feat(cluster): PG Logical Replication setup + Master-Key-Sync + Firewall-Ports

cluster-init-replication: - listen_addresses = '*' damit Cluster-Peers PG auf :5432 erreichen können - max_replication_slots = 20 / max_wal_senders = 10 (verhindert Slot-Erschöpfung bei initaler Tabellen-Synchronisation mit vielen gleichzeitigen Sync-Workern) - pg-replication-secret: Ownership an edgeguard-User (API-Lesezugriff) - detectPGConfig() statt hardcoded PG 16 (System läuft PG 17) cluster-setup-standby: - syncMasterKey(): holt /var/lib/edgeguard/.master_key via mTLS vom Primary — ohne identischen Master-Key können replizierte WireGuard-Keys nicht entschlüsselt werden - render-config: sudo -u edgeguard statt als root (DB-Zugriff) nftables Template: - Port 5432 (PG) + 6379 (KeyDB) für Cluster-Peers (@peer_ipv4/@peer_ipv6) freigegeben handlers/cluster.go: - GET /agent/cluster/master-key: gibt .master_key via mTLS zurück (hex-kodiert) v1.2.15 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
fix(rolling-update): stable done-detection, mobile banner layout, stale-state protection
2026-05-30 12:56:32 +02:00 · 2026-05-30 12:56:20 +02:00 · 2026-05-29 23:40:49 +02:00 · 2026-05-29 23:40:37 +02:00
30 changed files with 2147 additions and 150 deletions
--- a/2
+++ b/2
@@ -1 +1 @@
-1.1.162
+1.2.15
--- a/cmd/edgeguard-api/main.go
+++ b/cmd/edgeguard-api/main.go
@@ -40,6 +40,7 @@ import (
 	"git.netcell-it.de/projekte/edgeguard-native/internal/aggregator"
 	"git.netcell-it.de/projekte/edgeguard-native/internal/cluster/clustertls"
 	"git.netcell-it.de/projekte/edgeguard-native/internal/cluster/jointoken"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/services/clusterjoin"
 	aptsvc "git.netcell-it.de/projekte/edgeguard-native/internal/services/apt"
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/domainheaders"
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/domains"
@@ -60,7 +61,7 @@ import (
 	usersvc "git.netcell-it.de/projekte/edgeguard-native/internal/services/users"
 )

-var version = "1.1.162"
+var version = "1.2.13"

 func main() {
 	addr := os.Getenv("EDGEGUARD_API_ADDR")
@@ -175,6 +176,22 @@ func main() {
 			go runClusterHeartbeat(context.Background(), pool, nodeID, version)
 		}

+		// Secondary: push config_hash to primary every 5 min so the primary's
+		// ha_nodes reflects actual state. Without this, the primary retains the
+		// stale hash written at join-time and the drift banner never clears.
+		// st.IsClusterNode + PrimaryFQDN are only set on joined secondary nodes.
+		if nodeID != "" && st != nil && st.IsClusterNode && st.PrimaryFQDN != "" {
+			if primaryURL, normErr := clusterjoin.NormalizePrimaryURL(st.PrimaryFQDN); normErr == nil {
+				go runPrimaryPush(context.Background(), pool, nodeID, st.FQDN, version, primaryURL)
+			} else {
+				slog.Warn("cluster: cannot normalize primary URL for push", "primary", st.PrimaryFQDN, "error", normErr)
+			}
+			// Logical Replication liefert Änderungen automatisch — aber Service-
+			// Configs (haproxy.cfg, nftables …) müssen nach jeder Änderung neu
+			// gerendert werden. Diese Goroutine erkennt hash-Änderungen und rendert.
+			go runSecondaryConfigRender(context.Background(), pool)
+		}
+
 		// Phase 3.3: Cluster-CA + Peer-Cert. Founder-Pfad — auf einem
 		// frisch installierten Single-Node generieren wir die CA und
 		// signieren uns selbst, damit der Agent-Listener auf :8443
@@ -324,7 +341,8 @@ func main() {
 		clusterHdl := handlers.NewClusterHandler(clusterStore, nodeID).
 			WithAggregator(clusterAggregator).
 			WithJoinFlow(clusterTLSStore, joinTokens).
-			WithPeerReloader(peerReloader)
+			WithPeerReloader(peerReloader).
+			WithVersion(version)
 		clusterHdl.Register(authed)
 		// /cluster/issue-cert läuft PUBLIC — joining Peer hat noch
 		// keine Session/Cert. Token + Nonce-Tracking ist die einzige
@@ -457,6 +475,10 @@ func main() {
 	// schon erledigt.
 	startAgentListener(version, agentHdl, systemHdl)

+	// Nach einem Upgrade-Neustart: wenn die State-Datei "updating-primary"
+	// enthält, sind wir gerade neu gestartet → Update abgeschlossen → "done".
+	handlers.FinishRollingUpdateIfPending()
+
 	log.Printf("edgeguard-api %s listening on %s", version, addr)
 	srv := &http.Server{Addr: addr, Handler: r}
 	if err := srv.ListenAndServe(); err != nil && err != http.ErrServerClosed {
@@ -680,6 +702,84 @@ func runClusterHeartbeat(ctx context.Context, pool *pgxpoolPool, localID, versio
 	}
 }

