25c7cd0cb5
- PG Logical Replication: edgeguard_shared PUBLICATION auf Primary, edgeguard_sub SUBSCRIPTION auf Secondary. Nur geteilte Config-Tabellen werden repliziert; node-eigene Daten (network_interfaces, ip_addresses, static_routes, cluster_settings, dns_settings, ntp_settings) bleiben lokal — OPNsense-Muster. - cluster-init-replication: Erstellt PUBLICATION, Rolle + pg_hba-Einträge (logical + replication), WAL-Level auf logical. - cluster-setup-standby: Erstellt SUBSCRIPTION (copy_data=true), pollt pg_subscription_rel bis alle Tabellen sync = 'r', rendert dann Configs. - promote: manueller Failover via pg_promote() + touch recovery.signal. - VIP/Keepalived: cluster_settings-Tabelle (vip_address, vip_interface, vrrp_router_id), /cluster/vip-settings API, Keepalived-Config-Generator mit VRRP + check_script + notify-Skripten in /usr/lib/edgeguard/scripts/. - config_hash sync: Secondary pusht alle 5 Min seinen Hash via mTLS an Primary (PushSelfToPrimary). Heartbeat schreibt nur LOCAL, daher ohne aktiven Push wäre Primary-Sicht des Secondary-Hash stale gewesen. - runSecondaryConfigRender: Goroutine auf Secondary rendert HAProxy+nftables neu wenn config_hash sich ändert (Logical-Replication-Nachzügler). - confighash: node-spezifische Tabellen aus hashSpec entfernt. - postinst: Keepalived-Skripte installieren, sudoers für keepalived. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
41 lines
906 B
Smarty
41 lines
906 B
Smarty
global_defs {
|
|
router_id {{ .RouterID }}
|
|
script_user root
|
|
enable_script_security
|
|
vrrp_garp_interval 0
|
|
vrrp_gna_interval 0
|
|
}
|
|
|
|
vrrp_script chk_edgeguard {
|
|
script "/usr/lib/edgeguard/keepalived-check.sh"
|
|
interval 2
|
|
weight -50
|
|
fall 3
|
|
rise 2
|
|
}
|
|
|
|
vrrp_instance VI_1 {
|
|
state {{ .State }}
|
|
interface {{ .Interface }}
|
|
virtual_router_id {{ .RouterID }}
|
|
priority {{ .Priority }}
|
|
advert_int 1
|
|
{{ if .SrcIP }} unicast_src_ip {{ .SrcIP }}
|
|
unicast_peer {
|
|
{{ .PeerIP }}
|
|
}
|
|
{{ end }} authentication {
|
|
auth_type PASS
|
|
auth_pass {{ .AuthPass }}
|
|
}
|
|
virtual_ipaddress {
|
|
{{ .VIP }}
|
|
}
|
|
track_script {
|
|
chk_edgeguard
|
|
}
|
|
notify_master "/usr/lib/edgeguard/keepalived-master.sh"
|
|
notify_backup "/usr/lib/edgeguard/keepalived-backup.sh"
|
|
notify_fault "/usr/lib/edgeguard/keepalived-backup.sh"
|
|
}
|