindings)
+    const syncedBindings = syncCommonDomain(bindings)
+    const domains = buildDomainsPayload(syncedBindings)
     const normalizedFqdns = domains.map((d) => d.fqdn.trim().toLowerCase())
     const hasDuplicateFqdn =
       new Set(normalizedFqdns).size !== normalizedFqdns.length
     if (hasDuplicateFqdn) {
       toast.error('Укажите уникальные FQDN — дубликаты привязок недопустимы')
-      setActiveTab('bindings')
       return
     }
     const groupId = resolveServiceGroupId()
-    const lbFields = groupHasDomain
-      ? { lb_weight: lbWeight, lb_priority: lbPriority }
-      : {}
     const configPayload = {
       ips,
       domains,
-      ...lbFields,
+      lb_weight: lbWeight,
+      lb_priority: lbPriority,
     }
     if (mode === 'create') {
       onCreate?.({
@@ -368,7 +399,8 @@ export function ServiceEditSheet({
         slug: slug.trim(),
         service_group_id: groupId,
         ips,
-        ...lbFields,
+        lb_weight: lbWeight,
+        lb_priority: lbPriority,
         domains,
       })
       return
@@ -398,29 +430,16 @@ export function ServiceEditSheet({
         <SheetHeader className="shrink-0 border-b pb-4">
           <SheetTitle>{isCreate ? 'Новый сервис' : 'Редактирование сервиса'}</SheetTitle>
           <SheetDescription>
-            Настройте параметры сервиса и привязки FQDN → IP или CNAME. Один
-            сервис может иметь несколько FQDN в разных зонах; зона определяется
-            из FQDN автоматически.
+            Общий домен и IP задаются у сервиса. Дополнительные FQDN — ниже, зона
+            определяется автоматически.
           </SheetDescription>
         </SheetHeader>
 
-        <div className="flex min-h-0 flex-1 flex-col gap-4 overflow-y-auto px-4 py-4">
-          <CountedLineTabs
-            tabs={[
-              { id: 'general', label: 'Основное' },
-              {
-                id: 'bindings',
-                label: 'Привязки',
-                count: bindings.length > 0 ? bindings.length : undefined,
-              },
-            ]}
-            value={activeTab}
-            onValueChange={setActiveTab}
-            className="flex w-full flex-col gap-4"
-            listClassName="mb-0 w-full"
-          >
-            <TabsContent value="general" className="flex flex-col gap-4">
-              <FieldGroup className="flex flex-col gap-4">
+        <div className="flex min-h-0 flex-1 flex-col gap-6 overflow-y-auto px-4 py-4">
+          <section className="flex flex-col gap-3">
+            <h3 className="text-sm font-medium">Сервис</h3>
+            <FieldGroup className="flex flex-col gap-3">
+              <div className="grid grid-cols-1 gap-3 sm:grid-cols-2">
                 <Field>
                   <FieldLabel htmlFor="edit-service-name">Название</FieldLabel>
                   <Input
@@ -439,239 +458,182 @@ export function ServiceEditSheet({
                     onChange={(e) => setSlug(e.target.value)}
                   />
                 </Field>
-                <Field>
-                  <FieldLabel htmlFor="edit-service-group">Группа сервисов</FieldLabel>
-                  <Select
-                    items={groupItems}
-                    value={serviceGroupId}
-                    onValueChange={(value) => setServiceGroupId(value ?? 'none')}
-                  >
-                    <SelectTrigger id="edit-service-group" className="w-full">
-                      <SelectValue placeholder="Без группы" />
-                    </SelectTrigger>
-                    <SelectContent>
-                      {groupItems.map((item) => (
-                        <SelectItem key={item.value} value={item.value}>
-                          {item.label}
-                        </SelectItem>
-                      ))}
-                    </SelectContent>
-                  </Select>
-                </Field>
-                <Field>
-                  <FieldLabel htmlFor="edit-service-ips">IP-адреса сервиса</FieldLabel>
-                  <TaggedInput
-                    id="edit-service-ips"
-                    value={ips}
-                    onChange={setIps}
-                    placeholder="192.168.1.1"
-                    validate={isValidIpv4}
-                  />
-                </Field>
-              </FieldGroup>
-
-              {groupHasDomain && (
-                <>
-                  <Separator />
-                  <div className="flex flex-col gap-2">
-                    <p className="text-sm text-muted-foreground">
-                      Балансировка внутри группы «{selectedGroup?.name}»: вес и приоритет
-                      сервиса для общего домена группы.
-                    </p>
-                    <div className="grid grid-cols-2 gap-4">
-                      <Field>
-                        <FieldLabel htmlFor="service-lb-weight">Вес</FieldLabel>
-                        <Input
-                          id="service-lb-weight"
-                          type="number"
-                          inputMode="numeric"
-                          min={1}
-                          max={100}
-                          value={lbWeight}
-                          onChange={(e) =>
-                            setLbWeight(Math.max(1, Number(e.target.value) || 1))
-                          }
-                        />
-                      </Field>
-                      <Field>
-                        <FieldLabel htmlFor="service-lb-priority">Приоритет</FieldLabel>
-                        <Input
-                          id="service-lb-priority"
-                          type="number"
-                          inputMode="numeric"
-                          min={1}
-                          max={100}
-                          value={lbPriority}
-                          onChange={(e) =>
-                            setLbPriority(Math.max(1, Number(e.target.value) || 1))
-                          }
-                        />
-                      </Field>
-                    </div>
-                  </div>
-                </>
-              )}
-            </TabsContent>
-
-            <TabsContent value="bindings" className="flex flex-col gap-4">
-              <div className="flex items-center justify-between gap-2">
-                <p className="text-sm text-muted-foreground">
-                  Несколько FQDN в разных зонах → IP или CNAME для DNS Cloudflare
-                </p>
-                <Button type="button" variant="outline" size="sm" onClick={handleAddBinding}>
-                  <PlusIcon data-icon="inline-start" />
-                  Добавить
-                </Button>
               </div>
-
-              {bindings.length === 0 ? (
-                <EmptyState
-                  icon={Link2Icon}
-                  title="Нет привязок"
-                  description="Необязательно. Можно добавить несколько FQDN: api.ivx.su и www.other.su — зоны определятся автоматически."
-                  centered={false}
-                  action={
-                    <Button type="button" variant="outline" size="sm" onClick={handleAddBinding}>
-                      <PlusIcon data-icon="inline-start" />
-                      Добавить привязку
-                    </Button>
+              <Field>
+                <FieldLabel htmlFor="edit-service-group">Группа сервисов</FieldLabel>
+                <Select
+                  items={groupItems}
+                  value={serviceGroupId}
+                  onValueChange={(value) => setServiceGroupId(value ?? 'none')}
+                >
+                  <SelectTrigger id="edit-service-group" className="w-full">
+                    <SelectValue placeholder="Без группы" />
+                  </SelectTrigger>
+                  <SelectContent>
+                    {groupItems.map((item) => (
+                      <SelectItem key={item.value} value={item.value}>
+                        {item.label}
+                      </SelectItem>
+                    ))}
+                  </SelectContent>
+                </Select>
+              </Field>
+              <Field>
+                <FieldLabel htmlFor="edit-service-common-domain">
+                  Общий домен (FQDN)
+                </FieldLabel>
+                <Input
+                  id="edit-service-common-domain"
+                  className="font-mono"
+                  value={commonFqdn}
+                  placeholder={
+                    zoneHints[0] ? `gw.${zoneHints[0]}` : 'gw.ivx.su'
                   }
+                  onChange={(e) => handleCommonFqdnChange(e.target.value)}
                 />
-              ) : (
-                <ItemGroup className="gap-2">
-                  {bindings.map((binding, index) => {
-                    const showLbBlock =
-                      (binding.record_type === 'A' && binding.target_ips.length > 0) ||
-                      (binding.record_type === 'CNAME' && binding.target_cname.trim().length > 0)
-                    const showMeta =
-                      binding.record_type === 'A' &&
-                      binding.target_ips.length > 1 &&
-                      binding.lb_mode !== 'round_robin'
-                    const parsedZone = parseFqdn(binding.fqdn, zoneHints)
-                    return (
-                      <Item key={`binding-${index}`} variant="outline" className="items-stretch">
-                        <ItemContent className="w-full flex flex-col gap-3">
-                          <div className="flex items-center justify-between gap-2">
-                            <div className="flex min-w-0 items-center gap-2">
-                              <span className="text-sm font-medium">
-                                Привязка {index + 1}
-                              </span>
-                              {parsedZone ? (
-                                <Badge variant="outline" size="xs" className="font-mono">
-                                  {parsedZone.zoneName}
-                                </Badge>
-                              ) : binding.fqdn.trim() ? (
-                                <Badge variant="warning-light" size="xs">
-                                  зона не найдена
-                                </Badge>
-                              ) : null}
-                            </div>
-                            <Button
-                              type="button"
-                              variant="ghost"
-                              size="icon-sm"
-                              className="shrink-0"
-                              aria-label="Удалить привязку"
-                              onClick={() => handleRemoveBinding(index)}
-                            >
-                              <Trash2Icon />
-                            </Button>
-                          </div>
-                          <Field className="min-w-0">
-                            <FieldLabel htmlFor={`binding-fqdn-${index}`}>FQDN</FieldLabel>
-                            <Input
-                              id={`binding-fqdn-${index}`}
-                              className="font-mono"
-                              value={binding.fqdn}
-                              onChange={(event) =>
-                                handleFqdnChange(index, event.target.value)
-                              }
-                              placeholder={
-                                zoneHints[0] ? `newdom.${zoneHints[0]}` : 'newdom.ivx.su'
-                              }
-                            />
-                          </Field>
-                          <Field>
-                            <FieldLabel htmlFor={`binding-type-${index}`}>Тип записи</FieldLabel>
-                            <Select
-                              items={[
-                                { label: 'A (IP)', value: 'A' },
-                                { label: 'CNAME', value: 'CNAME' },
-                              ]}
-                              value={binding.record_type}
-                              onValueChange={(value) =>
-                                handleRecordTypeChange(index, (value ?? 'A') as 'A' | 'CNAME')
-                              }
-                            >
-                              <SelectTrigger id={`binding-type-${index}`} className="w-full">
-                                <SelectValue />
-                              </SelectTrigger>
-                              <SelectContent>
-                                <SelectItem value="A">A (IP)</SelectItem>
-                                <SelectItem value="CNAME">CNAME</SelectItem>
-                              </SelectContent>
-                            </Select>
-                          </Field>
-                          {binding.record_type === 'CNAME' ? (
-                            <Field>
-                              <FieldLabel htmlFor={`binding-cname-${index}`}>
-                                CNAME-цель
-                              </FieldLabel>
-                              <Input
-                                id={`binding-cname-${index}`}
-                                value={binding.target_cname}
-                                placeholder="mmsk.rkns.top"
-                                onChange={(event) => handleCnameChange(index, event.target.value)}
-                              />
-                            </Field>
-                          ) : (
-                            <Field>
-                              <FieldLabel htmlFor={`binding-ip-${index}`}>IP</FieldLabel>
-                              <ServiceBindingIpInput
-                                id={`binding-ip-${index}`}
-                                value={binding.target_ips}
-                                pool={ips}
-                                onChange={(targetIps) => handleIpsChange(index, targetIps)}
-                                showMeta={showLbBlock && showMeta}
-                                weights={binding.target_ip_weights}
-                                priorities={binding.target_ip_priorities}
-                                onMetaChange={(ip, meta) =>
-                                  handleBindingMetaChange(index, ip, meta)
-                                }
-                              />
-                            </Field>
-                          )}
+              </Field>
+              <Field>
+                <FieldLabel htmlFor="edit-service-ips">IP-адреса сервиса</FieldLabel>
+                <TaggedInput
+                  id="edit-service-ips"
+                  value={ips}
+                  onChange={setIps}
+                  placeholder="192.168.1.1"
+                  validate={isValidIpv4}
+                />
+              </Field>
+            </FieldGroup>
+          </section>
 
-                          {showLbBlock ? (
-                            <HealthCheckConfigFields
-                              value={{
-                                lb_mode: binding.lb_mode,
-                                enabled: binding.health.enabled,
-                                type: binding.health.type,
-                                port: binding.health.port,
-                                path: binding.health.path,
-                                expected_status: binding.health.expected_status,
-                                interval_sec: binding.health.interval_sec,
-                                timeout_ms: binding.health.timeout_ms,
-                                verify_tls: binding.health.verify_tls,
-                                provider: binding.health.provider ?? 'local',
-                              }}
-                              onChange={(next) => handleBindingHealthChange(index, next)}
-                              lbModeLabel="Режим балансировки"
-                              showLbMode={
-                                binding.record_type === 'A' && binding.target_ips.length > 1
-                              }
-                              idPrefix={`binding-${index}-health`}
-                            />
-                          ) : null}
-                        </ItemContent>
-                      </Item>
-                    )
-                  })}
-                </ItemGroup>
-              )}
-            </TabsContent>
-          </CountedLineTabs>
+          <section className="flex flex-col gap-3">
+            <h3 className="text-sm font-medium">Health check</h3>
+            <HealthCheckConfigFields
+              idPrefix="service-health"
+              value={primaryHealthValue}
+              onChange={handlePrimaryHealthChange}
+            />
+          </section>
+
+          <section className="flex flex-col gap-3">
+            <div className="flex items-center justify-between gap-2">
+              <h3 className="text-sm font-medium">Доп. FQDN</h3>
+              <Button
+                type="button"
+                variant="outline"
+                size="sm"
+                onClick={handleAddExtraBinding}
+              >
+                <PlusIcon data-icon="inline-start" />
+                Добавить
+              </Button>
+            </div>
+            {extraBindings.length === 0 ? (
+              <p className="text-muted-foreground text-sm">
+                Нет дополнительных FQDN
+              </p>
+            ) : (
+              <ItemGroup className="gap-2">
+                {extraBindings.map((binding, extraIndex) => {
+                  const index = extraIndex + 1
+                  const parsedZone = parseFqdn(binding.fqdn, zoneHints)
+                  return (
+                    <Item
+                      key={`extra-binding-${index}`}
+                      variant="outline"
+                      size="sm"
+                      className="items-stretch"
+                    >
+                      <ItemContent className="flex w-full min-w-0 flex-col gap-2">
+                        <div className="flex items-center gap-2">
+                          {parsedZone ? (
+                            <Badge variant="outline" size="xs" className="font-mono">
+                              {parsedZone.zoneName}
+                            </Badge>
+                          ) : binding.fqdn.trim() ? (
+                            <Badge variant="warning-light" size="xs">
+                              зона не найдена
+                            </Badge>
+                          ) : (
+                            <span className="text-muted-foreground text-xs">
+                              FQDN
+                            </span>
+                          )}
+                          <Button
+                            type="button"
+                            variant="ghost"
+                            size="icon-sm"
+                            className="ml-auto shrink-0"
+                            aria-label="Удалить FQDN"
+                            onClick={() => handleRemoveExtraBinding(extraIndex)}
+                          >
+                            <Trash2Icon />
+                          </Button>
+                        </div>
+                        <div className="grid grid-cols-1 gap-2 sm:grid-cols-[minmax(0,1fr)_7.5rem]">
+                          <Input
+                            id={`extra-fqdn-${index}`}
+                            className="font-mono"
+                            value={binding.fqdn}
+                            onChange={(event) =>
+                              handleFqdnChange(index, event.target.value)
+                            }
+                            placeholder={
+                              zoneHints[0]
+                                ? `api.${zoneHints[0]}`
+                                : 'api.ivx.su'
+                            }
+                          />
+                          <Select
+                            items={[
+                              { label: 'A (IP)', value: 'A' },
+                              { label: 'CNAME', value: 'CNAME' },
+                            ]}
+                            value={binding.record_type}
+                            onValueChange={(value) =>
+                              handleRecordTypeChange(
+                                index,
+                                (value ?? 'A') as 'A' | 'CNAME',
+                              )
+                            }
+                          >
+                            <SelectTrigger
+                              id={`extra-type-${index}`}
+                              className="w-full"
+                            >
+                              <SelectValue />
+                            </SelectTrigger>
+                            <SelectContent>
+                              <SelectItem value="A">A (IP)</SelectItem>
+                              <SelectItem value="CNAME">CNAME</SelectItem>
+                            </SelectContent>
+                          </Select>
+                        </div>
+                        {binding.record_type === 'CNAME' ? (
+                          <Input
+                            id={`extra-cname-${index}`}
+                            value={binding.target_cname}
+                            placeholder="mmsk.rkns.top"
+                            onChange={(event) =>
+                              handleCnameChange(index, event.target.value)
+                            }
+                          />
+                        ) : (
+                          <ServiceBindingIpInput
+                            id={`extra-ip-${index}`}
+                            value={binding.target_ips}
+                            pool={ips}
+                            onChange={(targetIps) =>
+                              handleIpsChange(index, targetIps)
+                            }
+                          />
+                        )}
+                      </ItemContent>
+                    </Item>
+                  )
+                })}
+              </ItemGroup>
+            )}
+          </section>
         </div>
 
         <SheetFooter className="shrink-0 flex flex-row flex-wrap gap-2 border-t pt-4">

apps/web/src/components/service-group-edit-sheet.tsx

@@ -1,4 +1,4 @@
-import { useEffect, useState } from 'react'
+import { useEffect } from 'react'
 import { useForm, Controller } from 'react-hook-form'
 import { zodResolver } from '@hookform/resolvers/zod'
 import {
@@ -12,10 +12,6 @@ import { FormFieldSimple } from '@/components/form-field'
 import { LoadingButton } from '@/components/loading-button'
 import { AppFieldGroup } from '@/components/app-field'
 import { AppInput } from '@/components/app-input'
-import {
-  HealthCheckConfigFields,
-  type LbAndHealthConfig,
-} from '@/components/health-check-config-fields'
 import {
   Select,
   SelectContent,
@@ -44,19 +40,6 @@ interface ServiceGroupEditSheetProps {
   onSave?: (id: number, body: CreateServiceGroupInput) => void
 }
 
-const defaultLbHealth: LbAndHealthConfig = {
-  lb_mode: 'round_robin',
-  enabled: false,
-  type: 'tcp',
-  port: null,
-  path: null,
-  expected_status: null,
-  interval_sec: 30,
-  timeout_ms: 3000,
-  verify_tls: false,
-  provider: 'local',
-}
-
 export function ServiceGroupEditSheet({
   mode,
   group,
@@ -74,7 +57,6 @@ export function ServiceGroupEditSheet({
       domain: null,
     },
   })
-  const [lbHealth, setLbHealth] = useState<LbAndHealthConfig>(defaultLbHealth)
 
   useEffect(() => {
     if (!open) return
@@ -82,44 +64,19 @@ export function ServiceGroupEditSheet({
       form.reset({
         name: group.name,
         type: group.type,
-        domain: group.domain ?? null,
-      })
-      setLbHealth({
-        lb_mode: group.lb_mode,
-        enabled: group.health_check_enabled,
-        type: group.health_check_type === 'http' ? 'http' : 'tcp',
-        port: group.health_check_port,
-        path: group.health_check_path,
-        expected_status: group.health_check_expected_status,
-        interval_sec: group.health_check_interval_sec,
-        timeout_ms: group.health_check_timeout_ms,
-        verify_tls: group.health_check_verify_tls,
-        provider: 'local',
+        domain: null,
       })
     } else {
       form.reset({ name: '', type: 'custom', domain: null })
-      setLbHealth(defaultLbHealth)
     }
   }, [open, mode, group, form])
 
-  const domainValue = form.watch('domain')
-  const hasDomain = Boolean(domainValue?.trim())
-
   function handleSubmit(values: ServiceGroupFormValues) {
     const body: CreateServiceGroupInput = {
       name: values.name,
       type: values.type ?? 'custom',
       icon: values.icon,
-      domain: values.domain?.trim() || null,
-      lb_mode: lbHealth.lb_mode,
-      health_check_enabled: lbHealth.enabled,
-      health_check_type: lbHealth.type,
-      health_check_port: lbHealth.port,
-      health_check_path: lbHealth.path,
-      health_check_expected_status: lbHealth.expected_status,
-      health_check_interval_sec: lbHealth.interval_sec,
-      health_check_timeout_ms: lbHealth.timeout_ms,
-      health_check_verify_tls: lbHealth.verify_tls,
+      domain: null,
     }
     if (mode === 'create') {
       onCreate?.(body)
@@ -133,7 +90,7 @@ export function ServiceGroupEditSheet({
       open={open}
       onOpenChange={onOpenChange}
       title={mode === 'create' ? 'Новая группа сервисов' : 'Редактировать группу'}
-      description="Домен группы необязателен. Если указан FQDN (gr.ivx.su, domain.new.ivx.su), он публикуется в Cloudflare отдельно от привязок сервисов."
+      description="Группа нужна только для сортировки каталога. Общий домен и IP задаются у каждого сервиса."
       form={form}
       onSubmit={handleSubmit}
       contentClassName="gap-6"
@@ -186,26 +143,7 @@ export function ServiceGroupEditSheet({
             )}
           />
         </FormFieldSimple>
-        <FormFieldSimple
-          label="Домен группы (FQDN, необязательно)"
-          htmlFor="group-domain"
-        >
-          <AppInput
-            id="group-domain"
-            placeholder="domain.new.ivx.su"
-            {...form.register('domain')}
-          />
-        </FormFieldSimple>
       </AppFieldGroup>
-
-      {hasDomain ? (
-        <HealthCheckConfigFields
-          value={lbHealth}
-          onChange={setLbHealth}
-          lbModeLabel="Режим балансировки общего домена"
-          idPrefix="group-lb-health"
-        />
-      ) : null}
     </FormSheet>
   )
 }

apps/web/src/components/services/service-catalog-section.tsx

@@ -0,0 +1,168 @@
+import { FolderOpenIcon, MoreHorizontalIcon, PlusIcon } from 'lucide-react'
+
+import { Badge } from '@/components/reui/badge'
+import { IconTile } from '@/components/reui/icon-tile'
+import { ServiceGroupIcon } from '@/components/service-group-icon'
+import { ServiceUnitCard } from '@/components/services/service-unit-card'
+import type { ServiceGroup, ServiceGroupView, ServiceView } from '@/lib/schemas'
+import { Button } from '@cfdm/ui/components/button'
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuSeparator,
+  DropdownMenuTrigger,
+} from '@cfdm/ui/components/dropdown-menu'
+
+const GROUP_TYPE_LABELS: Record<ServiceGroup['type'], string> = {
+  vpn: 'VPN',
+  network: 'Сеть',
+  internet: 'Интернет',
+  bgp: 'BGP',
+  custom: 'Другое',
+}
+
+interface ServiceCatalogSectionProps {
+  group: ServiceGroupView | null
+  services: ServiceView[]
+  togglingId: number | null
+  togglingIp: { serviceId: number; ip: string } | null
+  onEditService: (service: ServiceView) => void
+  onDeleteService: (service: ServiceView) => void
+  onToggleService: (serviceId: number, enabled: boolean) => void
+  onToggleServiceIp: (serviceId: number, ip: string, enabled: boolean) => void
+  onEditGroup: (group: ServiceGroupView) => void
+  onDeleteGroup: (group: ServiceGroupView) => void
+  onAddServiceToGroup: (groupId: number | null) => void
+}
+
+export function ServiceCatalogSection({
+  group,
+  services,
+  togglingId,
+  togglingIp,
+  onEditService,
+  onDeleteService,
+  onToggleService,
+  onToggleServiceIp,
+  onEditGroup,
+  onDeleteGroup,
+  onAddServiceToGroup,
+}: ServiceCatalogSectionProps) {
+  const title = group?.name ?? 'Без группы'
+  const typeLabel = group ? GROUP_TYPE_LABELS[group.type] : null
+  const groupId = group?.id ?? null
+
+  return (
+    <section
+      className="@container flex w-full flex-col gap-2"
+      aria-labelledby={`group-${groupId ?? 'none'}`}
+    >
+      <div className="flex items-center justify-between gap-3">
+        <div className="flex min-w-0 items-center gap-2.5">
+          <IconTile
+            variant="elevated"
+            size="sm"
+            className="text-muted-foreground"
+            aria-hidden="true"
+          >
+            {group ? (
+              <ServiceGroupIcon type={group.type} />
+            ) : (
+              <FolderOpenIcon />
+            )}
+          </IconTile>
+          <div className="flex min-w-0 flex-wrap items-center gap-1.5">
+            <h2
+              id={`group-${groupId ?? 'none'}`}
+              className="truncate text-sm font-medium"
+            >
+              {title}
+            </h2>
+            {typeLabel ? (
+              <span className="text-muted-foreground text-xs">{typeLabel}</span>
+            ) : null}
+            <Badge variant="outline" size="xs" className="shrink-0 tabular-nums">
+              {services.length}
+            </Badge>
+          </div>
+        </div>
+        <div className="flex shrink-0 items-center gap-1">
+          <Button
+            type="button"
+            size="icon-sm"
+            variant="ghost"
+            aria-label={`Добавить сервис в ${title}`}
+            onClick={() => onAddServiceToGroup(groupId)}
+          >
+            <PlusIcon aria-hidden />
+          </Button>
+          {group ? (
+            <DropdownMenu>
+              <DropdownMenuTrigger
+                render={
+                  <Button
+                    type="button"
+                    variant="ghost"
+                    size="icon-sm"
+                    aria-label={`Действия группы ${group.name}`}
+                  />
+                }
+              >
+                <MoreHorizontalIcon aria-hidden />
+              </DropdownMenuTrigger>
+              <DropdownMenuContent align="end">
+                <DropdownMenuItem onClick={() => onAddServiceToGroup(group.id)}>
+                  <PlusIcon aria-hidden />
+                  Добавить сервис
+                </DropdownMenuItem>
+                <DropdownMenuItem onClick={() => onEditGroup(group)}>
+                  Изменить группу
+                </DropdownMenuItem>
+                <DropdownMenuSeparator />
+                <DropdownMenuItem
+                  variant="destructive"
+                  onClick={() => onDeleteGroup(group)}
+                >
+                  Удалить группу
+                </DropdownMenuItem>
+              </DropdownMenuContent>
+            </DropdownMenu>
+          ) : null}
+        </div>
+      </div>
+
+      {services.length === 0 ? (
+        <div className="flex flex-wrap items-center justify-between gap-2 py-1">
+          <span className="text-muted-foreground text-sm">Нет сервисов</span>
+          <Button
+            type="button"
+            variant="ghost"
+            size="sm"
+            onClick={() => onAddServiceToGroup(groupId)}
+          >
+            <PlusIcon data-icon="inline-start" aria-hidden />
+            Добавить сервис
+          </Button>
+        </div>
+      ) : (
+        <div className="grid grid-cols-1 gap-2 @xl:grid-cols-2 @4xl:grid-cols-3">
+          {services.map((service) => (
+            <ServiceUnitCard
+              key={service.id}
+              service={service}
+              togglingId={togglingId}
+              togglingIp={
+                togglingIp?.serviceId === service.id ? togglingIp.ip : null
+              }
+              onEditService={onEditService}
+              onDeleteService={onDeleteService}
+              onToggleService={onToggleService}
+              onToggleServiceIp={onToggleServiceIp}
+            />
+          ))}
+        </div>
+      )}
+    </section>
+  )
+}

apps/web/src/components/services/service-fqdn-list.tsx

@@ -1,12 +1,14 @@
 import { CheckIcon, CopyIcon } from 'lucide-react'
 import { toast } from 'sonner'
 