+// runSecondaryConfigRender läuft auf Secondary-Nodes und re-rendert alle
+// Service-Configs wenn die Logical Replication Änderungen vom Primary
+// geliefert hat. Erkennt das an einem geänderten config_hash.
+// Tick: 5 min — balanciert Reaktionszeit gegen Reload-Overhead.
+func runSecondaryConfigRender(ctx context.Context, pool *pgxpoolPool) {
+	const tick = 5 * time.Minute
+	t := time.NewTicker(tick)
+	defer t.Stop()
+	var lastHash string
+	render := func() {
+		rCtx, cancel := context.WithTimeout(ctx, 60*time.Second)
+		defer cancel()
+		hash, err := cluster.ComputeConfigHash(rCtx, pool)
+		if err != nil || hash == lastHash {
+			return
+		}
+		lastHash = hash
+		slog.Info("cluster: secondary config changed via replication, re-rendering", "hash", hash)
+		// HAProxy
+		if err := haproxy.New(pool).Render(rCtx); err != nil {
+			slog.Warn("cluster: secondary haproxy render failed", "error", err)
+		}
+		// nftables
+		if err := firewallrender.New(pool).Render(rCtx); err != nil {
+			slog.Warn("cluster: secondary nftables render failed", "error", err)
+		}
+		// Weitere Dienste (Squid, Unbound, Chrony, WireGuard) werden bei
+		// Änderungen an ihren spezifischen Tabellen ebenfalls neu gerendert.
+		// render-config ohne Reload: die Dienste merken Änderungen selbst
+		// (HAProxy/nftables über systemctl reload, der oben bereits läuft).
+	}
+	// Initialer Check nach kurzem Delay (Replication braucht einen Moment)
+	select {
+	case <-ctx.Done():
+		return
+	case <-time.After(30 * time.Second):
+		render()
+	}
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-t.C:
+			render()
+		}
+	}
+}
+
+// runPrimaryPush periodically pushes this secondary node's config_hash to the
+// primary via mTLS. The primary's ha_nodes view only gets config_hash written
+// during join-time autoRegister — after that the primary never hears about
+// hash changes unless we push. Without this, the drift banner shows stale
+// hashes from join-time forever.
+func runPrimaryPush(ctx context.Context, pool *pgxpoolPool, nodeID, fqdn, version, primaryURL string) {
+	const tick = 5 * time.Minute
+	t := time.NewTicker(tick)
+	defer t.Stop()
+	push := func() {
+		pCtx, cancel := context.WithTimeout(ctx, 15*time.Second)
+		defer cancel()
+		hash, _ := cluster.ComputeConfigHash(pCtx, pool)
+		if err := clusterjoin.PushSelfToPrimary(primaryURL, "", nodeID, fqdn, version, hash); err != nil {
+			slog.Warn("cluster: push-to-primary failed", "error", err)
+		} else {
+			slog.Debug("cluster: config_hash pushed to primary", "hash", hash)
+		}
+	}
+	push() // immediate push on API startup
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-t.C:
+			push()
+		}
+	}
+}
+
 func randomEphemeralSecret() []byte {
 	b := make([]byte, 32)
 	if _, err := rand.Read(b); err != nil {
--- a/cmd/edgeguard-ctl/cluster_replication.go
+++ b/cmd/edgeguard-ctl/cluster_replication.go
@@ -0,0 +1,573 @@
+package main
+
+import (
+	"crypto/rand"
+	"crypto/tls"
+	"crypto/x509"
+	"encoding/json"
+	"flag"
+	"fmt"
+	"net/http"
+	"os"
+	"os/exec"
+	"os/user"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"time"
+
+	"git.netcell-it.de/projekte/edgeguard-native/internal/cluster/clustertls"
+)
+
+const (
+	egReplSecret = "/var/lib/edgeguard/pg-replication-secret"
+	egReplUser   = "edgeguard_replicator"
+	egPubName    = "edgeguard_shared"
+	egSubName    = "edgeguard_sub"
+)
+
+// pgConfig hält die zur Laufzeit erkannten PG-Pfade.
+type pgConfig struct {
+	Version string // z.B. "17"
+	Cluster string // z.B. "main"
+	DataDir string // /var/lib/postgresql/17/main
+	HBAPath string // /etc/postgresql/17/main/pg_hba.conf
+	ConfD   string // /etc/postgresql/17/main/conf.d
+}
+
+// detectPGConfig ermittelt Version, Cluster und Pfade aus der laufenden
+// PG-Instanz via SHOW hba_file / SHOW data_directory. Damit ist der Code
+// unabhängig von der PG-Hauptversion (16, 17, …).
+func detectPGConfig() (pgConfig, error) {
+	hbaRaw, err := psqlRun([]string{"-tA", "-c", "SHOW hba_file;"})
+	if err != nil {
+		return pgConfig{}, fmt.Errorf("cannot detect pg hba_file: %w", err)
+	}
+	hbaPath := strings.TrimSpace(string(hbaRaw))
+
+	dataRaw, err := psqlRun([]string{"-tA", "-c", "SHOW data_directory;"})
+	if err != nil {
+		return pgConfig{}, fmt.Errorf("cannot detect pg data_directory: %w", err)
+	}
+	dataDir := strings.TrimSpace(string(dataRaw))
+
+	// hbaPath: /etc/postgresql/<version>/<cluster>/pg_hba.conf
+	parts := strings.Split(filepath.ToSlash(hbaPath), "/")
+	if len(parts) < 6 {
+		return pgConfig{}, fmt.Errorf("unexpected hba_file path: %s", hbaPath)
+	}
+	version := parts[3]
+	cluster := parts[4]
+	confD := filepath.Join("/etc/postgresql", version, cluster, "conf.d")
+
+	return pgConfig{
+		Version: version,
+		Cluster: cluster,
+		DataDir: dataDir,
+		HBAPath: hbaPath,
+		ConfD:   confD,
+	}, nil
+}
+
+// localOnlyTables listet alle Tabellen die nicht in die Replikations-
+// Publication aufgenommen werden. Alles andere wird automatisch repliziert.
+var localOnlyTables = []string{
+	"ha_nodes",           // Node-Identität, Status
+	"network_interfaces", // Eigene Interfaces (eth0, eth1 …)
+	"ip_addresses",       // Eigene IP-Adressen (unterschiedlich pro Node!)
+	"static_routes",      // Node-spezifisches Routing
+	"cluster_settings",   // VIP-Interface kann pro Node unterschiedlich sein
+	"dns_settings",       // listen_addresses ist node-spezifisch
+	"ntp_settings",       // listen_addresses ist node-spezifisch
+	"system_settings",    // Hostname, Maintenance-Mode etc.
+	"join_tokens_used",   // Token-Tracking nur auf Primary relevant
+	"audit_log",          // Lokales Audit-Protokoll
+	"alert_events",       // Lokale Laufzeit-Events
+	"backups",            // Backup-Historie ist per-Node
+	"goose_db_version",   // Migration-Tracking, internes Tool-State
+}
+
+// cmdClusterInitReplication richtet PG auf dieser Node als Logical-Replication-
+// Primary ein. Idempotent — kann gefahrlos mehrfach laufen.
+//
+// Ablauf:
+//  1. edgeguard_replicator-Rolle anlegen/aktualisieren
+//  2. Passwort → /var/lib/edgeguard/pg-replication-secret
+//  3. conf.d/edgeguard-replication.conf mit wal_level=logical schreiben
+//  4. pg_hba.conf für Replikations-Verbindungen aktualisieren
+//  5. SELECT-Grants auf alle geteilten Tabellen
+//  6. PUBLICATION erstellen (alle Tabellen außer localOnlyTables)
+//  7. PG reload
+func cmdClusterInitReplication(args []string) int {
+	fs := flag.NewFlagSet("cluster-init-replication", flag.ContinueOnError)
+	fs.SetOutput(os.Stderr)
+	if err := fs.Parse(args); err != nil {
+		return 2
+	}
+
+	pg, err := detectPGConfig()
+	if err != nil {
+		fmt.Fprintln(os.Stderr, "cluster-init-replication: PG-Erkennung:", err)
+		return 1
+	}
+	fmt.Printf("→ PostgreSQL %s/%s erkannt\n", pg.Version, pg.Cluster)
+
+	// 1. Passwort generieren
+	pass, err := generatePassword(32)
+	if err != nil {
+		fmt.Fprintln(os.Stderr, "cluster-init-replication: generate password:", err)
+		return 1
+	}
+
+	// 2. edgeguard_replicator-Rolle anlegen/updaten
+	roleSQL := fmt.Sprintf(`DO $$
+BEGIN
+  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = '%s') THEN
+    CREATE ROLE %s REPLICATION LOGIN PASSWORD '%s';
+  ELSE
+    ALTER ROLE %s PASSWORD '%s';
+  END IF;
+END
+$$`, egReplUser, egReplUser, pass, egReplUser, pass)
+	if err := psqlExec(roleSQL); err != nil {
+		fmt.Fprintln(os.Stderr, "cluster-init-replication: create replication role:", err)
+		return 1
+	}
+	fmt.Printf("✓ Replication-Rolle %q angelegt/aktualisiert\n", egReplUser)
+
+	// 3. Passwort speichern
+	if err := os.MkdirAll(filepath.Dir(egReplSecret), 0o750); err != nil {
+		fmt.Fprintln(os.Stderr, "cluster-init-replication: mkdir:", err)
+		return 1
+	}
+	if err := os.WriteFile(egReplSecret, []byte(pass), 0o600); err != nil {
+		fmt.Fprintln(os.Stderr, "cluster-init-replication: write secret:", err)
+		return 1
+	}
+	// Ownership an edgeguard-api-User übergeben damit die API lesen kann
+	if u, err := user.Lookup("edgeguard"); err == nil {
+		uid, _ := strconv.Atoi(u.Uid)
+		gid, _ := strconv.Atoi(u.Gid)
+		_ = os.Chown(egReplSecret, uid, gid)
+	}
+	fmt.Printf("✓ Replication-Secret gespeichert: %s\n", egReplSecret)
+
+	// 4. conf.d/edgeguard-replication.conf schreiben
+	// wal_level=logical ist eine Obermenge von replica — unterstützt
+	// sowohl Logical Replication als auch ggfs. physisches WAL-Archiving.
+	if err := os.MkdirAll(pg.ConfD, 0o755); err != nil {
+		fmt.Fprintln(os.Stderr, "cluster-init-replication: conf.d mkdir:", err)
+		return 1
+	}
+	replConf := `# EdgeGuard Logical Replication — automatisch generiert
+# Nicht manuell bearbeiten; wird von edgeguard-ctl cluster-init-replication verwaltet.
+wal_level = logical
+max_wal_senders = 10
+max_replication_slots = 20
+max_logical_replication_workers = 4
+wal_keep_size = 512MB
+# Lausche auf localhost + alle konfigurierten Interfaces damit Cluster-Peers
+# sich verbinden können. '*' ist sicher weil pg_hba.conf den Zugriff auf
+# bekannte Replikations-User beschränkt.
+listen_addresses = '*'
+`
+	confPath := filepath.Join(pg.ConfD, "edgeguard-replication.conf")
+	if err := os.WriteFile(confPath, []byte(replConf), 0o644); err != nil {
+		fmt.Fprintln(os.Stderr, "cluster-init-replication: write postgresql conf:", err)
+		return 1
+	}
+	fmt.Printf("✓ %s geschrieben (wal_level=logical)\n", confPath)
+
+	// 5. pg_hba.conf aktualisieren
+	if err := ensureHBAReplication(pg.HBAPath); err != nil {
+		fmt.Fprintln(os.Stderr, "cluster-init-replication: pg_hba.conf:", err)
+		return 1
+	}
+	fmt.Printf("✓ %s aktualisiert\n", pg.HBAPath)
+
+	// 6. PG reload (damit wal_level + pg_hba aktiv werden)
+	if out, err := exec.Command("pg_ctlcluster", pg.Version, pg.Cluster, "reload").CombinedOutput(); err != nil {
+		fmt.Fprintf(os.Stderr, "cluster-init-replication: pg reload failed: %v\n%s\n", err, out)
+		return 1
+	}
+	fmt.Printf("✓ PostgreSQL %s/%s neu geladen\n", pg.Version, pg.Cluster)
+
+	// 7. SELECT-Grants: edgeguard_replicator muss alle zu replizierenden
+	// Tabellen lesen können. DEFAULT PRIVILEGES sichert zukünftige Tabellen.
+	grantSQL := fmt.Sprintf(`
+GRANT SELECT ON ALL TABLES IN SCHEMA public TO %s;
+ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO %s;
+`, egReplUser, egReplUser)
+	if err := psqlDBExec("edgeguard", grantSQL); err != nil {
+		fmt.Fprintln(os.Stderr, "cluster-init-replication: grant SELECT:", err)
+		return 1
+	}
+	fmt.Printf("✓ SELECT auf alle Tabellen für %q gewährt\n", egReplUser)
+
+	// 8. PUBLICATION erstellen — alle public-Tabellen außer localOnlyTables.
+	// Idempotent: DROP IF EXISTS + CREATE.
+	if err := createPublication(); err != nil {
+		fmt.Fprintln(os.Stderr, "cluster-init-replication: create publication:", err)
+		return 1
+	}
+	fmt.Printf("✓ PUBLICATION %q erstellt\n", egPubName)
+
+	fmt.Println()
+	fmt.Println("Nächste Schritte:")
+	fmt.Println("  1) Auf dem Secondary: edgeguard-ctl cluster-setup-standby <primary-ip>")
+	fmt.Println("  2) Cluster-Settings (VIP) auf BEIDEN Nodes separat konfigurieren")
+	fmt.Println("     → Settings → Cluster → VIP/Keepalived")
+	return 0
+}
+
+// createPublication baut die PUBLICATION dynamisch aus allen Tabellen
+// im public-Schema minus localOnlyTables. Idempotent: löscht eine
+// bestehende Publication gleichen Namens zuerst.
+func createPublication() error {
+	// Alle Tabellen im public-Schema ermitteln
+	listSQL := `SELECT tablename FROM pg_tables WHERE schemaname = 'public' ORDER BY tablename`
+	out, err := psqlDBRun("edgeguard", []string{"-tA", "-c", listSQL})
+	if err != nil {
+		return fmt.Errorf("list tables: %w", err)
+	}
+
+	excluded := make(map[string]bool)
+	for _, t := range localOnlyTables {
+		excluded[t] = true
+	}
+
+	var tables []string
+	for _, line := range strings.Split(strings.TrimSpace(string(out)), "\n") {
+		t := strings.TrimSpace(line)
+		if t == "" || excluded[t] {
+			continue
+		}
+		tables = append(tables, t)
+	}
+	if len(tables) == 0 {
+		return fmt.Errorf("keine Tabellen für Publication gefunden")
+	}
+
+	dropSQL := fmt.Sprintf("DROP PUBLICATION IF EXISTS %s;", egPubName)
+	if err := psqlDBExec("edgeguard", dropSQL); err != nil {
+		return fmt.Errorf("drop old publication: %w", err)
+	}
+
+	createSQL := fmt.Sprintf("CREATE PUBLICATION %s FOR TABLE %s;",
+		egPubName, strings.Join(tables, ", "))
+	if err := psqlDBExec("edgeguard", createSQL); err != nil {
+		return fmt.Errorf("create publication: %w", err)
+	}
+	return nil
+}
+
+// ensureHBAReplication fügt Einträge für die Replikations-Verbindung
+// in pg_hba.conf ein. Für Logical Replication brauchen wir einen
+// normalen "host edgeguard"-Eintrag (nicht "host replication").
+// Idempotent via Marker-Kommentar.
+func ensureHBAReplication(hbaPath string) error {
+	data, err := os.ReadFile(hbaPath)
+	if err != nil {
+		return fmt.Errorf("read: %w", err)
+	}
+	const marker = "# EdgeGuard replication"
+	if strings.Contains(string(data), marker) {
+		return nil
+	}
+	entry := fmt.Sprintf(`
+%s
+host edgeguard   %s 0.0.0.0/0 scram-sha-256
+host edgeguard   %s ::/0      scram-sha-256
+host replication %s 0.0.0.0/0 scram-sha-256
+host replication %s ::/0      scram-sha-256
+`, marker, egReplUser, egReplUser, egReplUser, egReplUser)
+	f, err := os.OpenFile(hbaPath, os.O_APPEND|os.O_WRONLY, 0o640)
+	if err != nil {
+		return fmt.Errorf("open: %w", err)
+	}
+	defer f.Close()
+	_, err = f.WriteString(entry)
+	return err
+}
+
+// cmdClusterSetupStandby richtet diesen Node als Logical-Replication-
+// Subscriber ein. Der Secondary behält seine eigene beschreibbare PG-
+// Instanz — nur die geteilten Tabellen werden vom Primary repliziert.
+// Node-spezifische Tabellen (Interfaces, IPs, Routen, VIP-Settings …)
+// bleiben lokal und werden NICHT überschrieben. Analog zu OPNsense's
+// HA-Sync: Interface-IPs und Hostname bleiben immer per-Node konfiguriert.
+//
+// Voraussetzungen:
+//   - cluster-join erfolgreich (TLS-Certs in /var/lib/edgeguard/cluster-tls/)
+//   - Primary hat cluster-init-replication ausgeführt
+//   - Dieser Node hat edgeguard-api schon gelaufen (Migrations ausgeführt)
+//
+// Ablauf:
+//  1. Replication-Credentials via mTLS vom Primary holen
+//  2. Bestehende Subscription löschen (idempotent)
+//  3. SUBSCRIPTION auf Primary erstellen (copy_data=true → Initialkopiierung)
+//  4. Warten bis Initialkopiierung abgeschlossen
+//  5. render-config ausführen damit Service-Configs den neuen Stand reflektieren
+func cmdClusterSetupStandby(args []string) int {
+	fs := flag.NewFlagSet("cluster-setup-standby", flag.ContinueOnError)
+	agentPort := fs.Int("agent-port", 8443, "mTLS agent port on primary")
+	tlsDir := fs.String("tls-dir", clustertls.DefaultDir, "Verzeichnis mit ca.crt + peer.{crt,key}")
+	fs.SetOutput(os.Stderr)
+	if err := fs.Parse(args); err != nil {
+		return 2
+	}
+	if fs.NArg() < 1 {
+		fmt.Fprintln(os.Stderr, "usage: edgeguard-ctl cluster-setup-standby <primary-ip-or-host>")
+		return 2
+	}
+	primaryHost := fs.Arg(0)
+
+	// 1. Replication-Credentials vom Primary holen
+	creds, err := fetchReplicationCreds(primaryHost, *agentPort, *tlsDir)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "cluster-setup-standby: replication-creds: %v\n", err)
+		return 1
+	}
+	fmt.Printf("✓ Replication-Credentials von %s:%d erhalten\n", primaryHost, *agentPort)
+
+	// 2. Bestehende Subscription löschen (idempotent)
+	dropSQL := fmt.Sprintf(`
+DO $$ BEGIN
+  IF EXISTS (SELECT FROM pg_subscription WHERE subname = '%s') THEN
+    ALTER SUBSCRIPTION %s DISABLE;
+    ALTER SUBSCRIPTION %s SET (slot_name = NONE);
+    DROP SUBSCRIPTION %s;
+  END IF;
+END $$;`, egSubName, egSubName, egSubName, egSubName)
+	if err := psqlDBExec("edgeguard", dropSQL); err != nil {
+		// Nicht fatal — wenn PG noch keine Subscription kennt ist das OK
+		fmt.Printf("  → keine bestehende Subscription gefunden (ok)\n")
+	} else {
+		fmt.Println("✓ Bestehende Subscription entfernt")
+	}
+
+	// 3. SUBSCRIPTION erstellen
+	// sslmode=require: Verbindung zwischen Cluster-Nodes soll immer verschlüsselt sein.
+	// copy_data=true: Initialkopiierung aller geteilten Tabellen vom Primary.
+	connStr := fmt.Sprintf(
+		"host=%s port=%d user=%s password=%s dbname=edgeguard sslmode=require",
+		creds.Host, creds.Port, creds.User, creds.Password,
+	)
+	createSQL := fmt.Sprintf(
+		"CREATE SUBSCRIPTION %s CONNECTION '%s' PUBLICATION %s WITH (copy_data = true, enabled = true);",
+		egSubName, connStr, egPubName,
+	)
+	if err := psqlDBExec("edgeguard", createSQL); err != nil {
+		fmt.Fprintf(os.Stderr, "cluster-setup-standby: create subscription: %v\n", err)
+		return 1
+	}
+	fmt.Printf("✓ SUBSCRIPTION %q erstellt — Initialkopiierung läuft\n", egSubName)
+
+	// 4. Warten bis Initialkopiierung abgeschlossen
+	fmt.Print("→ Warte auf Initialkopiierung")
+	deadline := time.Now().Add(5 * time.Minute)
+	for time.Now().Before(deadline) {
+		pendingSQL := fmt.Sprintf(`
+SELECT COUNT(*) FROM pg_subscription_rel
+WHERE srsubid = (SELECT oid FROM pg_subscription WHERE subname = '%s')
+  AND srsubstate != 'r';`, egSubName)
+		out, err := psqlDBRun("edgeguard", []string{"-tA", "-c", pendingSQL})
+		if err == nil && strings.TrimSpace(string(out)) == "0" {
+			break
+		}
+		fmt.Print(".")
+		time.Sleep(3 * time.Second)
+	}
+	fmt.Println()
+
+	// Finale Prüfung
+	checkSQL := fmt.Sprintf(`
+SELECT COUNT(*) FROM pg_subscription_rel
+WHERE srsubid = (SELECT oid FROM pg_subscription WHERE subname = '%s')
+  AND srsubstate != 'r';`, egSubName)
+	if out, err := psqlDBRun("edgeguard", []string{"-tA", "-c", checkSQL}); err == nil {
+		if n := strings.TrimSpace(string(out)); n != "0" {
+			fmt.Fprintf(os.Stderr,
+				"cluster-setup-standby: %s Tabellen noch nicht synchronisiert — prüfe PG-Logs\n", n)
+			fmt.Println("  → Subscription läuft trotzdem weiter im Hintergrund")
+		} else {
+			fmt.Println("✓ Alle geteilten Tabellen synchronisiert")
+		}
+	}
+
+	// 5. Master-Key vom Primary holen — für WireGuard-Key-Entschlüsselung
+	fmt.Println("→ Secrets Master-Key vom Primary synchronisieren...")
+	if err := syncMasterKey(primaryHost, *agentPort, *tlsDir); err != nil {
+		fmt.Fprintf(os.Stderr, "cluster-setup-standby: master-key: %v (WireGuard-Keys können nicht entschlüsselt werden)\n", err)
+	} else {
+		fmt.Println("✓ Master-Key synchronisiert")
+	}
+
+	// 6. render-config ausführen — muss als edgeguard-User laufen (DB-Zugriff)
+	fmt.Println("→ Service-Configs neu rendern...")
+	if out, err := exec.Command("sudo", "-u", "edgeguard", "edgeguard-ctl", "render-config").CombinedOutput(); err != nil {
+		fmt.Fprintf(os.Stderr, "cluster-setup-standby: render-config: %v\n%s\n", err, out)
+		fmt.Println("  → Manuell nachholen: sudo -u edgeguard edgeguard-ctl render-config")
+	} else {
+		fmt.Print(string(out))
+		fmt.Println("✓ Service-Configs aktualisiert")
+	}
+
+	fmt.Println()
+	fmt.Println("✓ Logical Replication eingerichtet.")
+	fmt.Println()
+	fmt.Println("Was repliziert wird (automatisch, in Echtzeit):")
+	fmt.Println("  Domains, Backends, Firewall-Rules, WireGuard, DNS-Zones,")
+	fmt.Println("  TLS-Certs, Users, Forward-Proxy, NTP-Pools, ...")
+	fmt.Println()
+	fmt.Println("Was NICHT repliziert wird (bleibt pro Node konfiguriert):")
+	fmt.Println("  Netzwerk-Interfaces, IP-Adressen, Routen,")
+	fmt.Println("  Cluster-Settings (VIP-Interface!), DNS/NTP-Listen-Adressen")
+	fmt.Println()
+	fmt.Println("Nächste Schritte:")
+	fmt.Println("  1) sudo systemctl restart edgeguard-api")
+	fmt.Println("  2) VIP/Keepalived auf BEIDEN Nodes separat konfigurieren:")
+	fmt.Println("     Settings → Cluster → VIP/Keepalived")
+	fmt.Println("  3) Bei Failover: edgeguard-ctl promote (auf dem Secondary)")
+	return 0
+}
+
+// pgReplicationCreds sind die Credentials die der Primary via mTLS zurückgibt.
+type pgReplicationCreds struct {
+	Host     string `json:"host"`
+	Port     int    `json:"port"`
+	User     string `json:"user"`
+	Password string `json:"password"`
+}
+
+// fetchReplicationCreds ruft GET /agent/cluster/pg-replication-info via mTLS ab.
+func fetchReplicationCreds(host string, agentPort int, tlsDir string) (*pgReplicationCreds, error) {
+	caPath := filepath.Join(tlsDir, "ca.crt")
+	certPath := filepath.Join(tlsDir, "peer.crt")
+	keyPath := filepath.Join(tlsDir, "peer.key")
+
+	caCert, err := os.ReadFile(caPath)
+	if err != nil {
+		return nil, fmt.Errorf("read ca.crt: %w", err)
+	}
+	pool := x509.NewCertPool()
+	pool.AppendCertsFromPEM(caCert)
+
+	cert, err := tls.LoadX509KeyPair(certPath, keyPath)
+	if err != nil {
+		return nil, fmt.Errorf("load peer cert: %w", err)
+	}
+
+	client := &http.Client{
+		Timeout: 15 * time.Second,
+		Transport: &http.Transport{
+			TLSClientConfig: &tls.Config{
+				RootCAs:      pool,
+				Certificates: []tls.Certificate{cert},
+			},
+		},
+	}
+
+	url := fmt.Sprintf("https://%s:%d/agent/cluster/pg-replication-info", host, agentPort)
+	resp, err := client.Get(url)
+	if err != nil {
+		return nil, fmt.Errorf("GET %s: %w", url, err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("GET %s: HTTP %d", url, resp.StatusCode)
+	}
+
+	var result struct {
+		Data pgReplicationCreds `json:"data"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
+		return nil, fmt.Errorf("decode response: %w", err)
+	}
+	return &result.Data, nil
+}
+
+// syncMasterKey holt den Secrets-Master-Key vom Primary via mTLS und schreibt
+// ihn nach /var/lib/edgeguard/.master_key. Dadurch können replizierte
+// verschlüsselte WireGuard-Keys und PSKs auf dem Secondary entschlüsselt werden.
+func syncMasterKey(host string, agentPort int, tlsDir string) error {
+	caPath := filepath.Join(tlsDir, "ca.crt")
+	certPath := filepath.Join(tlsDir, "peer.crt")
+	keyPath := filepath.Join(tlsDir, "peer.key")
+
+	caCert, err := os.ReadFile(caPath)
+	if err != nil {
+		return fmt.Errorf("read ca.crt: %w", err)
+	}
+	rootPool := x509.NewCertPool()
+	rootPool.AppendCertsFromPEM(caCert)
+	cert, err := tls.LoadX509KeyPair(certPath, keyPath)
+	if err != nil {
+		return fmt.Errorf("load peer cert: %w", err)
+	}
+	client := &http.Client{
+		Timeout: 15 * time.Second,
+		Transport: &http.Transport{
+			TLSClientConfig: &tls.Config{
+				RootCAs:      rootPool,
+				Certificates: []tls.Certificate{cert},
+			},
+		},
+	}
+	url := fmt.Sprintf("https://%s:%d/agent/cluster/master-key", host, agentPort)
+	resp, err := client.Get(url)
+	if err != nil {
+		return fmt.Errorf("GET %s: %w", url, err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("GET %s: HTTP %d", url, resp.StatusCode)
+	}
+	var result struct {
+		Data struct {
+			KeyHex string `json:"key_hex"`
+		} `json:"data"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
+		return fmt.Errorf("decode response: %w", err)
+	}
+	key := make([]byte, 32)
+	if _, err := fmt.Sscanf(result.Data.KeyHex, "%x", &key); err != nil {
+		return fmt.Errorf("decode key_hex: %w", err)
+	}
+	const masterKeyPath = "/var/lib/edgeguard/.master_key"
+	if err := os.WriteFile(masterKeyPath, key, 0o600); err != nil {
+		return fmt.Errorf("write master key: %w", err)
+	}
+	if u, err := user.Lookup("edgeguard"); err == nil {
+		uid, _ := strconv.Atoi(u.Uid)
+		gid, _ := strconv.Atoi(u.Gid)
+		_ = os.Chown(masterKeyPath, uid, gid)
+	}
+	return nil
+}
+
+// generatePassword erzeugt ein kryptographisch sicheres Passwort.
+func generatePassword(n int) (string, error) {
+	const charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
+	buf := make([]byte, n)
+	if _, err := rand.Read(buf); err != nil {
+		return "", err
+	}
+	for i, b := range buf {
+		buf[i] = charset[int(b)%len(charset)]
+	}
+	return string(buf), nil
+}
+
+// psqlDBExec führt SQL in der angegebenen Datenbank als postgres-Superuser aus.
+func psqlDBExec(db, sql string) error {
+	_, err := psqlDBRun(db, []string{"-v", "ON_ERROR_STOP=1", "-c", sql})
+	return err
+}
+
+// psqlDBRun führt psql-Kommandos gegen eine bestimmte Datenbank aus.
+func psqlDBRun(db string, args []string) ([]byte, error) {
+	baseArgs := []string{"-d", db}
+	return psqlRun(append(baseArgs, args...))
+}
--- a/cmd/edgeguard-ctl/main.go
+++ b/cmd/edgeguard-ctl/main.go
@@ -1,7 +1,6 @@
 // Command edgeguard-ctl is the admin CLI for setup, migrations and
-// (later) cluster ops. v1 wires migrate + initdb so postinst can
-// initialise a fresh node; cluster-* and promote remain stubs until
-// Phase 3.
+// cluster ops. v1.2 implements PG streaming replication setup,
+// VIP/Keepalived config and manual failover (promote).
 package main

 import (
@@ -11,7 +10,7 @@ import (
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/setup"
 )

