homelab/ansible/roles/keepalived-ntp/tasks/main.yml

---
# Keepalived NTP VIP Role
#
# Supports Debian (PVE cluster nodes) and Arch (edge-1). Unlike chrony, the
# keepalived package uses the same config path (/etc/keepalived/keepalived.conf)
# and unit name (keepalived.service) on both, so only the install step branches.
#
# The chrony unit name does differ, and the health check script needs it -- see
# the fact resolution below.

- name: Fail on unsupported distribution
  ansible.builtin.fail:
    msg: >-
      keepalived-ntp supports Debian and Archlinux only;
      this host reports os_family={{ ansible_facts['os_family'] }}
  when: ansible_facts['os_family'] not in ['Debian', 'Archlinux']

# Resolved here as well as in chrony-ntp-server so this role remains usable
# standalone. Both compute the same value from the same fact.
- name: Resolve chrony unit name for the health check
  ansible.builtin.set_fact:
    chrony_service_name: >-
      {{ 'chrony' if ansible_facts['os_family'] == 'Debian' else 'chronyd' }}

- name: Install keepalived (Debian)
  ansible.builtin.apt:
    name: keepalived
    state: present
    update_cache: true
  when: ansible_facts['os_family'] == 'Debian'

- name: Install keepalived (Arch)
  ansible.builtin.package:
    name: keepalived
    state: present
  when: ansible_facts['os_family'] == 'Archlinux'

# --- Verify nothing else is assigning the IPv6 service address ---------------
#
# The removal itself lives in withdraw-static.yml, run as a separate fleet-wide
# play before any host reaches this role (see install-ntp-ha.yml). It has to
# complete everywhere first: DAD is enabled on the VRRP address, so a static
# copy on one host and a VRRP-managed copy on another cannot coexist -- the
# kernel marks the newcomer `dadfailed` and its master serves nothing.
#
# What remains here are the guards. They run on every execution, not just the
# migration, and fail the play if any static assignment survives -- which would
# both defeat the health gating (a static copy does not disappear when
# keepalived decides the host is unfit) and break the VRRP copy via DAD.
#
# The config file is what gets checked, not the running address, and that is
# what makes it safe to run every time: keepalived never writes to these files,
# so anything found is by definition static, whereas the live address is
# legitimately present on whichever host is master.
#
# Prefix-agnostic and \b-anchored on purpose. Matching the full
# address/prefixlen would fail open against a hand-written assignment using any
# other mask.
- name: Detect any remaining static assignment of the service address (ifupdown)
  ansible.builtin.command:
    argv:
      - grep
      - -rlE
      - "{{ keepalived_ntp_vip6.split('/')[0] }}\\b"
      - /etc/network/interfaces
      - /etc/network/interfaces.d/
  register: keepalived_ntp_static6_ifupdown
  changed_when: false
  failed_when: false
  when:
    - keepalived_ntp_vip6 | length > 0
    - ansible_facts['os_family'] == 'Debian'

- name: Assert ifupdown is not also assigning the service address
  ansible.builtin.assert:
    that:
      - keepalived_ntp_static6_ifupdown.stdout | default('') | length == 0
    fail_msg: >-
      {{ keepalived_ntp_vip6 }} is still assigned statically by ifupdown on
      this host
      ({{ keepalived_ntp_static6_ifupdown.stdout_lines | default([]) | join(', ') }}).
      The automatic removal only matches the exact form
      `up ip -6 addr replace {{ keepalived_ntp_vip6 }} dev <if> nodad`, so a
      different prefix length or layout is left in place. Handing the address
      to keepalived while ifupdown also assigns it means it would NOT be
      withdrawn when check_ntp fails -- the host would keep serving time on an
      address VRRP believes it has released. Remove the assignment from the
      file(s) above, then re-run.
    success_msg: >-
      No static ifupdown assignment of {{ keepalived_ntp_vip6 }}; safe for
      keepalived to own it.
  when:
    - keepalived_ntp_vip6 | length > 0
    - ansible_facts['os_family'] == 'Debian'