+import { HealthCheckBadge } from '@/components/health-check-badge'
 import { Badge } from '@/components/reui/badge'
 import { TruncatedText } from '@/components/truncated-text'
 import { useCopyToClipboard } from '@/hooks/use-copy-to-clipboard'
 import { serviceDisplayFqdns } from '@/lib/service-utils'
 import type { ServiceView } from '@/lib/schemas'
 import { Button } from '@cfdm/ui/components/button'
+import { Switch } from '@cfdm/ui/components/switch'
 import {
   Tooltip,
   TooltipContent,
@@ -53,6 +55,7 @@ interface ServiceFqdnListProps {
   className?: string
   emptyLabel?: string
   copyable?: boolean
+  textClassName?: string
 }
 
 export function ServiceFqdnList({
@@ -60,6 +63,7 @@ export function ServiceFqdnList({
   className,
   emptyLabel = 'Нет FQDN',
   copyable = false,
+  textClassName,
 }: ServiceFqdnListProps) {
   const fqdns = serviceDisplayFqdns(service)
   if (fqdns.length === 0) {
@@ -76,7 +80,12 @@ export function ServiceFqdnList({
 
   return (
     <div className={cn('flex min-w-0 items-center gap-1.5', className)}>
-      <TruncatedText className="text-muted-foreground min-w-0 font-mono text-xs">
+      <TruncatedText
+        className={cn(
+          'text-muted-foreground min-w-0 font-mono text-xs',
+          textClassName,
+        )}
+      >
         {first}
       </TruncatedText>
       {extraCount > 0 ? (
@@ -107,3 +116,114 @@ export function ServiceFqdnList({
     </div>
   )
 }
+
+const VISIBLE_IP_LIMIT = 6
+
+interface ServiceIpListProps {
+  ips: string[]
+  ipHealth?: ServiceView['ip_health']
+  ipEnabled?: Record<string, boolean>
+  togglingIp?: string | null
+  ipToggleDisabled?: boolean
+  onToggleIp?: (ip: string, enabled: boolean) => void
+  className?: string
+  emptyLabel?: string
+  copyable?: boolean
+  textClassName?: string
+}
+
+export function ServiceIpList({
+  ips,
+  ipHealth = [],
+  ipEnabled = {},
+  togglingIp = null,
+  ipToggleDisabled = false,
+  onToggleIp,
+  className,
+  emptyLabel = 'Нет IP',
+  copyable = false,
+  textClassName,
+}: ServiceIpListProps) {
+  if (ips.length === 0) {
+    return (
+      <span className={cn('text-muted-foreground text-xs', className)}>
+        {emptyLabel}
+      </span>
+    )
+  }
+
+  const healthByIp = new Map(ipHealth.map((row) => [row.ip, row]))
+  const visible = onToggleIp ? ips : ips.slice(0, VISIBLE_IP_LIMIT)
+  const extraCount = ips.length - visible.length
+
+  return (
+    <div className={cn('flex min-w-0 flex-col gap-1', className)}>
+      {visible.map((ip) => {
+        const health = healthByIp.get(ip)
+        const enabled = ipEnabled[ip] !== false
+        return (
+          <div key={ip} className="flex min-w-0 items-center gap-1.5">
+            <HealthCheckBadge
+              status={health?.status ?? 'unknown'}
+              latencyMs={health?.latency_ms}
+              lastCheckedAt={health?.last_checked_at}
+              lastError={health?.last_error}
+              colo={health?.colo}
+              provider={health?.provider}
+              size="xs"
+            />
+            <TruncatedText
+              className={cn(
+                'min-w-0 font-mono text-xs',
+                enabled ? 'text-muted-foreground' : 'text-muted-foreground/60',
+                textClassName,
+              )}
+            >
+              {ip}
+            </TruncatedText>
+            {copyable ? <CopyFqdnButton value={ip} /> : null}
+            {onToggleIp ? (
+              <Switch
+                size="sm"
+                className="ml-auto shrink-0"
+                checked={enabled}
+                disabled={ipToggleDisabled || togglingIp === ip}
+                onClick={(event) => {
+                  event.stopPropagation()
+                }}
+                onCheckedChange={(checked) => onToggleIp(ip, Boolean(checked))}
+                aria-label={
+                  enabled ? `Выключить IP ${ip}` : `Включить IP ${ip}`
+                }
+              />
+            ) : null}
+          </div>
+        )
+      })}
+      {extraCount > 0 ? (
+        <TooltipProvider>
+          <Tooltip>
+            <TooltipTrigger
+              render={
+                <Badge
+                  variant="outline"
+                  size="xs"
+                  className="w-fit shrink-0 tabular-nums"
+                />
+              }
+            >
+              ещё {extraCount}
+            </TooltipTrigger>
+            <TooltipContent className="max-w-xs">
+              <ul className="flex flex-col gap-0.5 font-mono text-xs">
+                {ips.slice(VISIBLE_IP_LIMIT).map((ip) => (
+                  <li key={ip}>{ip}</li>
+                ))}
+              </ul>
+            </TooltipContent>
+          </Tooltip>
+        </TooltipProvider>
+      ) : null}
+    </div>
+  )
+}

apps/web/src/components/services/service-group-unit.tsx

@@ -1,392 +0,0 @@
-import { useState } from 'react'
-import { Link } from '@tanstack/react-router'
-import {
-  ChevronDownIcon,
-  FolderOpenIcon,
-  MoreHorizontalIcon,
-  PlusIcon,
-} from 'lucide-react'
-
-import { HealthCheckBadge } from '@/components/health-check-badge'
-import { Badge } from '@/components/reui/badge'
-import {
-  Frame,
-  FrameDescription,
-  FrameHeader,
-  FramePanel,
-  FrameTitle,
-} from '@/components/reui/frame'
-import { IconTile } from '@/components/reui/icon-tile'
-import { CopyFqdnButton, ServiceFqdnList } from '@/components/services/service-fqdn-list'
-import { ServiceGroupIcon } from '@/components/service-group-icon'
-import { TruncatedText } from '@/components/truncated-text'
-import type { ServiceGroup, ServiceGroupView, ServiceView } from '@/lib/schemas'
-import { Button } from '@cfdm/ui/components/button'
-import {
-  Collapsible,
-  CollapsibleContent,
-  CollapsibleTrigger,
-} from '@cfdm/ui/components/collapsible'
-import {
-  DropdownMenu,
-  DropdownMenuContent,
-  DropdownMenuItem,
-  DropdownMenuSeparator,
-  DropdownMenuTrigger,
-} from '@cfdm/ui/components/dropdown-menu'
-import {
-  Item,
-  ItemActions,
-  ItemContent,
-  ItemTitle,
-} from '@cfdm/ui/components/item'
-import { Separator } from '@cfdm/ui/components/separator'
-import { Switch } from '@cfdm/ui/components/switch'
-import { cn } from '@cfdm/ui/lib/utils'
-
-const VISIBLE_SERVICE_LIMIT = 5
-
-const GROUP_TYPE_LABELS: Record<ServiceGroup['type'], string> = {
-  vpn: 'VPN',
-  network: 'Сеть',
-  internet: 'Интернет',
-  bgp: 'BGP',
-  custom: 'Другое',
-}
-
-function servicesCountLabel(count: number): string {
-  const mod10 = count % 10
-  const mod100 = count % 100
-  if (mod10 === 1 && mod100 !== 11) return `${count} сервис`
-  if (mod10 >= 2 && mod10 <= 4 && (mod100 < 12 || mod100 > 14)) {
-    return `${count} сервиса`
-  }
-  return `${count} сервисов`
-}
-
-interface ServiceGroupUnitProps {
-  group: ServiceGroupView | null
-  services: ServiceView[]
-  togglingId: number | null
-  onEditService: (service: ServiceView) => void
-  onDeleteService: (service: ServiceView) => void
-  onToggleService: (serviceId: number, enabled: boolean) => void
-  onEditGroup: (group: ServiceGroupView) => void
-  onDeleteGroup: (group: ServiceGroupView) => void
-  onAddServiceToGroup: (groupId: number | null) => void
-}
-
-export function ServiceGroupUnit({
-  group,
-  services,
-  togglingId,
-  onEditService,
-  onDeleteService,
-  onToggleService,
-  onEditGroup,
-  onDeleteGroup,
-  onAddServiceToGroup,
-}: ServiceGroupUnitProps) {
-  const [moreOpen, setMoreOpen] = useState(false)
-  const title = group?.name ?? 'Без группы'
-  const typeLabel = group ? GROUP_TYPE_LABELS[group.type] : null
-  const commonDomain = group?.domain?.trim() || null
-  const visible = services.slice(0, VISIBLE_SERVICE_LIMIT)
-  const rest = services.slice(VISIBLE_SERVICE_LIMIT)
-  const groupId = group?.id ?? null
-
-  return (
-    <Frame dense spacing="sm" className="w-full">
-      <FrameHeader className="flex-row items-start justify-between gap-3">
-        <div className="flex min-w-0 items-start gap-3">
-          <IconTile
-            variant="elevated"
-            size="sm"
-            className="text-muted-foreground"
-            aria-hidden="true"
-          >
-            {group ? (
-              <ServiceGroupIcon type={group.type} />
-            ) : (
-              <FolderOpenIcon />
-            )}
-          </IconTile>
-          <div className="flex min-w-0 flex-col gap-1">
-            <div className="flex min-w-0 items-center gap-2">
-              <FrameTitle className="truncate">{title}</FrameTitle>
-              <Badge variant="outline" size="xs" className="shrink-0 tabular-nums">
-                {services.length}
-              </Badge>
-            </div>
-            <FrameDescription className="flex flex-wrap items-center gap-1.5 text-xs">
-              <span>{servicesCountLabel(services.length)}</span>
-              {typeLabel ? (
-                <>
-                  <span
-                    className="bg-input size-1 shrink-0 rounded-full"
-                    aria-hidden="true"
-                  />
-                  <span>{typeLabel}</span>
-                </>
-              ) : null}
-            </FrameDescription>
-          </div>
-        </div>
-        <div className="flex shrink-0 items-center gap-2">
-          {group ? (
-            <HealthCheckBadge
-              status={group.health_status ?? 'unknown'}
-              latencyMs={group.health_latency_ms}
-              size="xs"
-            />
-          ) : null}
-          {group ? (
-            <DropdownMenu>
-              <DropdownMenuTrigger
-                render={
-                  <Button
-                    type="button"
-                    variant="ghost"
-                    size="icon-sm"
-                    aria-label={`Действия группы ${group.name}`}
-                  />
-                }
-              >
-                <MoreHorizontalIcon aria-hidden />
-              </DropdownMenuTrigger>
-              <DropdownMenuContent align="end">
-                <DropdownMenuItem onClick={() => onAddServiceToGroup(group.id)}>
-                  <PlusIcon aria-hidden />
-                  Добавить сервис
-                </DropdownMenuItem>
-                <DropdownMenuItem onClick={() => onEditGroup(group)}>
-                  Изменить группу
-                </DropdownMenuItem>
-                <DropdownMenuSeparator />
-                <DropdownMenuItem
-                  variant="destructive"
-                  onClick={() => onDeleteGroup(group)}
-                >
-                  Удалить группу
-                </DropdownMenuItem>
-              </DropdownMenuContent>
-            </DropdownMenu>
-          ) : (
-            <Button
-              type="button"
-              size="icon-sm"
-              variant="ghost"
-              aria-label="Добавить сервис без группы"
-              onClick={() => onAddServiceToGroup(null)}
-            >
-              <PlusIcon aria-hidden />
-            </Button>
-          )}
-        </div>
-      </FrameHeader>
-
-      <FramePanel className="p-0 shadow-none!">
-        {group ? (
-          <>
-            <Separator />
-            <div className="flex items-center justify-between gap-3 px-(--frame-panel-header-px) py-(--frame-panel-header-py)">
-              <div className="flex min-w-0 flex-col gap-0.5">
-                <span className="text-muted-foreground text-xs">Общий домен</span>
-                {commonDomain ? (
-                  <TruncatedText className="min-w-0 font-mono text-sm">
-                    {commonDomain}
-                  </TruncatedText>
-                ) : (
-                  <span className="text-muted-foreground text-sm">Не задан</span>
-                )}
-              </div>
-              {commonDomain ? (
-                <CopyFqdnButton className="shrink-0" value={commonDomain} />
-              ) : null}
-            </div>
-          </>
-        ) : null}
-
-        <Separator />
-
-        <div className="flex flex-col gap-2 px-(--frame-panel-header-px) py-(--frame-panel-header-py)">
-          <p className="text-muted-foreground text-xs">Сервисы</p>
-          {services.length === 0 ? (
-            <div className="flex flex-wrap items-center justify-between gap-2">
-              <span className="text-muted-foreground text-sm">Нет сервисов</span>
-              <Button
-                type="button"
-                variant="ghost"
-                size="sm"
-                onClick={() => onAddServiceToGroup(groupId)}
-              >
-                <PlusIcon data-icon="inline-start" aria-hidden />
-                Добавить сервис
-              </Button>
-            </div>
-          ) : (
-            <div className="flex flex-col">
-              {visible.map((service, index) => (
-                <ServiceUnitRow
-                  key={service.id}
-                  service={service}
-                  togglingId={togglingId}
-                  showSeparator={index > 0}
-                  onEditService={onEditService}
-                  onDeleteService={onDeleteService}
-                  onToggleService={onToggleService}
-                />
-              ))}
-              {rest.length > 0 ? (
-                <Collapsible open={moreOpen} onOpenChange={setMoreOpen}>
-                  <CollapsibleContent>
-                    {rest.map((service) => (
-                      <ServiceUnitRow
-                        key={service.id}
-                        service={service}
-                        togglingId={togglingId}
-                        showSeparator
-                        onEditService={onEditService}
-                        onDeleteService={onDeleteService}
-                        onToggleService={onToggleService}
-                      />
-                    ))}
-                  </CollapsibleContent>
-                  <div className="flex justify-end pt-2">
-                    <CollapsibleTrigger
-                      render={
-                        <Button
-                          type="button"
-                          variant="ghost"
-                          size="sm"
-                          aria-expanded={moreOpen}
-                        />
-                      }
-                    >
-                      {moreOpen
-                        ? 'Скрыть'
-                        : `Показать ещё ${rest.length}`}
-                      <ChevronDownIcon
-                        aria-hidden
-                        data-icon="inline-end"
-                        className={cn(
-                          'transition-transform duration-200',
-                          moreOpen && 'rotate-180',
-                        )}
-                      />
-                    </CollapsibleTrigger>
-                  </div>
-                </Collapsible>
-              ) : null}
-            </div>
-          )}
-        </div>
-      </FramePanel>
-    </Frame>
-  )
-}
-
-function ServiceUnitRow({
-  service,
-  togglingId,
-  showSeparator,
-  onEditService,
-  onDeleteService,
-  onToggleService,
-}: {
-  service: ServiceView
-  togglingId: number | null
-  showSeparator: boolean
-  onEditService: (service: ServiceView) => void
-  onDeleteService: (service: ServiceView) => void
-  onToggleService: (serviceId: number, enabled: boolean) => void
-}) {
-  return (
-    <>
-      {showSeparator ? <Separator /> : null}
-      <Item size="sm" className="rounded-none px-0 py-2.5">
-        <ItemContent className="min-w-0 gap-1 sm:hidden">
-          <ItemTitle className="min-w-0">
-            <Link
-              to="/services/$serviceId"
-              params={{ serviceId: String(service.id) }}
-              className="truncate hover:underline"
-            >
-              {service.name}
-            </Link>
-          </ItemTitle>
-          <ServiceFqdnList copyable service={service} />
-        </ItemContent>
-        <ItemContent className="hidden min-w-0 sm:flex sm:flex-row sm:items-center sm:gap-3">
-          <ItemTitle className="min-w-0 shrink-0">
-            <Link
-              to="/services/$serviceId"
-              params={{ serviceId: String(service.id) }}
-              className="truncate hover:underline"
-            >
-              {service.name}
-            </Link>
-          </ItemTitle>
-          <ServiceFqdnList
-            copyable
-            className="min-w-0 flex-1 justify-end"
-            service={service}
-          />
-        </ItemContent>
-        <ItemActions className="shrink-0">
-          <Switch
-            size="sm"
-            checked={service.enabled}
-            disabled={togglingId === service.id}
-            onCheckedChange={(checked) =>
-              onToggleService(service.id, Boolean(checked))
-            }
-            aria-label={
-              service.enabled ? 'Выключить сервис' : 'Включить сервис'
-            }
-          />
-          <HealthCheckBadge
-            status={service.health_status ?? 'unknown'}
-            latencyMs={service.health_latency_ms}
-            size="xs"
-          />
-          <DropdownMenu>
-            <DropdownMenuTrigger
-              render={
-                <Button
-                  type="button"
-                  variant="ghost"
-                  size="icon-sm"
-                  aria-label={`Действия ${service.name}`}
-                />
-              }
-            >
-              <MoreHorizontalIcon aria-hidden />
-            </DropdownMenuTrigger>
-            <DropdownMenuContent align="end">
-              <DropdownMenuItem
-                render={
-                  <Link
-                    to="/services/$serviceId"
-                    params={{ serviceId: String(service.id) }}
-                  />
-                }
-              >
-                Обзор
-              </DropdownMenuItem>
-              <DropdownMenuItem onClick={() => onEditService(service)}>
-                Изменить
-              </DropdownMenuItem>
-              <DropdownMenuItem
-                variant="destructive"
-                onClick={() => onDeleteService(service)}
-              >
-                Удалить
-              </DropdownMenuItem>
-            </DropdownMenuContent>
-          </DropdownMenu>
-        </ItemActions>
-      </Item>
-    </>
-  )
-}

apps/web/src/components/services/service-unit-card.tsx

@@ -0,0 +1,178 @@
+import { Link } from '@tanstack/react-router'
+import { MoreHorizontalIcon, ServerIcon } from 'lucide-react'
+
+import { Badge } from '@/components/reui/badge'
+import {
+  Frame,
+  FrameDescription,
+  FrameHeader,
+  FramePanel,
+  FrameTitle,
+} from '@/components/reui/frame'
+import { IconTile } from '@/components/reui/icon-tile'
+import {
+  CopyFqdnButton,
+  ServiceIpList,
+} from '@/components/services/service-fqdn-list'
+import { serviceDisplayFqdn, serviceDisplayFqdns } from '@/lib/service-utils'
+import type { ServiceView } from '@/lib/schemas'
+import { Button } from '@cfdm/ui/components/button'
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+} from '@cfdm/ui/components/dropdown-menu'
+import { Switch } from '@cfdm/ui/components/switch'
+import {
+  Tooltip,
+  TooltipContent,
+  TooltipProvider,
+  TooltipTrigger,
+} from '@cfdm/ui/components/tooltip'
+
+interface ServiceUnitCardProps {
+  service: ServiceView
+  togglingId: number | null
+  togglingIp: string | null
+  onEditService: (service: ServiceView) => void
+  onDeleteService: (service: ServiceView) => void
+  onToggleService: (serviceId: number, enabled: boolean) => void
+  onToggleServiceIp: (serviceId: number, ip: string, enabled: boolean) => void
+}
+
+export function ServiceUnitCard({
+  service,
+  togglingId,
+  togglingIp,
+  onEditService,
+  onDeleteService,
+  onToggleService,
+  onToggleServiceIp,
+}: ServiceUnitCardProps) {
+  const fqdns = serviceDisplayFqdns(service)
+  const primaryDomain = serviceDisplayFqdn(service)
+  const extraCount = Math.max(0, fqdns.length - 1)
+
+  return (
+    <Frame dense spacing="sm" className="h-full min-w-0 overflow-hidden">
+      <FrameHeader className="flex-row items-center justify-between gap-2">
+        <div className="flex min-w-0 items-center gap-2">
+          <IconTile
+            variant="elevated"
+            size="sm"
+            className="text-muted-foreground"
+            aria-hidden="true"
+          >
+            <ServerIcon />
+          </IconTile>
+          <div className="flex min-w-0 flex-col gap-px">
+            <FrameTitle className="min-w-0 truncate text-sm">
+              <Link
+                to="/services/$serviceId"
+                params={{ serviceId: String(service.id) }}
+                className="hover:underline"
+              >
+                {service.name}
+              </Link>
+            </FrameTitle>
+            <div className="flex min-w-0 items-center gap-1">
+              <FrameDescription className="min-w-0 truncate font-mono text-xs">
+                {primaryDomain}
+              </FrameDescription>
+              {extraCount > 0 ? (
+                <TooltipProvider>
+                  <Tooltip>
+                    <TooltipTrigger
+                      render={
+                        <Badge
+                          variant="outline"
+                          size="xs"
+                          className="shrink-0 tabular-nums"
+                        />
+                      }
+                    >
+                      +{extraCount}
+                    </TooltipTrigger>
+                    <TooltipContent className="max-w-xs">
+                      <ul className="flex flex-col gap-0.5 font-mono text-xs">
+                        {fqdns.map((fqdn) => (
+                          <li key={fqdn}>{fqdn}</li>
+                        ))}
+                      </ul>
+                    </TooltipContent>
+                  </Tooltip>
+                </TooltipProvider>
+              ) : null}
+              {primaryDomain !== '—' ? (
+                <CopyFqdnButton value={fqdns.join('\n')} />
+              ) : null}
+            </div>
+          </div>
+        </div>
+        <div className="flex shrink-0 items-center gap-1">
+          <Switch
+            size="sm"
+            checked={service.enabled}
+            disabled={togglingId === service.id}
+            onCheckedChange={(checked) =>
+              onToggleService(service.id, Boolean(checked))
+            }
+            aria-label={
+              service.enabled ? 'Выключить сервис' : 'Включить сервис'
+            }
+          />
+          <DropdownMenu>
+            <DropdownMenuTrigger
+              render={
+                <Button
+                  type="button"
+                  variant="ghost"
+                  size="icon-sm"
+                  aria-label={`Действия ${service.name}`}
+                />
+              }
+            >
+              <MoreHorizontalIcon aria-hidden />
+            </DropdownMenuTrigger>
+            <DropdownMenuContent align="end">
+              <DropdownMenuItem
+                render={
+                  <Link
+                    to="/services/$serviceId"
+                    params={{ serviceId: String(service.id) }}
+                  />
+                }
+              >
+                Обзор
+              </DropdownMenuItem>
+              <DropdownMenuItem onClick={() => onEditService(service)}>
+                Изменить
+              </DropdownMenuItem>
+              <DropdownMenuItem
+                variant="destructive"
+                onClick={() => onDeleteService(service)}
+              >
+                Удалить
+              </DropdownMenuItem>
+            </DropdownMenuContent>
+          </DropdownMenu>
+        </div>
+      </FrameHeader>
+
+      <FramePanel className="flex min-w-0 flex-col gap-1 pt-0 shadow-none!">
+        <ServiceIpList
+          copyable
+          ips={service.ips ?? []}
+          ipHealth={service.ip_health ?? []}
+          ipEnabled={service.ip_enabled ?? {}}
+          ipToggleDisabled={togglingId === service.id}
+          togglingIp={togglingIp}
+          onToggleIp={(ip, enabled) =>
+            onToggleServiceIp(service.id, ip, enabled)
+          }
+        />
+      </FramePanel>
+    </Frame>
+  )
+}

apps/web/src/components/services/services-grouped-catalog.tsx

@@ -1,14 +1,12 @@
 import { useMemo, useState, type ReactNode } from 'react'
 import {
   ChevronDownIcon,
-  FilterIcon,
   FolderPlusIcon,
-  FunnelXIcon,
   PlusIcon,
+  SearchIcon,
   ServerIcon,
 } from 'lucide-react'
 
-import { Filters, type Filter } from '@/components/reui/filters'
 import {
   Frame,
   FrameDescription,
@@ -16,21 +14,13 @@ import {
   FramePanel,
   FrameTitle,
 } from '@/components/reui/frame'
-import { CountedLineTabs } from '@/components/counted-line-tabs'
 import { EmptyState } from '@/components/empty-state'
+import { ServiceCatalogSection } from '@/components/services/service-catalog-section'
 import {
-  applyFiltersToData,
-  getActiveFilters,
-} from '@/components/reui-kit/filter-utils'
-import { ServiceGroupUnit } from '@/components/services/service-group-unit'
-import {
-  SERVICE_TABS,
-  createDefaultServiceFilters,
-  serviceFilterFieldValue,
   serviceTabFilter,
-  useServiceFilterFields,
   type ServiceCatalogRow,
 } from '@/components/columns/services-columns'
+import { serviceDisplayFqdns } from '@/lib/service-utils'
 import type {
   ServiceGroupView,
   ServiceGroupsResponse,
@@ -43,23 +33,29 @@ import {
   DropdownMenuItem,
   DropdownMenuTrigger,
 } from '@cfdm/ui/components/dropdown-menu'
-import { Separator } from '@cfdm/ui/components/separator'
+import {
+  InputGroup,
+  InputGroupAddon,
+  InputGroupInput,
+  InputGroupText,
+} from '@cfdm/ui/components/input-group'
 import { Skeleton } from '@cfdm/ui/components/skeleton'
 