-var version = "1.1.162"
+var version = "1.2.15"

 const usage = `edgeguard-ctl — EdgeGuard CLI

@@ -25,23 +24,25 @@ Commands:
  migrate check                Validate embedded migrations (no DB connect)
  migrate dump [dir]           Write embedded SQL files to dir (default: ./migrations)
  initdb                       Create PostgreSQL role + database (idempotent)
-  render-config                Regenerate haproxy / nftables configs from PG (--no-reload, --only=)
+  render-config                Regenerate all configs from PG (--no-reload, --only=svc)
+                               Services: haproxy nftables squid wireguard unbound chrony keepalived
  wg-import [--path <dir>] [iface…]
                               Import /etc/wireguard/*.conf files into the DB.
-                               Without iface arguments: imports all .conf files.
-                               With iface args: imports only the named interfaces.
  reset-password               Generate a one-time token for the /reset-password UI flow
  cluster-join <primary> --token <…>
-                               Provision Cluster-TLS material on this node by
-                               exchanging the join-token at the primary's
-                               /api/v1/cluster/issue-cert endpoint. Writes
-                               ca.crt + peer.{crt,key} into /var/lib/edgeguard/
-                               cluster-tls/. PG-Basebackup + KeyDB replica
-                               setup remain manual until Phase 3.5.
-  cluster-renew-self           Re-issue this node's peer.{crt,key} using the
-                               local cluster CA (founder/single-node only).
-                               1-year validity. Restart edgeguard-api after.
-  promote                      Promote this node's PG to primary (Phase 3, not yet implemented)
+                               Provision Cluster-TLS material; writes ca.crt + peer.{crt,key}
+  cluster-init-replication     Richtet PG Logical Replication auf dem Primary ein.
+                               Erstellt edgeguard_replicator-Rolle, setzt wal_level=logical,
+                               erstellt PUBLICATION edgeguard_shared (alle geteilten Tabellen).
+                               Auf dem Primary ausführen bevor der Secondary joined.
+  cluster-setup-standby <ip>   Richtet diesen Node als Logical-Replication-Subscriber ein.
+                               Erstellt SUBSCRIPTION gegen den Primary (Initialkopiierung
+                               aller geteilten Tabellen). Node-eigene Daten (Interfaces,
+                               IPs, Routen, VIP-Settings) bleiben unangetastet.
+                               Voraussetzung: cluster-join + cluster-init-replication.
+  cluster-renew-self           Re-issue this node's peer.{crt,key} using the local cluster CA.
+  promote                      Promote diesen PG-Standby zum Primary (manueller Failover).
+                               Kein Auto-Promote — Split-Brain-Schutz durch manuelle Entscheidung.
  dump-config                  Print effective config (Phase 3, not yet implemented)
 `

@@ -69,7 +70,13 @@ func main() {
 		os.Exit(cmdClusterJoin(os.Args[2:]))
 	case "cluster-renew-self":
 		os.Exit(cmdClusterRenewSelf(os.Args[2:]))
-	case "cluster-leave", "promote", "dump-config":
+	case "cluster-init-replication":
+		os.Exit(cmdClusterInitReplication(os.Args[2:]))
+	case "cluster-setup-standby":
+		os.Exit(cmdClusterSetupStandby(os.Args[2:]))
+	case "promote":
+		os.Exit(cmdPromote(os.Args[2:]))
+	case "cluster-leave", "dump-config":
 		fmt.Fprintf(os.Stderr, "edgeguard-ctl: %q is a Phase-3 stub — not yet implemented\n", os.Args[1])
 		os.Exit(1)
 	default:
--- a/cmd/edgeguard-ctl/promote.go
+++ b/cmd/edgeguard-ctl/promote.go
@@ -0,0 +1,160 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"git.netcell-it.de/projekte/edgeguard-native/internal/cluster"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/database"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/keepalived"
+)
+
+// cmdPromote promotes this node's PostgreSQL instance from Hot-Standby
+// to Primary. Manual failover — keine automatische Promotion, um Split-Brain
+// in 2-Node-Clustern ohne externen Quorum zu verhindern.
+//
+// Ablauf:
+//  1. Prüfen ob standby.signal vorhanden (wir sind wirklich Standby)
+//  2. pg_ctlcluster promote → PG wird Primary
+//  3. Warten bis pg_is_in_recovery() = false
+//  4. ha_nodes.pg_role auf 'primary' setzen
+//  5. KeyDB cluster:pg-primary-url auf lokal setzen
+//  6. keepalived.conf neu rendern (Primary bekommt Priorität 200)
+//  7. keepalived reload
+func cmdPromote(args []string) int {
+	pg, err := detectPGConfig()
+	if err != nil {
+		fmt.Fprintln(os.Stderr, "promote: PG-Erkennung:", err)
+		return 1
+	}
+
+	// 1. Standby-Signal prüfen
+	signalPath := filepath.Join(pg.DataDir, "standby.signal")
+	if _, err := os.Stat(signalPath); os.IsNotExist(err) {
+		fmt.Fprintf(os.Stderr,
+			"promote: %s nicht gefunden — diese Node ist kein PG-Standby oder wurde bereits promoted.\n",
+			signalPath)
+		return 1
+	}
+
+	fmt.Printf("→ Promoting PostgreSQL %s/%s zu Primary...\n", pg.Version, pg.Cluster)
+	if out, err := exec.Command("pg_ctlcluster", pg.Version, pg.Cluster, "promote").
+		CombinedOutput(); err != nil {
+		fmt.Fprintf(os.Stderr, "promote: pg_ctlcluster promote: %v\n%s\n", err, out)
+		return 1
+	}
+	fmt.Println("✓ pg_ctlcluster promote gesendet")
+
+	// 2. Warten bis PG wirklich Primary ist (pg_is_in_recovery = false)
+	fmt.Print("→ Warte auf PG Primary-Mode")
+	deadline := time.Now().Add(60 * time.Second)
+	for time.Now().Before(deadline) {
+		out, err := psqlRun([]string{"-tA", "-c", "SELECT pg_is_in_recovery();"})
+		if err == nil && strings.TrimSpace(string(out)) == "f" {
+			break
+		}
+		fmt.Print(".")
+		time.Sleep(2 * time.Second)
+	}
+	fmt.Println()
+	// Nochmal prüfen
+	out, err := psqlRun([]string{"-tA", "-c", "SELECT pg_is_in_recovery();"})
+	if err != nil || strings.TrimSpace(string(out)) != "f" {
+		fmt.Fprintln(os.Stderr, "promote: PG ist nach 60s noch in recovery — prüfe PG-Logs")
+		return 1
+	}
+	fmt.Println("✓ PostgreSQL ist jetzt Primary")
+
+	// 3. ha_nodes.pg_role + role aktualisieren
+	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
+	defer cancel()
+
+	pool, err := database.Open(ctx, database.ConnStringFromEnv())
+	if err != nil {
+		fmt.Fprintln(os.Stderr, "promote: db connect:", err)
+		fmt.Println("  → ha_nodes manuell updaten: UPDATE ha_nodes SET pg_role='primary', role='primary' WHERE id='<local-id>';")
+	} else {
+		defer pool.Close()
+		localID, err := loadLocalID()
+		if err != nil {
+			fmt.Fprintln(os.Stderr, "promote: local node ID:", err)
+		} else {
+			_, err = pool.Exec(ctx, `UPDATE ha_nodes SET pg_role='primary', role='primary', status='online', updated_at=NOW() WHERE id=$1`, localID)
+			if err != nil {
+				fmt.Fprintln(os.Stderr, "promote: update ha_nodes:", err)
+			} else {
+				fmt.Println("✓ ha_nodes.pg_role = 'primary' gesetzt")
+			}
+		}
+	}
+
+	// 4. KeyDB cluster:pg-primary-url updaten
+	if err := updateKeyDBPrimaryURL(); err != nil {
+		fmt.Fprintf(os.Stderr, "promote: KeyDB update: %v\n", err)
+		fmt.Println("  → Manuell: redis-cli SET cluster:pg-primary-url 'postgres://edgeguard@/edgeguard'")
+	} else {
+		fmt.Println("✓ KeyDB cluster:pg-primary-url aktualisiert")
+	}
+
+	// 5. Keepalived.conf neu rendern (Primary = Priorität 200)
+	if pool != nil {
+		localID, _ := loadLocalID()
+		kg := keepalived.New(pool, localID)
+		renderCtx, renderCancel := context.WithTimeout(context.Background(), 10*time.Second)
+		defer renderCancel()
+		if err := kg.Render(renderCtx); err != nil {
+			fmt.Fprintf(os.Stderr, "promote: keepalived render: %v\n", err)
+			fmt.Println("  → Manuell: edgeguard-ctl render-config --only=keepalived")
+		} else {
+			fmt.Println("✓ keepalived.conf neu gerendert (Priority 200)")
+		}
+	}
+
+	fmt.Println()
+	fmt.Println("✓ Promotion abgeschlossen. Diese Node ist jetzt der primäre EdgeGuard-Knoten.")
+	fmt.Println()
+	fmt.Println("Empfohlene Nachschritte:")
+	fmt.Println("  1) sudo systemctl restart edgeguard-api  (falls noch nicht laufend)")
+	fmt.Println("  2) Alte Primary-Node nach Recovery als neuen Standby einrichten:")
+	fmt.Println("     edgeguard-ctl cluster-setup-standby <diese-node-ip>")
+	return 0
+}
+
+// loadLocalID liest die Node-ID aus /var/lib/edgeguard/node.conf.
+func loadLocalID() (string, error) {
+	c, err := cluster.LoadLocalConfig("")
+	if err != nil {
+		return "", err
+	}
+	if c.NodeID == "" {
+		return "", fmt.Errorf("NODE_ID in node.conf ist leer")
+	}
+	return c.NodeID, nil
+}
+
+// updateKeyDBPrimaryURL schreibt den lokalen PG-DSN als cluster:pg-primary-url
+// in KeyDB, damit alle Nodes im Cluster Writes an diese Node schicken.
+func updateKeyDBPrimaryURL() error {
+	// edgeguard-api nutzt Unix-Socket-Auth, der DSN ist immer lokal.
+	const localDSN = "postgres://edgeguard@/edgeguard?host=/var/run/postgresql"
+	out, err := exec.Command("redis-cli",
+		"-s", "/var/run/keydb/keydb.sock",
+		"SET", "cluster:pg-primary-url", localDSN,
+	).CombinedOutput()
+	if err != nil {
+		// Fallback: Standard-Port
+		out2, err2 := exec.Command("redis-cli",
+			"-p", "6379",
+			"SET", "cluster:pg-primary-url", localDSN,
+		).CombinedOutput()
+		if err2 != nil {
+			return fmt.Errorf("%v: %s / %v: %s", err, out, err2, out2)
+		}
+	}
+	return nil
+}
--- a/cmd/edgeguard-ctl/render.go
+++ b/cmd/edgeguard-ctl/render.go
@@ -12,6 +12,8 @@ import (
 	"git.netcell-it.de/projekte/edgeguard-native/internal/database"
 	"git.netcell-it.de/projekte/edgeguard-native/internal/firewall"
 	"git.netcell-it.de/projekte/edgeguard-native/internal/haproxy"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/cluster"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/keepalived"
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/configorch"
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/secrets"
 	"git.netcell-it.de/projekte/edgeguard-native/internal/squid"
@@ -64,7 +66,16 @@ func cmdRenderConfig(args []string) int {
 		fw.SkipReload = true
 	}

+	// keepalived: Node-ID aus node.conf für Prioritäts-Berechnung
+	var ka configgen.Generator
+	if lc, err := cluster.LoadLocalConfig(""); err == nil && lc.NodeID != "" {
+		ka = keepalived.New(pool, lc.NodeID)
+	}
+
 	gens := []configgen.Generator{hap, fw, sq, wg, ub, cn}
+	if ka != nil {
+		gens = append(gens, ka)
+	}

 	results, runErr := configorch.Run(ctx, gens, only)
 	fmt.Print(configorch.Summarise(results))
--- a/cmd/edgeguard-scheduler/main.go
+++ b/cmd/edgeguard-scheduler/main.go
@@ -41,7 +41,7 @@ import (
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/tlscerts"
 )

-var version = "1.1.162"
+var version = "1.2.15"

 const (
 	// renewTickInterval — how often we re-evaluate expiring certs.
--- a/deploy/keepalived/keepalived.conf.tpl
+++ b/deploy/keepalived/keepalived.conf.tpl
@@ -0,0 +1,40 @@
+global_defs {
+    router_id {{ .RouterID }}
+    script_user root
+    enable_script_security
+    vrrp_garp_interval 0
+    vrrp_gna_interval 0
+}
+
+vrrp_script chk_edgeguard {
+    script "/usr/lib/edgeguard/keepalived-check.sh"
+    interval 2
+    weight -50
+    fall 3
+    rise 2
+}
+
+vrrp_instance VI_1 {
+    state {{ .State }}
+    interface {{ .Interface }}
+    virtual_router_id {{ .RouterID }}
+    priority {{ .Priority }}
+    advert_int 1
+{{ if .SrcIP }}    unicast_src_ip {{ .SrcIP }}
+    unicast_peer {
+        {{ .PeerIP }}
+    }
+{{ end }}    authentication {
+        auth_type PASS
+        auth_pass {{ .AuthPass }}
+    }
+    virtual_ipaddress {
+        {{ .VIP }}
+    }
+    track_script {
+        chk_edgeguard
+    }
+    notify_master  "/usr/lib/edgeguard/keepalived-master.sh"
+    notify_backup  "/usr/lib/edgeguard/keepalived-backup.sh"
+    notify_fault   "/usr/lib/edgeguard/keepalived-backup.sh"
+}
--- a/internal/aggregator/aggregator.go
+++ b/internal/aggregator/aggregator.go
@@ -192,6 +192,43 @@ func agentURL(apiURL string, agentPort int, path string) (string, error) {
 	return u.String(), nil
 }

+// PostPeer sendet einen POST-Request an einen einzelnen Peer.
+// Wird vom Rolling-Update-Orchestrator genutzt um /agent/cluster/trigger-update
+// auf dem Secondary auszulösen.
+func (a *Aggregator) PostPeer(ctx context.Context, p models.HANode, path string) PeerResult {
+	start := time.Now()
+	res := PeerResult{NodeID: p.ID, FQDN: p.FQDN}
+	target, err := agentURL(p.APIURL, a.AgentPort, path)
+	if err != nil {
+		res.Err = "bad api_url: " + err.Error()
+		return res
+	}
+	reqCtx, cancel := context.WithTimeout(ctx, 15*time.Second)
+	defer cancel()
+	req, err := http.NewRequestWithContext(reqCtx, http.MethodPost, target, nil)
+	if err != nil {
+		res.Err = err.Error()
+		return res
+	}
+	req.Header.Set("Content-Type", "application/json")
+	resp, err := a.HTTPClient.Do(req)
+	if err != nil {
+		res.Err = err.Error()
+		res.Duration = time.Since(start).Milliseconds()
+		return res
+	}
+	defer resp.Body.Close()
+	body, _ := io.ReadAll(io.LimitReader(resp.Body, 1<<20))
+	if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusAccepted {
+		res.Err = fmt.Sprintf("HTTP %d: %s", resp.StatusCode, strings.TrimSpace(string(body)))
+		res.Duration = time.Since(start).Milliseconds()
+		return res
+	}
+	res.OK = true
+	res.Duration = time.Since(start).Milliseconds()
+	return res
+}
+
 // Compile-time check dass cluster importiert wird (für Drift-Detection
 // vom hashSpec — die Aggregator-Resultate werden parallel im Drift-
 // Banner mitverarbeitet). Nicht runtime-essentiell, aber dokumentiert
--- a/internal/cluster/confighash.go
+++ b/internal/cluster/confighash.go
@@ -35,10 +35,12 @@ import (

