43 lines
2.1 KiB
Plaintext
43 lines
2.1 KiB
Plaintext
|
# Settings for the vrrp-wan scripts. Installed to /config/vrrp-wan.conf.
|
||
|
|
#
|
||
|
|
# Why a file and not systemd Environment=: keepalived invokes vrrp-wan-health
|
||
|
|
# with NO environment at all, so an Environment= line in the .service would be
|
||
|
|
# read by the reconciler and ignored by the health check -- two sources of truth
|
||
|
|
# for the one value that decides who is master. It is also what stops a repeat
|
||
|
|
# of 2026-09-05, when the sim's proof was obtained from scripts hand-`sed`-ed in
|
||
|
|
# place: /config/vrrp-wan-health differed from git, and a reinstall would have
|
||
|
|
# silently reverted the tested behaviour.
|
||
|
|
|
||
|
|
# The management VIP. "Do I hold this address" IS the definition of master here
|
||
|
|
# -- ground truth, not a marker written by a script that may not have run.
|
||
|
|
VRRP_WAN_VIP=192.168.1.1
|
||
|
|
|
||
|
|
# The DHCP WAN sub-interface. Stays on the config plane because its lease is
|
||
|
|
# bound to a cloned MAC, which only VyOS config can move.
|
||
|
|
WAN_VIF=53
|
||
|
|
|
||
|
|
# Seconds a new master may go without any WAN before the health check fails it.
|
||
|
|
#
|
||
|
|
# Must exceed the ISP's stale-session hold-down, or a hard failover blows the
|
||
|
|
# window and BOTH routers end up in FAULT -- worse than the outage the check
|
||
|
|
# exists to prevent. accel-ppp's default dead-peer budget is
|
||
|
|
# lcp-echo-interval(30) x lcp-echo-failure(3) = 90s, so 90 sat exactly on the
|
||
|
|
# boundary. Measured worst case: see labsim/wan-failover-evidence/.
|
||
|
|
GRACE=180
|
||
|
|
|
||
|
|
# may-dial is a LEASE, not a flag. vrrp-wan-reconcile renews its mtime every
|
||
|
|
# tick; vrrp-wan-guard revokes it once it goes stale. A plain flag survives the
|
||
|
|
# reconciler dying, and a router that stops reconciling while demoted would keep
|
||
|
|
# dialling for ever.
|
||
|
|
LEASE_TTL=75
|
||
|
|
|
||
|
|
# Flap damper. Two routers that both believe they hold the VIP (a VRRP
|
||
|
|
# partition) will both dial; with the AC set to `replace` each dial kills the
|
||
|
|
# other's session, the loser's pppd exits non-zero, systemd redials in 5s, and
|
||
|
|
# the pair hammers the access concentrator indefinitely. Against a real ISP that
|
||
|
|
# is how an account gets rate-limited. More than FLAP_MAX dials in FLAP_WINDOW
|
||
|
|
# puts this box in hold-off and logs loudly.
|
||
|
|
FLAP_MAX=6
|
||
|
|
FLAP_WINDOW=600
|
||
|
|
FLAP_HOLDOFF=900
|