From 9b563baaa14131338f6ab8c0784b8e4b965557cc Mon Sep 17 00:00:00 2001
From: Debian <linux@myhorse.netcell-it.de>
Date: Sun, 7 Jun 2026 19:07:24 +0200
Subject: [PATCH] =?UTF-8?q?fix(cluster):=20keepalived=20Track-Scripts=20oh?=
 =?UTF-8?q?ne=20weight=20(Sync-Group)=20=E2=80=94=20v1.2.105?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`keepalived -t` zeigte "ignoring tracked script chk_edgeguard/chk_gateway with
weights due to SYNC group": gewichtete Track-Scripts werden in einer
vrrp_sync_group ignoriert → Health-Check-Failover (Gateway weg / API tot) griff
NICHT. Fix: weight entfernt → Scripts wirken als binäre FAULT-Trigger (fall-mal
Fehler → Instanz+Sync-Group FAULT → gesunder Peer übernimmt). Für 2-Node-Cluster
die korrekte Semantik.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 VERSION                                 |  2 +-
 internal/keepalived/keepalived.conf.tpl |  8 ++++++--
 internal/keepalived/keepalived_test.go  | 10 ++++++++++
 3 files changed, 17 insertions(+), 3 deletions(-)

diff --git a/VERSION b/VERSION
index 9c6884d..f69a1d4 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1.2.104
\ No newline at end of file
+1.2.105
\ No newline at end of file
diff --git a/internal/keepalived/keepalived.conf.tpl b/internal/keepalived/keepalived.conf.tpl
index 5bb7ca5..2c71728 100644
--- a/internal/keepalived/keepalived.conf.tpl
+++ b/internal/keepalived/keepalived.conf.tpl
@@ -11,10 +11,15 @@ global_defs {
     vrrp_garp_master_refresh 60
 }
 
+{{/* KEIN weight: in einer vrrp_sync_group ignoriert keepalived gewichtete
+     Track-Scripts ("ignoring tracked script ... with weights due to SYNC
+     group") → die Health-Checks wären wirkungslos. Ohne weight wirken sie
+     als binäre FAULT-Trigger: schlägt ein Check fall-mal in Folge fehl,
+     geht die Instanz (und via Sync-Group der ganze Node) in FAULT → der
+     gesunde Peer übernimmt. Für einen 2-Node-Cluster die saubere Semantik. */}}
 vrrp_script chk_edgeguard {
     script "/usr/lib/edgeguard/keepalived-check.sh"
     interval 2
-    weight -50
     fall 3
     rise 2
 }
@@ -22,7 +27,6 @@ vrrp_script chk_edgeguard {
 vrrp_script chk_gateway {
     script "/usr/lib/edgeguard/keepalived-gw-check.sh {{ .GWCheckIP }}"
     interval 5
-    weight -110
     fall 5
     rise 2
 }
diff --git a/internal/keepalived/keepalived_test.go b/internal/keepalived/keepalived_test.go
index f7a1f3a..70441a7 100644
--- a/internal/keepalived/keepalived_test.go
+++ b/internal/keepalived/keepalived_test.go
@@ -54,6 +54,16 @@ func TestTemplateGARPRefresh(t *testing.T) {
 	}
 }
 
+// Track-Scripts dürfen KEIN weight haben: in einer vrrp_sync_group ignoriert
+// keepalived gewichtete Scripts → Health-Checks wären wirkungslos. Ohne weight
+// wirken sie als FAULT-Trigger.
+func TestTemplateTrackScriptsUnweighted(t *testing.T) {
+	out := render(t, testView())
+	if strings.Contains(out, "weight") {
+		t.Fatalf("Track-Scripts dürfen kein weight tragen (Sync-Group ignoriert sie sonst):\n%s", out)
+	}
+}
+
 // gw-Check darf nicht zu zucken (fall 5, nicht fall 2) — ein kurzer Upstream-
 // Blip soll keinen Failover erzwingen.
 func TestTemplateGatewayCheckNotTwitchy(t *testing.T) {