 // hashTable beschreibt eine Tabelle die in den config-hash einfließt.
 type hashTable struct {
-	Name          string
-	Singleton     bool     // dns_settings, ntp_settings → eine row, id=1
-	ExtraExclude  []string // Spalten die zusätzlich aus to_jsonb gefiltert werden
-	SkipUpdatedAt bool     // setze true wenn updated_at semantisch relevant ist
+	Name             string
+	Singleton        bool     // dns_settings, ntp_settings → eine row, id=1
+	ExtraExclude     []string // Spalten die zusätzlich aus to_jsonb gefiltert werden
+	SkipUpdatedAt    bool     // setze true wenn updated_at semantisch relevant ist
+	MigrationDefault bool     // Tabelle hat migrations-erzeugte Default-Rows (firewall_zones, ntp_pools…)
+	                          // → zählt nicht als "user hat config" bei der Empty-DB-Erkennung
 }

 // hashSpec ist die Reihenfolge-stabile Liste. NEUE Tabellen hier
@@ -49,15 +51,13 @@ var hashSpec = []hashTable{
 	{Name: "backends"},
 	{Name: "backend_servers"},
 	{Name: "routing_rules"},
-	{Name: "network_interfaces"},
-	{Name: "ip_addresses"},
 	{Name: "tls_certs", ExtraExclude: []string{"last_renewed_at", "last_error"}},

-	{Name: "firewall_zones"},
+	{Name: "firewall_zones", MigrationDefault: true},
 	{Name: "firewall_address_objects"},
 	{Name: "firewall_address_groups"},
-	{Name: "firewall_services"},
-	{Name: "firewall_service_groups"},
+	{Name: "firewall_services", MigrationDefault: true},
+	{Name: "firewall_service_groups", MigrationDefault: true},
 	{Name: "firewall_rules"},
 	{Name: "firewall_nat_rules"},

@@ -67,12 +67,12 @@ var hashSpec = []hashTable{

 	{Name: "dns_zones"},
 	{Name: "dns_records"},
-	{Name: "dns_settings", Singleton: true},

-	{Name: "ntp_pools"},
-	{Name: "ntp_settings", Singleton: true},
+	{Name: "ntp_pools", MigrationDefault: true},

-	{Name: "static_routes"},
+	// network_interfaces, ip_addresses, static_routes, dns_settings, ntp_settings
+	// sind node-spezifisch (jeder Node hat eigene IPs/Routes/Listen-Adressen)
+	// und fließen NICHT in den Drift-Hash ein.
 }

 // hashSQL rendert die SHA-Input-SQL für eine Tabelle.
@@ -100,22 +100,35 @@ func hashSQL(t hashTable) string {
 // ComputeConfigHash gibt den 16-hex-char-Hash über alle Spec-Tabellen
 // zurück. Fehlende Tabellen (transienter schema-flux) werden als
 // leerer Per-Table-Hash behandelt — kein Abbruch.
+//
+// Gibt "" zurück wenn alle user-konfigurierbaren Tabellen leer sind
+// (Singleton- und MigrationDefault-Tabellen zählen nicht als User-Config).
+// Das verhindert False-Positive-Drift-Banner auf frisch gejointen Secondaries.
 func ComputeConfigHash(ctx context.Context, pool *pgxpool.Pool) (string, error) {
 	if pool == nil {
 		return "", fmt.Errorf("nil pool")
 	}
 	h := sha256.New()
+	hasUserConfig := false
 	for _, t := range hashSpec {
 		var s string
 		if err := pool.QueryRow(ctx, hashSQL(t)).Scan(&s); err != nil {
 			// Migration fehlt o.ä. → leeren string nehmen, weiter.
 			s = ""
 		}
+		if s != "" && !t.Singleton && !t.MigrationDefault {
+			hasUserConfig = true
+		}
 		h.Write([]byte(t.Name))
 		h.Write([]byte{0})
 		h.Write([]byte(s))
 		h.Write([]byte{0})
 	}
+	if !hasUserConfig {
+		// Frisch gejoincter Secondary oder komplett leere DB →
+		// leerer String signalisiert "kein Drift prüfen" im Status-Handler.
+		return "", nil
+	}
 	return hex.EncodeToString(h.Sum(nil))[:16], nil
 }

--- a/internal/database/migrations/0029_cluster_vip.sql
+++ b/internal/database/migrations/0029_cluster_vip.sql
@@ -0,0 +1,36 @@
+-- +goose Up
+-- +goose StatementBegin
+
+-- pg_role: Rolle dieser Node in der PG-Replikation.
+-- "standalone" = kein Streaming-Replication-Setup
+-- "primary"    = WAL-Sender, repliziert an Standby(s)
+-- "standby"    = Hot-Standby, liest WAL vom Primary
+ALTER TABLE ha_nodes ADD COLUMN IF NOT EXISTS pg_role TEXT NOT NULL DEFAULT 'standalone';
+
+-- cluster_settings: VIP + VRRP-Konfiguration (Singleton, id=1).
+-- vip_address   = die virtuelle IP-Adresse (z.B. "89.163.205.10")
+-- vip_interface = Netzwerk-Interface (z.B. "eth0")
+-- vip_auth_pass = VRRP-Authentication-Passwort (max. 8 Zeichen, Keepalived-Limit)
+-- vrrp_router_id = VRRP Virtual Router ID (1–255, muss im Subnetz eindeutig sein)
+CREATE TABLE IF NOT EXISTS cluster_settings (
+    id              INTEGER PRIMARY KEY DEFAULT 1,
+    vip_address     TEXT,
+    vip_interface   TEXT,
+    vip_auth_pass   TEXT,
+    vrrp_router_id  INTEGER NOT NULL DEFAULT 51,
+    created_at      TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at      TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    CONSTRAINT cluster_settings_singleton CHECK (id = 1)
+);
+
+INSERT INTO cluster_settings (id) VALUES (1) ON CONFLICT DO NOTHING;
+
+-- +goose StatementEnd
+
+-- +goose Down
+-- +goose StatementBegin
+
+DROP TABLE IF EXISTS cluster_settings;
+ALTER TABLE ha_nodes DROP COLUMN IF EXISTS pg_role;
+
+-- +goose StatementEnd
--- a/internal/firewall/ruleset.nft.tpl
+++ b/internal/firewall/ruleset.nft.tpl
@@ -49,6 +49,11 @@ table inet edgeguard {
        # Cluster-internal: peers reach edgeguard-api over mTLS on :8443
        tcp dport 8443 ip  saddr @peer_ipv4 accept
        tcp dport 8443 ip6 saddr @peer_ipv6 accept
+        # Cluster-internal: PG Logical Replication (:5432) + KeyDB Active-Active (:6379)
+        tcp dport 5432 ip  saddr @peer_ipv4 accept
+        tcp dport 5432 ip6 saddr @peer_ipv6 accept
+        tcp dport 6379 ip  saddr @peer_ipv4 accept
+        tcp dport 6379 ip6 saddr @peer_ipv6 accept

        # ── Service-Auto-Rules (DNS/Squid/WG/...) ──
        # Aus dem laufenden Service-State abgeleitet — Operator
--- a/internal/handlers/cluster.go
+++ b/internal/handlers/cluster.go
@@ -7,6 +7,9 @@ import (
 	"encoding/pem"
 	"fmt"
 	"log/slog"
+	"net/http"
+	"os"
+	"os/exec"
 	"strings"
 	"time"

@@ -31,6 +34,7 @@ type ClusterHandler struct {
 	Store      *cluster.Store
 	LocalID    string
 	Aggregator *aggregator.Aggregator
+	Version    string // laufende Binary-Version, für Rolling-Update-Koordination

 	// TLSStore + Tokens: optional, gesetzt bei Phase 3.4. Erlauben das
 	// Generieren von Join-Tokens und das Issue-Cert für joining Peers.
@@ -67,6 +71,10 @@ func (h *ClusterHandler) Register(rg *gin.RouterGroup) {
 	g.GET("/status", h.Status)
 	g.GET("/system/load", h.SystemLoad)
 	g.DELETE("/nodes/:id", h.DeleteNode)
+	g.GET("/vip-settings", h.GetVIPSettings)
+	g.PUT("/vip-settings", h.UpdateVIPSettings)
+	g.POST("/rolling-update", h.RollingUpdate)
+	g.GET("/rolling-update/status", h.RollingUpdateStatus)
 	if h.TLSStore != nil {
 		g.GET("/cert-status", h.CertStatus)
 		g.POST("/renew-self", h.RenewSelf)
@@ -115,6 +123,73 @@ func (h *ClusterHandler) DeleteNode(c *gin.Context) {
 	response.NoContent(c)
 }

+// GetVIPSettings liest die cluster_settings-Singleton-Row (VIP/VRRP-Config).
+func (h *ClusterHandler) GetVIPSettings(c *gin.Context) {
+	if h.Store == nil {
+		response.NotFound(c, simpleError("cluster store not available"))
+		return
+	}
+	var cs vipSettingsRow
+	row := h.Store.Pool.QueryRow(c.Request.Context(),
+		`SELECT vip_address, vip_interface, vip_auth_pass, vrrp_router_id FROM cluster_settings WHERE id = 1`)
+	if err := row.Scan(&cs.VIPAddress, &cs.VIPInterface, &cs.VIPAuthPass, &cs.VRRPRouterID); err != nil {
+		response.Internal(c, err)
+		return
+	}
+	response.OK(c, cs)
+}
+
+// UpdateVIPSettings speichert die VIP/VRRP-Konfiguration und triggert
+// einen Keepalived-Config-Render. Viewer-Schutz via RequireAdminForMutations-
+// Middleware auf der authed-Group — kein Extra-Check nötig.
+func (h *ClusterHandler) UpdateVIPSettings(c *gin.Context) {
+	var req vipSettingsRow
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+	if h.Store == nil {
+		response.NotFound(c, simpleError("cluster store not available"))
+		return
+	}
+	_, err := h.Store.Pool.Exec(c.Request.Context(), `
+		UPDATE cluster_settings
+		SET vip_address=$1, vip_interface=$2, vip_auth_pass=$3, vrrp_router_id=$4, updated_at=NOW()
+		WHERE id=1`,
+		nullIfEmpty(req.VIPAddress), nullIfEmpty(req.VIPInterface),
+		nullIfEmpty(req.VIPAuthPass), req.VRRPRouterID)
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	slog.Info("cluster: VIP settings updated", "vip", req.VIPAddress, "actor", actorOf(c))
+	// Keepalived-Config asynchron neu rendern
+	if h.PeerReloader != nil {
+		go func() {
+			rctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
+			defer cancel()
+			if err := h.PeerReloader(rctx); err != nil {
+				slog.Warn("cluster: keepalived render after VIP update failed", "error", err)
+			}
+		}()
+	}
+	response.NoContent(c)
+}
+
+type vipSettingsRow struct {
+	VIPAddress   *string `json:"vip_address"`
+	VIPInterface *string `json:"vip_interface"`
+	VIPAuthPass  *string `json:"vip_auth_pass"`
+	VRRPRouterID int     `json:"vrrp_router_id"`
+}
+
+func nullIfEmpty(s *string) *string {
+	if s == nil || *s == "" {
+		return nil
+	}
+	return s
+}
+
 // RegisterPublic mountet die public (unauth) Endpoints — joining Peers
 // haben noch keine Session/Cert, deshalb läuft /issue-cert vor der
 // requireAuth-Middleware. Aufrufer muss diesen Group auf /api/v1 setzen
@@ -139,6 +214,10 @@ func (h *ClusterHandler) RegisterAgent(rg *gin.RouterGroup) {
 	g := rg.Group("/agent/cluster")
 	g.POST("/peers", h.AgentRegisterPeer)
 	g.GET("/identity", h.AgentIdentity)
+	g.GET("/pg-replication-info", h.AgentPGReplicationInfo)
+	g.GET("/master-key", h.AgentMasterKey)
+	g.GET("/version", h.AgentVersion)
+	g.POST("/trigger-update", h.AgentTriggerUpdate)
 }

 // AgentIdentity gibt die eigene ha_nodes-Row zurück. Wird vom Primary
@@ -161,6 +240,59 @@ func (h *ClusterHandler) AgentIdentity(c *gin.Context) {
 	response.OK(c, node)
 }

+// AgentPGReplicationInfo gibt die Replication-Credentials für pg_basebackup
+// zurück. Nur über den mTLS-Agent-Listener erreichbar. Liest das Passwort
+// aus /var/lib/edgeguard/pg-replication-secret. Gibt 404 zurück wenn die
+// Datei fehlt (cluster-init-replication noch nicht ausgeführt).
+func (h *ClusterHandler) AgentPGReplicationInfo(c *gin.Context) {
+	const secretPath = "/var/lib/edgeguard/pg-replication-secret"
+	pass, err := readFileString(secretPath)
+	if err != nil {
+		response.NotFound(c, simpleError("pg-replication-secret nicht gefunden — cluster-init-replication auf dem Primary ausführen"))
+		return
+	}
+	// Host = eigene Public-IP aus ha_nodes (oder Fallback: FQDN)
+	host := ""
+	if h.Store != nil && h.LocalID != "" {
+		if node, err := h.Store.Get(c.Request.Context(), h.LocalID); err == nil {
+			if node.PublicIP != nil && *node.PublicIP != "" {
+				host = *node.PublicIP
+			}
+			if host == "" {
+				host = node.FQDN
+			}
+		}
+	}
+	response.OK(c, gin.H{
+		"host":     host,
+		"port":     5432,
+		"user":     "edgeguard_replicator",
+		"password": strings.TrimSpace(pass),
+	})
+}
+
+// AgentMasterKey gibt den Secrets-Master-Key zurück, damit cluster-setup-standby
+// ihn auf dem Secondary synchronisieren kann. Nur über den mTLS-Agent-Listener
+// erreichbar. Ohne gemeinsamen Master-Key können replizierte verschlüsselte
+// Felder (WireGuard private keys, PSKs) auf dem Secondary nicht entschlüsselt werden.
+func (h *ClusterHandler) AgentMasterKey(c *gin.Context) {
+	const keyPath = "/var/lib/edgeguard/.master_key"
+	data, err := os.ReadFile(keyPath)
+	if err != nil {
+		response.NotFound(c, simpleError("master key nicht gefunden"))
+		return
+	}
+	response.OK(c, gin.H{"key_hex": fmt.Sprintf("%x", data)})
+}
+
+func readFileString(path string) (string, error) {
+	b, err := os.ReadFile(path)
+	if err != nil {
+		return "", err
+	}
+	return string(b), nil
+}
+
 // PeerReloader: optionale Funktion die nach einem Auto-Register
 // Firewall + ggfs. andere Configs regeneriert (damit peer_ipv4-Set
 // frisch ist). Wird vom main.go gesetzt.
@@ -172,6 +304,12 @@ func (h *ClusterHandler) WithPeerReloader(r PeerReloader) *ClusterHandler {
 	return h
 }

+// WithVersion: setzt die laufende Binary-Version für Rolling-Update-Koordination.
+func (h *ClusterHandler) WithVersion(v string) *ClusterHandler {
+	h.Version = v
+	return h
+}
+
 func (h *ClusterHandler) ListNodes(c *gin.Context) {
 	nodes, err := h.Store.List(c.Request.Context())
 	if err != nil {
@@ -555,6 +693,60 @@ func (h *ClusterHandler) reconcileJoiningPeers(placeholders []models.HANode) {
 	}
 }

