HA and VIP failover

What it is—and is not

Configure both nodes with the same virtual-router identity, interface, virtual IPv4 CIDR, and advertisement interval. Give the preferred node a higher priority. When it owns the VIP, the active node advertises ownership and announces the address at L2; the peer can promote after a failure. With preempt: true, a recovered higher-priority node can reclaim active ownership.

This is not a general clustering, quorum, or split-brain-resolution system. It does not provide a shared configuration store, shared connection state, or multi-site failover. Because its failover protocol is custom and authenticated UDP, do not mix it with another vendor’s VRRP implementation or make interoperability assumptions from the field names.

Node configuration

Node A:

# Node A: higher priority
ha:
  enabled: true
  virtual_router_id: 51
  priority: 150
  interface: eth0
  virtual_ips: ["10.0.0.100/24"]
  advert_interval: 1s
  preempt: true

Node B:

# Node B: same virtual-router identity and VIP, lower priority
ha:
  enabled: true
  virtual_router_id: 51
  priority: 100
  interface: eth0
  virtual_ips: ["10.0.0.100/24"]
  advert_interval: 1s
  preempt: true

Use priorities from 1 through 254. The configured virtual-router ID is 1 through 255. The feature is IPv4 only; virtual IPs must be IPv4 CIDRs. Do not use loopback as the HA interface.

Network and privilege prerequisites

• Both nodes must share the L2 segment used for the VIP; the network must permit the protocol traffic and address announcements.
• Clients must reach the floating IPv4 address, not a node’s permanent address.
• The service needs permission to bind privileged ports and to manage the virtual address/interface. Grant only the capabilities required by the installed service configuration.
• Keep backend reachability and TLS material equivalent on both nodes. HA moves the edge address; it does not replicate application state.

Prove failover before relying on it

# On each node: inspect process logs and the VIP on the L2 interface.
journalctl -u omlb -f
ip addr show dev eth0

# Fail one node during a maintenance window; probe the floating address.
curl --resolve app.example.com:443:10.0.0.100 https://app.example.com/healthz

Exercise a controlled failure with monitoring active. Confirm one—and only one—node owns the VIP before and after promotion, then test recovery and your chosen preemption behavior. Treat any inability to release a virtual address, duplicate ownership, or unexplained role transition as an incident requiring network and host investigation.