-const HEALTH_TABS = [
-  { id: 'health-ok', label: 'OK' },
-  { id: 'health-slow', label: 'Slow' },
-  { id: 'health-down', label: 'Down' },
-  { id: 'health-unknown', label: '—' },
-] as const
-
-const ALL_TABS = [...SERVICE_TABS, ...HEALTH_TABS] as const
-
 function serviceMatchesDomain(service: ServiceView, domainId?: number) {
   if (domainId == null) return true
   return service.domains.some((d) => d.domain_id === domainId)
 }
 
+function serviceMatchesQuery(service: ServiceView, query: string) {
+  const needle = query.trim().toLowerCase()
+  if (!needle) return true
+  if (service.name.toLowerCase().includes(needle)) return true
+  if (service.slug.toLowerCase().includes(needle)) return true
+  return serviceDisplayFqdns(service).some((fqdn) =>
+    fqdn.toLowerCase().includes(needle),
+  )
+}
+
 function toCatalogRow(
   service: ServiceView,
   groupId: number | null,
@@ -77,18 +73,6 @@ function toCatalogRow(
   }
 }
 
-function catalogTabFilter(row: ServiceCatalogRow, tabId: string) {
-  if (tabId.startsWith('health-')) {
-    const status = row.service.health_status ?? 'unknown'
-    if (tabId === 'health-ok') return status === 'up'
-    if (tabId === 'health-slow') return status === 'degraded'
-    if (tabId === 'health-down') return status === 'down'
-    if (tabId === 'health-unknown') return status === 'unknown'
-    return true
-  }
-  return serviceTabFilter(row, tabId)
-}
-
 interface GroupUnitData {
   id: string
   group: ServiceGroupView | null
@@ -176,11 +160,13 @@ interface ServicesGroupedCatalogProps {
   primaryAction?: ReactNode
   hideHeader?: boolean
   togglingId: number | null
+  togglingIp: { serviceId: number; ip: string } | null
   activeTab?: string
   onTabChange?: (tabId: string) => void
   onEditService: (service: ServiceView) => void
   onDeleteService: (service: ServiceView) => void
   onToggleService: (serviceId: number, enabled: boolean) => void
+  onToggleServiceIp: (serviceId: number, ip: string, enabled: boolean) => void
   onEditGroup: (group: ServiceGroupView) => void
   onDeleteGroup: (group: ServiceGroupView) => void
   onAddServiceToGroup: (groupId: number | null) => void
@@ -195,23 +181,18 @@ export function ServicesGroupedCatalog({
   primaryAction,
   hideHeader = false,
   togglingId,
-  activeTab: controlledTab,
-  onTabChange,
+  togglingIp,
+  activeTab = 'all',
   onEditService,
   onDeleteService,
   onToggleService,
+  onToggleServiceIp,
   onEditGroup,
   onDeleteGroup,
   onAddServiceToGroup,
   emptyAction,
 }: ServicesGroupedCatalogProps) {
-  const [internalTab, setInternalTab] = useState('all')
-  const tab = controlledTab ?? internalTab
-  const setTab = onTabChange ?? setInternalTab
-  const [filters, setFilters] = useState<Filter[]>(() =>
-    createDefaultServiceFilters(),
-  )
-  const filterFields = useServiceFilterFields()
+  const [query, setQuery] = useState('')
 
   const flatRows = useMemo(() => {
     const rows: ServiceCatalogRow[] = []
@@ -228,24 +209,16 @@ export function ServicesGroupedCatalog({
     return rows
   }, [data, domainId])
 
-  const tabCounts = useMemo(() => {
-    const counts: Record<string, number> = {}
-    for (const t of ALL_TABS) {
-      counts[t.id] = flatRows.filter((row) => catalogTabFilter(row, t.id)).length
-    }
-    return counts
-  }, [flatRows])
-
   const filteredIds = useMemo(() => {
-    const afterTab = flatRows.filter((row) => catalogTabFilter(row, tab))
-    const afterFilters = applyFiltersToData(afterTab, filters, (item, field) =>
-      serviceFilterFieldValue(item, field),
+    const afterTab = flatRows.filter((row) => serviceTabFilter(row, activeTab))
+    const afterQuery = afterTab.filter((row) =>
+      serviceMatchesQuery(row.service, query),
     )
-    return new Set(afterFilters.map((r) => r.id))
-  }, [flatRows, tab, filters])
+    return new Set(afterQuery.map((r) => r.id))
+  }, [flatRows, activeTab, query])
 
   const showEmptyGroups =
-    tab === 'all' && domainId == null && getActiveFilters(filters).length === 0
+    activeTab === 'all' && domainId == null && query.trim().length === 0
 
   const units = useMemo(
     () => buildGroupUnits(data, filteredIds, domainId, showEmptyGroups),
@@ -260,7 +233,7 @@ export function ServicesGroupedCatalog({
           <Skeleton className="h-4 w-72" />
         </FrameHeader>
         <FramePanel className="flex flex-col gap-3 p-4">
-          <Skeleton className="h-9 w-full max-w-md" />
+          <Skeleton className="h-8 w-full max-w-md" />
           {Array.from({ length: 3 }).map((_, i) => (
             <Skeleton key={i} className="h-36 w-full rounded-xl" />
           ))}
@@ -296,7 +269,7 @@ export function ServicesGroupedCatalog({
             <FrameDescription>
               {domainLabel
                 ? `Каталог сервисов с привязками к ${domainLabel}`
-                : 'Группы, общий домен и FQDN сервисов'}
+                : 'Группы для сортировки; у каждого сервиса — общий домен и IP'}
             </FrameDescription>
           </div>
           {primaryAction ? (
@@ -307,79 +280,39 @@ export function ServicesGroupedCatalog({
         </FrameHeader>
       ) : null}
 
-      <FramePanel className="p-0 shadow-none!">
-        <div className="px-(--frame-panel-header-px) pt-(--frame-panel-header-py)">
-          <CountedLineTabs
-            tabs={ALL_TABS.map((t) => ({
-              id: t.id,
-              label: t.label,
-              count: tabCounts[t.id] ?? 0,
-            }))}
-            value={tab}
-            onValueChange={setTab}
+      <FramePanel className="flex flex-col gap-4">
+        <InputGroup className="max-w-md">
+          <InputGroupAddon>
+            <InputGroupText>
+              <SearchIcon aria-hidden />
+            </InputGroupText>
+          </InputGroupAddon>
+          <InputGroupInput
+            value={query}
+            onChange={(event) => setQuery(event.target.value)}
+            placeholder="Поиск по названию"
+            aria-label="Поиск по названию"
           />
-        </div>
-
-        <Separator />
-
-        <div className="flex flex-wrap items-center justify-between gap-3 px-(--frame-panel-header-px) py-(--frame-panel-header-py)">
-          <Filters
-            filters={filters}
-            fields={filterFields}
-            onChange={setFilters}
-            size="default"
-            trigger={
-              <Button type="button" variant="outline" aria-label="Фильтры">
-                <FilterIcon className="size-4" aria-hidden />
-                Фильтры
-              </Button>
-            }
-          />
-          <Button
-            type="button"
-            variant="outline"
-            onClick={() => {
-              setTab('all')
-              setFilters(createDefaultServiceFilters())
-            }}
-          >
-            <FunnelXIcon className="size-4" aria-hidden />
-            Сбросить
-          </Button>
-        </div>
-
-        <Separator />
+        </InputGroup>
 
         {units.length === 0 ? (
-          <div className="p-6">
-            <EmptyState
-              title="Нет совпадений"
-              description="Измените фильтры или вкладку."
-              action={
-                <Button
-                  type="button"
-                  variant="outline"
-                  onClick={() => {
-                    setTab('all')
-                    setFilters(createDefaultServiceFilters())
-                  }}
-                >
-                  Сбросить
-                </Button>
-              }
-            />
-          </div>
+          <EmptyState
+            title="Нет совпадений"
+            description="Измените запрос поиска."
+          />
         ) : (
-          <div className="flex flex-col gap-3 px-(--frame-panel-header-px) py-(--frame-panel-header-py)">
+          <div className="flex flex-col gap-6">
             {units.map((unit) => (
-              <ServiceGroupUnit
+              <ServiceCatalogSection
                 key={unit.id}
                 group={unit.group}
                 services={unit.services}
                 togglingId={togglingId}
+                togglingIp={togglingIp}
                 onEditService={onEditService}
                 onDeleteService={onDeleteService}
                 onToggleService={onToggleService}
+                onToggleServiceIp={onToggleServiceIp}
                 onEditGroup={onEditGroup}
                 onDeleteGroup={onDeleteGroup}
                 onAddServiceToGroup={onAddServiceToGroup}

apps/web/src/lib/schemas.ts

@@ -36,6 +36,7 @@ export const serviceGroupSchema = z.object({
   health_check_interval_sec: z.number().default(30),
   health_check_timeout_ms: z.number().default(3000),
   health_check_verify_tls: z.coerce.boolean().default(false),
+  health_check_provider: z.enum(['local', 'cloudflare']).catch('local'),
   created_at: z.string(),
   updated_at: z.string(),
 })
@@ -76,6 +77,7 @@ export const serviceDomainBindingSchema = z
     health_check_interval_sec: z.number().default(30),
     health_check_timeout_ms: z.number().default(3000),
     health_check_verify_tls: z.coerce.boolean().default(false),
+    health_check_provider: z.enum(['local', 'cloudflare']).catch('local'),
     sync_status: z.string().nullable().default(null),
   })
   .transform((binding) => ({
@@ -94,6 +96,30 @@ export const serviceDomainBindingSchema = z
       : (binding.record_type ?? 'A'),
   }))
 
+export const serviceIpHealthSchema = z.object({
+  ip: z.string(),
+  status: z.enum(['up', 'down', 'degraded', 'unknown']),
+  latency_ms: z.number().nullable(),
+  last_checked_at: z.string().nullable().optional(),
+  last_error: z.string().nullable().optional(),
+  provider: z.enum(['local', 'cloudflare']).optional(),
+  colo: z.string().nullable().optional(),
+})
+
+export const healthProbeLogSchema = z.object({
+  id: z.number(),
+  scope: z.string(),
+  ref_id: z.number(),
+  ip: z.string(),
+  provider: z.enum(['local', 'cloudflare']),
+  status: z.enum(['up', 'down', 'degraded', 'unknown']),
+  ok: z.coerce.boolean(),
+  latency_ms: z.number().nullable(),
+  colo: z.string().nullable(),
+  error: z.string().nullable(),
+  checked_at: z.string(),
+})
+
 export const serviceViewSchema = serviceSchema.extend({
   subdomain: z.string().default(''),
   enabled: z.coerce.boolean().default(false),
@@ -101,6 +127,8 @@ export const serviceViewSchema = serviceSchema.extend({
   domains: z.array(serviceDomainBindingSchema).default([]),
   health_status: z.enum(['up', 'down', 'degraded', 'unknown']).default('unknown'),
   health_latency_ms: z.number().nullable().default(null),
+  ip_health: z.array(serviceIpHealthSchema).default([]),
+  ip_enabled: z.record(z.string(), z.boolean()).default({}),
 })
 
 export const serviceGroupViewSchema = serviceGroupSchema.extend({
@@ -160,6 +188,7 @@ export const serviceBindingSchema = z
     health_check_interval_sec: z.number().default(30),
     health_check_timeout_ms: z.number().default(3000),
     health_check_verify_tls: z.coerce.boolean().default(false),
+    health_check_provider: z.enum(['local', 'cloudflare']).catch('local'),
     sync_status: z.string().nullable().default(null),
     created_at: z.string(),
     updated_at: z.string(),
@@ -244,6 +273,7 @@ const healthCheckConfigFields = {
   health_check_interval_sec: z.number().int().min(5).max(3600).optional(),
   health_check_timeout_ms: z.number().int().min(100).max(30000).optional(),
   health_check_verify_tls: z.boolean().optional(),
+  health_check_provider: z.enum(['local', 'cloudflare']).optional(),
 }
 
 const serviceDomainInputSchema = z

apps/web/src/queries/services.ts

@@ -1,6 +1,7 @@
 import { queryOptions } from '@tanstack/react-query'
 import { api } from '@/lib/api-client'
 import {
+  healthProbeLogSchema,
   serviceBindingSchema,
   serviceGroupsResponseSchema,
   serviceViewSchema,
@@ -87,8 +88,28 @@ export async function deleteServiceBinding(id: number) {
 export const serviceDetailKeys = {
   overview: (id: number) => [...serviceKeys.all, id, 'overview'] as const,
   nodes: (id: number) => [...serviceKeys.all, id, 'nodes'] as const,
+  healthLog: (id: number) => [...serviceKeys.all, id, 'health-log'] as const,
+  view: (id: number) => [...serviceKeys.all, id, 'view'] as const,
 }
 
+export const serviceViewQueryOptions = (id: number) =>
+  queryOptions({
+    queryKey: serviceDetailKeys.view(id),
+    queryFn: async () => {
+      const data = await api.get<unknown>(`/api/v1/services/${id}`)
+      return serviceViewSchema.parse(data)
+    },
+  })
+
+export const serviceHealthLogQueryOptions = (id: number) =>
+  queryOptions({
+    queryKey: serviceDetailKeys.healthLog(id),
+    queryFn: async () => {
+      const data = await api.get<unknown>(`/api/v1/services/${id}/health-log`)
+      return z.object({ items: z.array(healthProbeLogSchema) }).parse(data)
+    },
+  })
+
 export const serviceOverviewQueryOptions = (id: number) =>
   queryOptions({
     queryKey: serviceDetailKeys.overview(id),

apps/web/src/routeTree.gen.ts

@@ -20,6 +20,7 @@ import { Route as AuthSettingsIndexRouteImport } from './routes/_auth/settings/i
 import { Route as AuthServicesIndexRouteImport } from './routes/_auth/services/index'
 import { Route as AuthDomainsIndexRouteImport } from './routes/_auth/domains/index'
 import { Route as AuthSettingsIntegrationsRouteImport } from './routes/_auth/settings/integrations'
+import { Route as AuthSettingsHealthRouteImport } from './routes/_auth/settings/health'
 import { Route as AuthSettingsAppearanceRouteImport } from './routes/_auth/settings/appearance'
 import { Route as AuthGroupsGroupIdRouteImport } from './routes/_auth/groups/$groupId'
 import { Route as AuthServicesServiceIdRouteRouteImport } from './routes/_auth/services/$serviceId/route'
@@ -86,6 +87,11 @@ const AuthSettingsIntegrationsRoute =
     path: '/integrations',
     getParentRoute: () => AuthSettingsRouteRoute,
   } as any)
+const AuthSettingsHealthRoute = AuthSettingsHealthRouteImport.update({
+  id: '/health',
+  path: '/health',
+  getParentRoute: () => AuthSettingsRouteRoute,
+} as any)
 const AuthSettingsAppearanceRoute = AuthSettingsAppearanceRouteImport.update({
   id: '/appearance',
   path: '/appearance',
@@ -154,6 +160,7 @@ export interface FileRoutesByFullPath {
   '/services/$serviceId': typeof AuthServicesServiceIdRouteRouteWithChildren
   '/groups/$groupId': typeof AuthGroupsGroupIdRoute
   '/settings/appearance': typeof AuthSettingsAppearanceRoute
+  '/settings/health': typeof AuthSettingsHealthRoute
   '/settings/integrations': typeof AuthSettingsIntegrationsRoute
   '/domains/': typeof AuthDomainsIndexRoute
   '/services/': typeof AuthServicesIndexRoute
@@ -174,6 +181,7 @@ export interface FileRoutesByTo {
   '/': typeof AuthIndexRoute
   '/groups/$groupId': typeof AuthGroupsGroupIdRoute
   '/settings/appearance': typeof AuthSettingsAppearanceRoute
+  '/settings/health': typeof AuthSettingsHealthRoute
   '/settings/integrations': typeof AuthSettingsIntegrationsRoute
   '/domains': typeof AuthDomainsIndexRoute
   '/services': typeof AuthServicesIndexRoute
@@ -198,6 +206,7 @@ export interface FileRoutesById {
   '/_auth/services/$serviceId': typeof AuthServicesServiceIdRouteRouteWithChildren
   '/_auth/groups/$groupId': typeof AuthGroupsGroupIdRoute
   '/_auth/settings/appearance': typeof AuthSettingsAppearanceRoute
+  '/_auth/settings/health': typeof AuthSettingsHealthRoute
   '/_auth/settings/integrations': typeof AuthSettingsIntegrationsRoute
   '/_auth/domains/': typeof AuthDomainsIndexRoute
   '/_auth/services/': typeof AuthServicesIndexRoute
@@ -222,6 +231,7 @@ export interface FileRouteTypes {
     | '/services/$serviceId'
     | '/groups/$groupId'
     | '/settings/appearance'
+    | '/settings/health'
     | '/settings/integrations'
     | '/domains/'
     | '/services/'
@@ -242,6 +252,7 @@ export interface FileRouteTypes {
     | '/'
     | '/groups/$groupId'
     | '/settings/appearance'
+    | '/settings/health'
     | '/settings/integrations'
     | '/domains'
     | '/services'
@@ -265,6 +276,7 @@ export interface FileRouteTypes {
     | '/_auth/services/$serviceId'
     | '/_auth/groups/$groupId'
     | '/_auth/settings/appearance'
+    | '/_auth/settings/health'
     | '/_auth/settings/integrations'
     | '/_auth/domains/'
     | '/_auth/services/'
@@ -363,6 +375,13 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof AuthSettingsIntegrationsRouteImport
       parentRoute: typeof AuthSettingsRouteRoute
     }
+    '/_auth/settings/health': {
+      id: '/_auth/settings/health'
+      path: '/health'
+      fullPath: '/settings/health'
+      preLoaderRoute: typeof AuthSettingsHealthRouteImport
+      parentRoute: typeof AuthSettingsRouteRoute
+    }
     '/_auth/settings/appearance': {
       id: '/_auth/settings/appearance'
       path: '/appearance'
@@ -438,12 +457,14 @@ declare module '@tanstack/react-router' {
 
 interface AuthSettingsRouteRouteChildren {
   AuthSettingsAppearanceRoute: typeof AuthSettingsAppearanceRoute
+  AuthSettingsHealthRoute: typeof AuthSettingsHealthRoute
   AuthSettingsIntegrationsRoute: typeof AuthSettingsIntegrationsRoute
   AuthSettingsIndexRoute: typeof AuthSettingsIndexRoute
 }
 
 const AuthSettingsRouteRouteChildren: AuthSettingsRouteRouteChildren = {
   AuthSettingsAppearanceRoute: AuthSettingsAppearanceRoute,
+  AuthSettingsHealthRoute: AuthSettingsHealthRoute,
   AuthSettingsIntegrationsRoute: AuthSettingsIntegrationsRoute,
   AuthSettingsIndexRoute: AuthSettingsIndexRoute,
 }

apps/web/src/routes/_auth/services/$serviceId/health.tsx

@@ -1,22 +1,16 @@
-import { createFileRoute } from '@tanstack/react-router'
-import { useState } from 'react'
-import { useForm } from 'react-hook-form'
-import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query'
-import { toast } from 'sonner'
-import { DetailPanel } from '@/components/reui-kit'
+import { createFileRoute, Link } from '@tanstack/react-router'
+import { useQuery } from '@tanstack/react-query'
+import { ActivityIcon, GlobeIcon, ServerIcon } from 'lucide-react'
+import { DetailPanel, KpiStatGrid } from '@/components/reui-kit'
 import { EmptyState } from '@/components/empty-state'
-import { FormSheet } from '@/components/form-sheet'
-import { FormFieldSimple } from '@/components/form-field'
-import { LoadingButton } from '@/components/loading-button'
-import { Button } from '@cfdm/ui/components/button'
-import { Input } from '@cfdm/ui/components/input'
 import { Alert, AlertDescription, AlertTitle } from '@/components/reui/alert'
-import { HealthProviderToggle } from '@/components/health-check-config-fields'
+import { HealthTimeline } from '@/components/health/health-timeline'
+import { HealthCheckBadge } from '@/components/health-check-badge'
 import {
-  createOriginHealthCheck,
-  listOriginHealthChecks,
-  serviceOverviewQueryOptions,
+  serviceHealthLogQueryOptions,
+  serviceViewQueryOptions,
 } from '@/queries'
+import { formatDate } from '@/lib/format'
 
 export const Route = createFileRoute('/_auth/services/$serviceId/health')({
   component: ServiceHealthPage,
@@ -25,119 +19,86 @@ export const Route = createFileRoute('/_auth/services/$serviceId/health')({
 export function ServiceHealthPage() {
   const { serviceId } = Route.useParams()
   const id = Number(serviceId)
-  const queryClient = useQueryClient()
-  const overview = useQuery(serviceOverviewQueryOptions(id))
-  const checksQuery = useQuery({
-    queryKey: ['health-checks'],
-    queryFn: listOriginHealthChecks,
-  })
-  const [open, setOpen] = useState(false)
-  const form = useForm<{
-    name: string
-    provider: 'local' | 'cloudflare'
-    protocol: string
-  }>({
-    defaultValues: { name: '', provider: 'local', protocol: 'tcp' },
-  })
-  const provider = form.watch('provider')
-  const checks = (checksQuery.data ?? []) as Array<{
-    id: number
-    name: string
-    provider: string
-    protocol: string
-  }>
+  const serviceQuery = useQuery(serviceViewQueryOptions(id))
+  const logQuery = useQuery(serviceHealthLogQueryOptions(id))
+  const service = serviceQuery.data
+  const items = logQuery.data?.items ?? []
+  const ipHealth = service?.ip_health ?? []
 
-  const createMut = useMutation({
-    mutationFn: (values: { name: string; provider: 'local' | 'cloudflare'; protocol: string }) =>
-      createOriginHealthCheck({
-        name: values.name,
-        provider: values.provider,
-        protocol: values.protocol,
-      }),
-    onSuccess: async () => {
-      toast.success('Health check сохранён')
-      await queryClient.invalidateQueries({ queryKey: ['health-checks'] })
-      setOpen(false)
-    },
-    onError: (e: unknown) =>
-      toast.error(
-        e instanceof Error
-          ? e.message
-          : 'Cloudflare Health Checks недоступны для этой зоны',
+  const kpiCards = ipHealth.map((row) => {
+    const variant =
+      row.status === 'down'
+        ? ('destructive' as const)
+        : row.status === 'degraded'
+          ? ('warning' as const)
+          : ('default' as const)
+    return {
+      id: row.ip,
+      label: row.ip,
+      value: row.latency_ms != null ? `${row.latency_ms} мс` : '—',
+      hint: row.colo ? `colo ${row.colo}` : row.provider === 'cloudflare' ? 'Worker' : 'Local',
+      icon: row.provider === 'cloudflare' ? <GlobeIcon /> : <ServerIcon />,
+      variant,
+      footer: (
+        <HealthCheckBadge
+          status={row.status}
+          latencyMs={row.latency_ms}
+          lastCheckedAt={row.last_checked_at}
+          lastError={row.last_error}
+          colo={row.colo}
+          provider={row.provider}
+          size="xs"
+        />
       ),
+    }
   })
 
