projekte/edgeguard-native
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(cluster): startup peer-sync + stable primary-ID in ha_nodes

Browse Source 
On API restart, cluster nodes now re-register their primary in the local
ha_nodes and reload nftables so @peer_ipv4 is correct after a package
update or reboot without requiring a re-join.

Also fixes duplicate ha_nodes rows: preRegisterPrimary previously used
time.Now().UnixNano() as node ID, creating a fresh row each call.
Now uses a deterministic ID derived from the FQDN so repeated upserts
are idempotent.

PrimaryFQDN is now persisted in setup.json during CompleteAsNode so the
startup sync knows which primary to contact.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Debian
2026-05-29 17:45:26 +02:00
parent 8ac066d99a
commit de28523708
6 changed files with 42 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
internal/handlers/setup.go
View File

@@ -191,8 +191,9 @@ func (h *SetupHandler) JoinCluster(c *gin.Context) {
}
st, err := h.Store.CompleteAsNode(setup.NodeRequest{
FQDN: fqdn,
ACMEEmail: body.ACMEEmail,
FQDN: fqdn,
ACMEEmail: body.ACMEEmail,
PrimaryFQDN: strings.ToLower(strings.TrimSpace(body.PrimaryFQDN)),
})
if err != nil {
response.Internal(c, err)
@@ -212,8 +213,24 @@ func (h *SetupHandler) JoinCluster(c *gin.Context) {
})
}
// StartupPeerSync is called once after the DB pool and ClusterStore are
// ready. On cluster nodes it re-registers the primary in the local ha_nodes
// and reloads nftables so @peer_ipv4 is correct after a package update or
// reboot — without requiring a new join.
func (h *SetupHandler) StartupPeerSync() {
if h.ClusterStore == nil || h.PeerReloader == nil {
return
}
st, err := h.Store.Load()
if err != nil || st == nil || !st.IsClusterNode || st.PrimaryFQDN == "" {
return
}
h.preRegisterPrimary(st.PrimaryFQDN)
}
// preRegisterPrimary inserts the primary node into the local ha_nodes with
// its resolved IP so nftables @peer_ipv4 allows port 8443 from the primary.
// Uses a stable ID derived from the FQDN so repeated calls are idempotent.
func (h *SetupHandler) preRegisterPrimary(primaryFQDN string) {
ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
defer cancel()
@@ -228,7 +245,8 @@ func (h *SetupHandler) preRegisterPrimary(primaryFQDN string) {
}
ip := addrs[0]
nodeID := fmt.Sprintf("primary-%x", time.Now().UnixNano())
// Stable ID so repeated calls (join + startup) don't accumulate rows.
nodeID := fmt.Sprintf("prenode-%s", strings.ReplaceAll(primaryFQDN, ".", "-"))
n := models.HANode{
ID: nodeID,
Name: primaryFQDN,