+// AgentVersion gibt die laufende Binary-Version zurück. Wird vom Rolling-
+// Update-Orchestrator gepollt um zu erkennen wann der Secondary die neue
+// Version hat.
+func (h *ClusterHandler) AgentVersion(c *gin.Context) {
+	response.OK(c, gin.H{"version": h.Version})
+}
+
+// AgentTriggerUpdate startet den Upgrade-Prozess auf diesem Node via
+// systemd-run (detached). Wird vom Primary via mTLS aufgerufen um den
+// Secondary zuerst zu aktualisieren (Rolling-Update). Pattern identisch
+// zu /system/upgrade — nutzt dieselbe Sudoers-Whitelist aus dem postinst.
+func (h *ClusterHandler) AgentTriggerUpdate(c *gin.Context) {
+	const scriptPath = "/var/lib/edgeguard/upgrade.sh"
+	const script = `#!/bin/bash
+set -e
+sleep 2
+export DEBIAN_FRONTEND=noninteractive
+dpkg --configure -a || true
+retry_apt() {
+    local attempt=0 max=3 wait_for=15
+    while [ $attempt -lt $max ]; do
+        attempt=$((attempt + 1))
+        apt-get update -qq || true
+        if apt-get install -y -qq -o Dpkg::Options::=--force-confold \
+            edgeguard-api edgeguard-ui edgeguard; then return 0; fi
+        [ $attempt -lt $max ] && sleep $wait_for && wait_for=$((wait_for * 2))
+    done
+    return 1
+}
+retry_apt
+echo "[upgrade] complete"
+rm -f /var/lib/edgeguard/upgrade.sh
+`
+	if err := os.WriteFile(scriptPath, []byte(script), 0o755); err != nil {
+		response.Internal(c, err)
+		return
+	}
+	const unitName = "edgeguard-upgrade.service"
+	_ = exec.Command("sudo", "-n", "/usr/bin/systemctl", "reset-failed", unitName).Run()
+	cmd := exec.Command("sudo", "-n", "/usr/bin/systemd-run",
+		"--unit="+unitName,
+		"--description=EdgeGuard self-upgrade",
+		"--collect",
+		"bash", scriptPath)
+	if err := cmd.Run(); err != nil {
+		slog.Warn("cluster: AgentTriggerUpdate: systemd-run failed", "error", err)
+		response.Internal(c, err)
+		return
+	}
+	slog.Info("cluster: rolling update triggered on this node by primary mTLS call",
+		"client", c.ClientIP())
+	c.JSON(http.StatusAccepted, gin.H{"status": "upgrading"})
+}
+
 var errInvalidJoinRequest = simpleError("missing token or csr")

 type simpleError string
@@ -623,14 +815,15 @@ func (h *ClusterHandler) RenewSelf(c *gin.Context) {
 // die wir wirklich brauchen — sonst kann ein joining Peer beliebige
 // ha_nodes-Felder überschreiben.
 type registerPeerRequest struct {
-	ID         string `json:"id"`           // Joiner's eigene node-id
-	Name       string `json:"name"`         // hostname
-	FQDN       string `json:"fqdn"`         // sollte mit Client-Cert-CN matchen
-	APIURL     string `json:"api_url"`      // https://<fqdn>
-	PublicIP   string `json:"public_ip"`    // optional
-	InternalIP string `json:"internal_ip"`  // mTLS-Listener-IP (für peer_ipv4-Set)
-	MgmtIP     string `json:"mgmt_ip"`      // optional
-	Version    string `json:"version"`
+	ID         string  `json:"id"`           // Joiner's eigene node-id
+	Name       string  `json:"name"`         // hostname
+	FQDN       string  `json:"fqdn"`         // sollte mit Client-Cert-CN matchen
+	APIURL     string  `json:"api_url"`      // https://<fqdn>
+	PublicIP   string  `json:"public_ip"`    // optional
+	InternalIP string  `json:"internal_ip"`  // mTLS-Listener-IP (für peer_ipv4-Set)
+	MgmtIP     string  `json:"mgmt_ip"`      // optional
+	Version    string  `json:"version"`
+	ConfigHash *string `json:"config_hash"`  // nil=absent (don't change), ""=no user config
 }

 // AgentRegisterPeer: vom Joiner nach issue-cert via mTLS aufgerufen.
@@ -693,6 +886,9 @@ func (h *ClusterHandler) AgentRegisterPeer(c *gin.Context) {
 		v := req.Version
 		n.Version = &v
 	}
+	if req.ConfigHash != nil {
+		n.ConfigHash = req.ConfigHash
+	}
 	// Placeholder zuerst löschen: ha_nodes hat UNIQUE(fqdn). Der INSERT
 	// in UpsertSelf verwendet ON CONFLICT(id) — greift NICHT bei fqdn-
 	// Konflikten. Ohne das Delete würde der INSERT mit "duplicate key on
--- a/internal/handlers/cluster_rollingupdate.go
+++ b/internal/handlers/cluster_rollingupdate.go
@@ -0,0 +1,258 @@
+package handlers
+
+import (
+	"context"
+	"encoding/json"
+	"log/slog"
+	"net/http"
+	"os"
+	"os/exec"
+	"time"
+
+	"github.com/gin-gonic/gin"
+
+	"git.netcell-it.de/projekte/edgeguard-native/internal/handlers/response"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/models"
+)
+
+const rollingUpdateStateFile = "/var/lib/edgeguard/rolling-update-state.json"
+
+const (
+	phaseIdle              = "idle"
+	phaseUpdatingSecondary = "updating-secondary"
+	phaseWaitingSecondary  = "waiting-secondary"
+	phaseUpdatingPrimary   = "updating-primary"
+	phaseDone              = "done"
+	phaseFailed            = "failed"
+)
+
+// FinishRollingUpdateIfPending wird beim API-Start aufgerufen. Wenn die
+// State-Datei "updating-primary" enthält, bedeutet das dass der Primary
+// gerade erfolgreich neugestartet ist → Update abgeschlossen → "done" schreiben.
+func FinishRollingUpdateIfPending() {
+	st := readRollingUpdateState()
+	if st.Phase == phaseUpdatingPrimary {
+		writeRollingUpdateState(RollingUpdateState{
+			Phase:         phaseDone,
+			SecondaryID:   st.SecondaryID,
+			SecondaryFQDN: st.SecondaryFQDN,
+		})
+	}
+}
+
+// RollingUpdateState hält den Fortschritt des Rolling-Updates.
+// Persistiert in rollingUpdateStateFile damit der Status über
+// einen kurzen API-Neustart hinaus lesbar bleibt.
+type RollingUpdateState struct {
+	Phase         string    `json:"phase"`
+	SecondaryID   string    `json:"secondary_id,omitempty"`
+	SecondaryFQDN string    `json:"secondary_fqdn,omitempty"`
+	StartedAt     time.Time `json:"started_at,omitempty"`
+	UpdatedAt     time.Time `json:"updated_at"`
+	Error         string    `json:"error,omitempty"`
+}
+
+func readRollingUpdateState() RollingUpdateState {
+	data, err := os.ReadFile(rollingUpdateStateFile)
+	if err != nil {
+		return RollingUpdateState{Phase: phaseIdle, UpdatedAt: time.Now()}
+	}
+	var s RollingUpdateState
+	if err := json.Unmarshal(data, &s); err != nil {
+		return RollingUpdateState{Phase: phaseIdle, UpdatedAt: time.Now()}
+	}
+	return s
+}
+
+func writeRollingUpdateState(s RollingUpdateState) {
+	s.UpdatedAt = time.Now()
+	data, err := json.Marshal(s)
+	if err != nil {
+		slog.Warn("rolling-update: failed to marshal state", "error", err)
+		return
+	}
+	if err := os.WriteFile(rollingUpdateStateFile, data, 0o600); err != nil {
+		slog.Warn("rolling-update: failed to write state file", "error", err)
+	}
+}
+
+// RollingUpdate startet den Rolling-Update-Prozess:
+// 1. Secondary aktualisieren (via mTLS /agent/cluster/trigger-update)
+// 2. Warten bis Secondary neue Version meldet
+// 3. Primary (dieser Node) aktualisieren (wie /system/upgrade)
+//
+// Kein Cluster vorhanden → 409 zurück damit der Client auf /system/upgrade
+// ausweichen kann. Wenn bereits ein Rolling-Update läuft → aktuellen State.
+func (h *ClusterHandler) RollingUpdate(c *gin.Context) {
+	if h.Aggregator == nil || h.Store == nil {
+		c.JSON(http.StatusConflict, gin.H{"error": "no cluster — use /system/upgrade"})
+		return
+	}
+
+	st := readRollingUpdateState()
+	if st.Phase != phaseIdle && st.Phase != phaseFailed && st.Phase != phaseDone {
+		response.OK(c, st)
+		return
+	}
+
+	nodes, err := h.Store.List(c.Request.Context())
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	var secondary *models.HANode
+	for i := range nodes {
+		if nodes[i].ID != h.LocalID {
+			secondary = &nodes[i]
+			break
+		}
+	}
+	if secondary == nil {
+		c.JSON(http.StatusConflict, gin.H{"error": "no peer node — use /system/upgrade"})
+		return
+	}
+
+	newState := RollingUpdateState{
+		Phase:         phaseUpdatingSecondary,
+		SecondaryID:   secondary.ID,
+		SecondaryFQDN: secondary.FQDN,
+		StartedAt:     time.Now(),
+	}
+	writeRollingUpdateState(newState)
+	slog.Info("rolling-update: started", "secondary", secondary.FQDN)
+
+	go h.runRollingUpdate(secondary)
+
+	c.JSON(http.StatusAccepted, newState)
+}
+
+// RollingUpdateStatus gibt den aktuellen Rolling-Update-State zurück.
+// Bei phase == "done" wird nach Auslieferung sofort auf idle zurückgesetzt
+// damit der nächste Pageload keinen Stale-done vorfindet.
+func (h *ClusterHandler) RollingUpdateStatus(c *gin.Context) {
+	st := readRollingUpdateState()
+	response.OK(c, st)
+	if st.Phase == phaseDone {
+		writeRollingUpdateState(RollingUpdateState{Phase: phaseIdle})
+	}
+}
+
+func (h *ClusterHandler) runRollingUpdate(secondary *models.HANode) {
+	ctx := context.Background()
+
+	// 1. Secondary triggern
+	slog.Info("rolling-update: posting trigger-update to secondary", "fqdn", secondary.FQDN)
+	result := h.Aggregator.PostPeer(ctx, *secondary, "/agent/cluster/trigger-update")
+	if !result.OK {
+		writeRollingUpdateState(RollingUpdateState{
+			Phase:         phaseFailed,
+			SecondaryID:   secondary.ID,
+			SecondaryFQDN: secondary.FQDN,
+			Error:         "trigger-update failed: " + result.Err,
+		})
+		slog.Warn("rolling-update: secondary trigger failed", "error", result.Err)
+		return
+	}
+
+	// 2. Secondary-Version pollen — der Secondary restartet nach dem
+	//    Upgrade, danach zeigt /agent/cluster/version eine neue Version.
+	writeRollingUpdateState(RollingUpdateState{
+		Phase:         phaseWaitingSecondary,
+		SecondaryID:   secondary.ID,
+		SecondaryFQDN: secondary.FQDN,
+	})
+	slog.Info("rolling-update: waiting for secondary version flip")
+
+	// Kurze Wartezeit damit apt auf dem Secondary erst losläuft
+	time.Sleep(20 * time.Second)
+
+	deadline := time.Now().Add(10 * time.Minute)
+	versionFlipped := false
+	for time.Now().Before(deadline) {
+		results := h.Aggregator.FanOut(ctx, []models.HANode{*secondary}, "/agent/cluster/version", h.LocalID)
+		if len(results) > 0 && results[0].OK {
+			var ver struct {
+				Version string `json:"version"`
+			}
+			if err := json.Unmarshal(results[0].Data, &ver); err == nil {
+				slog.Info("rolling-update: secondary version", "version", ver.Version, "primary", h.Version)
+				if ver.Version != h.Version {
+					versionFlipped = true
+					break
+				}
+			}
+		}
+		time.Sleep(10 * time.Second)
+	}
+
+	if !versionFlipped {
+		writeRollingUpdateState(RollingUpdateState{
+			Phase:         phaseFailed,
+			SecondaryID:   secondary.ID,
+			SecondaryFQDN: secondary.FQDN,
+			Error:         "timeout (10 min) waiting for secondary version flip",
+		})
+		slog.Warn("rolling-update: secondary version flip timeout")
+		return
+	}
+
+	// 3. Primary (uns selbst) aktualisieren — identisch zu /system/upgrade
+	writeRollingUpdateState(RollingUpdateState{
+		Phase:         phaseUpdatingPrimary,
+		SecondaryID:   secondary.ID,
+		SecondaryFQDN: secondary.FQDN,
+	})
+	slog.Info("rolling-update: triggering primary self-upgrade")
+
+	const scriptPath = "/var/lib/edgeguard/upgrade.sh"
+	const script = `#!/bin/bash
+set -e
+sleep 2
+export DEBIAN_FRONTEND=noninteractive
+dpkg --configure -a || true
+retry_apt() {
+    local attempt=0 max=3 wait_for=15
+    while [ $attempt -lt $max ]; do
+        attempt=$((attempt + 1))
+        apt-get update -qq || true
+        if apt-get install -y -qq -o Dpkg::Options::=--force-confold \
+            edgeguard-api edgeguard-ui edgeguard; then return 0; fi
+        [ $attempt -lt $max ] && sleep $wait_for && wait_for=$((wait_for * 2))
+    done
+    return 1
+}
+retry_apt
+echo "[upgrade] complete"
+rm -f /var/lib/edgeguard/upgrade.sh
+`
+	if err := os.WriteFile(scriptPath, []byte(script), 0o755); err != nil {
+		writeRollingUpdateState(RollingUpdateState{
+			Phase:         phaseFailed,
+			SecondaryID:   secondary.ID,
+			SecondaryFQDN: secondary.FQDN,
+			Error:         "write upgrade script: " + err.Error(),
+		})
+		return
+	}
+
+	const unitName = "edgeguard-upgrade.service"
+	_ = exec.Command("sudo", "-n", "/usr/bin/systemctl", "reset-failed", unitName).Run()
+	cmd := exec.Command("sudo", "-n", "/usr/bin/systemd-run",
+		"--unit="+unitName,
+		"--description=EdgeGuard self-upgrade",
+		"--collect",
+		"bash", scriptPath)
+	if err := cmd.Run(); err != nil {
+		writeRollingUpdateState(RollingUpdateState{
+			Phase:         phaseFailed,
+			SecondaryID:   secondary.ID,
+			SecondaryFQDN: secondary.FQDN,
+			Error:         "systemd-run failed: " + err.Error(),
+		})
+		slog.Warn("rolling-update: primary systemd-run failed", "error", err)
+		return
+	}
+	// State bleibt "updating-primary" — der Primary restartet gleich.
+	// UI erkennt Version-Flip via /system/health und schließt den Flow.
+	slog.Info("rolling-update: primary upgrade dispatched, process will restart")
+}
--- a/internal/keepalived/keepalived.conf.tpl
+++ b/internal/keepalived/keepalived.conf.tpl
@@ -0,0 +1,40 @@
+global_defs {
+    router_id {{ .RouterID }}
+    script_user root
+    enable_script_security
+    vrrp_garp_interval 0
+    vrrp_gna_interval 0
+}
+
+vrrp_script chk_edgeguard {
+    script "/usr/lib/edgeguard/keepalived-check.sh"
+    interval 2
+    weight -50
+    fall 3
+    rise 2
+}
+
+vrrp_instance VI_1 {
+    state {{ .State }}
+    interface {{ .Interface }}
+    virtual_router_id {{ .RouterID }}
+    priority {{ .Priority }}
+    advert_int 1
+{{ if .SrcIP }}    unicast_src_ip {{ .SrcIP }}
+    unicast_peer {
+        {{ .PeerIP }}
+    }
+{{ end }}    authentication {
+        auth_type PASS
+        auth_pass {{ .AuthPass }}
+    }
+    virtual_ipaddress {
+        {{ .VIP }}
+    }
+    track_script {
+        chk_edgeguard
+    }
+    notify_master  "/usr/lib/edgeguard/keepalived-master.sh"
+    notify_backup  "/usr/lib/edgeguard/keepalived-backup.sh"
+    notify_fault   "/usr/lib/edgeguard/keepalived-backup.sh"
+}
--- a/internal/keepalived/keepalived.go
+++ b/internal/keepalived/keepalived.go
@@ -0,0 +1,154 @@
+// Package keepalived rendert /etc/keepalived/keepalived.conf aus
+// cluster_settings (VIP/VRRP-Config) und ha_nodes (local vs. peer).
+//
+// Split-Brain-Strategie: kein Auto-Promote. notify_master loggt nur
+// und sendet einen internen Alert. Promotion ist immer manuell via
+// "edgeguard-ctl promote" — das ist die einzig sichere Option ohne
+// externes Quorum in einem 2-Node-Cluster.
+package keepalived
+
+import (
+	"bytes"
+	"context"
+	_ "embed"
+	"fmt"
+	"os"
+	"os/exec"
+	"text/template"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"git.netcell-it.de/projekte/edgeguard-native/internal/configgen"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/models"
+)
+
+const ConfPath = "/etc/keepalived/keepalived.conf"
+
+//go:embed keepalived.conf.tpl
+var cfgTpl string
+
+var tpl = template.Must(template.New("keepalived").Parse(cfgTpl))
+
+// View ist der Template-Kontext.
+type View struct {
+	State    string // MASTER | BACKUP
+	Interface string
+	RouterID int
+	Priority int    // MASTER=200, BACKUP=100
+	SrcIP    string // eigene Public-IP (für unicast_src_ip)
+	PeerIP   string // Peer-Public-IP (für unicast_peer)
+	AuthPass string
+	VIP      string
+}
+
+type generator struct {
+	pool    *pgxpool.Pool
+	localID string
+}
+
+func New(pool *pgxpool.Pool, localID string) configgen.Generator {
+	return &generator{pool: pool, localID: localID}
+}
+
+func (g *generator) Name() string { return "keepalived" }
+
+func (g *generator) Render(ctx context.Context) error {
+	cs, local, peer, err := g.loadData(ctx)
+	if err != nil {
+		return fmt.Errorf("keepalived: load: %w", err)
+	}
+	if cs.VIPAddress == nil || *cs.VIPAddress == "" {
+		// Kein VIP konfiguriert → keepalived.conf nicht schreiben.
+		return nil
+	}
+	v := g.buildView(cs, local, peer)
+	var buf bytes.Buffer
+	if err := tpl.Execute(&buf, v); err != nil {
+		return fmt.Errorf("keepalived: template: %w", err)
+	}
+	if err := configgen.AtomicWrite(ConfPath, buf.Bytes(), 0o640); err != nil {
+		return fmt.Errorf("keepalived: write: %w", err)
+	}
+	if err := reloadKeepalived(); err != nil {
+		return fmt.Errorf("keepalived: reload: %w", err)
+	}
+	return nil
+}
+
+func (g *generator) loadData(ctx context.Context) (*models.ClusterSettings, *models.HANode, *models.HANode, error) {
+	var cs models.ClusterSettings
+	row := g.pool.QueryRow(ctx, `SELECT id, vip_address, vip_interface, vip_auth_pass, vrrp_router_id FROM cluster_settings WHERE id = 1`)
+	if err := row.Scan(&cs.ID, &cs.VIPAddress, &cs.VIPInterface, &cs.VIPAuthPass, &cs.VRRPRouterID); err != nil {
+		return nil, nil, nil, fmt.Errorf("cluster_settings: %w", err)
+	}
+
+	rows, err := g.pool.Query(ctx, `SELECT id, fqdn, role, pg_role, public_ip, status FROM ha_nodes ORDER BY joined_at`)
+	if err != nil {
+		return nil, nil, nil, fmt.Errorf("ha_nodes: %w", err)
+	}
+	defer rows.Close()
+
+	var local, peer *models.HANode
+	for rows.Next() {
+		n := &models.HANode{}
+		if err := rows.Scan(&n.ID, &n.FQDN, &n.Role, &n.PGRole, &n.PublicIP, &n.Status); err != nil {
+			continue
+		}
+		if n.ID == g.localID {
+			local = n
+		} else {
+			peer = n
+		}
+	}
+	if local == nil {
+		return nil, nil, nil, fmt.Errorf("local node %s not in ha_nodes", g.localID)
+	}
+	return &cs, local, peer, nil
+}
+
+func (g *generator) buildView(cs *models.ClusterSettings, local, peer *models.HANode) View {
+	v := View{
+		RouterID: cs.VRRPRouterID,
+		VIP:      deref(cs.VIPAddress),
+		Interface: deref(cs.VIPInterface),
+		AuthPass: deref(cs.VIPAuthPass),
+	}
+	if v.Interface == "" {
+		v.Interface = "eth0"
+	}
+	if v.AuthPass == "" {
+		v.AuthPass = "edgeguard"
+	}
+
+	// Primary-Node bekommt höhere Priorität und startet als MASTER.
+	if local.PGRole == "primary" || local.Role == "primary" {
+		v.State = "MASTER"
+		v.Priority = 200
+	} else {
+		v.State = "BACKUP"
+		v.Priority = 100
+	}
+
+	if local.PublicIP != nil {
+		v.SrcIP = *local.PublicIP
+	}
+	if peer != nil && peer.PublicIP != nil {
+		v.PeerIP = *peer.PublicIP
+	}
+	return v
+}
+
+func reloadKeepalived() error {
+	if _, err := os.Stat("/run/keepalived.pid"); os.IsNotExist(err) {
+		// keepalived läuft noch nicht — erster Render beim Start.
+		return nil
+	}
+	return exec.Command("systemctl", "reload-or-restart", "keepalived").Run()
+}
+
+func deref(s *string) string {
+	if s == nil {
+		return ""
+	}
+	return *s
+}
--- a/internal/models/cluster_settings.go
+++ b/internal/models/cluster_settings.go
@@ -0,0 +1,17 @@
+package models
+
+import "time"
+
+// ClusterSettings ist die Singleton-Tabelle (id=1) für VIP/VRRP-
+// und Replikations-Konfiguration. Angelegt in Migration 0029.
+type ClusterSettings struct {
+	ID           int       `gorm:"column:id;primaryKey"   json:"id"`
+	VIPAddress   *string   `gorm:"column:vip_address"     json:"vip_address,omitempty"`
+	VIPInterface *string   `gorm:"column:vip_interface"   json:"vip_interface,omitempty"`
+	VIPAuthPass  *string   `gorm:"column:vip_auth_pass"   json:"vip_auth_pass,omitempty"`
+	VRRPRouterID int       `gorm:"column:vrrp_router_id"  json:"vrrp_router_id"`
+	CreatedAt    time.Time `gorm:"column:created_at"      json:"created_at"`
+	UpdatedAt    time.Time `gorm:"column:updated_at"      json:"updated_at"`
+}
+
+func (ClusterSettings) TableName() string { return "cluster_settings" }
--- a/internal/models/ha_node.go
+++ b/internal/models/ha_node.go
@@ -4,7 +4,7 @@ import "time"