-  void overview
-
   return (
     <DetailPanel>
       <DetailPanel.Header
-        title="Health checks"
-        description="Local TCP/HTTP или официальный Cloudflare Health Checks API."
-        actions={
-          <Button size="sm" onClick={() => setOpen(true)}>
-            Добавить проверку
-          </Button>
+        title="Health"
+        description="Снимок проб этого сервиса. Cloudflare = Worker с edge, не Health Checks API."
+      />
+      <Alert>
+        <AlertTitle>XOR провайдеров</AlertTitle>
+        <AlertDescription>
+          Local ходит с API CFDM; Cloudflare — через Worker. Cron и пороги Slow/Down общие, в{' '}
+          <Link to="/settings/health" className="text-foreground underline">
+            Настройках → Health-check
+          </Link>
+          . Если Worker не задан, цель не пробируется как Local.
+        </AlertDescription>
+      </Alert>
+      {kpiCards.length > 0 ? (
+        <KpiStatGrid cards={kpiCards} />
+      ) : (
+        <EmptyState
+          icon={ActivityIcon}
+          title="Нет проб"
+          description="Включите health-check на привязке — статус IP появится после cron."
+        />
+      )}
+      <DetailPanel.Header
+        title="Журнал проб"
+        description={
+          items[0]?.checked_at
+            ? `Последняя: ${formatDate(items[0].checked_at)}`
+            : 'Последние пробы по IP этого сервиса'
         }
       />
-      {checks.length === 0 ? (
-        <EmptyState
-          title="Нет проверок"
-          description="Локальные пробы уже работают на привязках. Cloudflare Health Checks — опционально."
-        />
-      ) : (
-        <div className="flex flex-col gap-2">
-          {checks.map((check) => (
-            <div
-              key={check.id}
-              className="flex items-center justify-between gap-3 border-b py-3 last:border-0"
-            >
-              <div className="flex flex-col gap-1">
-                <span className="font-medium">{check.name}</span>
-                <span className="text-muted-foreground text-xs">
-                  {check.provider} · {check.protocol}
-                </span>
-              </div>
-            </div>
-          ))}
-        </div>
-      )}
-      <FormSheet
-        open={open}
-        onOpenChange={setOpen}
-        title="Health check"
-        description="Поля Cloudflare соответствуют официальному API (address, type, interval, timeout, retries)."
-        form={form}
-        onSubmit={(values) => createMut.mutate(values)}
-        footer={
-          <LoadingButton type="submit" isLoading={createMut.isPending}>
-            Сохранить
-          </LoadingButton>
-        }
-      >
-        <FormFieldSimple label="Имя" htmlFor="hc-name">
-          <Input id="hc-name" {...form.register('name')} />
-        </FormFieldSimple>
-        <FormFieldSimple label="Провайдер" htmlFor="hc-provider">
-          <HealthProviderToggle
-            id="hc-provider"
-            value={provider}
-            onChange={(next) => form.setValue('provider', next)}
-          />
-        </FormFieldSimple>
-        {provider === 'cloudflare' ? (
-          <Alert>
-            <AlertTitle>Cloudflare Health Checks</AlertTitle>
-            <AlertDescription>
-              Если зона не поддерживает Health Checks, вернётся ошибка плана — останется
-              Local. Workers не используются.
-            </AlertDescription>
-          </Alert>
-        ) : null}
-        <FormFieldSimple label="Протокол" htmlFor="hc-protocol">
-          <Input id="hc-protocol" {...form.register('protocol')} placeholder="tcp" />
-        </FormFieldSimple>
-      </FormSheet>
+      <HealthTimeline
+        events={items.map((row) => ({
+          id: row.id,
+          hostname: row.ip,
+          type: row.provider,
+          status: row.status,
+          latency_ms: row.latency_ms,
+          error: row.error,
+          checked_at: row.checked_at,
+          colo: row.colo,
+          provider: row.provider,
+        }))}
+      />
     </DetailPanel>
   )
 }

apps/web/src/routes/_auth/services/index.tsx

@@ -81,6 +81,29 @@ function setServiceEnabled(
   }
 }
 
+function setCatalogServiceIpEnabled(
+  data: ServiceGroupsResponse,
+  serviceId: number,
+  ip: string,
+  enabled: boolean,
+): ServiceGroupsResponse {
+  const patch = (service: ServiceView): ServiceView =>
+    service.id === serviceId
+      ? {
+          ...service,
+          ip_enabled: { ...(service.ip_enabled ?? {}), [ip]: enabled },
+        }
+      : service
+
+  return {
+    groups: data.groups.map((group) => ({
+      ...group,
+      services: group.services.map(patch),
+    })),
+    ungrouped: data.ungrouped.map(patch),
+  }
+}
+
 const GROUP_DOT_COLORS = [
   'bg-chart-1',
   'bg-chart-2',
@@ -150,6 +173,10 @@ function ServicesPage() {
   const [deletingId, setDeletingId] = useState<number | null>(null)
   const [deletingGroupId, setDeletingGroupId] = useState<number | null>(null)
   const [togglingServiceId, setTogglingServiceId] = useState<number | null>(null)
+  const [togglingIp, setTogglingIp] = useState<{
+    serviceId: number
+    ip: string
+  } | null>(null)
   const [bulkToggling, setBulkToggling] = useState(false)
   const [activeTab, setActiveTab] = useState('all')
   const queryClient = useQueryClient()
@@ -364,6 +391,54 @@ function ServicesPage() {
     },
   })
 
+  const toggleServiceIpMutation = useMutation({
+    mutationFn: ({
+      id,
+      ip,
+      enabled,
+    }: {
+      id: number
+      ip: string
+      enabled: boolean
+    }) =>
+      api.patch<ServiceView>(`/api/v1/services/${id}/ips/toggle`, {
+        ip,
+        enabled,
+      }),
+    onMutate: async ({ id, ip, enabled }) => {
+      await queryClient.cancelQueries({ queryKey: serviceGroupKeys.all })
+      const previous = queryClient.getQueryData<ServiceGroupsResponse>(
+        serviceGroupKeys.all,
+      )
+      if (previous) {
+        queryClient.setQueryData(
+          serviceGroupKeys.all,
+          setCatalogServiceIpEnabled(previous, id, ip, enabled),
+        )
+      }
+      return { previous }
+    },
+    onError: (err, _vars, context) => {
+      if (context?.previous) {
+        queryClient.setQueryData(serviceGroupKeys.all, context.previous)
+      }
+      toast.error(
+        err instanceof Error ? err.message : 'Не удалось переключить IP',
+      )
+    },
+    onSuccess: (_data, { enabled }) => {
+      toast.success(
+        enabled
+          ? 'IP включён и добавлен в DNS-привязки'
+          : 'IP выключен и снят с DNS-привязок',
+      )
+    },
+    onSettled: async () => {
+      setTogglingIp(null)
+      await invalidateAll()
+    },
+  })
+
   const deleteGroupMutation = useMutation({
     mutationFn: (id: number) => api.delete(`/api/v1/service-groups/${id}`),
     onSuccess: async () => {
@@ -398,6 +473,15 @@ function ServicesPage() {
     toggleServiceMutation.mutate({ id: serviceId, enabled })
   }
 
+  function handleServiceIpToggle(
+    serviceId: number,
+    ip: string,
+    enabled: boolean,
+  ) {
+    setTogglingIp({ serviceId, ip })
+    toggleServiceIpMutation.mutate({ id: serviceId, ip, enabled })
+  }
+
   function handleOpenCreateService(groupId: number | null = null) {
     setDefaultGroupId(groupId)
     setCreateSheetOpen(true)
@@ -456,7 +540,6 @@ function ServicesPage() {
       board.columns.map((column, index) => ({
         id: column.id,
         title: column.title,
-        description: column.domain ?? undefined,
         healthStatus: column.group?.health_status,
         healthLatencyMs: column.group?.health_latency_ms,
         dotClassName: GROUP_DOT_COLORS[index % GROUP_DOT_COLORS.length],
@@ -494,7 +577,7 @@ function ServicesPage() {
 
   const pageDescription = filteredDomain
     ? `Сервисы с привязками к домену ${filteredDomain.zone_name}`
-    : 'Группы, общий домен и FQDN сервисов'
+    : 'Группы для сортировки; у каждого сервиса — общий домен и IP'
 
   const sheets = (
     <>
@@ -603,9 +686,11 @@ function ServicesPage() {
             isLoading
             hideHeader
             togglingId={null}
+            togglingIp={null}
             onEditService={() => {}}
             onDeleteService={() => {}}
             onToggleService={() => {}}
+            onToggleServiceIp={() => {}}
             onEditGroup={() => {}}
             onDeleteGroup={() => {}}
             onAddServiceToGroup={() => {}}
@@ -703,12 +788,14 @@ function ServicesPage() {
           domainId={domainId}
           domainLabel={filteredDomain?.zone_name}
           togglingId={togglingServiceId}
+          togglingIp={togglingIp}
           activeTab={activeTab}
           onTabChange={setActiveTab}
           hideHeader
           onEditService={setEditingService}
           onDeleteService={setDeletingService}
           onToggleService={handleServiceToggle}
+          onToggleServiceIp={handleServiceIpToggle}
           onEditGroup={setEditingGroup}
           onDeleteGroup={setDeletingGroup}
           onAddServiceToGroup={handleOpenCreateService}

apps/web/src/routes/_auth/settings/health.tsx

@@ -0,0 +1,348 @@
+import { useEffect } from 'react'
+import { createFileRoute } from '@tanstack/react-router'
+import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query'
+import { useForm, Controller } from 'react-hook-form'
+import { zodResolver } from '@hookform/resolvers/zod'
+import { z } from 'zod'
+import { toast } from 'sonner'
+import { HeartPulseIcon } from 'lucide-react'
+
+import { api } from '@/lib/api-client'
+import { SettingRow } from '@/components/setting-row'
+import { LoadingButton } from '@/components/loading-button'
+import {
+  Frame,
+  FrameDescription,
+  FrameFooter,
+  FrameHeader,
+  FramePanel,
+  FrameTitle,
+} from '@/components/reui/frame'
+import {
+  NumberField,
+  NumberFieldDecrement,
+  NumberFieldGroup,
+  NumberFieldIncrement,
+  NumberFieldInput,
+} from '@/components/reui/number-field'
+import { FieldGroup } from '@cfdm/ui/components/field'
+import { Input } from '@cfdm/ui/components/input'
+import { Alert, AlertDescription, AlertTitle } from '@/components/reui/alert'
+
+const formSchema = z.object({
+  healthCheckCron: z.string().trim().min(1, 'Укажите cron').max(64),
+  healthDegradedFailures: z.number().int().min(1).max(20),
+  healthDownFailures: z.number().int().min(1).max(50),
+  healthLatencyWarnMs: z.number().int().min(50).max(60_000),
+  healthSuccessRecoveries: z.number().int().min(1).max(20),
+  healthWorkerUrl: z.string().trim().url('Некорректный URL').or(z.literal('')),
+  healthWorkerToken: z.string().optional(),
+}).superRefine((data, ctx) => {
+  if (data.healthDownFailures < data.healthDegradedFailures) {
+    ctx.addIssue({
+      code: 'custom',
+      message: 'Не меньше порога degraded',
+      path: ['healthDownFailures'],
+    })
+  }
+})
+
+type FormValues = z.infer<typeof formSchema>
+
+type SettingsResponse = FormValues & {
+  id: string
+  healthWorkerTokenSet?: boolean
+}
+
+export const Route = createFileRoute('/_auth/settings/health')({
+  component: HealthSettingsPage,
+})
+
+function CompactNumberInput({
+  id,
+  value,
+  min,
+  max,
+  disabled,
+  onValueChange,
+}: {
+  id: string
+  value: number
+  min: number
+  max: number
+  disabled?: boolean
+  onValueChange: (next: number) => void
+}) {
+  return (
+    <NumberField
+      id={id}
+      size="sm"
+      value={value}
+      min={min}
+      max={max}
+      disabled={disabled}
+      onValueChange={(next) => {
+        if (next != null) onValueChange(next)
+      }}
+    >
+      <NumberFieldGroup className="w-36">
+        <NumberFieldDecrement />
+        <NumberFieldInput />
+        <NumberFieldIncrement />
+      </NumberFieldGroup>
+    </NumberField>
+  )
+}
+
+function HealthSettingsPage() {
+  const queryClient = useQueryClient()
+  const { data, isLoading } = useQuery({
+    queryKey: ['app-settings'],
+    queryFn: () => api.get<SettingsResponse>('/api/v1/settings'),
+  })
+
+  const form = useForm<FormValues>({
+    resolver: zodResolver(formSchema),
+    defaultValues: {
+      healthCheckCron: '0 */2 * * * *',
+      healthDegradedFailures: 1,
+      healthDownFailures: 2,
+      healthLatencyWarnMs: 1000,
+      healthSuccessRecoveries: 2,
+      healthWorkerUrl: '',
+      healthWorkerToken: '',
+    },
+  })
+
+  useEffect(() => {
+    if (!data) return
+    form.reset({
+      healthCheckCron: data.healthCheckCron,
+      healthDegradedFailures: data.healthDegradedFailures,
+      healthDownFailures: data.healthDownFailures,
+      healthLatencyWarnMs: data.healthLatencyWarnMs,
+      healthSuccessRecoveries: data.healthSuccessRecoveries,
+      healthWorkerUrl: data.healthWorkerUrl ?? '',
+      healthWorkerToken: '',
+    })
+  }, [data, form])
+
+  const saveMut = useMutation({
+    mutationFn: (values: FormValues) => {
+      const payload: Record<string, unknown> = {
+        healthCheckCron: values.healthCheckCron,
+        healthDegradedFailures: values.healthDegradedFailures,
+        healthDownFailures: values.healthDownFailures,
+        healthLatencyWarnMs: values.healthLatencyWarnMs,
+        healthSuccessRecoveries: values.healthSuccessRecoveries,
+        healthWorkerUrl: values.healthWorkerUrl,
+      }
+      if (values.healthWorkerToken?.trim()) {
+        payload.healthWorkerToken = values.healthWorkerToken.trim()
+      }
+      return api.patch<SettingsResponse>('/api/v1/settings', payload)
+    },
+    onSuccess: () => {
+      void queryClient.invalidateQueries({ queryKey: ['app-settings'] })
+      toast.success('Настройки health-check сохранены')
+    },
+    onError: (e: unknown) =>
+      toast.error(e instanceof Error ? e.message : 'Не удалось сохранить'),
+  })
+
+  return (
+    <form
+      className="flex w-full flex-col gap-4"
+      onSubmit={(event) =>
+        void form.handleSubmit((values) => saveMut.mutate(values))(event)
+      }
+    >
+      <Frame dense spacing="sm" className="w-full">
+        <FrameHeader>
+          <FrameTitle className="flex items-center gap-2">
+            <HeartPulseIcon className="size-4" aria-hidden />
+            Local health-check
+          </FrameTitle>
+          <FrameDescription>
+            Расписание и пороги движка — общие для Local и Cloudflare Worker.
+            Тип/порт/path задаются в карточке сервиса.
+          </FrameDescription>
+        </FrameHeader>
+        <FramePanel className="p-0">
+          <FieldGroup className="gap-0">
+            <SettingRow
+              title="Cron"
+              description="Расписание проб (6 полей: сек мин час день месяц день-недели). Env: HEALTH_CHECK_CRON."
+              labelFor="health-cron"
+              stacked
+            >
+              <Input
+                id="health-cron"
+                className="font-mono"
+                spellCheck={false}
+                autoComplete="off"
+                disabled={isLoading || saveMut.isPending}
+                {...form.register('healthCheckCron')}
+              />
+            </SettingRow>
+            {form.formState.errors.healthCheckCron ? (
+              <p className="text-destructive px-5 pb-2 text-sm">
+                {form.formState.errors.healthCheckCron.message}
+              </p>
+            ) : null}
+
+            <SettingRow
+              title="Ошибок до Slow"
+              description="Подряд неуспешных проб до статуса degraded. Env: HEALTH_DEGRADED_FAILURES."
+              labelFor="health-degraded"
+              compact
+            >
+              <Controller
+                control={form.control}
+                name="healthDegradedFailures"
+                render={({ field }) => (
+                  <CompactNumberInput
+                    id="health-degraded"
+                    value={field.value}
+                    min={1}
+                    max={20}
+                    disabled={isLoading || saveMut.isPending}
+                    onValueChange={field.onChange}
+                  />
+                )}
+              />
+            </SettingRow>
+
+            <SettingRow
+              title="Ошибок до Down"
+              description="Подряд неуспешных проб до статуса down. Env: HEALTH_DOWN_FAILURES."
+              labelFor="health-down"
+              compact
+            >
+              <Controller
+                control={form.control}
+                name="healthDownFailures"
+                render={({ field }) => (
+                  <CompactNumberInput
+                    id="health-down"
+                    value={field.value}
+                    min={1}
+                    max={50}
+                    disabled={isLoading || saveMut.isPending}
+                    onValueChange={field.onChange}
+                  />
+                )}
+              />
+            </SettingRow>
+            {form.formState.errors.healthDownFailures ? (
+              <p className="text-destructive px-5 pb-2 text-sm">
+                {form.formState.errors.healthDownFailures.message}
+              </p>
+            ) : null}
+
+            <SettingRow
+              title="Латентность Slow, мс"
+              description="Порог задержки для degraded при успешной пробе. Env: HEALTH_LATENCY_WARN_MS."
+              labelFor="health-latency"
+              compact
+            >
+              <Controller
+                control={form.control}
+                name="healthLatencyWarnMs"
+                render={({ field }) => (
+                  <CompactNumberInput
+                    id="health-latency"
+                    value={field.value}
+                    min={50}
+                    max={60_000}
+                    disabled={isLoading || saveMut.isPending}
+                    onValueChange={field.onChange}
+                  />
+                )}
+              />
+            </SettingRow>
+
+            <SettingRow
+              title="Успехов для recovery"
+              description="Подряд успешных проб, чтобы выйти из Checking в Healthy. Env: HEALTH_SUCCESS_RECOVERIES."
+              labelFor="health-recoveries"
+              compact
+            >
+              <Controller
+                control={form.control}
+                name="healthSuccessRecoveries"
+                render={({ field }) => (
+                  <CompactNumberInput
+                    id="health-recoveries"
+                    value={field.value}
+                    min={1}
+                    max={20}
+                    disabled={isLoading || saveMut.isPending}
+                    onValueChange={field.onChange}
+                  />
+                )}
+              />
+            </SettingRow>
+
+            <SettingRow
+              title="URL Worker"
+              description="https://cfdm-health-probe.<account>.workers.dev. Env: HEALTH_WORKER_URL."
+              labelFor="health-worker-url"
+              compact
+            >
+              <Input
+                id="health-worker-url"
+                type="url"
+                placeholder="https://cfdm-health-probe.workers.dev"
+                disabled={isLoading || saveMut.isPending}
+                {...form.register('healthWorkerUrl')}
+              />
+            </SettingRow>
+            {form.formState.errors.healthWorkerUrl ? (
+              <p className="text-destructive px-5 pb-2 text-sm">
+                {form.formState.errors.healthWorkerUrl.message}
+              </p>
+            ) : null}
+
+            <SettingRow
+              title="Токен Worker"
+              description={
+                data?.healthWorkerTokenSet
+                  ? 'Токен задан. Оставьте пустым, чтобы не менять.'
+                  : 'Authorization Bearer. Env: HEALTH_WORKER_TOKEN.'
+              }
+              labelFor="health-worker-token"
+              compact
+              last
+            >
+              <Input
+                id="health-worker-token"
+                type="password"
+                autoComplete="new-password"
+                placeholder={data?.healthWorkerTokenSet ? '••••••••' : 'секрет'}
+                disabled={isLoading || saveMut.isPending}
+                {...form.register('healthWorkerToken')}
+              />
+            </SettingRow>
+          </FieldGroup>
+          <Alert>
+            <AlertTitle>Cloudflare Worker, не Health Checks API</AlertTitle>
+            <AlertDescription>
+              На Free-плане продукта Health Checks нет. CFDM вызывает Worker с edge;
+              cron остаётся здесь. Лимит Free Workers ≈ 100k запросов/сутки (cron × число IP).
+            </AlertDescription>
+          </Alert>
+          <FrameFooter className="flex flex-row justify-end">
+            <LoadingButton
+              type="submit"
+              isLoading={saveMut.isPending}
+              disabled={isLoading || !form.formState.isDirty}
+            >
+              Сохранить
+            </LoadingButton>
+          </FrameFooter>
+        </FramePanel>
+      </Frame>
+    </form>
+  )
+}

docs/Home.md

@@ -20,11 +20,13 @@ Manage Cloudflare zones, DNS records, domain groups, and TLS certificate expiry
 | `ADMIN_USERNAME` | Admin username |
 | `ADMIN_PASSWORD_HASH` | Argon2 hash (empty = dev `admin`/`admin`) |
 | `LOG_LEVEL` | Уровень логов API (`info`, `debug`) |
-| `HEALTH_CHECK_CRON` | Cron для health-check (default `*/30 * * * * *`) |
-| `HEALTH_DEGRADED_FAILURES` | Ошибок подряд до `degraded` (default `1`) |
-| `HEALTH_DOWN_FAILURES` | Ошибок подряд до `down` (default `2`) |
-| `HEALTH_SUCCESS_RECOVERIES` | Успехов подряд для recovery `CHECKING → HEALTHY` (default `2`) |
-| `HEALTH_LATENCY_WARN_MS` | Латентность-порог для `degraded` (default `1000`) |
+| `HEALTH_CHECK_CRON` | Cron для health-check (default `0 */2 * * * *`). Переопределяется в **Настройки → Health-check**. |
+| `HEALTH_DEGRADED_FAILURES` | Ошибок подряд до `degraded` (default `1`). То же в UI. |
+| `HEALTH_DOWN_FAILURES` | Ошибок подряд до `down` (default `2`). То же в UI. |
+| `HEALTH_SUCCESS_RECOVERIES` | Успехов подряд для recovery `CHECKING → HEALTHY` (default `2`). То же в UI. |
+| `HEALTH_LATENCY_WARN_MS` | Латентность-порог для `degraded` (default `1000`). То же в UI. |
+| `HEALTH_WORKER_URL` | URL Worker health-probe (fallback). Переопределяется в **Настройки → Health-check**. |
+| `HEALTH_WORKER_TOKEN` | Bearer-токен Worker (fallback). В GET `/settings` не отдаётся целиком. |
 
 ## Load balancing & health checks
 
@@ -46,8 +48,32 @@ health-check работают на двух уровнях:
 Режимы LB: `round_robin`, `failover`, `weighted`. В Cloudflare free `weighted`
 работает как `round_robin` (одна A на IP). `unknown` **не** считается healthy и
 не попадает в пул, пока нет успешных проб; восстановление — `UNHEALTHY → CHECKING → HEALTHY`
-после `HEALTH_SUCCESS_RECOVERIES` (default 2). Reconcile DNS запускается cron-задачей
-`health-check`. Cloudflare Health Checks — официальный API зоны, Workers не используются.
+после `HEALTH_SUCCESS_RECOVERIES` (default 2). Пороги и cron движка задаются в
+**Настройки → Health-check** (env — fallback, пока значения не сохранены в UI).
+
+### Local XOR Cloudflare Worker
+
+Провайдер задаётся на привязке (`service_bindings.health_check_provider`): **local**
+или **cloudflare**. Одновременно оба не работают.
+
+| | Local | Cloudflare Worker |
+|---|---|---|
+| Кто пробирует | процесс API CFDM | Worker на edge Cloudflare |
+| Планировщик | глобальный cron CFDM | тот же cron вызывает Worker |
+| Пороги Slow/Down | Настройки → Health-check | те же |
+| Результат | SQLite `ip_health_status` | та же SQLite + `colo` |
+| Регионы Health Checks | нет | нет (на Free продукта нет) |
+
+**Cloudflare в CFDM — это Worker**, не [Health Checks API](https://developers.cloudflare.com/api/resources/healthchecks).
+Продукт Health Checks на Free-плане недоступен и **не используется**. Worker
+stateless: конфиг и журнал (`health_probe_log`) живут в SQLite CFDM.
+
+Деплой Worker: [`workers/health-probe/README.md`](../workers/health-probe/README.md)
+(`wrangler deploy`). URL и токен — **Настройки → Health-check**. Если Worker не
+задан, cloudflare-цели **не** пробируются как Local.
+
+Reconcile DNS запускается cron-задачей `health-check`. Free Workers ≈ 100k
+запросов/сутки; cron раз в 2 мин × число IP должен влезать.
 
