[FR] possebility to choose between manual and auto sync in HA mode

[colttt]

Important notices

Before you add a new report, we ask you kindly to acknowledge the following:

• I have read the contributing guide lines at https://github.com/opnsense/core/blob/master/CONTRIBUTING.md
• I have searched the existing issues and I am convinced that mine is new.

Is your feature request related to a problem? Please describe.
If we have HA configured we need to push configuration changes (like firewall rules) manually. It would be nice if we can choose between manually or automatically. And yes it's a bit risky, but then I can choose for myself what I want.

Describe the solution you like
An Opt-In option to choose between both methods

[mimugmail]

https://www.reddit.com/r/OPNsenseFirewall/comments/lto37l/new_community_plugin_ha_config_sync_and_reload/

[AdSchellevis]

@mimugmail adding a task which can be added in cron to do a sync + restart (just like the gui does) depending on state might also be an option for the core system.

I don't mind as long as the action has no relation to the config sync so it can't block and it's not the default behaviour of the firewall (use it your own risk). If that's a feature more people seem to miss, we might consider adding an optional task and a reference in the documentation.

[mimugmail]

@AdSchellevis the logic of the script isn't really smart, but it does what it should:

STATUS=$(ifconfig | grep "carp:" | awk '{ print $2 }' | uniq)

if [ $STATUS = MASTER ]

then
  /usr/local/etc/rc.filter_synchronize

elif [ $STATUS = BACKUP ]

then
  /usr/local/sbin/configctl template reload \*

else
  echo "UNKNOWN STATUS"

fi

[AdSchellevis]

@mimugmail ok, shall we interpret this request then as a sync + restart job that only triggers when all interfaces are master? I don't mind adding a configd call for that if it makes people happy. (you need the restart to prevent async backup state)

[mimugmail]

I'd guess its a good alternative for the ones insisting on automatic sync

Always happy to test :)

[AdSchellevis]

ok, there you go d737ff9

To try:

opnsense-patch d737ff9
service configd restart
configctl system ha_reconfigure_backup

(action should be visible in cron too)

Still need to update the docs

[mimugmail]

Thx, this was quick.
But rc.filter_synchronize itself to transfer from master to backup also needs a description for cron?

[AdSchellevis]

@mimugmail nope, it's the same script, ha_reconfigure_backup just adds actions