 // HANode mirrort eine Row der ha_nodes-Tabelle. Erweitert in Migration
 // 0020 um version/config_hash/mgmt_ip/status für Cluster-Phase-3-
-// Drift-Detection + Health-State.
+// Drift-Detection + Health-State. Migration 0029 fügt PGRole hinzu.
 type HANode struct {
 	ID         string     `gorm:"column:id;primaryKey"           json:"id"`
 	Name       string     `gorm:"column:name"                    json:"name"`
@@ -14,6 +14,7 @@ type HANode struct {
 	InternalIP *string    `gorm:"column:internal_ip;type:inet"   json:"internal_ip,omitempty"`
 	MgmtIP     *string    `gorm:"column:mgmt_ip;type:inet"       json:"mgmt_ip,omitempty"`
 	Role       string     `gorm:"column:role"                    json:"role"`
+	PGRole     string     `gorm:"column:pg_role"                 json:"pg_role"`
 	Version    *string    `gorm:"column:version"                 json:"version,omitempty"`
 	ConfigHash *string    `gorm:"column:config_hash"             json:"config_hash,omitempty"`
 	Status     string     `gorm:"column:status"                  json:"status"`
--- a/internal/services/clusterjoin/join.go
+++ b/internal/services/clusterjoin/join.go
@@ -128,7 +128,7 @@ func Join(req Request) error {
 	// synchronous on the primary side.
 	var autoRegErr error
 	for i := 0; i < 3; i++ {
-		if err := autoRegister(primary, tlsDir, req.CommonName, req.Version, req.NodeID); err == nil {
+		if err := autoRegister(primary, tlsDir, req.CommonName, req.Version, req.NodeID, ""); err == nil {
 			autoRegErr = nil
 			break
 		} else {
@@ -217,7 +217,18 @@ func issueCert(primary, token, csr string, insecure bool) (caCert, peerCert stri
 	return env.Data.CACert, env.Data.PeerCert, nil
 }

-func autoRegister(primary, tlsDir, commonName, version, nodeID string) error {
+// PushSelfToPrimary sends this node's current identity + configHash to the
+// primary via mTLS. Exported for use by the API server's periodic push
+// goroutine so the primary's ha_nodes always reflects the secondary's actual
+// config_hash (not the stale join-time value).
+func PushSelfToPrimary(primaryURL, tlsDir, nodeID, fqdn, version, configHash string) error {
+	if tlsDir == "" {
+		tlsDir = clustertls.DefaultDir
+	}
+	return autoRegister(primaryURL, tlsDir, fqdn, version, nodeID, configHash)
+}
+
+func autoRegister(primary, tlsDir, commonName, version, nodeID, configHash string) error {
 	u, err := url.Parse(primary)
 	if err != nil {
 		return err
@@ -231,11 +242,12 @@ func autoRegister(primary, tlsDir, commonName, version, nodeID string) error {
 	}
 	hostname, _ := os.Hostname()
 	body, _ := json.Marshal(map[string]string{
-		"id":      nodeID,
-		"name":    hostname,
-		"fqdn":    commonName,
-		"api_url": "https://" + commonName + ":3443",
-		"version": version,
+		"id":          nodeID,
+		"name":        hostname,
+		"fqdn":        commonName,
+		"api_url":     "https://" + commonName + ":3443",
+		"version":     version,
+		"config_hash": configHash,
 	})

 	pair, err := tls.LoadX509KeyPair(tlsDir+"/peer.crt", tlsDir+"/peer.key")
--- a/management-ui/src/components/UpdateBanner.tsx
+++ b/management-ui/src/components/UpdateBanner.tsx
@@ -1,5 +1,5 @@
-import { Alert, Button, Popconfirm, Space, Tooltip, message } from 'antd'
-import { CloudDownloadOutlined, ReloadOutlined, RocketOutlined } from '@ant-design/icons'
+import { Alert, Button, Popconfirm, Tooltip, message } from 'antd'
+import { CloudDownloadOutlined, ReloadOutlined, RocketOutlined, ClusterOutlined } from '@ant-design/icons'
 import { useQuery } from '@tanstack/react-query'
 import { useEffect, useRef, useState } from 'react'
 import { useTranslation } from 'react-i18next'
@@ -20,6 +20,19 @@ interface SystemHealth { status: string; version: string }

 interface PendingUpdate { pkg: string; installed: string; available: string }

+interface ClusterStatus {
+  mode: string   // "single-node" | "cluster"
+  peers: Array<{ id: string; fqdn: string }>
+}
+
+interface RollingUpdateState {
+  phase: string         // idle | updating-secondary | waiting-secondary | updating-primary | failed
+  secondary_fqdn: string
+  secondary_id: string
+  error?: string
+  updated_at: string
+}
+
 // allUpdates parsed das flache map-Format ({pkg_installed,pkg_available})
 // das /system/package-versions zurückliefert. Eines davon ist meist
 // das meta-Paket "edgeguard" → die "Ziel-Version".
@@ -53,6 +66,46 @@ export default function UpdateBanner({ compact = false }: UpdateBannerProps = {}
    gcTime: 0,
  })

+  const clusterStatus = useQuery({
+    queryKey: ['cluster', 'status-update-banner'],
+    queryFn: async () => {
+      try {
+        const r = await apiClient.get('/cluster/status')
+        return isEnvelope(r.data) ? (r.data.data as ClusterStatus) : null
+      } catch {
+        return null
+      }
+    },
+    refetchInterval: 60_000,
+    staleTime: 30_000,
+  })
+
+  const rollingStatus = useQuery({
+    queryKey: ['cluster', 'rolling-update-status'],
+    queryFn: async () => {
+      try {
+        const r = await apiClient.get('/cluster/rolling-update/status')
+        return isEnvelope(r.data) ? (r.data.data as RollingUpdateState) : null
+      } catch {
+        return null
+      }
+    },
+    refetchInterval: 5_000,
+    staleTime: 0,
+    gcTime: 0,
+  })
+
+  const isCluster = clusterStatus.data?.mode === 'cluster'
+  const rollingPhase = rollingStatus.data?.phase ?? 'idle'
+  const rollingActive = rollingPhase !== 'idle' && rollingPhase !== 'failed' && rollingPhase !== 'done'
+  const secondaryFQDN = rollingStatus.data?.secondary_fqdn ?? ''
+
+  // Verhindert dass ein stale "done" aus einer vorherigen Session sofort
+  // einen Reload auslöst. Nur wenn rollingActive in DIESER Session true
+  // war, reagieren wir auf "done".
+  const wasRollingActiveRef = useRef(false)
+
+  // Normal single-node upgrade state
  const [upgrading, setUpgrading] = useState(false)
  const [upgradeElapsed, setUpgradeElapsed] = useState(0)
  const [forceChecking, setForceChecking] = useState(false)
@@ -61,11 +114,62 @@ export default function UpdateBanner({ compact = false }: UpdateBannerProps = {}
  const installedRef = useRef<string>('')
  const targetRef = useRef<string>('')

+  // Rolling update elapsed counter
+  const [rollingElapsed, setRollingElapsed] = useState(0)
+  const rollingTickRef = useRef<ReturnType<typeof setInterval> | null>(null)
+
  useEffect(() => () => {
    if (upgradePollRef.current) clearInterval(upgradePollRef.current)
    if (upgradeTickRef.current) clearInterval(upgradeTickRef.current)
+    if (rollingTickRef.current) clearInterval(rollingTickRef.current)
  }, [])

+  // Start rolling elapsed timer when rolling becomes active
+  useEffect(() => {
+    if (rollingActive) {
+      wasRollingActiveRef.current = true
+      if (!rollingTickRef.current) {
+        setRollingElapsed(0)
+        rollingTickRef.current = setInterval(() => setRollingElapsed(e => e + 1), 1000)
+      }
+    } else if (!rollingActive && rollingTickRef.current) {
+      clearInterval(rollingTickRef.current)
+      rollingTickRef.current = null
+    }
+  }, [rollingActive])
+
+  // "done": nur reagieren wenn wir in DIESER Session rollingActive gesehen
+  // haben — sonst würde ein stale "done" sofort einen Reload auslösen.
+  useEffect(() => {
+    if (rollingPhase === 'done' && wasRollingActiveRef.current) {
+      msg.success(t('update.success', { version: targetRef.current || '…' }))
+      setTimeout(() => window.location.reload(), 1500)
+    }
+  }, [rollingPhase, msg, t])
+
+  // Fallback: wenn "updating-primary" und die API noch antwortet (Primary
+  // schon neu gestartet bevor das UI die Phase gesehen hat), poll auf "done".
+  useEffect(() => {
+    if (rollingPhase === 'updating-primary') {
+      let sawDown = false
+      const poll = setInterval(async () => {
+        try {
+          const res = await apiClient.get('/system/health')
+          const newV = isEnvelope(res.data) ? (res.data.data as SystemHealth).version : ''
+          if (sawDown && newV) {
+            clearInterval(poll)
+            void rollingStatus.refetch()
+          }
+        } catch {
+          sawDown = true
+        }
+      }, 3000)
+      // Safety: nach 2 Min einfach reload
+      const safety = setTimeout(() => { clearInterval(poll); window.location.reload() }, 120_000)
+      return () => { clearInterval(poll); clearTimeout(safety) }
+    }
+  }, [rollingPhase, rollingStatus])
+
  const data = pkgVersions.data ?? {}
  const updates = allUpdates(data)
  const updateAvailable = updates.length > 0
@@ -76,14 +180,8 @@ export default function UpdateBanner({ compact = false }: UpdateBannerProps = {}
  const forceCheck = async () => {
    setForceChecking(true)
    try {
-      // ?force=1: bypassed den Server-seitigen 5-min-Throttle für
-      // apt-get update. Ohne den Force-Hint würde der Endpoint
-      // einfach den letzten Cache zurückliefern (max. 5 min alt) und
-      // der Button fühlt sich kaputt an. Pattern aus mail-gateway.
      const r = await apiClient.get('/system/package-versions?force=1')
      const fresh = (isEnvelope(r.data) ? (r.data.data as PackageVersions) : {})
-      // useQuery-Cache mit dem frischen Wert füttern damit der Banner
-      // sofort umschaltet, ohne auf die nächste 30s-Welle zu warten.
      void pkgVersions.refetch()
      const found = allUpdates(fresh).length > 0
      msg[found ? 'success' : 'info'](
@@ -105,8 +203,6 @@ export default function UpdateBanner({ compact = false }: UpdateBannerProps = {}

    apiClient.post('/system/upgrade')
      .then(() => {
-        // Poll /healthz (kein Auth, robust auch wenn die API gerade
-        // restartet und Cookie ihre Session nicht erkennt).
        let sawDown = false
        upgradePollRef.current = setInterval(async () => {
          try {
@@ -121,14 +217,9 @@ export default function UpdateBanner({ compact = false }: UpdateBannerProps = {}
              setTimeout(() => window.location.reload(), 1500)
            }
          } catch {
-            // Connection refused / 502 → API restartet. Beim nächsten
-            // erfolgreichen Poll erkennen wir den Version-Flip.
            sawDown = true
          }
        }, 3000)
-        // Sicherheits-Timeout: nach 2 Min einfach reload — falls der
-        // Restart länger braucht als erwartet, kommt die UI in jedem
-        // Fall wieder hoch.
        setTimeout(() => {
          if (upgradePollRef.current) clearInterval(upgradePollRef.current)
          if (upgradeTickRef.current) clearInterval(upgradeTickRef.current)
@@ -144,13 +235,19 @@ export default function UpdateBanner({ compact = false }: UpdateBannerProps = {}
      })
  }