 ## Docker
 

packages/db/dist/index.js

@@ -52,6 +52,7 @@ var serviceGroups = sqliteTable("service_groups", {
   health_check_interval_sec: integer("health_check_interval_sec").notNull().default(30),
   health_check_timeout_ms: integer("health_check_timeout_ms").notNull().default(3e3),
   health_check_verify_tls: integer("health_check_verify_tls", { mode: "boolean" }).notNull().default(false),
+  health_check_provider: text("health_check_provider").notNull().default("local"),
   created_at: text("created_at").notNull().default(sql`datetime('now')`),
   updated_at: text("updated_at").notNull().default(sql`datetime('now')`)
 });
@@ -117,6 +118,7 @@ var serviceBindings = sqliteTable(
     health_check_verify_tls: integer("health_check_verify_tls", {
       mode: "boolean"
     }).notNull().default(false),
+    health_check_provider: text("health_check_provider").notNull().default("local"),
     routing_strategy: text("routing_strategy").notNull().default("round_robin"),
     operation_version: integer("operation_version").notNull().default(0),
     created_at: text("created_at").notNull().default(sql`datetime('now')`),
@@ -187,6 +189,7 @@ var serviceIps = sqliteTable("service_ips", {
   id: integer("id").primaryKey({ autoIncrement: true }),
   service_id: integer("service_id").notNull().references(() => services.id, { onDelete: "cascade" }),
   ip: text("ip").notNull(),
+  enabled: integer("enabled", { mode: "boolean" }).notNull().default(true),
   created_at: text("created_at").notNull().default(sql`datetime('now')`)
 });
 var serviceBindingRecords = sqliteTable(
@@ -251,6 +254,8 @@ var ipHealthStatus = sqliteTable(
     consecutive_successes: integer("consecutive_successes").notNull().default(0),
     last_checked_at: text("last_checked_at"),
     last_error: text("last_error"),
+    colo: text("colo"),
+    provider: text("provider").notNull().default("local"),
     created_at: text("created_at").notNull().default(sql`datetime('now')`),
     updated_at: text("updated_at").notNull().default(sql`datetime('now')`)
   },
@@ -269,6 +274,13 @@ var appSettings = sqliteTable("app_settings", {
   show_quick_actions: integer("show_quick_actions", {
     mode: "boolean"
   }).notNull().default(true),
+  health_check_cron: text("health_check_cron"),
+  health_degraded_failures: integer("health_degraded_failures"),
+  health_down_failures: integer("health_down_failures"),
+  health_latency_warn_ms: integer("health_latency_warn_ms"),
+  health_success_recoveries: integer("health_success_recoveries"),
+  health_worker_url: text("health_worker_url"),
+  health_worker_token: text("health_worker_token"),
   created_at: text("created_at").notNull().default(sql`datetime('now')`),
   updated_at: text("updated_at").notNull().default(sql`datetime('now')`)
 });
@@ -305,6 +317,19 @@ var domainMonitorResults = sqliteTable("domain_monitor_results", {
   error: text("error"),
   checked_at: text("checked_at").notNull().default(sql`datetime('now')`)
 });
+var healthProbeLog = sqliteTable("health_probe_log", {
+  id: integer("id").primaryKey({ autoIncrement: true }),
+  scope: text("scope").notNull(),
+  ref_id: integer("ref_id").notNull(),
+  ip: text("ip").notNull(),
+  provider: text("provider").notNull(),
+  status: text("status").notNull(),
+  ok: integer("ok", { mode: "boolean" }).notNull(),
+  latency_ms: integer("latency_ms"),
+  colo: text("colo"),
+  error: text("error"),
+  checked_at: text("checked_at").notNull().default(sql`datetime('now')`)
+});
 var notificationLog = sqliteTable("notification_log", {
   id: integer("id").primaryKey({ autoIncrement: true }),
   kind: text("kind").notNull(),
@@ -352,6 +377,7 @@ var schema = {
   domainTags,
   domainMonitors,
   domainMonitorResults,
+  healthProbeLog,
   notificationLog,
   auditLog
 };
@@ -493,7 +519,19 @@ function listAudit(db, opts = {}) {
 // src/settings-repo.ts
 import { eq as eq2 } from "drizzle-orm";
 var SETTINGS_ID = "settings-main";
-function toDto(row) {
+function coalesceInt(value, fallback) {
+  return value == null || Number.isNaN(value) || value < 1 ? fallback : value;
+}
+function toDto(row, fallbacks) {
+  const env = fallbacks ?? {
+    healthCheckCron: "0 */2 * * * *",
+    healthDegradedFailures: 1,
+    healthDownFailures: 2,
+    healthLatencyWarnMs: 1e3,
+    healthSuccessRecoveries: 2,
+    healthWorkerUrl: "",
+    healthWorkerTokenSet: false
+  };
   return {
     id: row.id,
     vpsTrackerUrl: row.vps_tracker_url?.trim() ?? "",
@@ -502,28 +540,50 @@ function toDto(row) {
     ),
     vpsTrackerSyncEnabled: Boolean(row.vps_tracker_sync_enabled),
     vpsTrackerLastSyncAt: row.vps_tracker_last_sync_at,
-    showQuickActions: row.show_quick_actions == null ? true : Boolean(row.show_quick_actions)
+    showQuickActions: row.show_quick_actions == null ? true : Boolean(row.show_quick_actions),
+    healthCheckCron: row.health_check_cron?.trim() || env.healthCheckCron,
+    healthDegradedFailures: coalesceInt(
+      row.health_degraded_failures,
+      env.healthDegradedFailures
+    ),
+    healthDownFailures: coalesceInt(
+      row.health_down_failures,
+      env.healthDownFailures
+    ),
+    healthLatencyWarnMs: coalesceInt(
+      row.health_latency_warn_ms,
+      env.healthLatencyWarnMs
+    ),
+    healthSuccessRecoveries: coalesceInt(
+      row.health_success_recoveries,
+      env.healthSuccessRecoveries
+    ),
+    healthWorkerUrl: row.health_worker_url?.trim() || env.healthWorkerUrl,
+    healthWorkerTokenSet: Boolean(row.health_worker_token?.trim()) || env.healthWorkerTokenSet
   };
 }
-function getAppSettings(db) {
+function getAppSettings(db, fallbacks) {
   const row = db.select().from(appSettings).where(eq2(appSettings.id, SETTINGS_ID)).get();
   if (!row) {
     db.insert(appSettings).values({ id: SETTINGS_ID }).run();
     return toDto(
-      db.select().from(appSettings).where(eq2(appSettings.id, SETTINGS_ID)).get()
+      db.select().from(appSettings).where(eq2(appSettings.id, SETTINGS_ID)).get(),
+      fallbacks
     );
   }
-  return toDto(row);
+  return toDto(row, fallbacks);
 }
 function getAppSettingsSecrets(db) {
   const row = db.select().from(appSettings).where(eq2(appSettings.id, SETTINGS_ID)).get();
   return {
     vpsTrackerUrl: row?.vps_tracker_url?.trim() ?? "",
     vpsTrackerIntegrationToken: row?.vps_tracker_integration_token?.trim() ?? "",
-    vpsTrackerSyncEnabled: Boolean(row?.vps_tracker_sync_enabled)
+    vpsTrackerSyncEnabled: Boolean(row?.vps_tracker_sync_enabled),
+    healthWorkerUrl: row?.health_worker_url?.trim() ?? "",
+    healthWorkerToken: row?.health_worker_token?.trim() ?? ""
   };
 }
-function updateAppSettings(db, patch) {
+function updateAppSettings(db, patch, fallbacks) {
   const existing = db.select().from(appSettings).where(eq2(appSettings.id, SETTINGS_ID)).get();
   if (!existing) {
     db.insert(appSettings).values({ id: SETTINGS_ID }).run();
@@ -535,9 +595,16 @@ function updateAppSettings(db, patch) {
     vps_tracker_integration_token: patch.vpsTrackerIntegrationToken !== void 0 && patch.vpsTrackerIntegrationToken.trim() !== "" ? patch.vpsTrackerIntegrationToken : current.vps_tracker_integration_token,
     vps_tracker_sync_enabled: patch.vpsTrackerSyncEnabled !== void 0 ? patch.vpsTrackerSyncEnabled : current.vps_tracker_sync_enabled,
     show_quick_actions: patch.showQuickActions !== void 0 ? patch.showQuickActions : current.show_quick_actions,
+    health_check_cron: patch.healthCheckCron !== void 0 ? patch.healthCheckCron.trim() : current.health_check_cron,
+    health_degraded_failures: patch.healthDegradedFailures !== void 0 ? patch.healthDegradedFailures : current.health_degraded_failures,
+    health_down_failures: patch.healthDownFailures !== void 0 ? patch.healthDownFailures : current.health_down_failures,
+    health_latency_warn_ms: patch.healthLatencyWarnMs !== void 0 ? patch.healthLatencyWarnMs : current.health_latency_warn_ms,
+    health_success_recoveries: patch.healthSuccessRecoveries !== void 0 ? patch.healthSuccessRecoveries : current.health_success_recoveries,
+    health_worker_url: patch.healthWorkerUrl !== void 0 ? patch.healthWorkerUrl.trim() || null : current.health_worker_url,
+    health_worker_token: patch.healthWorkerToken !== void 0 && patch.healthWorkerToken.trim() !== "" ? patch.healthWorkerToken : current.health_worker_token,
     updated_at: (/* @__PURE__ */ new Date()).toISOString()
   }).where(eq2(appSettings.id, SETTINGS_ID)).run();
-  return getAppSettings(db);
+  return getAppSettings(db, fallbacks);
 }
 function touchVpsTrackerSync(db) {
   db.update(appSettings).set({
@@ -605,6 +672,7 @@ __export(repos_exports, {
   getSyncJob: () => getSyncJob,
   insertBinding: () => insertBinding,
   insertDnsRecord: () => insertDnsRecord,
+  insertHealthProbeLog: () => insertHealthProbeLog,
   insertNotificationLog: () => insertNotificationLog,
   linkBindingRecord: () => linkBindingRecord,
   linkGroupDnsRecord: () => linkGroupDnsRecord,
@@ -631,12 +699,15 @@ __export(repos_exports, {
   listGroups: () => listGroups,
   listHealthCheckTargets: () => listHealthCheckTargets,
   listHealthChecks: () => listHealthChecks,
+  listHealthProbeLogForService: () => listHealthProbeLogForService,
+  listIpHealthByServiceIds: () => listIpHealthByServiceIds,
   listIpHealthStatus: () => listIpHealthStatus,
   listNodes: () => listNodes,
   listNotificationLog: () => listNotificationLog,
   listOriginIpsForFqdn: () => listOriginIpsForFqdn,
   listRecordsForBinding: () => listRecordsForBinding,
   listServiceGroups: () => listServiceGroups,
+  listServiceIpRows: () => listServiceIpRows,
   listServiceIps: () => listServiceIps,
   listServices: () => listServices,
   listServicesByGroup: () => listServicesByGroup,
@@ -658,6 +729,7 @@ __export(repos_exports, {
   setServiceEnabled: () => setServiceEnabled,
   setServiceGroup: () => setServiceGroup,
   setServiceGroupEnabled: () => setServiceGroupEnabled,
+  setServiceIpEnabled: () => setServiceIpEnabled,
   setServiceLb: () => setServiceLb,
   unlinkBindingRecord: () => unlinkBindingRecord,
   unlinkGroupDnsRecord: () => unlinkGroupDnsRecord,
@@ -1064,6 +1136,9 @@ function deleteService(db, id) {
   const result = db.delete(services).where(eq3(services.id, id)).run();
   if (result.changes === 0) throw new NotFoundError(`service ${id}`);
 }
+function normalizeHealthProvider(value) {
+  return value === "cloudflare" ? "cloudflare" : "local";
+}
 function mapServiceGroup(row) {
   return {
     id: row.id,
@@ -1081,6 +1156,7 @@ function mapServiceGroup(row) {
     health_check_interval_sec: row.health_check_interval_sec,
     health_check_timeout_ms: row.health_check_timeout_ms,
     health_check_verify_tls: row.health_check_verify_tls,
+    health_check_provider: normalizeHealthProvider(row.health_check_provider),
     created_at: row.created_at,
     updated_at: row.updated_at
   };
@@ -1107,7 +1183,8 @@ function createServiceGroup(db, name, groupType, icon, domain, lbPatch) {
     health_check_expected_status: lbPatch?.health_check_expected_status ?? null,
     health_check_interval_sec: lbPatch?.health_check_interval_sec ?? 30,
     health_check_timeout_ms: lbPatch?.health_check_timeout_ms ?? 3e3,
-    health_check_verify_tls: lbPatch?.health_check_verify_tls ?? false
+    health_check_verify_tls: lbPatch?.health_check_verify_tls ?? false,
+    health_check_provider: lbPatch?.health_check_provider ?? "local"
   }).returning({ id: serviceGroups.id }).get().id;
   return getServiceGroup(db, id);
 }
@@ -1137,6 +1214,8 @@ function updateServiceGroup(db, id, name, groupType, icon, domain, lbPatch) {
       update.health_check_timeout_ms = lbPatch.health_check_timeout_ms;
     if (lbPatch.health_check_verify_tls !== void 0)
       update.health_check_verify_tls = lbPatch.health_check_verify_tls;
+    if (lbPatch.health_check_provider !== void 0)
+      update.health_check_provider = lbPatch.health_check_provider;
   }
   const result = db.update(serviceGroups).set(update).where(eq3(serviceGroups.id, id)).run();
   if (result.changes === 0) throw new NotFoundError(`service group ${id}`);
@@ -1154,16 +1233,32 @@ function deleteServiceGroup(db, id) {
 function insertServiceIpIfMissing(db, serviceId, ip) {
   const existing = db.select({ ip: serviceIps.ip }).from(serviceIps).where(and2(eq3(serviceIps.service_id, serviceId), eq3(serviceIps.ip, ip))).get();
   if (!existing) {
-    db.insert(serviceIps).values({ service_id: serviceId, ip }).run();
+    db.insert(serviceIps).values({ service_id: serviceId, ip, enabled: true }).run();
   }
 }
+function listServiceIpRows(db, serviceId) {
+  return db.select({ ip: serviceIps.ip, enabled: serviceIps.enabled }).from(serviceIps).where(eq3(serviceIps.service_id, serviceId)).all().map((row) => ({ ip: row.ip, enabled: Boolean(row.enabled) }));
+}
 function listServiceIps(db, serviceId) {
-  return db.select({ ip: serviceIps.ip }).from(serviceIps).where(eq3(serviceIps.service_id, serviceId)).all().map((r) => r.ip);
+  return listServiceIpRows(db, serviceId).map((row) => row.ip);
+}
+function setServiceIpEnabled(db, serviceId, ip, enabled) {
+  const result = db.update(serviceIps).set({ enabled }).where(and2(eq3(serviceIps.service_id, serviceId), eq3(serviceIps.ip, ip))).run();
+  if (result.changes === 0) {
+    throw new NotFoundError(`service ip ${ip}`);
+  }
 }
 function replaceServiceIps(db, serviceId, ips) {
+  const previous = new Map(
+    listServiceIpRows(db, serviceId).map((row) => [row.ip, row.enabled])
+  );
   db.delete(serviceIps).where(eq3(serviceIps.service_id, serviceId)).run();
   for (const ip of ips) {
-    db.insert(serviceIps).values({ service_id: serviceId, ip }).run();
+    db.insert(serviceIps).values({
+      service_id: serviceId,
+      ip,
+      enabled: previous.get(ip) ?? true
+    }).run();
     ensureNode(db, serviceId, ip);
   }
   const keep = new Set(ips);
@@ -1430,6 +1525,8 @@ function updateBindingLbConfig(db, bindingId, patch) {
     update.health_check_timeout_ms = patch.health_check_timeout_ms;
   if (patch.health_check_verify_tls !== void 0)
     update.health_check_verify_tls = patch.health_check_verify_tls;
+  if (patch.health_check_provider !== void 0)
+    update.health_check_provider = patch.health_check_provider;
   db.update(serviceBindings).set(update).where(eq3(serviceBindings.id, bindingId)).run();
 }
 function setBindingCnameTarget(db, bindingId, target) {
@@ -1488,7 +1585,7 @@ function dnsRecordMatchesHostname(recordName, hostname, zoneName) {
 var SERVICE_BINDING_SELECT_COLUMNS = `sb.id, sb.domain_id, sb.service_id, sb.hostname, sb.dns_record_id,
   sb.lb_mode, sb.health_check_enabled, sb.health_check_type, sb.health_check_port,
   sb.health_check_path, sb.health_check_expected_status, sb.health_check_interval_sec,
-  sb.health_check_timeout_ms, sb.health_check_verify_tls, sb.cname_target,
+  sb.health_check_timeout_ms, sb.health_check_verify_tls, sb.health_check_provider, sb.cname_target,
   d.zone_name, d.group_id, g.name AS group_name,
   s.name AS service_name, s.slug AS service_slug,
   dr.content AS target_ip, dr.sync_status,
@@ -1709,7 +1806,7 @@ function finishSyncJob(db, id, status, message) {
 function listIpHealthStatus(db, scope, refId) {
   return db.all(sql2`
     SELECT scope, ref_id, ip, status, latency_ms, consecutive_failures,
-      last_checked_at, last_error
+      last_checked_at, last_error, colo, provider
     FROM ip_health_status
     WHERE scope = ${scope} AND ref_id = ${refId}
   `);
@@ -1822,6 +1919,47 @@ function aggregateIpHealthByServiceIds(db, serviceIds) {
   }
   return result;
 }
+function listIpHealthByServiceIds(db, serviceIds) {
+  const result = /* @__PURE__ */ new Map();
+  if (serviceIds.length === 0) return result;
+  const idList = sql2.join(
+    serviceIds.map((id) => sql2`${id}`),
+    sql2`, `
+  );
+  const rows = db.all(sql2`
+    SELECT sb.service_id AS service_id,
+      ihs.ip AS ip,
+      ${WORST_HEALTH_SQL} AS health_status,
+      MAX(ihs.latency_ms) AS health_latency_ms,
+      MAX(ihs.last_checked_at) AS last_checked_at,
+      MAX(ihs.last_error) AS last_error,
+      MAX(ihs.provider) AS provider,
+      MAX(ihs.colo) AS colo
+    FROM ip_health_status ihs
+    INNER JOIN service_bindings sb
+      ON ihs.scope = 'binding' AND ihs.ref_id = sb.id
+    WHERE sb.service_id IN (${idList})
+    GROUP BY sb.service_id, ihs.ip
+  `);
+  for (const row of rows) {
+    const parsed = parseHealthAggregateRow({
+      health_status: row.health_status,
+      health_latency_ms: row.health_latency_ms
+    });
+    const list = result.get(row.service_id) ?? [];
+    list.push({
+      ip: row.ip,
+      status: parsed.health_status,
+      latency_ms: parsed.health_latency_ms,
+      last_checked_at: row.last_checked_at,
+      last_error: row.last_error,
+      provider: normalizeHealthProvider(row.provider),
+      colo: row.colo
+    });
+    result.set(row.service_id, list);
+  }
+  return result;
+}
 function mergeHealthAggregates(parts) {
   const rank = {
     unknown: 0,
@@ -1851,20 +1989,24 @@ function mergeHealthAggregates(parts) {
 function getIpHealthStatusRow(db, scope, refId, ip) {
   const rows = db.all(sql2`
     SELECT scope, ref_id, ip, status, latency_ms, consecutive_failures,
-      consecutive_successes, last_checked_at, last_error
+      consecutive_successes, last_checked_at, last_error, colo, provider
     FROM ip_health_status
     WHERE scope = ${scope} AND ref_id = ${refId} AND ip = ${ip}
     LIMIT 1
   `);
   return rows[0] ?? null;
 }
-function upsertIpHealthStatus(db, scope, refId, ip, status, latencyMs, consecutiveFailures, lastError, consecutiveSuccesses = 0) {
+function upsertIpHealthStatus(db, scope, refId, ip, status, latencyMs, consecutiveFailures, lastError, consecutiveSuccesses = 0, extras) {
+  const colo = extras?.colo ?? null;
+  const provider = extras?.provider ?? "local";
   db.run(sql2`
     INSERT INTO ip_health_status
       (scope, ref_id, ip, status, latency_ms, consecutive_failures,
-       consecutive_successes, last_checked_at, last_error, created_at, updated_at)
+       consecutive_successes, last_checked_at, last_error, colo, provider,
+       created_at, updated_at)
     VALUES (${scope}, ${refId}, ${ip}, ${status}, ${latencyMs}, ${consecutiveFailures},
-      ${consecutiveSuccesses}, datetime('now'), ${lastError}, datetime('now'), datetime('now'))
+      ${consecutiveSuccesses}, datetime('now'), ${lastError}, ${colo}, ${provider},
+      datetime('now'), datetime('now'))
     ON CONFLICT(scope, ref_id, ip) DO UPDATE SET
       status = excluded.status,
       latency_ms = excluded.latency_ms,
@@ -1872,6 +2014,8 @@ function upsertIpHealthStatus(db, scope, refId, ip, status, latencyMs, consecuti
       consecutive_successes = excluded.consecutive_successes,
       last_checked_at = excluded.last_checked_at,
       last_error = excluded.last_error,
+      colo = excluded.colo,
+      provider = excluded.provider,
       updated_at = datetime('now')
   `);
 }
@@ -1934,7 +2078,8 @@ function listHealthCheckTargets(db) {
       sb.health_check_path AS path,
       sb.health_check_expected_status AS expected_status,
       sb.health_check_timeout_ms AS timeout_ms,
-      sb.health_check_verify_tls AS verify_tls
+      sb.health_check_verify_tls AS verify_tls,
+      COALESCE(sb.health_check_provider, 'local') AS provider
     FROM service_binding_ips sbi
     JOIN service_bindings sb ON sb.id = sbi.binding_id
     JOIN domains d ON d.id = sb.domain_id
@@ -1948,7 +2093,8 @@ function listHealthCheckTargets(db) {
       sg.health_check_path AS path,
       sg.health_check_expected_status AS expected_status,
       sg.health_check_timeout_ms AS timeout_ms,
-      sg.health_check_verify_tls AS verify_tls
+      sg.health_check_verify_tls AS verify_tls,
+      COALESCE(sg.health_check_provider, 'local') AS provider
     FROM service_binding_ips sbi
     JOIN service_bindings sb ON sb.id = sbi.binding_id
     JOIN services s ON s.id = sb.service_id
@@ -1968,7 +2114,8 @@ function listHealthCheckTargets(db) {
       sg.health_check_path AS path,
       sg.health_check_expected_status AS expected_status,
       sg.health_check_timeout_ms AS timeout_ms,
-      sg.health_check_verify_tls AS verify_tls
+      sg.health_check_verify_tls AS verify_tls,
+      COALESCE(sg.health_check_provider, 'local') AS provider
     FROM service_binding_ips sbi
     JOIN service_bindings sb ON sb.id = sbi.binding_id
     JOIN domains d ON d.id = sb.domain_id
@@ -1988,7 +2135,8 @@ function listHealthCheckTargets(db) {
       sb.health_check_path AS path,
       sb.health_check_expected_status AS expected_status,
       sb.health_check_timeout_ms AS timeout_ms,
-      sb.health_check_verify_tls AS verify_tls
+      sb.health_check_verify_tls AS verify_tls,
+      COALESCE(sb.health_check_provider, 'local') AS provider
     FROM service_bindings sb
     JOIN domains d ON d.id = sb.domain_id
     JOIN services s ON s.id = sb.service_id
@@ -2005,7 +2153,8 @@ function listHealthCheckTargets(db) {
       sg.health_check_path AS path,
       sg.health_check_expected_status AS expected_status,
       sg.health_check_timeout_ms AS timeout_ms,
-      sg.health_check_verify_tls AS verify_tls
+      sg.health_check_verify_tls AS verify_tls,
+      COALESCE(sg.health_check_provider, 'local') AS provider
     FROM service_bindings sb
     JOIN domains d ON d.id = sb.domain_id
     JOIN services s ON s.id = sb.service_id
@@ -2026,7 +2175,8 @@ function listHealthCheckTargets(db) {
     ...groupInheritedCnameBindingTargets
   ].map((t) => ({
     ...t,
-    verify_tls: Boolean(t.verify_tls)
+    verify_tls: Boolean(t.verify_tls),
+    provider: normalizeHealthProvider(t.provider)
   }));
 }
 function listDomainTags(db, domainId) {
@@ -2121,6 +2271,46 @@ function listDomainMonitorResultsForDomain(db, domainId, limit = 50) {
     LIMIT ${limit}
   `);
 }
+var HEALTH_PROBE_LOG_KEEP = 50;
+function insertHealthProbeLog(db, entry) {
+  db.insert(healthProbeLog).values({
+    scope: entry.scope,
+    ref_id: entry.refId,
+    ip: entry.ip,
+    provider: entry.provider,
+    status: entry.status,
+    ok: entry.ok,
+    latency_ms: entry.latencyMs,
+    colo: entry.colo,
+    error: entry.error
+  }).run();
+  db.run(sql2`
+    DELETE FROM health_probe_log
+    WHERE id IN (
+      SELECT id FROM health_probe_log
+      WHERE scope = ${entry.scope} AND ref_id = ${entry.refId} AND ip = ${entry.ip}
+      ORDER BY checked_at DESC, id DESC
+      LIMIT -1 OFFSET ${HEALTH_PROBE_LOG_KEEP}
+    )
+  `);
+}
+function listHealthProbeLogForService(db, serviceId, limit = 50) {
+  const rows = db.all(sql2`
+    SELECT l.id, l.scope, l.ref_id, l.ip, l.provider, l.status, l.ok,
+      l.latency_ms, l.colo, l.error, l.checked_at
+    FROM health_probe_log l
+    INNER JOIN service_bindings sb
+      ON l.scope = 'binding' AND l.ref_id = sb.id
+    WHERE sb.service_id = ${serviceId}
+    ORDER BY l.checked_at DESC, l.id DESC
+    LIMIT ${limit}
+  `);
+  return rows.map((row) => ({
+    ...row,
+    provider: normalizeHealthProvider(row.provider),
+    ok: Boolean(row.ok)
+  }));
+}
 function insertNotificationLog(db, kind, refType, refId, title, message) {
   db.insert(notificationLog).values({
     kind,
@@ -2158,6 +2348,7 @@ export {
   groups,
   healthCheck,
   healthChecks,
+  healthProbeLog,
   ipHealthStatus,
   listAudit,
   nodes,

packages/db/migrations/019_service_ips_enabled.sql

@@ -0,0 +1 @@
+ALTER TABLE service_ips ADD COLUMN enabled INTEGER NOT NULL DEFAULT 1;

packages/db/migrations/020_health_engine_settings.sql

@@ -0,0 +1,7 @@
+-- Local health-check engine settings (cron + state-machine thresholds).
+-- NULL = inherit from process env (HEALTH_CHECK_CRON / HEALTH_*).
+ALTER TABLE app_settings ADD COLUMN health_check_cron TEXT;
+ALTER TABLE app_settings ADD COLUMN health_degraded_failures INTEGER;
+ALTER TABLE app_settings ADD COLUMN health_down_failures INTEGER;
+ALTER TABLE app_settings ADD COLUMN health_latency_warn_ms INTEGER;
+ALTER TABLE app_settings ADD COLUMN health_success_recoveries INTEGER;

packages/db/migrations/021_health_worker_xor.sql

@@ -0,0 +1,27 @@
+-- XOR health-check: persist provider on bindings/groups; Worker URL/token;
+-- colo + probe journal. Cloudflare = Worker edge probe, not Health Checks API.
+ALTER TABLE service_bindings ADD COLUMN health_check_provider TEXT NOT NULL DEFAULT 'local';
+ALTER TABLE service_groups ADD COLUMN health_check_provider TEXT NOT NULL DEFAULT 'local';
+
+ALTER TABLE app_settings ADD COLUMN health_worker_url TEXT;
+ALTER TABLE app_settings ADD COLUMN health_worker_token TEXT;
+
+ALTER TABLE ip_health_status ADD COLUMN colo TEXT;
+ALTER TABLE ip_health_status ADD COLUMN provider TEXT NOT NULL DEFAULT 'local';
+
+CREATE TABLE IF NOT EXISTS health_probe_log (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  scope TEXT NOT NULL,
+  ref_id INTEGER NOT NULL,
+  ip TEXT NOT NULL,
+  provider TEXT NOT NULL,
+  status TEXT NOT NULL,
+  ok INTEGER NOT NULL,
+  latency_ms INTEGER,
+  colo TEXT,
+  error TEXT,
+  checked_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+
+CREATE INDEX IF NOT EXISTS idx_health_probe_log_target
+  ON health_probe_log(scope, ref_id, ip, checked_at DESC);

packages/db/src/repos.ts

@@ -5,6 +5,7 @@ import type {
   DomainListItem,
   Group,
   GroupWithStats,
+  HealthCheckProvider,
   HealthCheckScope,
   HealthCheckTarget,
   HealthCheckType,
@@ -33,6 +34,7 @@ import {
   domains,
   groups,
   healthChecks,
+  healthProbeLog,
   ipHealthStatus,
   nodes,
   bindingNodes,
@@ -768,6 +770,10 @@ export function deleteService(db: Db, id: number): void {
 
