From e9a4913069096280e58bc37ff2ce1c903cc0d7e1 Mon Sep 17 00:00:00 2001
From: beatzaplenty <wayne.bennett@live.com>
Date: Wed, 29 Jul 2026 18:33:34 +1000
Subject: [PATCH] fix(ha): split health.sh VIP check into LAN (NFS) and storage
 (iSCSI)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Storage VIP (192.168.20.229) is on vmbr2 — an internal-only bridge with no
physical uplink, unreachable from the LAN. Test it via SSH to the active node
(which has VLAN 20 connectivity) instead of directly. LAN VIP (192.168.2.229)
continues to be tested directly from wherever the script runs.

Also adds VIP_LAN variable to config section.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J8djTWdXVzXZc99iujU6T2
---
 scripts/ha/health.sh | 53 +++++++++++++++++++++++++++++++-------------
 1 file changed, 37 insertions(+), 16 deletions(-)

diff --git a/scripts/ha/health.sh b/scripts/ha/health.sh
index f245721..d5a4a1e 100755
--- a/scripts/ha/health.sh
+++ b/scripts/ha/health.sh
@@ -11,7 +11,8 @@ NODE1="${NODE1:-ha-server-1}"
 NODE2="${NODE2:-ha-server-2}"
 NODE1_IP="${NODE1_IP:-192.168.2.228}"   # vars.haServer1Ip
 NODE2_IP="${NODE2_IP:-192.168.2.227}"   # vars.haServer2Ip
-VIP="${VIP:-192.168.20.229}"            # vars.haServerVip
+VIP="${VIP:-192.168.20.229}"            # vars.haServerVip (storage-client, VLAN 20 — internal only)
+VIP_LAN="${VIP_LAN:-192.168.2.229}"    # vars.haServerLanVip (LAN, VLAN 2 — reachable from workstation)
 XFS_MOUNT="${XFS_MOUNT:-/srv/ha-data}"  # vars.haStorageRoot
 HA_USER="${HA_USER:-nixos}"
 # ──────────────────────────────────────────────────────────────────────────
@@ -149,25 +150,45 @@ check_mount() {
 $REACHABLE_1 && check_mount "$NODE1" n1 || echo "  $NODE1  [OFFLINE]"
 $REACHABLE_2 && check_mount "$NODE2" n2 || echo "  $NODE2  [OFFLINE]"
 
-# ── Service ports via VIP ──────────────────────────────────────────────────
-section "Services via VIP ($VIP)"
-
-check_port() {
-  local name=$1 port=$2
-  if bash -c "echo >/dev/tcp/${VIP}/${port}" 2>/dev/null; then
-    printf "  %-10s  port %-5s  OK\n" "$name" "$port"
-  else
-    printf "  %-10s  port %-5s  UNREACHABLE\n" "$name" "$port"
-  fi
-}
-
-if ping -c1 -W2 "$VIP" >/dev/null 2>&1; then
+# ── LAN VIP (NFS) — reachable from workstation ────────────────────────────────
+section "LAN VIP ($VIP_LAN) — NFS"
+if ping -c1 -W2 "$VIP_LAN" >/dev/null 2>&1; then
   echo "  Ping       OK"
 else
   echo "  Ping       UNREACHABLE"
 fi
-check_port "NFS"    2049
-check_port "iSCSI"  3260
+if bash -c "echo >/dev/tcp/${VIP_LAN}/2049" 2>/dev/null; then
+  printf "  %-10s  port %-5s  OK\n" "NFS" "2049"
+else
+  printf "  %-10s  port %-5s  UNREACHABLE\n" "NFS" "2049"
+fi
+
+# ── Storage VIP (iSCSI) — VLAN 20 internal bridge, tested via active node ─────
+section "Storage VIP ($VIP) — iSCSI (via ${ACTIVE_NODE:-unknown})"
+
+run_active_raw() {
+  local active_ip=""
+  [[ "$ACTIVE_NODE" == "$NODE1" ]] && active_ip="$NODE1_IP"
+  [[ "$ACTIVE_NODE" == "$NODE2" ]] && active_ip="$NODE2_IP"
+  [[ -z "$active_ip" ]] && return 1
+  ssh -i ~/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o ConnectTimeout=5 \
+    "${HA_USER}@${active_ip}" "$@" 2>/dev/null
+}
+
+if [[ -z "$ACTIVE_NODE" ]]; then
+  echo "  Cannot determine active node — skipping"
+else
+  if run_active_raw "ping -c1 -W2 '$VIP' >/dev/null 2>&1"; then
+    echo "  Ping       OK"
+  else
+    echo "  Ping       UNREACHABLE"
+  fi
+  if run_active_raw "bash -c 'echo >/dev/tcp/${VIP}/3260' 2>/dev/null"; then
+    printf "  %-10s  port %-5s  OK\n" "iSCSI" "3260"
+  else
+    printf "  %-10s  port %-5s  UNREACHABLE\n" "iSCSI" "3260"
+  fi
+fi
 
 echo ""
 echo "════════════════════════════════════════════════════"