+  const startRollingUpdate = () => {
+    installedRef.current = installedVersion
+    targetRef.current = targetVersion
+    apiClient.post('/cluster/rolling-update')
+      .then(() => {
+        void rollingStatus.refetch()
+      })
+      .catch((e: Error) => {
+        msg.error(t('update.failed') + ': ' + e.message)
+      })
+  }
+
  if (compact) {
-    // Compact-Variante: Force-Check-Button für "ich will jetzt prüfen",
-    // wenn aktuell NICHTS ausstehendes da ist. Sobald ein Update
-    // verfügbar ist, übernimmt der gelbe Full-Mode-Banner (in
-    // AppLayout) die Sichtbarkeit — wir blenden den Compact-Button
-    // dann komplett aus, sonst doppelt-doppelt Info (Befund 2026-05-15:
-    // "die roten Banner können weg, der gelbe Banner reicht").
    if (updateAvailable) {
      return <>{msgCtx}</>
    }
@@ -171,7 +268,7 @@ export default function UpdateBanner({ compact = false }: UpdateBannerProps = {}
    )
  }

-  if (!updateAvailable && !upgrading) {
+  if (!updateAvailable && !upgrading && !rollingActive) {
    return <>{msgCtx}</>
  }

@@ -179,38 +276,43 @@ export default function UpdateBanner({ compact = false }: UpdateBannerProps = {}
    <>
      {msgCtx}

-      {updateAvailable && !upgrading && (
+      {updateAvailable && !upgrading && !rollingActive && (
        <Alert
          type="warning"
          banner
          showIcon
          icon={<CloudDownloadOutlined />}
-          message={t('update.available', { version: targetVersion })}
-          description={updates.length > 1
-            ? t('update.multiPackageHint', { count: updates.length })
-            : undefined}
-          action={
-            <Space>
-              <Button
-                size="small"
-                icon={<ReloadOutlined />}
-                loading={forceChecking}
-                onClick={forceCheck}
-              >
-                {t('update.checkNow')}
-              </Button>
-              <Popconfirm
-                title={t('update.confirmTitle')}
-                description={t('update.confirmDesc', { version: targetVersion })}
-                okText={t('update.applyNow')}
-                cancelText={t('common.cancel')}
-                onConfirm={startUpgrade}
-              >
-                <Button size="small" type="primary" icon={<CloudDownloadOutlined />}>
-                  {t('update.applyNow')}
-                </Button>
-              </Popconfirm>
-            </Space>
+          message={
+            <div className="update-banner-row">
+              <span>{t('update.available', { version: targetVersion })}</span>
+              {isCluster ? (
+                <Popconfirm
+                  title={t('update.rollingConfirmTitle')}
+                  description={t('update.rollingConfirmDesc', {
+                    secondary: clusterStatus.data?.peers?.[0]?.fqdn ?? 'secondary',
+                  })}
+                  okText={t('update.rollingUpdate')}
+                  cancelText={t('common.cancel')}
+                  onConfirm={startRollingUpdate}
+                >
+                  <Button size="small" type="primary" icon={<ClusterOutlined />}>
+                    Rolling Update
+                  </Button>
+                </Popconfirm>
+              ) : (
+                <Popconfirm
+                  title={t('update.confirmTitle')}
+                  description={t('update.confirmDesc', { version: targetVersion })}
+                  okText={t('update.applyNow')}
+                  cancelText={t('common.cancel')}
+                  onConfirm={startUpgrade}
+                >
+                  <Button size="small" type="primary" icon={<CloudDownloadOutlined />}>
+                    {t('update.applyNow')}
+                  </Button>
+                </Popconfirm>
+              )}
+            </div>
          }
        />
      )}
@@ -234,26 +336,10 @@ export default function UpdateBanner({ compact = false }: UpdateBannerProps = {}
            </div>

            <div className="update-modal__steps">
-              <Step
-                done={upgradeElapsed >= 5}
-                active={upgradeElapsed < 5}
-                label={t('update.stepDownload')}
-              />
-              <Step
-                done={upgradeElapsed >= 15}
-                active={upgradeElapsed >= 5 && upgradeElapsed < 15}
-                label={t('update.stepInstall')}
-              />
-              <Step
-                done={upgradeElapsed >= 25}
-                active={upgradeElapsed >= 15 && upgradeElapsed < 25}
-                label={t('update.stepRestart')}
-              />
-              <Step
-                done={false}
-                active={upgradeElapsed >= 25}
-                label={t('update.stepVerify')}
-              />
+              <Step done={upgradeElapsed >= 5} active={upgradeElapsed < 5} label={t('update.stepDownload')} />
+              <Step done={upgradeElapsed >= 15} active={upgradeElapsed >= 5 && upgradeElapsed < 15} label={t('update.stepInstall')} />
+              <Step done={upgradeElapsed >= 25} active={upgradeElapsed >= 15 && upgradeElapsed < 25} label={t('update.stepRestart')} />
+              <Step done={false} active={upgradeElapsed >= 25} label={t('update.stepVerify')} />
            </div>

            <div className="update-modal__timer">{upgradeElapsed}s</div>
@@ -261,6 +347,54 @@ export default function UpdateBanner({ compact = false }: UpdateBannerProps = {}
          </div>
        </div>
      )}
+
+      {rollingActive && (
+        <div className="update-modal-overlay">
+          <div className="update-modal">
+            <div className="update-modal__orbit">
+              <div className="update-modal__ring" />
+              <div className="update-modal__ring update-modal__ring--2" />
+              <div className="update-modal__dot" />
+              <div className="update-modal__dot update-modal__dot--2" />
+              <div className="update-modal__center">
+                <ClusterOutlined className="update-modal__icon" />
+              </div>
+            </div>
+
+            <div className="update-modal__title">{t('update.rollingRunning')}</div>
+            <div className="update-modal__version">
+              v{installedRef.current || '…'} → v{targetRef.current || '…'}
+            </div>
+
+            <div className="update-modal__steps">
+              <Step
+                done={rollingPhase === 'waiting-secondary' || rollingPhase === 'updating-primary'}
+                active={rollingPhase === 'updating-secondary'}
+                label={t('update.rollingStepSecondary', { fqdn: secondaryFQDN })}
+              />
+              <Step
+                done={rollingPhase === 'updating-primary'}
+                active={rollingPhase === 'waiting-secondary'}
+                label={t('update.rollingStepWaiting')}
+              />
+              <Step
+                done={false}
+                active={rollingPhase === 'updating-primary'}
+                label={t('update.rollingStepPrimary')}
+              />
+            </div>
+
+            <div className="update-modal__timer">{rollingElapsed}s</div>
+            <div className="update-modal__hint">{t('update.waitHint')}</div>
+
+            {rollingStatus.data?.error && (
+              <div className="update-modal__hint" style={{ color: '#ff4d4f' }}>
+                {rollingStatus.data.error}
+              </div>
+            )}
+          </div>
+        </div>
+      )}
    </>
  )
 }
--- a/management-ui/src/i18n/locales/de/common.json
+++ b/management-ui/src/i18n/locales/de/common.json
@@ -629,6 +629,7 @@
      "node": "Knoten",
      "status": "Status",
      "role": "Rolle",
+      "pgRole": "PG-Rolle",
      "apiUrl": "API-URL",
      "configHash": "Config-Hash",
      "version": "Version",
@@ -641,6 +642,30 @@
      "uptime": "Uptime",
      "fetchMs": "Fetch"
    },
+    "pgRole": {
+      "standalone": "standalone",
+      "primary": "primary",
+      "standby": "standby"
+    },
+    "vipCard": {
+      "title": "Hochverfügbarkeit (VIP / Keepalived)",
+      "vipAddress": "VIP-Adresse",
+      "vipAddressHelp": "Virtuelle IP-Adresse die zwischen Nodes wandert (z.B. 89.163.205.10)",
+      "vipInterface": "Netzwerk-Interface",
+      "vipInterfaceHelp": "Interface auf dem die VIP gebunden wird (z.B. eth0)",
+      "vipAuthPass": "VRRP Auth-Passwort",
+      "vipAuthPassHelp": "Max. 8 Zeichen — Keepalived-Limit. Gleich auf allen Nodes.",
+      "vrrpRouterId": "VRRP Router-ID",
+      "vrrpRouterIdHelp": "Muss im Subnetz eindeutig sein (1–255). Standard: 51.",
+      "saveBtn": "Speichern & Keepalived neu konfigurieren",
+      "saved": "VIP-Einstellungen gespeichert",
+      "saveFailed": "Speichern fehlgeschlagen",
+      "hintTitle": "Nächste Schritte nach dem Speichern",
+      "hintPrimary": "Auf dem Primary: edgeguard-ctl cluster-init-replication",
+      "hintStandby": "Auf dem Secondary: edgeguard-ctl cluster-setup-standby <primary-ip>",
+      "hintKeepalived": "Keepalived auf beiden Nodes: sudo systemctl enable --now keepalived",
+      "hintFailover": "Bei Failover: edgeguard-ctl promote (auf dem Secondary)"
+    },
    "loadTitle": "Per-Node Resources (mTLS-Aggregator)",
    "loadEmpty": "Keine Node-Resources verfügbar — Agent-Listener nicht erreichbar?",
    "certCardTitle": "Cluster-TLS-Zertifikate",
@@ -841,7 +866,14 @@
    "stepDownload": "Pakete laden",
    "stepInstall": "Installation",
    "stepRestart": "Service-Restart",
-    "stepVerify": "Verifizierung"
+    "stepVerify": "Verifizierung",
+    "rollingUpdate": "Rolling Update (Cluster)",
+    "rollingConfirmTitle": "Rolling Update starten?",
+    "rollingConfirmDesc": "Der Secondary-Node ({{secondary}}) wird zuerst aktualisiert, danach dieser Primary. Kein Ausfall für den Proxied-Traffic während der Secondary-Phase.",
+    "rollingRunning": "Rolling Update läuft…",
+    "rollingStepSecondary": "Secondary aktualisieren ({{fqdn}})",
+    "rollingStepWaiting": "Warte auf Neustart des Secondary",
+    "rollingStepPrimary": "Primary aktualisieren (dieser Node)"
  },
  "wg": {
    "title": "WireGuard",
--- a/management-ui/src/i18n/locales/en/common.json
+++ b/management-ui/src/i18n/locales/en/common.json
@@ -629,6 +629,7 @@
      "node": "Node",
      "status": "Status",
      "role": "Role",
+      "pgRole": "PG role",
      "apiUrl": "API URL",
      "configHash": "Config hash",
      "version": "Version",
@@ -641,6 +642,30 @@
      "uptime": "Uptime",
      "fetchMs": "Fetch"
    },
+    "pgRole": {
+      "standalone": "standalone",
+      "primary": "primary",
+      "standby": "standby"
+    },
+    "vipCard": {
+      "title": "High Availability (VIP / Keepalived)",
+      "vipAddress": "VIP address",
+      "vipAddressHelp": "Virtual IP address that moves between nodes (e.g. 89.163.205.10)",
+      "vipInterface": "Network interface",
+      "vipInterfaceHelp": "Interface to bind the VIP on (e.g. eth0)",
+      "vipAuthPass": "VRRP auth password",
+      "vipAuthPassHelp": "Max. 8 characters — Keepalived limit. Same on all nodes.",
+      "vrrpRouterId": "VRRP router ID",
+      "vrrpRouterIdHelp": "Must be unique in the subnet (1–255). Default: 51.",
+      "saveBtn": "Save & reconfigure Keepalived",
+      "saved": "VIP settings saved",
+      "saveFailed": "Failed to save",
+      "hintTitle": "Next steps after saving",
+      "hintPrimary": "On primary: edgeguard-ctl cluster-init-replication",
+      "hintStandby": "On secondary: edgeguard-ctl cluster-setup-standby <primary-ip>",
+      "hintKeepalived": "Keepalived on both nodes: sudo systemctl enable --now keepalived",
+      "hintFailover": "On failover: edgeguard-ctl promote (on the secondary node)"
+    },
    "loadTitle": "Per-node resources (mTLS aggregator)",
    "loadEmpty": "No node resources available — agent listener unreachable?",
    "certCardTitle": "Cluster TLS certificates",
@@ -841,7 +866,14 @@
    "stepDownload": "Download packages",
    "stepInstall": "Install",
    "stepRestart": "Service restart",
-    "stepVerify": "Verification"
+    "stepVerify": "Verification",
+    "rollingUpdate": "Rolling Update (Cluster)",
+    "rollingConfirmTitle": "Start Rolling Update?",
+    "rollingConfirmDesc": "The secondary node ({{secondary}}) is updated first, then this primary. No downtime for proxied traffic during the secondary phase.",
+    "rollingRunning": "Rolling update in progress…",
+    "rollingStepSecondary": "Updating secondary ({{fqdn}})",
+    "rollingStepWaiting": "Waiting for secondary restart",
+    "rollingStepPrimary": "Updating primary (this node)"
  },
  "wg": {
    "title": "WireGuard",
--- a/management-ui/src/pages/Cluster/index.tsx
+++ b/management-ui/src/pages/Cluster/index.tsx
@@ -22,6 +22,7 @@ interface HANode {
  internal_ip?: string | null
  mgmt_ip?: string | null
  role: string
+  pg_role: 'standalone' | 'primary' | 'standby'
  version?: string | null
  config_hash?: string | null
  status: 'online' | 'offline' | 'joining' | 'leaving' | 'unknown'
@@ -291,6 +292,13 @@ export default function ClusterPage() {
      title: t('cluster.col.role'), dataIndex: 'role', width: 110,
      render: (v: string) => <Tag color={v === 'primary' ? 'gold' : 'default'}>{v}</Tag>,
    },
+    {
+      title: t('cluster.col.pgRole'), dataIndex: 'pg_role', width: 110,
+      render: (v?: string) => {
+        if (!v || v === 'standalone') return <Tag>{t('cluster.pgRole.standalone')}</Tag>
+        return <Tag color={v === 'primary' ? 'blue' : 'cyan'}>{t(`cluster.pgRole.${v}`)}</Tag>
+      },
+    },
    {
      title: t('cluster.col.version'), dataIndex: 'version', width: 100,
      render: (v?: string | null) => v ? <Tag>{v}</Tag> : <Text type="secondary">—</Text>,
@@ -525,6 +533,13 @@ export default function ClusterPage() {
                  {data.local_node.role}
                </Tag>
              </Descriptions.Item>
+              <Descriptions.Item label={t('cluster.col.pgRole')}>
+                {(() => {
+                  const v = data.local_node.pg_role
+                  if (!v || v === 'standalone') return <Tag>{t('cluster.pgRole.standalone')}</Tag>
+                  return <Tag color={v === 'primary' ? 'blue' : 'cyan'}>{t(`cluster.pgRole.${v}`)}</Tag>
+                })()}
+              </Descriptions.Item>
              <Descriptions.Item label={t('cluster.col.version')}>
                {data.local_node.version ? <Tag>{data.local_node.version}</Tag> : '—'}
              </Descriptions.Item>
--- a/management-ui/src/pages/Settings/index.tsx
+++ b/management-ui/src/pages/Settings/index.tsx
@@ -1,5 +1,5 @@
 import { Alert, Button, Card, Descriptions, Form, Input, InputNumber, Popconfirm, Select, Space, Spin, Switch, Tooltip, Typography, message } from 'antd'
-import { CloudDownloadOutlined, CloudSyncOutlined, CodeOutlined, CopyOutlined, DatabaseOutlined, DownloadOutlined, ExclamationCircleOutlined, FileSearchOutlined, GlobalOutlined, LockOutlined, MailOutlined, ReloadOutlined, SettingOutlined, StopOutlined, ToolOutlined } from '@ant-design/icons'
+import { ApartmentOutlined, CloudDownloadOutlined, CloudSyncOutlined, CodeOutlined, CopyOutlined, DatabaseOutlined, DownloadOutlined, ExclamationCircleOutlined, FileSearchOutlined, GlobalOutlined, LockOutlined, MailOutlined, ReloadOutlined, SettingOutlined, StopOutlined, ToolOutlined } from '@ant-design/icons'
 import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query'
 import { useEffect, useState } from 'react'
 import { useTranslation } from 'react-i18next'
@@ -34,12 +34,20 @@ interface ChangePasswordValues {
  confirm_password: string
 }