 // --- Service Groups ---
 
+function normalizeHealthProvider(value: unknown): HealthCheckProvider {
+  return value === "cloudflare" ? "cloudflare" : "local";
+}
+
 function mapServiceGroup(row: typeof serviceGroups.$inferSelect): ServiceGroup {
   return {
     id: row.id,
@@ -785,6 +791,7 @@ function mapServiceGroup(row: typeof serviceGroups.$inferSelect): ServiceGroup {
     health_check_interval_sec: row.health_check_interval_sec,
     health_check_timeout_ms: row.health_check_timeout_ms,
     health_check_verify_tls: row.health_check_verify_tls,
+    health_check_provider: normalizeHealthProvider(row.health_check_provider),
     created_at: row.created_at,
     updated_at: row.updated_at,
   };
@@ -819,6 +826,7 @@ export interface ServiceGroupLbPatch {
   health_check_interval_sec?: number;
   health_check_timeout_ms?: number;
   health_check_verify_tls?: boolean;
+  health_check_provider?: HealthCheckProvider;
 }
 
 export function createServiceGroup(
@@ -845,6 +853,7 @@ export function createServiceGroup(
       health_check_interval_sec: lbPatch?.health_check_interval_sec ?? 30,
       health_check_timeout_ms: lbPatch?.health_check_timeout_ms ?? 3000,
       health_check_verify_tls: lbPatch?.health_check_verify_tls ?? false,
+      health_check_provider: lbPatch?.health_check_provider ?? "local",
     })
     .returning({ id: serviceGroups.id })
     .get()!.id;
@@ -885,6 +894,8 @@ export function updateServiceGroup(
       update.health_check_timeout_ms = lbPatch.health_check_timeout_ms;
     if (lbPatch.health_check_verify_tls !== undefined)
       update.health_check_verify_tls = lbPatch.health_check_verify_tls;
+    if (lbPatch.health_check_provider !== undefined)
+      update.health_check_provider = lbPatch.health_check_provider;
   }
   const result = db
     .update(serviceGroups)
@@ -923,17 +934,42 @@ function insertServiceIpIfMissing(db: Db, serviceId: number, ip: string): void {
     .where(and(eq(serviceIps.service_id, serviceId), eq(serviceIps.ip, ip)))
     .get();
   if (!existing) {
-    db.insert(serviceIps).values({ service_id: serviceId, ip }).run();
+    db.insert(serviceIps).values({ service_id: serviceId, ip, enabled: true }).run();
   }
 }
 
-export function listServiceIps(db: Db, serviceId: number): string[] {
+export type ServiceIpRow = {
+  ip: string;
+  enabled: boolean;
+};
+
+export function listServiceIpRows(db: Db, serviceId: number): ServiceIpRow[] {
   return db
-    .select({ ip: serviceIps.ip })
+    .select({ ip: serviceIps.ip, enabled: serviceIps.enabled })
     .from(serviceIps)
     .where(eq(serviceIps.service_id, serviceId))
     .all()
-    .map((r) => r.ip);
+    .map((row) => ({ ip: row.ip, enabled: Boolean(row.enabled) }));
+}
+
+export function listServiceIps(db: Db, serviceId: number): string[] {
+  return listServiceIpRows(db, serviceId).map((row) => row.ip);
+}
+
+export function setServiceIpEnabled(
+  db: Db,
+  serviceId: number,
+  ip: string,
+  enabled: boolean,
+): void {
+  const result = db
+    .update(serviceIps)
+    .set({ enabled })
+    .where(and(eq(serviceIps.service_id, serviceId), eq(serviceIps.ip, ip)))
+    .run();
+  if (result.changes === 0) {
+    throw new NotFoundError(`service ip ${ip}`);
+  }
 }
 
 export function replaceServiceIps(
@@ -941,9 +977,18 @@ export function replaceServiceIps(
   serviceId: number,
   ips: string[],
 ): void {
+  const previous = new Map(
+    listServiceIpRows(db, serviceId).map((row) => [row.ip, row.enabled]),
+  );
   db.delete(serviceIps).where(eq(serviceIps.service_id, serviceId)).run();
   for (const ip of ips) {
-    db.insert(serviceIps).values({ service_id: serviceId, ip }).run();
+    db.insert(serviceIps)
+      .values({
+        service_id: serviceId,
+        ip,
+        enabled: previous.get(ip) ?? true,
+      })
+      .run();
     ensureNode(db, serviceId, ip);
   }
   const keep = new Set(ips);
@@ -1393,6 +1438,7 @@ export interface BindingLbPatch {
   health_check_interval_sec?: number;
   health_check_timeout_ms?: number;
   health_check_verify_tls?: boolean;
+  health_check_provider?: HealthCheckProvider;
 }
 
 export function updateBindingLbConfig(
@@ -1423,6 +1469,8 @@ export function updateBindingLbConfig(
     update.health_check_timeout_ms = patch.health_check_timeout_ms;
   if (patch.health_check_verify_tls !== undefined)
     update.health_check_verify_tls = patch.health_check_verify_tls;
+  if (patch.health_check_provider !== undefined)
+    update.health_check_provider = patch.health_check_provider;
   db.update(serviceBindings)
     .set(update)
     .where(eq(serviceBindings.id, bindingId))
@@ -1530,7 +1578,7 @@ function dnsRecordMatchesHostname(
 const SERVICE_BINDING_SELECT_COLUMNS = `sb.id, sb.domain_id, sb.service_id, sb.hostname, sb.dns_record_id,
   sb.lb_mode, sb.health_check_enabled, sb.health_check_type, sb.health_check_port,
   sb.health_check_path, sb.health_check_expected_status, sb.health_check_interval_sec,
-  sb.health_check_timeout_ms, sb.health_check_verify_tls, sb.cname_target,
+  sb.health_check_timeout_ms, sb.health_check_verify_tls, sb.health_check_provider, sb.cname_target,
   d.zone_name, d.group_id, g.name AS group_name,
   s.name AS service_name, s.slug AS service_slug,
   dr.content AS target_ip, dr.sync_status,
@@ -1909,7 +1957,7 @@ export function listIpHealthStatus(
   return db
     .all<IpHealthStatus>(sql`
     SELECT scope, ref_id, ip, status, latency_ms, consecutive_failures,
-      last_checked_at, last_error
+      last_checked_at, last_error, colo, provider
     FROM ip_health_status
     WHERE scope = ${scope} AND ref_id = ${refId}
   `);
@@ -2070,6 +2118,71 @@ export function aggregateIpHealthByServiceIds(
   return result;
 }
 
+export type ServiceIpHealthRow = {
+  ip: string;
+  status: IpHealthState;
+  latency_ms: number | null;
+  last_checked_at: string | null;
+  last_error: string | null;
+  provider: HealthCheckProvider;
+  colo: string | null;
+};
+
+/** Per-IP binding-scope health, worst status if the same IP is on several bindings. */
+export function listIpHealthByServiceIds(
+  db: Db,
+  serviceIds: number[],
+): Map<number, ServiceIpHealthRow[]> {
+  const result = new Map<number, ServiceIpHealthRow[]>();
+  if (serviceIds.length === 0) return result;
+  const idList = sql.join(
+    serviceIds.map((id) => sql`${id}`),
+    sql`, `,
+  );
+  const rows = db.all<{
+    service_id: number;
+    ip: string;
+    health_status: string | null;
+    health_latency_ms: number | null;
+    last_checked_at: string | null;
+    last_error: string | null;
+    provider: string | null;
+    colo: string | null;
+  }>(sql`
+    SELECT sb.service_id AS service_id,
+      ihs.ip AS ip,
+      ${WORST_HEALTH_SQL} AS health_status,
+      MAX(ihs.latency_ms) AS health_latency_ms,
+      MAX(ihs.last_checked_at) AS last_checked_at,
+      MAX(ihs.last_error) AS last_error,
+      MAX(ihs.provider) AS provider,
+      MAX(ihs.colo) AS colo
+    FROM ip_health_status ihs
+    INNER JOIN service_bindings sb
+      ON ihs.scope = 'binding' AND ihs.ref_id = sb.id
+    WHERE sb.service_id IN (${idList})
+    GROUP BY sb.service_id, ihs.ip
+  `);
+  for (const row of rows) {
+    const parsed = parseHealthAggregateRow({
+      health_status: row.health_status,
+      health_latency_ms: row.health_latency_ms,
+    });
+    const list = result.get(row.service_id) ?? [];
+    list.push({
+      ip: row.ip,
+      status: parsed.health_status,
+      latency_ms: parsed.health_latency_ms,
+      last_checked_at: row.last_checked_at,
+      last_error: row.last_error,
+      provider: normalizeHealthProvider(row.provider),
+      colo: row.colo,
+    });
+    result.set(row.service_id, list);
+  }
+  return result;
+}
+
 export function mergeHealthAggregates(
   parts: Array<HealthAggregate | undefined | null>,
 ): HealthAggregate {
@@ -2112,7 +2225,7 @@ export function getIpHealthStatusRow(
 ): IpHealthStatus | null {
   const rows = db.all<IpHealthStatus>(sql`
     SELECT scope, ref_id, ip, status, latency_ms, consecutive_failures,
-      consecutive_successes, last_checked_at, last_error
+      consecutive_successes, last_checked_at, last_error, colo, provider
     FROM ip_health_status
     WHERE scope = ${scope} AND ref_id = ${refId} AND ip = ${ip}
     LIMIT 1
@@ -2130,13 +2243,18 @@ export function upsertIpHealthStatus(
   consecutiveFailures: number,
   lastError: string | null,
   consecutiveSuccesses = 0,
+  extras?: { colo?: string | null; provider?: HealthCheckProvider },
 ): void {
+  const colo = extras?.colo ?? null;
+  const provider = extras?.provider ?? "local";
   db.run(sql`
     INSERT INTO ip_health_status
       (scope, ref_id, ip, status, latency_ms, consecutive_failures,
-       consecutive_successes, last_checked_at, last_error, created_at, updated_at)
+       consecutive_successes, last_checked_at, last_error, colo, provider,
+       created_at, updated_at)
     VALUES (${scope}, ${refId}, ${ip}, ${status}, ${latencyMs}, ${consecutiveFailures},
-      ${consecutiveSuccesses}, datetime('now'), ${lastError}, datetime('now'), datetime('now'))
+      ${consecutiveSuccesses}, datetime('now'), ${lastError}, ${colo}, ${provider},
+      datetime('now'), datetime('now'))
     ON CONFLICT(scope, ref_id, ip) DO UPDATE SET
       status = excluded.status,
       latency_ms = excluded.latency_ms,
@@ -2144,6 +2262,8 @@ export function upsertIpHealthStatus(
       consecutive_successes = excluded.consecutive_successes,
       last_checked_at = excluded.last_checked_at,
       last_error = excluded.last_error,
+      colo = excluded.colo,
+      provider = excluded.provider,
       updated_at = datetime('now')
   `);
 }
@@ -2238,7 +2358,8 @@ export function listHealthCheckTargets(db: Db): HealthCheckTarget[] {
       sb.health_check_path AS path,
       sb.health_check_expected_status AS expected_status,
       sb.health_check_timeout_ms AS timeout_ms,
-      sb.health_check_verify_tls AS verify_tls
+      sb.health_check_verify_tls AS verify_tls,
+      COALESCE(sb.health_check_provider, 'local') AS provider
     FROM service_binding_ips sbi
     JOIN service_bindings sb ON sb.id = sbi.binding_id
     JOIN domains d ON d.id = sb.domain_id
@@ -2256,7 +2377,8 @@ export function listHealthCheckTargets(db: Db): HealthCheckTarget[] {
       sg.health_check_path AS path,
       sg.health_check_expected_status AS expected_status,
       sg.health_check_timeout_ms AS timeout_ms,
-      sg.health_check_verify_tls AS verify_tls
+      sg.health_check_verify_tls AS verify_tls,
+      COALESCE(sg.health_check_provider, 'local') AS provider
     FROM service_binding_ips sbi
     JOIN service_bindings sb ON sb.id = sbi.binding_id
     JOIN services s ON s.id = sb.service_id
@@ -2281,7 +2403,8 @@ export function listHealthCheckTargets(db: Db): HealthCheckTarget[] {
       sg.health_check_path AS path,
       sg.health_check_expected_status AS expected_status,
       sg.health_check_timeout_ms AS timeout_ms,
-      sg.health_check_verify_tls AS verify_tls
+      sg.health_check_verify_tls AS verify_tls,
+      COALESCE(sg.health_check_provider, 'local') AS provider
     FROM service_binding_ips sbi
     JOIN service_bindings sb ON sb.id = sbi.binding_id
     JOIN domains d ON d.id = sb.domain_id
@@ -2303,7 +2426,8 @@ export function listHealthCheckTargets(db: Db): HealthCheckTarget[] {
       sb.health_check_path AS path,
       sb.health_check_expected_status AS expected_status,
       sb.health_check_timeout_ms AS timeout_ms,
-      sb.health_check_verify_tls AS verify_tls
+      sb.health_check_verify_tls AS verify_tls,
+      COALESCE(sb.health_check_provider, 'local') AS provider
     FROM service_bindings sb
     JOIN domains d ON d.id = sb.domain_id
     JOIN services s ON s.id = sb.service_id
@@ -2323,7 +2447,8 @@ export function listHealthCheckTargets(db: Db): HealthCheckTarget[] {
       sg.health_check_path AS path,
       sg.health_check_expected_status AS expected_status,
       sg.health_check_timeout_ms AS timeout_ms,
-      sg.health_check_verify_tls AS verify_tls
+      sg.health_check_verify_tls AS verify_tls,
+      COALESCE(sg.health_check_provider, 'local') AS provider
     FROM service_bindings sb
     JOIN domains d ON d.id = sb.domain_id
     JOIN services s ON s.id = sb.service_id
@@ -2346,6 +2471,7 @@ export function listHealthCheckTargets(db: Db): HealthCheckTarget[] {
   ].map((t) => ({
     ...t,
     verify_tls: Boolean(t.verify_tls),
+    provider: normalizeHealthProvider(t.provider),
   }));
 }
 
@@ -2550,6 +2676,94 @@ export function listDomainMonitorResultsForDomain(
   `);
 }
 
+// --- Health probe journal ---
+
+const HEALTH_PROBE_LOG_KEEP = 50;
+
+export function insertHealthProbeLog(
+  db: Db,
+  entry: {
+    scope: HealthCheckScope;
+    refId: number;
+    ip: string;
+    provider: HealthCheckProvider;
+    status: string;
+    ok: boolean;
+    latencyMs: number | null;
+    colo: string | null;
+    error: string | null;
+  },
+): void {
+  db.insert(healthProbeLog)
+    .values({
+      scope: entry.scope,
+      ref_id: entry.refId,
+      ip: entry.ip,
+      provider: entry.provider,
+      status: entry.status,
+      ok: entry.ok,
+      latency_ms: entry.latencyMs,
+      colo: entry.colo,
+      error: entry.error,
+    })
+    .run();
+  db.run(sql`
+    DELETE FROM health_probe_log
+    WHERE id IN (
+      SELECT id FROM health_probe_log
+      WHERE scope = ${entry.scope} AND ref_id = ${entry.refId} AND ip = ${entry.ip}
+      ORDER BY checked_at DESC, id DESC
+      LIMIT -1 OFFSET ${HEALTH_PROBE_LOG_KEEP}
+    )
+  `);
+}
+
+export function listHealthProbeLogForService(
+  db: Db,
+  serviceId: number,
+  limit = 50,
+): {
+  id: number;
+  scope: string;
+  ref_id: number;
+  ip: string;
+  provider: HealthCheckProvider;
+  status: string;
+  ok: boolean;
+  latency_ms: number | null;
+  colo: string | null;
+  error: string | null;
+  checked_at: string;
+}[] {
+  const rows = db.all<{
+    id: number;
+    scope: string;
+    ref_id: number;
+    ip: string;
+    provider: string;
+    status: string;
+    ok: number;
+    latency_ms: number | null;
+    colo: string | null;
+    error: string | null;
+    checked_at: string;
+  }>(sql`
+    SELECT l.id, l.scope, l.ref_id, l.ip, l.provider, l.status, l.ok,
+      l.latency_ms, l.colo, l.error, l.checked_at
+    FROM health_probe_log l
+    INNER JOIN service_bindings sb
+      ON l.scope = 'binding' AND l.ref_id = sb.id
+    WHERE sb.service_id = ${serviceId}
+    ORDER BY l.checked_at DESC, l.id DESC
+    LIMIT ${limit}
+  `);
+  return rows.map((row) => ({
+    ...row,
+    provider: normalizeHealthProvider(row.provider),
+    ok: Boolean(row.ok),
+  }));
+}
+
 // --- Notification log ---
 
 export function insertNotificationLog(

packages/db/src/schema.ts

@@ -64,6 +64,7 @@ export const serviceGroups = sqliteTable("service_groups", {
   health_check_verify_tls: integer("health_check_verify_tls", { mode: "boolean" })
     .notNull()
     .default(false),
+  health_check_provider: text("health_check_provider").notNull().default("local"),
   created_at: text("created_at")
     .notNull()
     .default(sql`datetime('now')`),
@@ -165,6 +166,9 @@ export const serviceBindings = sqliteTable(
     })
       .notNull()
       .default(false),
+    health_check_provider: text("health_check_provider")
+      .notNull()
+      .default("local"),
     routing_strategy: text("routing_strategy").notNull().default("round_robin"),
     operation_version: integer("operation_version").notNull().default(0),
     created_at: text("created_at")
@@ -259,6 +263,7 @@ export const serviceIps = sqliteTable("service_ips", {
     .notNull()
     .references(() => services.id, { onDelete: "cascade" }),
   ip: text("ip").notNull(),
+  enabled: integer("enabled", { mode: "boolean" }).notNull().default(true),
   created_at: text("created_at")
     .notNull()
     .default(sql`datetime('now')`),
@@ -353,6 +358,8 @@ export const ipHealthStatus = sqliteTable(
       .default(0),
     last_checked_at: text("last_checked_at"),
     last_error: text("last_error"),
+    colo: text("colo"),
+    provider: text("provider").notNull().default("local"),
     created_at: text("created_at")
       .notNull()
       .default(sql`datetime('now')`),
@@ -379,6 +386,13 @@ export const appSettings = sqliteTable("app_settings", {
   })
     .notNull()
     .default(true),
+  health_check_cron: text("health_check_cron"),
+  health_degraded_failures: integer("health_degraded_failures"),
+  health_down_failures: integer("health_down_failures"),
+  health_latency_warn_ms: integer("health_latency_warn_ms"),
+  health_success_recoveries: integer("health_success_recoveries"),
+  health_worker_url: text("health_worker_url"),
+  health_worker_token: text("health_worker_token"),
   created_at: text("created_at")
     .notNull()
     .default(sql`datetime('now')`),
@@ -435,6 +449,22 @@ export const domainMonitorResults = sqliteTable("domain_monitor_results", {
     .default(sql`datetime('now')`),
 });
 
+export const healthProbeLog = sqliteTable("health_probe_log", {
+  id: integer("id").primaryKey({ autoIncrement: true }),
+  scope: text("scope").notNull(),
+  ref_id: integer("ref_id").notNull(),
+  ip: text("ip").notNull(),
+  provider: text("provider").notNull(),
+  status: text("status").notNull(),
+  ok: integer("ok", { mode: "boolean" }).notNull(),
+  latency_ms: integer("latency_ms"),
+  colo: text("colo"),
+  error: text("error"),
+  checked_at: text("checked_at")
+    .notNull()
+    .default(sql`datetime('now')`),
+});
+
 export const notificationLog = sqliteTable("notification_log", {
   id: integer("id").primaryKey({ autoIncrement: true }),
   kind: text("kind").notNull(),
@@ -488,6 +518,7 @@ export const schema = {
   domainTags,
   domainMonitors,
   domainMonitorResults,
+  healthProbeLog,
   notificationLog,
   auditLog,
 };

packages/db/src/settings-repo.ts

@@ -4,6 +4,14 @@ import { appSettings } from "./schema.js";
 
 const SETTINGS_ID = "settings-main";
 
+export type HealthEngineSettings = {
+  healthCheckCron: string;
+  healthDegradedFailures: number;
+  healthDownFailures: number;
+  healthLatencyWarnMs: number;
+  healthSuccessRecoveries: number;
+};
+
 export type AppSettingsDto = {
   id: string;
   vpsTrackerUrl: string;
@@ -11,16 +19,46 @@ export type AppSettingsDto = {
   vpsTrackerSyncEnabled: boolean;
   vpsTrackerLastSyncAt: string | null;
   showQuickActions: boolean;
-};
+  healthWorkerUrl: string;
+  healthWorkerTokenSet: boolean;
+} & HealthEngineSettings;
 
 export type AppSettingsPatch = {
   vpsTrackerUrl?: string;
   vpsTrackerIntegrationToken?: string;
   vpsTrackerSyncEnabled?: boolean;
   showQuickActions?: boolean;
+  healthCheckCron?: string;
+  healthDegradedFailures?: number;
+  healthDownFailures?: number;
+  healthLatencyWarnMs?: number;
+  healthSuccessRecoveries?: number;
+  healthWorkerUrl?: string;
+  healthWorkerToken?: string;
 };
 
-function toDto(row: typeof appSettings.$inferSelect): AppSettingsDto {
+export type HealthEngineFallbacks = HealthEngineSettings & {
+  healthWorkerUrl: string;
+  healthWorkerTokenSet: boolean;
+};
+
+function coalesceInt(value: number | null | undefined, fallback: number): number {
+  return value == null || Number.isNaN(value) || value < 1 ? fallback : value;
+}
+
+function toDto(
+  row: typeof appSettings.$inferSelect,
+  fallbacks?: HealthEngineFallbacks,
+): AppSettingsDto {
+  const env = fallbacks ?? {
+    healthCheckCron: "0 */2 * * * *",
+    healthDegradedFailures: 1,
+    healthDownFailures: 2,
+    healthLatencyWarnMs: 1000,
+    healthSuccessRecoveries: 2,
+    healthWorkerUrl: "",
+    healthWorkerTokenSet: false,
+  };
   return {
     id: row.id,
     vpsTrackerUrl: row.vps_tracker_url?.trim() ?? "",
@@ -31,10 +69,33 @@ function toDto(row: typeof appSettings.$inferSelect): AppSettingsDto {
     vpsTrackerLastSyncAt: row.vps_tracker_last_sync_at,
     showQuickActions:
       row.show_quick_actions == null ? true : Boolean(row.show_quick_actions),
+    healthCheckCron: row.health_check_cron?.trim() || env.healthCheckCron,
+    healthDegradedFailures: coalesceInt(
+      row.health_degraded_failures,
+      env.healthDegradedFailures,
+    ),
+    healthDownFailures: coalesceInt(
+      row.health_down_failures,
+      env.healthDownFailures,
+    ),
+    healthLatencyWarnMs: coalesceInt(
+      row.health_latency_warn_ms,
+      env.healthLatencyWarnMs,
+    ),
+    healthSuccessRecoveries: coalesceInt(
+      row.health_success_recoveries,
+      env.healthSuccessRecoveries,
+    ),
+    healthWorkerUrl: row.health_worker_url?.trim() || env.healthWorkerUrl,
+    healthWorkerTokenSet:
+      Boolean(row.health_worker_token?.trim()) || env.healthWorkerTokenSet,
   };
 }
 
-export function getAppSettings(db: Db): AppSettingsDto {
+export function getAppSettings(
+  db: Db,
+  fallbacks?: HealthEngineFallbacks,
+): AppSettingsDto {
   const row = db
     .select()
     .from(appSettings)
@@ -44,15 +105,18 @@ export function getAppSettings(db: Db): AppSettingsDto {
     db.insert(appSettings).values({ id: SETTINGS_ID }).run();
     return toDto(
       db.select().from(appSettings).where(eq(appSettings.id, SETTINGS_ID)).get()!,
+      fallbacks,
     );
   }
-  return toDto(row);
+  return toDto(row, fallbacks);
 }
 
 export function getAppSettingsSecrets(db: Db): {
   vpsTrackerUrl: string;
   vpsTrackerIntegrationToken: string;
   vpsTrackerSyncEnabled: boolean;
+  healthWorkerUrl: string;
+  healthWorkerToken: string;
 } {
   const row = db
     .select()
@@ -64,10 +128,16 @@ export function getAppSettingsSecrets(db: Db): {
     vpsTrackerIntegrationToken:
       row?.vps_tracker_integration_token?.trim() ?? "",
     vpsTrackerSyncEnabled: Boolean(row?.vps_tracker_sync_enabled),
+    healthWorkerUrl: row?.health_worker_url?.trim() ?? "",
+    healthWorkerToken: row?.health_worker_token?.trim() ?? "",
   };
 }
 
-export function updateAppSettings(db: Db, patch: AppSettingsPatch): AppSettingsDto {
+export function updateAppSettings(
+  db: Db,
+  patch: AppSettingsPatch,
+  fallbacks?: HealthEngineFallbacks,
+): AppSettingsDto {
   const existing = db
     .select()
     .from(appSettings)
@@ -102,12 +172,41 @@ export function updateAppSettings(db: Db, patch: AppSettingsPatch): AppSettingsD
         patch.showQuickActions !== undefined
           ? patch.showQuickActions
           : current.show_quick_actions,
+      health_check_cron:
+        patch.healthCheckCron !== undefined
+          ? patch.healthCheckCron.trim()
+          : current.health_check_cron,
+      health_degraded_failures:
+        patch.healthDegradedFailures !== undefined
+          ? patch.healthDegradedFailures
+          : current.health_degraded_failures,
+      health_down_failures:
+        patch.healthDownFailures !== undefined
+          ? patch.healthDownFailures
+          : current.health_down_failures,
+      health_latency_warn_ms:
+        patch.healthLatencyWarnMs !== undefined
+          ? patch.healthLatencyWarnMs
+          : current.health_latency_warn_ms,
+      health_success_recoveries:
+        patch.healthSuccessRecoveries !== undefined
+          ? patch.healthSuccessRecoveries
+          : current.health_success_recoveries,
+      health_worker_url:
+        patch.healthWorkerUrl !== undefined
+          ? patch.healthWorkerUrl.trim() || null
+          : current.health_worker_url,
+      health_worker_token:
+        patch.healthWorkerToken !== undefined &&
+        patch.healthWorkerToken.trim() !== ""
+          ? patch.healthWorkerToken
+          : current.health_worker_token,
       updated_at: new Date().toISOString(),
     })
     .where(eq(appSettings.id, SETTINGS_ID))
     .run();
 
