KeepaliveD

           +----------+
    +----->| BACKUP   |<-----+
    |      +----+-----+      |
    |           |             |
    |  (higher priority       | (MASTER seen with
    |   or timeout)           |  higher priority)
    |           v             |
    |      +----+-----+      |
    +------| MASTER   |------+
           +----------+

sudo apt-get update
sudo apt-get install keepalived

sudo dnf install keepalived

sudo pacman -S keepalived

# firewalld
sudo firewall-cmd --add-rich-rule='rule protocol value="vrrp" accept' --permanent
sudo firewall-cmd --reload

# iptables
sudo iptables -A INPUT -p vrrp -j ACCEPT

# nftables
sudo nft add rule inet filter input ip protocol vrrp accept

global_defs {
    enable_script_security
    script_user root
    router_id <MASTER_HOSTNAME>
}

vrrp_track_process chk_service {
    process nginx
    weight 2
}

vrrp_instance VI_1 {
    interface <interface>
    virtual_router_id 27
    state MASTER
    priority 101
    advert_int 1

    authentication {
        auth_type PASS
        auth_pass <secret>
    }

    virtual_ipaddress {
        <vip_address>/32
    }

    unicast_src_ip <master_ip>
    unicast_peer {
        <backup_ip>
    }

    track_process {
        chk_service
    }
}

global_defs {
    enable_script_security
    script_user root
    router_id <BACKUP_HOSTNAME>
}

vrrp_track_process chk_service {
    process nginx
    weight 2
}

vrrp_instance VI_1 {
    interface <interface>
    virtual_router_id 27
    state BACKUP
    priority 100
    advert_int 1

    authentication {
        auth_type PASS
        auth_pass <secret>
    }

    virtual_ipaddress {
        <vip_address>/32
    }

    unicast_src_ip <backup_ip>
    unicast_peer {
        <master_ip>
    }

    track_process {
        chk_service
    }
}

sudo systemctl enable --now keepalived
sudo systemctl status keepalived

effective_priority = base_priority + weight (if check passes)
effective_priority = base_priority - abs(weight) (if check fails and weight < 0)

vrrp_instance VI_1 {
    state BACKUP
    priority 101
    nopreempt            # Do not preempt; stay BACKUP if another node is MASTER

    # Or use a delay before preempting:
    # preempt_delay 300  # Wait 5 minutes before taking over
}

# Node A
vrrp_instance VI_WEB {
    priority 101
    virtual_ipaddress { 192.0.2.100/32 }
}
vrrp_instance VI_DB {
    priority 100
    virtual_ipaddress { 192.0.2.101/32 }
}

# Node B
vrrp_instance VI_WEB {
    priority 100
    virtual_ipaddress { 192.0.2.100/32 }
}
vrrp_instance VI_DB {
    priority 101
    virtual_ipaddress { 192.0.2.101/32 }
}

vrrp_track_process chk_nginx {
    process nginx
    weight 2           # Add 2 to priority when nginx is running
    quorum 1           # Minimum number of matching processes
    delay 2            # Wait 2 seconds before reacting to changes
}

vrrp_script chk_haproxy {
    script "/usr/local/bin/check_haproxy.sh"
    interval 2         # Check every 2 seconds
    weight -20         # Subtract 20 from priority on failure
    fall 3             # Require 3 consecutive failures to mark as failed
    rise 2             # Require 2 consecutive successes to mark as recovered
    timeout 5          # Script timeout in seconds
}

vrrp_instance VI_1 {
    track_script {
        chk_haproxy
    }
}

#!/usr/bin/env bash
# /usr/local/bin/check_haproxy.sh
if pgrep -x haproxy > /dev/null; then
    exit 0
fi
exit 1

#!/usr/bin/env bash
# /usr/local/bin/check_http.sh
HTTP_CODE=$(curl -s -o /dev/null -w '%{http_code}' http://localhost:8080/health)
if [ "${HTTP_CODE}" = "200" ]; then
    exit 0
fi
exit 1

#!/usr/bin/env bash
# /usr/local/bin/check_pgsql_primary.sh
RESULT=$(su - postgres -c "psql -tAc 'SELECT pg_is_in_recovery();'" 2>/dev/null)
if [ "${RESULT}" = "f" ]; then
    exit 0  # Is primary
fi
exit 1  # Is standby or unreachable

#!/usr/bin/env bash
# /usr/local/bin/check_port.sh
if /usr/bin/nc -z localhost 5432 2>/dev/null; then
    exit 0
fi
exit 1

vrrp_instance VI_1 {
    track_interface {
        eth0 weight -50
        eth1 weight -50
    }
}

vrrp_instance VI_6 {
    interface eth0
    virtual_router_id 61
    state MASTER
    priority 101
    advert_int 1
    use_vmac                   # Recommended for IPv6
    vmac_xmit_base             # Transmit on the base interface

    virtual_ipaddress {
        2001:db8::1/64
    }

    # No authentication block (VRRPv3 does not support it)
}

vrrp_instance VI_4 {
    interface eth0
    virtual_router_id 51
    state MASTER
    priority 101
    advert_int 1

    authentication {
        auth_type PASS
        auth_pass <secret>
    }

    virtual_ipaddress {
        192.0.2.100/24
    }
}

vrrp_instance VI_6 {
    interface eth0
    virtual_router_id 61
    state MASTER
    priority 101
    advert_int 1
    use_vmac
    vmac_xmit_base

    virtual_ipaddress {
        2001:db8::100/64
    }
}

global_defs {
    vrrp_version 3
}

vrrp_instance VI_1 {
    notify_master "/usr/local/bin/keepalived-notify.sh MASTER"
    notify_backup "/usr/local/bin/keepalived-notify.sh BACKUP"
    notify_fault  "/usr/local/bin/keepalived-notify.sh FAULT"
    notify_stop   "/usr/local/bin/keepalived-notify.sh STOP"

    # Or use a single notify script that receives state as argument:
    # notify "/usr/local/bin/keepalived-notify.sh"
}

#!/usr/bin/env bash
# /usr/local/bin/keepalived-notify.sh
STATE=$1
TIMESTAMP=$(date '+%Y-%m-%d %H:%M:%S')

echo "${TIMESTAMP} - Keepalived transitioned to ${STATE}" >> /var/log/keepalived-notify.log

case "${STATE}" in
    MASTER)
        # Actions when becoming MASTER
        systemctl start haproxy 2>/dev/null
        ;;
    BACKUP|FAULT|STOP)
        # Actions when losing MASTER
        systemctl stop haproxy 2>/dev/null
        ;;
esac

# Keepalived logs to syslog by default
journalctl -u keepalived -f

# Or in syslog
tail -f /var/log/syslog | grep -i keepalived

# Send SIGUSR1 to dump current data to /tmp/keepalived.data
sudo kill -USR1 $(cat /run/keepalived.pid)
cat /tmp/keepalived.data

# Send SIGUSR2 to dump stats to /tmp/keepalived.stats
sudo kill -USR2 $(cat /run/keepalived.pid)
cat /tmp/keepalived.stats

# Check if VIP is assigned
ip addr show dev <interface> | grep <vip_address>

# Watch VRRP advertisements (multicast mode)
sudo tcpdump -i <interface> -nn proto 112

# Watch VRRP advertisements (unicast mode)
sudo tcpdump -i <interface> -nn host <peer_ip> and proto 112

# Check config syntax
keepalived --config-test -f /etc/keepalived/keepalived.conf

global_defs {
    vrrp_garp_master_delay 1
    vrrp_garp_master_repeat 3
    log_unknown_vrids
}

keepalived -D -l -f /etc/keepalived/keepalived.conf