# On Arch (edge-1) the static assignment lives in a systemd-networkd file owned
# by the edge-vlan role, so this role must not rewrite it -- but it must not
# quietly proceed either. install-edge-host.yml is a separate play with no
# ordering relationship to this one, so nothing guarantees it has been re-run
# to drop the [Address] block. If it has not, edge-1 would end up holding
# fd40::123 statically AND running a VRRP instance for the same address:
# keepalived would believe it had withdrawn the address while networkd kept it
# assigned, and the host would go on answering NTP with a clock the health
# check had already rejected.
#
# That is the precise failure of 2026-08-04, on the host it happened to, so it
# fails fast rather than being left to inspection.
# Matched on the bare address, not the full address/prefixlen, and anchored
# with \b so it cannot also hit a longer address sharing the prefix (fd40::1234).
#
# Searching for the literal "fd40::123/128" would fail open: a hand-written
# [Address] using any other mask -- /64, say -- would not match, the assert
# below would pass, and keepalived would be handed an address networkd is
# still assigning. Since this check is detect-only, with no delete afterwards
# to catch the mistake, a miss here is silent. The Debian path does not share
# the problem: `ip -6 addr show ... to <prefix>` matches by range regardless of
# the assigned prefix length, and its delete is re-verified by assert.
- name: Detect a static assignment of the service address (systemd-networkd)
  ansible.builtin.command:
    argv:
      - grep
      - -rlE
      - "{{ keepalived_ntp_vip6.split('/')[0] }}\\b"
      - /etc/systemd/network/
  register: keepalived_ntp_static6_networkd
  changed_when: false
  failed_when: false
  when:
    - keepalived_ntp_vip6 | length > 0
    - ansible_facts['os_family'] == 'Archlinux'

- name: Assert networkd is not also assigning the service address
  ansible.builtin.assert:
    that:
      - keepalived_ntp_static6_networkd.stdout | default('') | length == 0
    fail_msg: >-
      {{ keepalived_ntp_vip6 }} is still assigned statically by
      systemd-networkd on this host
      ({{ keepalived_ntp_static6_networkd.stdout_lines | default([]) | join(', ') }}).
      Handing the address to keepalived while networkd also assigns it means
      it would NOT be withdrawn when check_ntp fails -- the host would keep
      serving time on an address VRRP believes it has released.
      Re-apply the edge-vlan role first, whose template no longer carries the
      [Address] block:
      ansible-playbook -i inventory/pve_hosts.yml plays/install-edge-host.yml
    success_msg: >-
      No static networkd assignment of {{ keepalived_ntp_vip6 }}; safe for
      keepalived to own it.
  when:
    - keepalived_ntp_vip6 | length > 0
    - ansible_facts['os_family'] == 'Archlinux'

- name: Create keepalived configuration
  ansible.builtin.template:
    src: keepalived.conf.j2
    dest: /etc/keepalived/keepalived.conf
    owner: root
    group: root
    mode: '0644'
  notify: restart keepalived

- name: Install health check script
  ansible.builtin.template:
    src: check-ntp-health.sh.j2
    dest: "{{ keepalived_ntp_check_script }}"
    owner: root
    group: root
    mode: '0755'

- name: Install notification script
  ansible.builtin.copy:
    src: keepalived-notify.sh
    dest: /usr/local/bin/keepalived-notify.sh
    owner: root
    group: root
    mode: '0755'

- name: Configure sysctl for VRRP
  ansible.posix.sysctl:
    name: "{{ item.name }}"
    value: "{{ item.value }}"
    state: present
    reload: true
  loop: "{{ keepalived_ntp_sysctl }}"

- name: Enable and start keepalived
  ansible.builtin.systemd:
    name: keepalived
    enabled: true
    state: started