-  return getAppSettings(db);
+  return getAppSettings(db, fallbacks);
 }
 
 export function touchVpsTrackerSync(db: Db): void {

packages/shared/dist/index.d.ts

@@ -31,6 +31,7 @@ interface ServiceGroup$1 {
     health_check_interval_sec: number;
     health_check_timeout_ms: number;
     health_check_verify_tls: boolean;
+    health_check_provider: HealthCheckProvider;
     created_at: string;
     updated_at: string;
 }
@@ -60,6 +61,7 @@ interface ServiceBinding {
     health_check_interval_sec: number;
     health_check_timeout_ms: number;
     health_check_verify_tls: boolean;
+    health_check_provider: HealthCheckProvider;
     routing_strategy: LbMode;
     operation_version: number;
     created_at: string;
@@ -90,6 +92,7 @@ interface ServiceBindingView {
     health_check_interval_sec: number;
     health_check_timeout_ms: number;
     health_check_verify_tls: boolean;
+    health_check_provider: HealthCheckProvider;
     sync_status: string | null;
     created_at: string;
     updated_at: string;
@@ -114,6 +117,7 @@ interface ServiceDomainBindingView {
     health_check_interval_sec: number;
     health_check_timeout_ms: number;
     health_check_verify_tls: boolean;
+    health_check_provider: HealthCheckProvider;
     sync_status: string | null;
 }
 interface ServiceView$1 {
@@ -132,6 +136,8 @@ interface ServiceView$1 {
     domains: ServiceDomainBindingView[];
     health_status: IpHealthState;
     health_latency_ms: number | null;
+    ip_health: ServiceIpHealth$1[];
+    ip_enabled: Record<string, boolean>;
 }
 interface SyncJob {
     id: string;
@@ -191,6 +197,17 @@ interface IpHealthStatus {
     consecutive_successes?: number;
     last_checked_at: string | null;
     last_error: string | null;
+    colo?: string | null;
+    provider?: HealthCheckProvider;
+}
+interface ServiceIpHealth$1 {
+    ip: string;
+    status: IpHealthState;
+    latency_ms: number | null;
+    last_checked_at?: string | null;
+    last_error?: string | null;
+    provider?: HealthCheckProvider;
+    colo?: string | null;
 }
 interface ServiceNode {
     id: number;
@@ -268,6 +285,7 @@ interface HealthCheckTarget {
     expected_status: number | null;
     timeout_ms: number;
     verify_tls: boolean;
+    provider: HealthCheckProvider;
 }
 
 declare class ValidationError extends Error {
@@ -371,7 +389,52 @@ declare const ipHealthStatusSchema: z.ZodObject<{
     consecutive_successes: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
     last_checked_at: z.ZodNullable<z.ZodString>;
     last_error: z.ZodNullable<z.ZodString>;
+    colo: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    provider: z.ZodOptional<z.ZodEnum<{
+        local: "local";
+        cloudflare: "cloudflare";
+    }>>;
 }, z.core.$strip>;
+declare const serviceIpHealthSchema: z.ZodObject<{
+    ip: z.ZodString;
+    status: z.ZodEnum<{
+        unknown: "unknown";
+        up: "up";
+        down: "down";
+        degraded: "degraded";
+    }>;
+    latency_ms: z.ZodNullable<z.ZodNumber>;
+    last_checked_at: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    last_error: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    provider: z.ZodOptional<z.ZodEnum<{
+        local: "local";
+        cloudflare: "cloudflare";
+    }>>;
+    colo: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, z.core.$strip>;
+type ServiceIpHealth = z.infer<typeof serviceIpHealthSchema>;
+declare const healthProbeLogSchema: z.ZodObject<{
+    id: z.ZodNumber;
+    scope: z.ZodString;
+    ref_id: z.ZodNumber;
+    ip: z.ZodString;
+    provider: z.ZodEnum<{
+        local: "local";
+        cloudflare: "cloudflare";
+    }>;
+    status: z.ZodEnum<{
+        unknown: "unknown";
+        up: "up";
+        down: "down";
+        degraded: "degraded";
+    }>;
+    ok: z.ZodCoercedBoolean<unknown>;
+    latency_ms: z.ZodNullable<z.ZodNumber>;
+    colo: z.ZodNullable<z.ZodString>;
+    error: z.ZodNullable<z.ZodString>;
+    checked_at: z.ZodString;
+}, z.core.$strip>;
+type HealthProbeLog = z.infer<typeof healthProbeLogSchema>;
 declare const groupSchema: z.ZodObject<{
     id: z.ZodNumber;
     name: z.ZodString;
@@ -425,6 +488,10 @@ declare const serviceGroupSchema: z.ZodObject<{
     health_check_interval_sec: z.ZodDefault<z.ZodNumber>;
     health_check_timeout_ms: z.ZodDefault<z.ZodNumber>;
     health_check_verify_tls: z.ZodDefault<z.ZodCoercedBoolean<unknown>>;
+    health_check_provider: z.ZodCatch<z.ZodEnum<{
+        local: "local";
+        cloudflare: "cloudflare";
+    }>>;
     created_at: z.ZodString;
     updated_at: z.ZodString;
 }, z.core.$strip>;
@@ -474,6 +541,10 @@ declare const serviceDomainBindingSchema: z.ZodPipe<z.ZodObject<{
     health_check_interval_sec: z.ZodDefault<z.ZodNumber>;
     health_check_timeout_ms: z.ZodDefault<z.ZodNumber>;
     health_check_verify_tls: z.ZodDefault<z.ZodCoercedBoolean<unknown>>;
+    health_check_provider: z.ZodCatch<z.ZodEnum<{
+        local: "local";
+        cloudflare: "cloudflare";
+    }>>;
     sync_status: z.ZodDefault<z.ZodNullable<z.ZodString>>;
 }, z.core.$strip>, z.ZodTransform<{
     target_ips: string[];
@@ -495,6 +566,7 @@ declare const serviceDomainBindingSchema: z.ZodPipe<z.ZodObject<{
     health_check_interval_sec: number;
     health_check_timeout_ms: number;
     health_check_verify_tls: boolean;
+    health_check_provider: "local" | "cloudflare";
     sync_status: string | null;
     target_ip?: string | null | undefined;
 }, {
@@ -513,6 +585,7 @@ declare const serviceDomainBindingSchema: z.ZodPipe<z.ZodObject<{
     health_check_interval_sec: number;
     health_check_timeout_ms: number;
     health_check_verify_tls: boolean;
+    health_check_provider: "local" | "cloudflare";
     sync_status: string | null;
     target_ips?: string[] | undefined;
     target_ip?: string | null | undefined;
@@ -566,6 +639,10 @@ declare const serviceViewSchema: z.ZodObject<{
         health_check_interval_sec: z.ZodDefault<z.ZodNumber>;
         health_check_timeout_ms: z.ZodDefault<z.ZodNumber>;
         health_check_verify_tls: z.ZodDefault<z.ZodCoercedBoolean<unknown>>;
+        health_check_provider: z.ZodCatch<z.ZodEnum<{
+            local: "local";
+            cloudflare: "cloudflare";
+        }>>;
         sync_status: z.ZodDefault<z.ZodNullable<z.ZodString>>;
     }, z.core.$strip>, z.ZodTransform<{
         target_ips: string[];
@@ -587,6 +664,7 @@ declare const serviceViewSchema: z.ZodObject<{
         health_check_interval_sec: number;
         health_check_timeout_ms: number;
         health_check_verify_tls: boolean;
+        health_check_provider: "local" | "cloudflare";
         sync_status: string | null;
         target_ip?: string | null | undefined;
     }, {
@@ -605,6 +683,7 @@ declare const serviceViewSchema: z.ZodObject<{
         health_check_interval_sec: number;
         health_check_timeout_ms: number;
         health_check_verify_tls: boolean;
+        health_check_provider: "local" | "cloudflare";
         sync_status: string | null;
         target_ips?: string[] | undefined;
         target_ip?: string | null | undefined;
@@ -619,6 +698,24 @@ declare const serviceViewSchema: z.ZodObject<{
         degraded: "degraded";
     }>>;
     health_latency_ms: z.ZodDefault<z.ZodNullable<z.ZodNumber>>;
+    ip_health: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        ip: z.ZodString;
+        status: z.ZodEnum<{
+            unknown: "unknown";
+            up: "up";
+            down: "down";
+            degraded: "degraded";
+        }>;
+        latency_ms: z.ZodNullable<z.ZodNumber>;
+        last_checked_at: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        last_error: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        provider: z.ZodOptional<z.ZodEnum<{
+            local: "local";
+            cloudflare: "cloudflare";
+        }>>;
+        colo: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, z.core.$strip>>>;
+    ip_enabled: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodBoolean>>;
 }, z.core.$strip>;
 declare const serviceGroupViewSchema: z.ZodObject<{
     id: z.ZodNumber;
@@ -651,6 +748,10 @@ declare const serviceGroupViewSchema: z.ZodObject<{
     health_check_interval_sec: z.ZodDefault<z.ZodNumber>;
     health_check_timeout_ms: z.ZodDefault<z.ZodNumber>;
     health_check_verify_tls: z.ZodDefault<z.ZodCoercedBoolean<unknown>>;
+    health_check_provider: z.ZodCatch<z.ZodEnum<{
+        local: "local";
+        cloudflare: "cloudflare";
+    }>>;
     created_at: z.ZodString;
     updated_at: z.ZodString;
     services: z.ZodDefault<z.ZodArray<z.ZodObject<{
@@ -699,6 +800,10 @@ declare const serviceGroupViewSchema: z.ZodObject<{
             health_check_interval_sec: z.ZodDefault<z.ZodNumber>;
             health_check_timeout_ms: z.ZodDefault<z.ZodNumber>;
             health_check_verify_tls: z.ZodDefault<z.ZodCoercedBoolean<unknown>>;
+            health_check_provider: z.ZodCatch<z.ZodEnum<{
+                local: "local";
+                cloudflare: "cloudflare";
+            }>>;
             sync_status: z.ZodDefault<z.ZodNullable<z.ZodString>>;
         }, z.core.$strip>, z.ZodTransform<{
             target_ips: string[];
@@ -720,6 +825,7 @@ declare const serviceGroupViewSchema: z.ZodObject<{
             health_check_interval_sec: number;
             health_check_timeout_ms: number;
             health_check_verify_tls: boolean;
+            health_check_provider: "local" | "cloudflare";
             sync_status: string | null;
             target_ip?: string | null | undefined;
         }, {
@@ -738,6 +844,7 @@ declare const serviceGroupViewSchema: z.ZodObject<{
             health_check_interval_sec: number;
             health_check_timeout_ms: number;
             health_check_verify_tls: boolean;
+            health_check_provider: "local" | "cloudflare";
             sync_status: string | null;
             target_ips?: string[] | undefined;
             target_ip?: string | null | undefined;
@@ -752,6 +859,24 @@ declare const serviceGroupViewSchema: z.ZodObject<{
             degraded: "degraded";
         }>>;
         health_latency_ms: z.ZodDefault<z.ZodNullable<z.ZodNumber>>;
+        ip_health: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            ip: z.ZodString;
+            status: z.ZodEnum<{
+                unknown: "unknown";
+                up: "up";
+                down: "down";
+                degraded: "degraded";
+            }>;
+            latency_ms: z.ZodNullable<z.ZodNumber>;
+            last_checked_at: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            last_error: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            provider: z.ZodOptional<z.ZodEnum<{
+                local: "local";
+                cloudflare: "cloudflare";
+            }>>;
+            colo: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        }, z.core.$strip>>>;
+        ip_enabled: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodBoolean>>;
     }, z.core.$strip>>>;
     health_status: z.ZodDefault<z.ZodEnum<{
         unknown: "unknown";
@@ -793,6 +918,10 @@ declare const serviceGroupsResponseSchema: z.ZodObject<{
         health_check_interval_sec: z.ZodDefault<z.ZodNumber>;
         health_check_timeout_ms: z.ZodDefault<z.ZodNumber>;
         health_check_verify_tls: z.ZodDefault<z.ZodCoercedBoolean<unknown>>;
+        health_check_provider: z.ZodCatch<z.ZodEnum<{
+            local: "local";
+            cloudflare: "cloudflare";
+        }>>;
         created_at: z.ZodString;
         updated_at: z.ZodString;
         services: z.ZodDefault<z.ZodArray<z.ZodObject<{
@@ -841,6 +970,10 @@ declare const serviceGroupsResponseSchema: z.ZodObject<{
                 health_check_interval_sec: z.ZodDefault<z.ZodNumber>;
                 health_check_timeout_ms: z.ZodDefault<z.ZodNumber>;
                 health_check_verify_tls: z.ZodDefault<z.ZodCoercedBoolean<unknown>>;
+                health_check_provider: z.ZodCatch<z.ZodEnum<{
+                    local: "local";
+                    cloudflare: "cloudflare";
+                }>>;
                 sync_status: z.ZodDefault<z.ZodNullable<z.ZodString>>;
             }, z.core.$strip>, z.ZodTransform<{
                 target_ips: string[];
@@ -862,6 +995,7 @@ declare const serviceGroupsResponseSchema: z.ZodObject<{
                 health_check_interval_sec: number;
                 health_check_timeout_ms: number;
                 health_check_verify_tls: boolean;
+                health_check_provider: "local" | "cloudflare";
                 sync_status: string | null;
                 target_ip?: string | null | undefined;
             }, {
@@ -880,6 +1014,7 @@ declare const serviceGroupsResponseSchema: z.ZodObject<{
                 health_check_interval_sec: number;
                 health_check_timeout_ms: number;
                 health_check_verify_tls: boolean;
+                health_check_provider: "local" | "cloudflare";
                 sync_status: string | null;
                 target_ips?: string[] | undefined;
                 target_ip?: string | null | undefined;
@@ -894,6 +1029,24 @@ declare const serviceGroupsResponseSchema: z.ZodObject<{
                 degraded: "degraded";
             }>>;
             health_latency_ms: z.ZodDefault<z.ZodNullable<z.ZodNumber>>;
+            ip_health: z.ZodDefault<z.ZodArray<z.ZodObject<{
+                ip: z.ZodString;
+                status: z.ZodEnum<{
+                    unknown: "unknown";
+                    up: "up";
+                    down: "down";
+                    degraded: "degraded";
+                }>;
+                latency_ms: z.ZodNullable<z.ZodNumber>;
+                last_checked_at: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+                last_error: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+                provider: z.ZodOptional<z.ZodEnum<{
+                    local: "local";
+                    cloudflare: "cloudflare";
+                }>>;
+                colo: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            }, z.core.$strip>>>;
+            ip_enabled: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodBoolean>>;
         }, z.core.$strip>>>;
         health_status: z.ZodDefault<z.ZodEnum<{
             unknown: "unknown";
@@ -949,6 +1102,10 @@ declare const serviceGroupsResponseSchema: z.ZodObject<{
             health_check_interval_sec: z.ZodDefault<z.ZodNumber>;
             health_check_timeout_ms: z.ZodDefault<z.ZodNumber>;
             health_check_verify_tls: z.ZodDefault<z.ZodCoercedBoolean<unknown>>;
+            health_check_provider: z.ZodCatch<z.ZodEnum<{
+                local: "local";
+                cloudflare: "cloudflare";
+            }>>;
             sync_status: z.ZodDefault<z.ZodNullable<z.ZodString>>;
         }, z.core.$strip>, z.ZodTransform<{
             target_ips: string[];
@@ -970,6 +1127,7 @@ declare const serviceGroupsResponseSchema: z.ZodObject<{
             health_check_interval_sec: number;
             health_check_timeout_ms: number;
             health_check_verify_tls: boolean;
+            health_check_provider: "local" | "cloudflare";
             sync_status: string | null;
             target_ip?: string | null | undefined;
         }, {
@@ -988,6 +1146,7 @@ declare const serviceGroupsResponseSchema: z.ZodObject<{
             health_check_interval_sec: number;
             health_check_timeout_ms: number;
             health_check_verify_tls: boolean;
+            health_check_provider: "local" | "cloudflare";
             sync_status: string | null;
             target_ips?: string[] | undefined;
             target_ip?: string | null | undefined;
@@ -1002,6 +1161,24 @@ declare const serviceGroupsResponseSchema: z.ZodObject<{
             degraded: "degraded";
         }>>;
         health_latency_ms: z.ZodDefault<z.ZodNullable<z.ZodNumber>>;
+        ip_health: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            ip: z.ZodString;
+            status: z.ZodEnum<{
+                unknown: "unknown";
+                up: "up";
+                down: "down";
+                degraded: "degraded";
+            }>;
+            latency_ms: z.ZodNullable<z.ZodNumber>;
+            last_checked_at: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            last_error: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            provider: z.ZodOptional<z.ZodEnum<{
+                local: "local";
+                cloudflare: "cloudflare";
+            }>>;
+            colo: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        }, z.core.$strip>>>;
+        ip_enabled: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodBoolean>>;
     }, z.core.$strip>>>;
 }, z.core.$strip>;
 declare const domainSchema: z.ZodObject<{
@@ -1203,6 +1380,10 @@ declare const healthCheckConfigSchema: z.ZodObject<{
     health_check_interval_sec: z.ZodOptional<z.ZodNumber>;
     health_check_timeout_ms: z.ZodOptional<z.ZodNumber>;
     health_check_verify_tls: z.ZodOptional<z.ZodBoolean>;
+    health_check_provider: z.ZodOptional<z.ZodEnum<{
+        local: "local";
+        cloudflare: "cloudflare";
+    }>>;
 }, z.core.$strip>;
 type HealthCheckConfig = z.infer<typeof healthCheckConfigSchema>;
 declare const createServiceSchema: z.ZodObject<{
@@ -1230,6 +1411,10 @@ declare const createServiceWithConfigSchema: z.ZodObject<{
         health_check_interval_sec: z.ZodOptional<z.ZodNumber>;
         health_check_timeout_ms: z.ZodOptional<z.ZodNumber>;
         health_check_verify_tls: z.ZodOptional<z.ZodBoolean>;
+        health_check_provider: z.ZodOptional<z.ZodEnum<{
+            local: "local";
+            cloudflare: "cloudflare";
+        }>>;
         fqdn: z.ZodString;
         target_ips: z.ZodOptional<z.ZodArray<z.ZodString>>;
         target_cname: z.ZodOptional<z.ZodString>;
@@ -1418,6 +1603,10 @@ declare const updateServiceConfigSchema: z.ZodObject<{
         health_check_interval_sec: z.ZodOptional<z.ZodNumber>;
         health_check_timeout_ms: z.ZodOptional<z.ZodNumber>;
         health_check_verify_tls: z.ZodOptional<z.ZodBoolean>;
+        health_check_provider: z.ZodOptional<z.ZodEnum<{
+            local: "local";
+            cloudflare: "cloudflare";
+        }>>;
         fqdn: z.ZodString;
         target_ips: z.ZodOptional<z.ZodArray<z.ZodString>>;
         target_cname: z.ZodOptional<z.ZodString>;
@@ -1445,6 +1634,10 @@ declare const createServiceGroupSchema: z.ZodObject<{
     health_check_interval_sec: z.ZodOptional<z.ZodNumber>;
     health_check_timeout_ms: z.ZodOptional<z.ZodNumber>;
     health_check_verify_tls: z.ZodOptional<z.ZodBoolean>;
+    health_check_provider: z.ZodOptional<z.ZodEnum<{
+        local: "local";
+        cloudflare: "cloudflare";
+    }>>;
     name: z.ZodString;
     type: z.ZodDefault<z.ZodEnum<{
         vpn: "vpn";
@@ -1475,6 +1668,10 @@ declare const updateServiceGroupSchema: z.ZodObject<{
     health_check_interval_sec: z.ZodOptional<z.ZodNumber>;
     health_check_timeout_ms: z.ZodOptional<z.ZodNumber>;
     health_check_verify_tls: z.ZodOptional<z.ZodBoolean>;
+    health_check_provider: z.ZodOptional<z.ZodEnum<{
+        local: "local";
+        cloudflare: "cloudflare";
+    }>>;
     name: z.ZodOptional<z.ZodString>;
     type: z.ZodOptional<z.ZodEnum<{
         vpn: "vpn";
@@ -1495,6 +1692,11 @@ type UpdateServiceGroupInput = z.infer<typeof updateServiceGroupSchema>;
 declare const toggleEnabledSchema: z.ZodObject<{
     enabled: z.ZodBoolean;
 }, z.core.$strip>;
+declare const toggleServiceIpSchema: z.ZodObject<{
+    ip: z.ZodString;
+    enabled: z.ZodBoolean;
+}, z.core.$strip>;
+type ToggleServiceIpInput = z.infer<typeof toggleServiceIpSchema>;
 declare const reorderServicesSchema: z.ZodObject<{
     group_id: z.ZodDefault<z.ZodOptional<z.ZodUnion<readonly [z.ZodNumber, z.ZodNull]>>>;
     service_ids: z.ZodArray<z.ZodNumber>;
@@ -1711,6 +1913,13 @@ declare const appSettingsPatchSchema: z.ZodObject<{
     vpsTrackerIntegrationToken: z.ZodOptional<z.ZodString>;
     vpsTrackerSyncEnabled: z.ZodOptional<z.ZodBoolean>;
     showQuickActions: z.ZodOptional<z.ZodBoolean>;
+    healthCheckCron: z.ZodOptional<z.ZodString>;
+    healthDegradedFailures: z.ZodOptional<z.ZodNumber>;
+    healthDownFailures: z.ZodOptional<z.ZodNumber>;
+    healthLatencyWarnMs: z.ZodOptional<z.ZodNumber>;
+    healthSuccessRecoveries: z.ZodOptional<z.ZodNumber>;
+    healthWorkerUrl: z.ZodOptional<z.ZodUnion<[z.ZodString, z.ZodLiteral<"">]>>;
+    healthWorkerToken: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 type AppSettingsPatch = z.infer<typeof appSettingsPatchSchema>;
 declare const vpsTrackerEventSchema: z.ZodObject<{
@@ -1835,4 +2044,4 @@ declare const ingestAuditEventSchema: z.ZodObject<{
 }, z.core.$strip>;
 type IngestAuditEvent = z.infer<typeof ingestAuditEventSchema>;
 
