Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

Active/passive

Two identical VMs on the same network: the active one carries a floating IP and provides the service, the passive one keeps an up-to-date copy and takes over if the active one fails. Service comes back in under 2 minutes; live calls are lost.

What is copied

  • The database, whole, continuously (PostgreSQL replication): a few seconds behind at most. Phone registrations are part of it: after a failover, phones do not have to register again.
  • The files (voicemail, announcements, music, recordings) and the keyring: every minute. A failover may lose the last minute of voicemail.
  • The configuration: copied when pairing.

The floating IP is the service address: SIP, audio, portal, API and trunks. DNS, phones and providers only see it.

Setting up

Two VMs installed from the image, each with its fixed address, plus a free address for the floating IP. Between them: VRRP (IP protocol 112), PostgreSQL (5432) and SSH (22). As root:

# Active 192.0.2.11, passive 192.0.2.12, floating IP 192.0.2.10.
centrex bascule cle            # on the passive: prints its public SSH key
centrex bascule preparer --ip-flottante 192.0.2.10/24 --autre 192.0.2.12 \
    --cle-autre "ssh-ed25519 …"     # on the active
centrex bascule rejoindre --actif 192.0.2.11 --cle-actif "ssh-ed25519 …"   # on the passive

preparer prints the full rejoindre command. Options: --temoin (address each VM must reach to keep or take the IP; the gateway by default) and --routeur (VRRP identifier, 51 by default, unique on the network).

PostgreSQL replication between the two VMs is not encrypted: link them through a private network.

Failover

  • The active announces itself every second; after 3 seconds of silence, the passive takes the IP.
  • A health check (PostgreSQL, FreeSWITCH, PBX) runs on the active; three failures in a row, and it gives up the IP.
  • A VM that can no longer reach the witness gives up the IP and stops: an isolated VM never promotes itself.
  • A former active that comes back stays passive: no automatic failback.

Operating

CommandFor
centrex bascule etatRole of the VM, state of both databases, witness, services, replication lag, last file copy.
centrex bascule cederOn the active: the passive takes over (maintenance, update).
  • Log: /var/log/centrex-bascule.log.
  • Update: the passive first, then ceder on the active, then the former active (Updates).
  • Monitoring: on the active, centrex_bascule_passives_connectees (1 in steady state) and centrex_replication_retard_secondes (Monitoring).