+interface VIPSettingsValues {
+  vip_address?: string
+  vip_interface?: string
+  vip_auth_pass?: string
+  vrrp_router_id?: number
+}
+
 export default function SettingsPage() {
  const { t } = useTranslation()
  const qc = useQueryClient()
  const isViewer = useAuthStore((s) => s.user?.role) === 'viewer'
  const [msg, msgCtx] = message.useMessage()
  const [pwForm] = Form.useForm<ChangePasswordValues>()
+  const [vipForm] = Form.useForm<VIPSettingsValues>()

  const { data: setupStatus, isLoading: loadingSetup } = useQuery({
    queryKey: ['setup', 'status'],
@@ -59,6 +67,27 @@ export default function SettingsPage() {
    },
  })

+  const { data: vipSettings } = useQuery({
+    queryKey: ['cluster', 'vip-settings'],
+    queryFn: async () => {
+      const r = await apiClient.get('/cluster/vip-settings')
+      return isEnvelope(r.data) ? r.data.data as VIPSettingsValues : null
+    },
+  })
+
+  useEffect(() => {
+    if (vipSettings) vipForm.setFieldsValue(vipSettings)
+  }, [vipSettings, vipForm])
+
+  const updateVIP = useMutation({
+    mutationFn: async (v: VIPSettingsValues) => apiClient.put('/cluster/vip-settings', v),
+    onSuccess: () => {
+      msg.success(t('cluster.vipCard.saved'))
+      void qc.invalidateQueries({ queryKey: ['cluster', 'vip-settings'] })
+    },
+    onError: (e: Error) => msg.error(t('cluster.vipCard.saveFailed') + ': ' + e.message),
+  })
+
  const [emailForm] = Form.useForm<ContactEmailValues>()
  const updateEmails = useMutation({
    mutationFn: async (v: ContactEmailValues) => {
@@ -768,6 +797,58 @@ export default function SettingsPage() {
        </Space>
      </Card>

+      <Card
+        title={<><ApartmentOutlined /> {t('cluster.vipCard.title')}</>}
+        size="small"
+        className="mb-12"
+      >
+        <Alert
+          type="info"
+          showIcon
+          className="mb-12"
+          message={t('cluster.vipCard.hintTitle')}
+          description={
+            <ul style={{ margin: '4px 0', paddingLeft: 18 }}>
+              <li><Typography.Text code>{t('cluster.vipCard.hintPrimary')}</Typography.Text></li>
+              <li><Typography.Text code>{t('cluster.vipCard.hintStandby')}</Typography.Text></li>
+              <li><Typography.Text code>{t('cluster.vipCard.hintKeepalived')}</Typography.Text></li>
+              <li><Typography.Text code>{t('cluster.vipCard.hintFailover')}</Typography.Text></li>
+            </ul>
+          }
+        />
+        <Form<VIPSettingsValues>
+          form={vipForm}
+          layout="vertical"
+          onFinish={(v) => updateVIP.mutate(v)}
+          initialValues={{ vrrp_router_id: 51 }}
+        >
+          <Form.Item label={t('cluster.vipCard.vipAddress')} name="vip_address"
+            extra={t('cluster.vipCard.vipAddressHelp')}>
+            <Input placeholder="89.163.205.10" disabled={isViewer} />
+          </Form.Item>
+          <Form.Item label={t('cluster.vipCard.vipInterface')} name="vip_interface"
+            extra={t('cluster.vipCard.vipInterfaceHelp')}>
+            <Input placeholder="eth0" disabled={isViewer} />
+          </Form.Item>
+          <Form.Item label={t('cluster.vipCard.vipAuthPass')} name="vip_auth_pass"
+            extra={t('cluster.vipCard.vipAuthPassHelp')}
+            rules={[{ max: 8, message: 'Max. 8 Zeichen (Keepalived-Limit)' }]}>
+            <Input.Password placeholder="max 8 chars" disabled={isViewer} />
+          </Form.Item>
+          <Form.Item label={t('cluster.vipCard.vrrpRouterId')} name="vrrp_router_id"
+            extra={t('cluster.vipCard.vrrpRouterIdHelp')}>
+            <InputNumber min={1} max={255} disabled={isViewer} />
+          </Form.Item>
+          {!isViewer && (
+            <Form.Item>
+              <Button type="primary" htmlType="submit" loading={updateVIP.isPending}>
+                {t('cluster.vipCard.saveBtn')}
+              </Button>
+            </Form.Item>
+          )}
+        </Form>
+      </Card>
+
      <Card title={<><LockOutlined /> {t('settings.passwordCardTitle')}</>} size="small">
        <Form<ChangePasswordValues>
          form={pwForm}
--- a/management-ui/src/styles/enterprise.css
+++ b/management-ui/src/styles/enterprise.css
@@ -2168,33 +2168,24 @@ h1, h2, h3, h4, h5, h6 {
 * center icon, plus a four-step progress list and a large seconds
 * timer. Classes are namespaced with `update-modal` so they don't
 * clash with AntD Modal internals. */
-/* Update-Banner Mobile-Layout (1.6.92+). Auf engen Viewports kollidiert
-   der „Update verfügbar"-Text mit den beiden Aktion-Buttons (Check +
-   Update Now), weil AntD-Alert beide horizontal nebeneinander rendert.
-   Unter 640 px kippen wir das Layout in column-flex, action-Bereich
-   landet unter der Message + die Buttons stretchen auf 100% Breite. */
-@media (max-width: 640px) {
-  .update-banner-alert.ant-alert {
-    flex-direction: column;
-    align-items: stretch;
-  }
-  .update-banner-alert .ant-alert-content {
-    margin-right: 0;
-  }
-  .update-banner-alert .ant-alert-action {
-    margin-left: 0;
-    margin-top: 8px;
-  }
-  .update-banner-alert .ant-alert-action .ant-space {
-    width: 100%;
-    display: flex;
-  }
-  .update-banner-alert .ant-alert-action .ant-space > .ant-space-item {
-    flex: 1;
-  }
-  .update-banner-alert .ant-alert-action button {
-    width: 100%;
-  }
+/* Update-Banner: Text links, Button rechts; auf Mobile umbrechen. */
+.update-banner-row {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  gap: 8px;
+}
+
+.update-banner-row > span {
+  flex: 1 1 160px;
+  min-width: 0;
+}
+
+.update-banner-row button,
+.update-banner-row .ant-popover-open,
+.update-banner-row > span + * {
+  flex-shrink: 0;
+  white-space: nowrap;
 }

 /* Popconfirm der hinter "Update jetzt installieren?" steckt. Default
--- a/packaging/debian/edgeguard-api/DEBIAN/postinst
+++ b/packaging/debian/edgeguard-api/DEBIAN/postinst
@@ -130,6 +130,9 @@ edgeguard ALL=(root) NOPASSWD: /usr/bin/systemd-run --unit=edgeguard-upgrade.ser
 # unter /var/lib/edgeguard/restore.sh, Unit-Form ist fix.
 edgeguard ALL=(root) NOPASSWD: /usr/bin/systemctl reset-failed edgeguard-restore.service
 edgeguard ALL=(root) NOPASSWD: /usr/bin/systemd-run --unit=edgeguard-restore.service --description=EdgeGuard self-restore --collect bash /var/lib/edgeguard/restore.sh
+# Keepalived reload: VIP-Settings-Änderung triggert keepalived-Reload.
+edgeguard ALL=(root) NOPASSWD: /usr/bin/systemctl reload-or-restart keepalived.service
+edgeguard ALL=(root) NOPASSWD: /bin/systemctl reload-or-restart keepalived.service
 SUDOERS

        # ── Distro-Conf-Includes für die per-Service Renderer ─────────
@@ -397,6 +400,17 @@ ROUTESUNIT
            chown "$EG_USER":"$EG_USER" /etc/edgeguard/routes.conf
        fi

+        # ── Keepalived notify-scripts installieren ───────────────────
+        # Die Skripte liegen im Package unter /usr/lib/edgeguard/ und
+        # werden von Keepalived als notify_master / notify_backup / check
+        # aufgerufen. Kein Auto-Promote — keepalived-master.sh loggt nur.
+        install -d -m 0755 /usr/lib/edgeguard
+        for script in keepalived-check.sh keepalived-master.sh keepalived-backup.sh; do
+            if [ -f "/usr/lib/edgeguard/${script}" ]; then
+                chmod 0755 "/usr/lib/edgeguard/${script}"
+            fi
+        done
+
        # ── Self-signed default cert so HAProxy starts cleanly ───────
        # HAProxy `bind :443 ssl crt /etc/edgeguard/tls/` needs at least
        # one PEM in the directory to come up. Operator runs certbot
--- a/packaging/scripts/keepalived-backup.sh
+++ b/packaging/scripts/keepalived-backup.sh
@@ -0,0 +1,9 @@
+#!/bin/bash
+# Keepalived notify_backup / notify_fault: VIP abgegeben oder Fault.
+logger -t keepalived -p daemon.info \
+    "BACKUP/FAULT: VIP abgegeben an Primary-Node."
+
+curl -sf --max-time 3 -X POST \
+    -H "Content-Type: application/json" \
+    -d '{"level":"info","message":"Keepalived BACKUP: VIP abgegeben — Primary ist wieder aktiv.","source":"keepalived"}' \
+    http://127.0.0.1:9443/api/v1/internal/alert > /dev/null 2>&1 || true
--- a/packaging/scripts/keepalived-check.sh
+++ b/packaging/scripts/keepalived-check.sh
@@ -0,0 +1,6 @@
+#!/bin/bash
+# Keepalived health check: edgeguard-api erreichbar?
+# Weight -50 → BACKUP gewinnt wenn Primary-API nicht antwortet.
+curl -sf --max-time 2 --unix-socket /run/edgeguard/api.sock \
+    http://localhost/api/v1/system/health > /dev/null 2>&1 \
+    || curl -sf --max-time 2 http://127.0.0.1:9443/api/v1/system/health > /dev/null 2>&1
--- a/packaging/scripts/keepalived-master.sh
+++ b/packaging/scripts/keepalived-master.sh
@@ -0,0 +1,15 @@
+#!/bin/bash
+# Keepalived notify_master: dieser Node hat die VIP übernommen.
+#
+# KEIN Auto-Promote — Split-Brain-Schutz durch manuelle Promotion.
+# Admin muss "edgeguard-ctl promote" ausführen wenn PG-Failover gewünscht.
+#
+# Was wir tun: Alert loggen + edgeguard-api benachrichtigen.
+logger -t keepalived -p daemon.warning \
+    "MASTER: VIP übernommen — PG-Rolle ist noch '$(cat /var/lib/edgeguard/pg_role 2>/dev/null || echo standby)'. Für PG-Failover: edgeguard-ctl promote"
+
+# Alert an die API schicken (best-effort, ignoriert Fehler)
+curl -sf --max-time 3 -X POST \
+    -H "Content-Type: application/json" \
+    -d '{"level":"warning","message":"Keepalived MASTER: VIP übernommen. Wenn PG-Failover gewünscht: edgeguard-ctl promote ausführen.","source":"keepalived"}' \
+    http://127.0.0.1:9443/api/v1/internal/alert > /dev/null 2>&1 || true
--- a/scripts/apt-repo/build-package.sh
+++ b/scripts/apt-repo/build-package.sh
@@ -78,6 +78,14 @@ build_api() {
    install -m 0644 "$REPO_ROOT/deploy/systemd/haproxy-edgeguard.conf" \
                    "$build_dir/etc/edgeguard/systemd/"

+    # Keepalived notify-scripts → /usr/lib/edgeguard/
+    # postinst setzt chmod 0755 nach der Installation.
+    mkdir -p "$build_dir/usr/lib/edgeguard"
+    for script in keepalived-check.sh keepalived-master.sh keepalived-backup.sh; do
+        install -m 0755 "$REPO_ROOT/packaging/scripts/$script" \
+                        "$build_dir/usr/lib/edgeguard/$script"
+    done
+
    # Installed-Size in KB (rounded up)
    local size
    size="$(du -sk "$build_dir" | awk '{print $1}')"
Author	SHA1	Message	Date
Debian	eaa6a04234	feat(cluster): PG Logical Replication setup + Master-Key-Sync + Firewall-Ports cluster-init-replication: - listen_addresses = '*' damit Cluster-Peers PG auf :5432 erreichen können - max_replication_slots = 20 / max_wal_senders = 10 (verhindert Slot-Erschöpfung bei initaler Tabellen-Synchronisation mit vielen gleichzeitigen Sync-Workern) - pg-replication-secret: Ownership an edgeguard-User (API-Lesezugriff) - detectPGConfig() statt hardcoded PG 16 (System läuft PG 17) cluster-setup-standby: - syncMasterKey(): holt /var/lib/edgeguard/.master_key via mTLS vom Primary — ohne identischen Master-Key können replizierte WireGuard-Keys nicht entschlüsselt werden - render-config: sudo -u edgeguard statt als root (DB-Zugriff) nftables Template: - Port 5432 (PG) + 6379 (KeyDB) für Cluster-Peers (@peer_ipv4/@peer_ipv6) freigegeben handlers/cluster.go: - GET /agent/cluster/master-key: gibt .master_key via mTLS zurück (hex-kodiert) v1.2.15 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-30 12:56:32 +02:00
Debian	884f84d3f1	fix(rolling-update): stable done-detection, mobile banner layout, stale-state protection - FinishRollingUpdateIfPending() auf API-Startup: transitiert updating-primary → done damit der UI-Flow nach Restart abschließt - RollingUpdateStatus: setzt done nach Auslieferung auf idle zurück (verhindert Stale-done bei Page-Reload) - wasRollingActiveRef: reagiert auf done nur wenn rolling in DIESER Session aktiv war — kein sofortiger Reload bei Stale-State - UI-Fallback für updating-primary: poll auf /system/health version-flip - Cluster-Erkennung via /cluster/status; Rolling-Update-Button nur im Cluster - Update-Banner-Button nicht mehr gequetscht (flex-shrink:0 + nowrap) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-30 12:56:20 +02:00
Debian	bc6db1fc2b	feat(cluster): Rolling Update — Secondary-first upgrade orchestration (v1.2.3) POST /cluster/rolling-update startet den gestaffelten Upgrade-Prozess: 1. Secondary via mTLS /agent/cluster/trigger-update anstoßen 2. /agent/cluster/version pollen bis Secondary Version-Flip zeigt (max 10 min) 3. Primary self-upgrade via systemd-run (identisch zu /system/upgrade) State wird in /var/lib/edgeguard/rolling-update-state.json persistiert: Phasen: updating-secondary → waiting-secondary → updating-primary. "done" wird nicht geschrieben — Prozess stirbt beim Upgrade. UI erkennt Abschluss via /system/health version-flip (analog Single-Node-Upgrade). UI: UpdateBanner erkennt Cluster-Modus (/cluster/status mode="cluster") und tauscht den "Install now"-Button gegen "Rolling Update (Cluster)" aus. Multi-Step-Modal zeigt die drei Phasen; ab updating-primary wechselt der Client auf /system/health polling. Aggregator.PostPeer: neuer einzel-POST-Helper für mTLS-trigger-update. WithVersion(): ClusterHandler bekommt Binary-Version für /agent/cluster/version. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-29 23:40:49 +02:00
Debian	25c7cd0cb5	feat(cluster): PG Logical Replication + VIP/Keepalived + config_hash sync (v1.2.1–1.2.2) - PG Logical Replication: edgeguard_shared PUBLICATION auf Primary, edgeguard_sub SUBSCRIPTION auf Secondary. Nur geteilte Config-Tabellen werden repliziert; node-eigene Daten (network_interfaces, ip_addresses, static_routes, cluster_settings, dns_settings, ntp_settings) bleiben lokal — OPNsense-Muster. - cluster-init-replication: Erstellt PUBLICATION, Rolle + pg_hba-Einträge (logical + replication), WAL-Level auf logical. - cluster-setup-standby: Erstellt SUBSCRIPTION (copy_data=true), pollt pg_subscription_rel bis alle Tabellen sync = 'r', rendert dann Configs. - promote: manueller Failover via pg_promote() + touch recovery.signal. - VIP/Keepalived: cluster_settings-Tabelle (vip_address, vip_interface, vrrp_router_id), /cluster/vip-settings API, Keepalived-Config-Generator mit VRRP + check_script + notify-Skripten in /usr/lib/edgeguard/scripts/. - config_hash sync: Secondary pusht alle 5 Min seinen Hash via mTLS an Primary (PushSelfToPrimary). Heartbeat schreibt nur LOCAL, daher ohne aktiven Push wäre Primary-Sicht des Secondary-Hash stale gewesen. - runSecondaryConfigRender: Goroutine auf Secondary rendert HAProxy+nftables neu wenn config_hash sich ändert (Logical-Replication-Nachzügler). - confighash: node-spezifische Tabellen aus hashSpec entfernt. - postinst: Keepalived-Skripte installieren, sudoers für keepalived. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-29 23:40:37 +02:00
@@ -1 +1 @@
 .1.162
 .2.15