-export { AUDIT_SEVERITIES, AUDIT_SOURCE_APPS, AUDIT_TARGET_TYPES, type AppSettingsPatch, type AppSwitcherConfig, type AppSwitcherEntry, type AuditListQuery, type AuditLogEntry, type AuditSeverity, type AuditSourceApp, type AuditTargetType, type BulkUpdateDomainsInput, CERT_ERROR, CERT_EXPIRED, CERT_MONITORING_VALUES, CERT_MONITOR_AUTO, CERT_MONITOR_REQUIRED, CERT_MONITOR_SKIPPED, CERT_OK, CERT_UNKNOWN, CERT_WARNING, type CertMonitoring, type Certificate, type CfDnsRecord, type CfHealthCheck, type CfZone, type CfdmBindingSyncItem, type ChangeDomainInput, type ChangeIpInput, type CreateDnsRecordInput, type CreateDnsRecordPayload, type CreateDomainInput, type CreateDomainMonitorInput, type CreateGroupInput, type CreateOriginHealthCheckInput, type CreateServiceBindingInput, type CreateServiceGroupInput, type CreateServiceInput, type CreateServiceNodeInput, type CreateServiceWithConfigInput, type CreateSubdomainInput, type DnsRecord, type Domain, type DomainEnvironment, type DomainListItem, type DomainMonitor, type DomainMonitorResult, type DomainMonitorType, type Group, type GroupWithStats, type HealthCheckConfig, type HealthCheckProvider, type HealthCheckScope, type HealthCheckTarget, type HealthCheckType, type HealthStatusQuery, type IngestAuditEvent, type IpHealthState, type IpHealthStatus, type JwtClaims, type LbMode, type LoginInput, type LoginRequest, type LoginResponse, type NodeHealthState, type NotificationLog, type OriginHealthCheck, type OriginHealthCheckRecord, type ParsedFqdn, type PatchDnsRecordPayload, type ReorderServicesInput, SYNC_CONFLICT, SYNC_ERROR, SYNC_PENDING_DELETE, SYNC_PENDING_PUSH, SYNC_SYNCED, type Service, type ServiceBinding, type ServiceBindingView, type ServiceDomainBinding, type ServiceDomainBindingView, type ServiceGroup, type ServiceGroupView, type ServiceGroupsResponse, type ServiceNode, type ServiceNodeRecord, type ServiceOverview, type ServiceView, type Subdomain, type SubdomainRecord, type SyncJob, type ToggleEnabledInput, type UpdateDomainInput, type UpdateServiceConfigInput, type UpdateServiceGroupInput, type UpdateServiceNodeInput, type UpdateSubdomainInput, ValidationError, type VpsTrackerEvent, appSettingsPatchSchema, appSwitcherConfigSchema, appSwitcherEntrySchema, appSwitcherIconSchema, auditListQuerySchema, auditLogEntrySchema, auditSeveritySchema, auditSourceAppSchema, auditTargetTypeSchema, bindingToFqdn, bulkUpdateDomainsSchema, certMonitoringSchema, certStatusFromExpiry, certificateSchema, cfdmBindingSyncItemSchema, cfdmSyncBindingsBodySchema, changeDomainSchema, changeIpSchema, createDnsRecordSchema, createDomainMonitorSchema, createDomainSchema, createGroupSchema, createOriginHealthCheckSchema, createServiceBindingSchema, createServiceGroupSchema, createServiceNodeSchema, createServiceSchema, createServiceWithConfigSchema, createSubdomainSchema, dnsNameToSubdomainLabel, dnsRecordNamesMatch, dnsRecordSchema, domainEnvironmentSchema, domainListItemSchema, domainMonitorResultSchema, domainMonitorSchema, domainMonitorTypeSchema, domainSchema, fqdnToDisplay, groupSchema, groupWithStatsSchema, healthCheckConfigSchema, healthCheckProviderSchema, healthCheckScopeSchema, healthCheckTypeSchema, healthStatusQuerySchema, ingestAuditEventSchema, ipHealthStateSchema, ipHealthStatusSchema, isIpLiteral, isValidIpv4, lbModeSchema, loginSchema, nodeHealthStateSchema, normalizeDnsRecordName, notificationLogSchema, originHealthCheckSchema, parseFqdn, reorderServicesSchema, serviceBindingSchema, serviceDomainBindingSchema, serviceGroupSchema, serviceGroupTypeSchema, serviceGroupViewSchema, serviceGroupsResponseSchema, serviceNodeSchema, serviceSchema, serviceViewSchema, shouldMonitorService, subdomainLabelToFqdn, subdomainSchema, toggleEnabledSchema, updateDomainGroupSchema, updateDomainSchema, updateServiceConfigSchema, updateServiceGroupSchema, updateServiceNodeSchema, updateSubdomainSchema, validateDnsRecord, vpsTrackerEventSchema };
+export { AUDIT_SEVERITIES, AUDIT_SOURCE_APPS, AUDIT_TARGET_TYPES, type AppSettingsPatch, type AppSwitcherConfig, type AppSwitcherEntry, type AuditListQuery, type AuditLogEntry, type AuditSeverity, type AuditSourceApp, type AuditTargetType, type BulkUpdateDomainsInput, CERT_ERROR, CERT_EXPIRED, CERT_MONITORING_VALUES, CERT_MONITOR_AUTO, CERT_MONITOR_REQUIRED, CERT_MONITOR_SKIPPED, CERT_OK, CERT_UNKNOWN, CERT_WARNING, type CertMonitoring, type Certificate, type CfDnsRecord, type CfHealthCheck, type CfZone, type CfdmBindingSyncItem, type ChangeDomainInput, type ChangeIpInput, type CreateDnsRecordInput, type CreateDnsRecordPayload, type CreateDomainInput, type CreateDomainMonitorInput, type CreateGroupInput, type CreateOriginHealthCheckInput, type CreateServiceBindingInput, type CreateServiceGroupInput, type CreateServiceInput, type CreateServiceNodeInput, type CreateServiceWithConfigInput, type CreateSubdomainInput, type DnsRecord, type Domain, type DomainEnvironment, type DomainListItem, type DomainMonitor, type DomainMonitorResult, type DomainMonitorType, type Group, type GroupWithStats, type HealthCheckConfig, type HealthCheckProvider, type HealthCheckScope, type HealthCheckTarget, type HealthCheckType, type HealthProbeLog, type HealthStatusQuery, type IngestAuditEvent, type IpHealthState, type IpHealthStatus, type JwtClaims, type LbMode, type LoginInput, type LoginRequest, type LoginResponse, type NodeHealthState, type NotificationLog, type OriginHealthCheck, type OriginHealthCheckRecord, type ParsedFqdn, type PatchDnsRecordPayload, type ReorderServicesInput, SYNC_CONFLICT, SYNC_ERROR, SYNC_PENDING_DELETE, SYNC_PENDING_PUSH, SYNC_SYNCED, type Service, type ServiceBinding, type ServiceBindingView, type ServiceDomainBinding, type ServiceDomainBindingView, type ServiceGroup, type ServiceGroupView, type ServiceGroupsResponse, type ServiceIpHealth, type ServiceNode, type ServiceNodeRecord, type ServiceOverview, type ServiceView, type Subdomain, type SubdomainRecord, type SyncJob, type ToggleEnabledInput, type ToggleServiceIpInput, type UpdateDomainInput, type UpdateServiceConfigInput, type UpdateServiceGroupInput, type UpdateServiceNodeInput, type UpdateSubdomainInput, ValidationError, type VpsTrackerEvent, appSettingsPatchSchema, appSwitcherConfigSchema, appSwitcherEntrySchema, appSwitcherIconSchema, auditListQuerySchema, auditLogEntrySchema, auditSeveritySchema, auditSourceAppSchema, auditTargetTypeSchema, bindingToFqdn, bulkUpdateDomainsSchema, certMonitoringSchema, certStatusFromExpiry, certificateSchema, cfdmBindingSyncItemSchema, cfdmSyncBindingsBodySchema, changeDomainSchema, changeIpSchema, createDnsRecordSchema, createDomainMonitorSchema, createDomainSchema, createGroupSchema, createOriginHealthCheckSchema, createServiceBindingSchema, createServiceGroupSchema, createServiceNodeSchema, createServiceSchema, createServiceWithConfigSchema, createSubdomainSchema, dnsNameToSubdomainLabel, dnsRecordNamesMatch, dnsRecordSchema, domainEnvironmentSchema, domainListItemSchema, domainMonitorResultSchema, domainMonitorSchema, domainMonitorTypeSchema, domainSchema, fqdnToDisplay, groupSchema, groupWithStatsSchema, healthCheckConfigSchema, healthCheckProviderSchema, healthCheckScopeSchema, healthCheckTypeSchema, healthProbeLogSchema, healthStatusQuerySchema, ingestAuditEventSchema, ipHealthStateSchema, ipHealthStatusSchema, isIpLiteral, isValidIpv4, lbModeSchema, loginSchema, nodeHealthStateSchema, normalizeDnsRecordName, notificationLogSchema, originHealthCheckSchema, parseFqdn, reorderServicesSchema, serviceBindingSchema, serviceDomainBindingSchema, serviceGroupSchema, serviceGroupTypeSchema, serviceGroupViewSchema, serviceGroupsResponseSchema, serviceIpHealthSchema, serviceNodeSchema, serviceSchema, serviceViewSchema, shouldMonitorService, subdomainLabelToFqdn, subdomainSchema, toggleEnabledSchema, toggleServiceIpSchema, updateDomainGroupSchema, updateDomainSchema, updateServiceConfigSchema, updateServiceGroupSchema, updateServiceNodeSchema, updateSubdomainSchema, validateDnsRecord, vpsTrackerEventSchema };

packages/shared/dist/index.js

@@ -190,7 +190,31 @@ var ipHealthStatusSchema = z.object({
   consecutive_failures: z.number(),
   consecutive_successes: z.number().optional().default(0),
   last_checked_at: z.string().nullable(),
-  last_error: z.string().nullable()
+  last_error: z.string().nullable(),
+  colo: z.string().nullable().optional(),
+  provider: healthCheckProviderSchema.optional()
+});
+var serviceIpHealthSchema = z.object({
+  ip: z.string(),
+  status: ipHealthStateSchema,
+  latency_ms: z.number().nullable(),
+  last_checked_at: z.string().nullable().optional(),
+  last_error: z.string().nullable().optional(),
+  provider: healthCheckProviderSchema.optional(),
+  colo: z.string().nullable().optional()
+});
+var healthProbeLogSchema = z.object({
+  id: z.number(),
+  scope: z.string(),
+  ref_id: z.number(),
+  ip: z.string(),
+  provider: healthCheckProviderSchema,
+  status: ipHealthStateSchema,
+  ok: z.coerce.boolean(),
+  latency_ms: z.number().nullable(),
+  colo: z.string().nullable(),
+  error: z.string().nullable(),
+  checked_at: z.string()
 });
 var groupSchema = z.object({
   id: z.number(),
@@ -225,6 +249,7 @@ var serviceGroupSchema = z.object({
   health_check_interval_sec: z.number().default(30),
   health_check_timeout_ms: z.number().default(3e3),
   health_check_verify_tls: z.coerce.boolean().default(false),
+  health_check_provider: healthCheckProviderSchema.catch("local"),
   created_at: z.string(),
   updated_at: z.string()
 });
@@ -262,6 +287,7 @@ var serviceDomainBindingSchema = z.object({
   health_check_interval_sec: z.number().default(30),
   health_check_timeout_ms: z.number().default(3e3),
   health_check_verify_tls: z.coerce.boolean().default(false),
+  health_check_provider: healthCheckProviderSchema.catch("local"),
   sync_status: z.string().nullable().default(null)
 }).transform((binding) => ({
   ...binding,
@@ -277,7 +303,9 @@ var serviceViewSchema = serviceSchema.extend({
   ips: z.array(z.string()).default([]),
   domains: z.array(serviceDomainBindingSchema).default([]),
   health_status: ipHealthStateSchema.default("unknown"),
-  health_latency_ms: z.number().nullable().default(null)
+  health_latency_ms: z.number().nullable().default(null),
+  ip_health: z.array(serviceIpHealthSchema).default([]),
+  ip_enabled: z.record(z.string(), z.boolean()).default({})
 });
 var serviceGroupViewSchema = serviceGroupSchema.extend({
   services: z.array(serviceViewSchema).default([]),
@@ -385,7 +413,8 @@ var healthCheckConfigFields = {
   health_check_expected_status: z.number().int().min(100).max(599).nullable().optional(),
   health_check_interval_sec: z.number().int().min(5).max(3600).optional(),
   health_check_timeout_ms: z.number().int().min(100).max(3e4).optional(),
-  health_check_verify_tls: z.boolean().optional()
+  health_check_verify_tls: z.boolean().optional(),
+  health_check_provider: healthCheckProviderSchema.optional()
 };
 var healthCheckConfigSchema = z.object(healthCheckConfigFields);
 var serviceDomainInputSchema = z.object({
@@ -552,6 +581,10 @@ var updateServiceGroupSchema = z.object({
 var toggleEnabledSchema = z.object({
   enabled: z.boolean()
 });
+var toggleServiceIpSchema = z.object({
+  ip: ipv4Schema,
+  enabled: z.boolean()
+});
 var reorderServicesSchema = z.object({
   group_id: z.union([z.number(), z.null()]).optional().default(null),
   service_ids: z.array(z.number().int().positive()).min(1)
@@ -687,7 +720,22 @@ var appSettingsPatchSchema = z3.object({
   vpsTrackerUrl: z3.string().url().or(z3.literal("")).optional(),
   vpsTrackerIntegrationToken: z3.string().optional(),
   vpsTrackerSyncEnabled: z3.boolean().optional(),
-  showQuickActions: z3.boolean().optional()
+  showQuickActions: z3.boolean().optional(),
+  healthCheckCron: z3.string().trim().min(1).max(64).optional(),
+  healthDegradedFailures: z3.number().int().min(1).max(20).optional(),
+  healthDownFailures: z3.number().int().min(1).max(50).optional(),
+  healthLatencyWarnMs: z3.number().int().min(50).max(6e4).optional(),
+  healthSuccessRecoveries: z3.number().int().min(1).max(20).optional(),
+  healthWorkerUrl: z3.string().url().or(z3.literal("")).optional(),
+  healthWorkerToken: z3.string().optional()
+}).superRefine((data, ctx) => {
+  if (data.healthDegradedFailures != null && data.healthDownFailures != null && data.healthDownFailures < data.healthDegradedFailures) {
+    ctx.addIssue({
+      code: "custom",
+      message: "\u043E\u0448\u0438\u0431\u043E\u043A \u0434\u043E down \u043D\u0435 \u043C\u0435\u043D\u044C\u0448\u0435, \u0447\u0435\u043C \u0434\u043E degraded",
+      path: ["healthDownFailures"]
+    });
+  }
 });
 var vpsTrackerEventSchema = z3.object({
   event: z3.enum(["vps_down", "vps_up"]),
@@ -823,6 +871,7 @@ export {
   healthCheckProviderSchema,
   healthCheckScopeSchema,
   healthCheckTypeSchema,
+  healthProbeLogSchema,
   healthStatusQuerySchema,
   ingestAuditEventSchema,
   ipHealthStateSchema,
@@ -843,6 +892,7 @@ export {
   serviceGroupTypeSchema,
   serviceGroupViewSchema,
   serviceGroupsResponseSchema,
+  serviceIpHealthSchema,
   serviceNodeSchema,
   serviceSchema,
   serviceViewSchema,
@@ -850,6 +900,7 @@ export {
   subdomainLabelToFqdn,
   subdomainSchema,
   toggleEnabledSchema,
+  toggleServiceIpSchema,
   updateDomainGroupSchema,
   updateDomainSchema,
   updateServiceConfigSchema,

packages/shared/src/integration-vps-tracker.ts

@@ -30,6 +30,25 @@ export const appSettingsPatchSchema = z.object({
   vpsTrackerIntegrationToken: z.string().optional(),
   vpsTrackerSyncEnabled: z.boolean().optional(),
   showQuickActions: z.boolean().optional(),
+  healthCheckCron: z.string().trim().min(1).max(64).optional(),
+  healthDegradedFailures: z.number().int().min(1).max(20).optional(),
+  healthDownFailures: z.number().int().min(1).max(50).optional(),
+  healthLatencyWarnMs: z.number().int().min(50).max(60_000).optional(),
+  healthSuccessRecoveries: z.number().int().min(1).max(20).optional(),
+  healthWorkerUrl: z.string().url().or(z.literal("")).optional(),
+  healthWorkerToken: z.string().optional(),
+}).superRefine((data, ctx) => {
+  if (
+    data.healthDegradedFailures != null &&
+    data.healthDownFailures != null &&
+    data.healthDownFailures < data.healthDegradedFailures
+  ) {
+    ctx.addIssue({
+      code: "custom",
+      message: "ошибок до down не меньше, чем до degraded",
+      path: ["healthDownFailures"],
+    });
+  }
 });
 
 export type AppSettingsPatch = z.infer<typeof appSettingsPatchSchema>;

packages/shared/src/schemas.ts

@@ -45,10 +45,40 @@ export const ipHealthStatusSchema = z.object({
   consecutive_successes: z.number().optional().default(0),
   last_checked_at: z.string().nullable(),
   last_error: z.string().nullable(),
+  colo: z.string().nullable().optional(),
+  provider: healthCheckProviderSchema.optional(),
 })
 
 export type IpHealthStatus = z.infer<typeof ipHealthStatusSchema>
 
+export const serviceIpHealthSchema = z.object({
+  ip: z.string(),
+  status: ipHealthStateSchema,
+  latency_ms: z.number().nullable(),
+  last_checked_at: z.string().nullable().optional(),
+  last_error: z.string().nullable().optional(),
+  provider: healthCheckProviderSchema.optional(),
+  colo: z.string().nullable().optional(),
+})
+
+export type ServiceIpHealth = z.infer<typeof serviceIpHealthSchema>
+
+export const healthProbeLogSchema = z.object({
+  id: z.number(),
+  scope: z.string(),
+  ref_id: z.number(),
+  ip: z.string(),
+  provider: healthCheckProviderSchema,
+  status: ipHealthStateSchema,
+  ok: z.coerce.boolean(),
+  latency_ms: z.number().nullable(),
+  colo: z.string().nullable(),
+  error: z.string().nullable(),
+  checked_at: z.string(),
+})
+
+export type HealthProbeLog = z.infer<typeof healthProbeLogSchema>
+
 export const groupSchema = z.object({
   id: z.number(),
   name: z.string(),
@@ -85,6 +115,7 @@ export const serviceGroupSchema = z.object({
   health_check_interval_sec: z.number().default(30),
   health_check_timeout_ms: z.number().default(3000),
   health_check_verify_tls: z.coerce.boolean().default(false),
+  health_check_provider: healthCheckProviderSchema.catch('local'),
   created_at: z.string(),
   updated_at: z.string(),
 })
@@ -125,6 +156,7 @@ export const serviceDomainBindingSchema = z
     health_check_interval_sec: z.number().default(30),
     health_check_timeout_ms: z.number().default(3000),
     health_check_verify_tls: z.coerce.boolean().default(false),
+    health_check_provider: healthCheckProviderSchema.catch('local'),
     sync_status: z.string().nullable().default(null),
   })
   .transform((binding) => ({
@@ -150,6 +182,8 @@ export const serviceViewSchema = serviceSchema.extend({
   domains: z.array(serviceDomainBindingSchema).default([]),
   health_status: ipHealthStateSchema.default('unknown'),
   health_latency_ms: z.number().nullable().default(null),
+  ip_health: z.array(serviceIpHealthSchema).default([]),
+  ip_enabled: z.record(z.string(), z.boolean()).default({}),
 })
 
 export const serviceGroupViewSchema = serviceGroupSchema.extend({
@@ -294,6 +328,7 @@ const healthCheckConfigFields = {
   health_check_interval_sec: z.number().int().min(5).max(3600).optional(),
   health_check_timeout_ms: z.number().int().min(100).max(30000).optional(),
   health_check_verify_tls: z.boolean().optional(),
+  health_check_provider: healthCheckProviderSchema.optional(),
 }
 
 export const healthCheckConfigSchema = z.object(healthCheckConfigFields)
@@ -512,6 +547,13 @@ export const toggleEnabledSchema = z.object({
   enabled: z.boolean(),
 })
 
+export const toggleServiceIpSchema = z.object({
+  ip: ipv4Schema,
+  enabled: z.boolean(),
+})
+
+export type ToggleServiceIpInput = z.infer<typeof toggleServiceIpSchema>
+
 export const reorderServicesSchema = z.object({
   group_id: z.union([z.number(), z.null()]).optional().default(null),
   service_ids: z.array(z.number().int().positive()).min(1),

packages/shared/src/types.ts

@@ -22,6 +22,7 @@ export interface ServiceGroup {
   health_check_interval_sec: number;
   health_check_timeout_ms: number;
   health_check_verify_tls: boolean;
+  health_check_provider: HealthCheckProvider;
   created_at: string;
   updated_at: string;
 }
@@ -121,6 +122,7 @@ export interface ServiceBinding {
   health_check_interval_sec: number;
   health_check_timeout_ms: number;
   health_check_verify_tls: boolean;
+  health_check_provider: HealthCheckProvider;
   routing_strategy: LbMode;
   operation_version: number;
   created_at: string;
@@ -152,6 +154,7 @@ export interface ServiceBindingView {
   health_check_interval_sec: number;
   health_check_timeout_ms: number;
   health_check_verify_tls: boolean;
+  health_check_provider: HealthCheckProvider;
   sync_status: string | null;
   created_at: string;
   updated_at: string;
@@ -177,6 +180,7 @@ export interface ServiceDomainBindingView {
   health_check_interval_sec: number;
   health_check_timeout_ms: number;
   health_check_verify_tls: boolean;
+  health_check_provider: HealthCheckProvider;
   sync_status: string | null;
 }
 
@@ -196,6 +200,8 @@ export interface ServiceView {
   domains: ServiceDomainBindingView[];
   health_status: IpHealthState;
   health_latency_ms: number | null;
+  ip_health: ServiceIpHealth[];
+  ip_enabled: Record<string, boolean>;
 }
 
 export interface GroupWithStats extends Group {
@@ -291,6 +297,18 @@ export interface IpHealthStatus {
   consecutive_successes?: number;
   last_checked_at: string | null;
   last_error: string | null;
+  colo?: string | null;
+  provider?: HealthCheckProvider;
+}
+
+export interface ServiceIpHealth {
+  ip: string;
+  status: IpHealthState;
+  latency_ms: number | null;
+  last_checked_at?: string | null;
+  last_error?: string | null;
+  provider?: HealthCheckProvider;
+  colo?: string | null;
 }
 
 export interface ServiceNode {
@@ -374,4 +392,5 @@ export interface HealthCheckTarget {
   expected_status: number | null;
   timeout_ms: number;
   verify_tls: boolean;
+  provider: HealthCheckProvider;
 }

workers/health-probe/README.md

@@ -0,0 +1,37 @@
+# CFDM health-probe Worker
+
+Stateless edge probe for CFDM. **Not** Cloudflare Health Checks API (unavailable on Free).
+Cron stays in CFDM — this Worker has no Cron Trigger.
+
+## Deploy
+
+```powershell
+cd workers/health-probe
+npx wrangler login
+npx wrangler secret put PROBE_TOKEN
+npx wrangler deploy
+```
+
+Paste the Worker URL (`https://cfdm-health-probe.<account>.workers.dev`) and the same token into **Настройки → Health-check**.
+
+Free Workers ≈ 100k requests/day. CFDM cron every 2 minutes × number of IPs must fit.
+
+## API
+
+`POST /probe` + `Authorization: Bearer <PROBE_TOKEN>`
+
+```json
+{
+  "type": "tcp",
+  "ip": "1.2.3.4",
+  "hostname": "app.example.com",
+  "port": 443,
+  "path": "/",
+  "expected_status": 200,
+  "timeout_ms": 3000,
+  "verify_tls": true,
+  "method": "GET"
+}
+```
+
+Response: `{ "ok": true, "latencyMs": 42, "error": null, "colo": "AMS" }`.

workers/health-probe/package.json

@@ -0,0 +1,11 @@
+{
+  "name": "cfdm-health-probe",
+  "private": true,
+  "scripts": {
+    "dev": "wrangler dev",
+    "deploy": "wrangler deploy"
+  },
+  "devDependencies": {
+    "wrangler": "^4.20.0"
+  }
+}

workers/health-probe/src/index.ts

@@ -0,0 +1,181 @@
+/**
+ * Stateless CFDM health probe. Cron lives in CFDM API — this Worker only
+ * answers POST /probe. Deploy: wrangler deploy; paste URL + token into
+ * Настройки → Health-check.
+ */
+
+export interface Env {
+  PROBE_TOKEN: string;
+}
+
+type ProbeType = "tcp" | "http";
+
+interface ProbeRequest {
+  type?: ProbeType;
+  ip?: string;
+  hostname?: string;
+  port?: number;
+  path?: string;
+  expected_status?: number | null;
+  timeout_ms?: number;
+  verify_tls?: boolean;
+  method?: string;
+}
+
+interface ProbeResponse {
+  ok: boolean;
+  latencyMs: number;
+  error: string | null;
+  colo: string | null;
+}
+
+export default {
+  async fetch(request: Request, env: Env): Promise<Response> {
+    const colo =
+      (request as Request & { cf?: { colo?: string } }).cf?.colo ?? null;
+    if (request.method !== "POST") {
+      return json({ ok: false, latencyMs: 0, error: "method not allowed", colo }, 405);
+    }
+    const pathname = new URL(request.url).pathname.replace(/\/$/, "") || "/";
+    if (pathname !== "/probe") {
+      return json({ ok: false, latencyMs: 0, error: "not found", colo }, 404);
+    }
+    const token = bearer(request);
+    if (!env.PROBE_TOKEN || token !== env.PROBE_TOKEN) {
+      return json({ ok: false, latencyMs: 0, error: "unauthorized", colo }, 401);
+    }
+
+    let body: ProbeRequest;
+    try {
+      body = (await request.json()) as ProbeRequest;
+    } catch {
+      return json({ ok: false, latencyMs: 0, error: "invalid json", colo }, 400);
+    }
+
+    const ip = String(body.ip ?? "").trim();
+    if (!ip) {
+      return json({ ok: false, latencyMs: 0, error: "ip required", colo }, 400);
+    }
+    const type: ProbeType = body.type === "http" ? "http" : "tcp";
+    const port = Number(body.port) || (type === "http" ? 80 : 80);
+    const timeoutMs = Math.min(Math.max(Number(body.timeout_ms) || 3000, 100), 25_000);
+    const hostname = String(body.hostname ?? "").trim() || ip;
+
+    try {
+      const result =
+        type === "http"
+          ? await httpProbe({
+              ip,
+              hostname,
+              port,
+              path: body.path || "/",
+              expectedStatus: body.expected_status ?? 200,
+              timeoutMs,
+              verifyTls: Boolean(body.verify_tls),
+              method: (body.method || "GET").toUpperCase(),
+            })
+          : await tcpProbe(ip, port, timeoutMs);
+      return json({ ...result, colo });
+    } catch (err) {
+      const message = err instanceof Error ? err.message : "probe failed";
+      return json({ ok: false, latencyMs: 0, error: message, colo });
+    }
+  },
+};
+
+function bearer(request: Request): string {
+  const header = request.headers.get("Authorization") ?? "";
+  return header.startsWith("Bearer ") ? header.slice(7) : "";
+}
+
+function json(body: ProbeResponse, status = 200): Response {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "content-type": "application/json" },
+  });
+}
+
+function withTimeout<T>(promise: Promise<T>, timeoutMs: number, label: string): Promise<T> {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => reject(new Error(`${label} timeout`)), timeoutMs);
+    promise.then(
+      (value) => {
+        clearTimeout(timer);
+        resolve(value);
+      },
+      (err) => {
+        clearTimeout(timer);
+        reject(err);
+      },
+    );
+  });
+}
+
+async function tcpProbe(
+  ip: string,
+  port: number,
+  timeoutMs: number,
+): Promise<Omit<ProbeResponse, "colo">> {
+  const started = Date.now();
+  const { connect } = await import("cloudflare:sockets");
+  const socket = connect({ hostname: ip, port });
+  try {
+    await withTimeout(socket.opened, timeoutMs, "tcp");
+    return { ok: true, latencyMs: Date.now() - started, error: null };
+  } catch (err) {
+    const message = err instanceof Error ? err.message : "tcp failed";
+    return { ok: false, latencyMs: Date.now() - started, error: message };
+  } finally {
+    try {
+      socket.close();
+    } catch {
+      // ignore
+    }
+  }
+}
+
+async function httpProbe(opts: {
+  ip: string;
+  hostname: string;
+  port: number;
+  path: string;
+  expectedStatus: number;
+  timeoutMs: number;
+  verifyTls: boolean;
+  method: string;
+}): Promise<Omit<ProbeResponse, "colo">> {
+  const started = Date.now();
+  const useTls = opts.verifyTls || opts.port === 443;
+  const host = opts.ip.includes(":") ? `[${opts.ip}]` : opts.ip;
+  const path = opts.path.startsWith("/") ? opts.path : `/${opts.path}`;
+  const url = `${useTls ? "https" : "http"}://${host}:${opts.port}${path}`;
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), opts.timeoutMs);
+  try {
+    const res = await fetch(url, {
+      method: opts.method === "HEAD" ? "HEAD" : "GET",
+      headers: { Host: opts.hostname },
+      signal: controller.signal,
+      redirect: "manual",
+    });
+    const latencyMs = Date.now() - started;
+    if (res.status !== opts.expectedStatus) {
+      return {
+        ok: false,
+        latencyMs,
+        error: `HTTP ${res.status} (ожидали ${opts.expectedStatus})`,
+      };
+    }
+    return { ok: true, latencyMs, error: null };
+  } catch (err) {
+    const message =
+      err instanceof Error
+        ? err.name === "AbortError"
+          ? "http timeout"
+          : err.message
+        : "http failed";
+    return { ok: false, latencyMs: Date.now() - started, error: message };
+  } finally {
+    clearTimeout(timer);
+  }
+}

workers/health-probe/wrangler.toml

@@ -0,0 +1,6 @@
+name = "cfdm-health-probe"
+main = "src/index.ts"
+compatibility_date = "2025-04-01"
+
+# Set the shared secret: wrangler secret put PROBE_TOKEN
+# Then paste the Worker URL + token into CFDM → Настройки → Health-check.