feat(ha): add dual VIP — retain 192.168.2.229 LAN alongside 192.168.5.229 storage

Both VIPs fail over together in ha-group:
  vip-lan:     192.168.2.229/24 on ens18 (vmbr0) — LAN iSCSI + NFS access
  vip-storage: 192.168.5.229/24 on ens20 (vmbr2) — storage-client iSCSI + NFS

variables.nix: haServerLanVip = "192.168.2.229"
cluster-init.sh: both VIP primitives in ha-group XML; VIP_LAN var added
ip-addressing.md: both VIP entries documented

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docs/ip-addressing.md

@@ -57,7 +57,7 @@ All VMs and LXC containers run on pve1.
 
 | IP | Hostname | Role | Status |
 |---|---|---|---|
-| `192.168.2.229` | — | Was planned as ha-vip; VIP moved to `192.168.5.229` (vmbr2) | Unassigned |
+| `192.168.2.229` | ha-vip-lan | HA file server LAN floating VIP (Pacemaker `vip-lan`) — LAN iSCSI + NFS | Active |
 | `192.168.2.228` | ha-node1 | HA file server node 1 — management NIC | Active |
 | `192.168.2.227` | ha-node2 | HA file server node 2 — management NIC | Active |
 | `192.168.2.226` | server | Current NFS/ZFS file server — retires when HA is live | Retiring |
@@ -125,7 +125,8 @@ Current → target IP for every host being renumbered.
 | nixos workstation | `192.168.2.119` | `192.168.2.243` | `networking.interfaces` / NetworkManager on guest |
 | ha-node1 | — | `192.168.2.228` (LAN), `192.168.4.228` (cluster), `192.168.5.228` (storage) | active |
 | ha-node2 | — | `192.168.2.227` (LAN), `192.168.4.227` (cluster), `192.168.5.227` (storage) | active |
-| ha-vip | — | `192.168.5.229` (vmbr2 / Pacemaker IPaddr2) | active |
+| ha-vip-lan | — | `192.168.2.229` (vmbr0 / Pacemaker `vip-lan`) — LAN iSCSI + NFS | active |
+| ha-vip-storage | — | `192.168.5.229` (vmbr2 / Pacemaker `vip-storage`) — storage-client iSCSI + NFS | active |
 | server | `192.168.2.252` | `192.168.2.226` | static config on guest |
 | docker | `192.168.2.249` | `192.168.2.225` | static config on guest |
 | nix-cache | `192.168.2.120` | `192.168.2.224` | static config on guest |

scripts/ha/cluster-init.sh

@@ -26,7 +26,8 @@ NODE1="${NODE1:-ha-server-1}"
 NODE2="${NODE2:-ha-server-2}"
 NODE1_IP="${NODE1_IP:-192.168.2.228}"   # vars.haServer1Ip
 NODE2_IP="${NODE2_IP:-192.168.2.227}"   # vars.haServer2Ip
-VIP="${VIP:-192.168.5.229}"             # vars.haServerVip
+VIP="${VIP:-192.168.5.229}"             # vars.haServerVip (storage-client, vmbr2)
+VIP_LAN="${VIP_LAN:-192.168.2.229}"    # vars.haServerLanVip (LAN, vmbr0)
 XFS_MOUNT="${XFS_MOUNT:-/srv/ha-data}"  # vars.haStorageRoot
 ISCSI_IQN="${ISCSI_IQN:-iqn.2026-01.home.sweet:ha-storage}"  # vars.haIscsiIqn
 ISCSI_LUN_FILE="${XFS_MOUNT}/iscsi-lun.img"
@@ -416,15 +417,28 @@ cibadmin --replace --scope resources --xml-text '<resources>
         <op id="nfs-monitor" name="monitor" interval="30s" timeout="40s"/>
       </operations>
     </primitive>
-    <primitive id="vip" class="ocf" type="IPaddr2" provider="heartbeat">
+    <primitive id="vip-storage" class="ocf" type="IPaddr2" provider="heartbeat">
-      <instance_attributes id="vip-attrs">
+      <instance_attributes id="vip-storage-attrs">
-        <nvpair id="vip-ip" name="ip" value="192.168.5.229"/>
+        <nvpair id="vip-storage-ip" name="ip" value="192.168.5.229"/>
-        <nvpair id="vip-cidr" name="cidr_netmask" value="24"/>
+        <nvpair id="vip-storage-cidr" name="cidr_netmask" value="24"/>
+        <nvpair id="vip-storage-nic" name="nic" value="ens20"/>
       </instance_attributes>
       <operations>
-        <op id="vip-start" name="start" interval="0" timeout="20s"/>
+        <op id="vip-storage-start" name="start" interval="0" timeout="20s"/>
-        <op id="vip-stop" name="stop" interval="0" timeout="20s"/>
+        <op id="vip-storage-stop" name="stop" interval="0" timeout="20s"/>
-        <op id="vip-monitor" name="monitor" interval="10s" timeout="20s"/>
+        <op id="vip-storage-monitor" name="monitor" interval="10s" timeout="20s"/>
+      </operations>
+    </primitive>
+    <primitive id="vip-lan" class="ocf" type="IPaddr2" provider="heartbeat">
+      <instance_attributes id="vip-lan-attrs">
+        <nvpair id="vip-lan-ip" name="ip" value="192.168.2.229"/>
+        <nvpair id="vip-lan-cidr" name="cidr_netmask" value="24"/>
+        <nvpair id="vip-lan-nic" name="nic" value="ens18"/>
+      </instance_attributes>
+      <operations>
+        <op id="vip-lan-start" name="start" interval="0" timeout="20s"/>
+        <op id="vip-lan-stop" name="stop" interval="0" timeout="20s"/>
+        <op id="vip-lan-monitor" name="monitor" interval="10s" timeout="20s"/>
       </operations>
     </primitive>
   </group>
@@ -441,11 +455,11 @@ crm_resource --cleanup 2>/dev/null || true
 
 log "Waiting for resources to start..."
 for i in $(seq 1 60); do
-  if crm_resource -r vip --locate 2>/dev/null | grep -q "running on"; then
+  if crm_resource -r vip-storage --locate 2>/dev/null | grep -q "running on"; then
-    log "VIP is up: $(crm_resource -r vip --locate)"
+    log "VIPs are up: $(crm_resource -r vip-storage --locate)"
     break
   fi
-  [[ $i -eq 60 ]] && { warn "VIP not up after 120 s — check: crm_mon -1"; break; }
+  [[ $i -eq 60 ]] && { warn "VIPs not up after 120 s — check: crm_mon -1"; break; }
   sleep 2
 done
 
@@ -453,9 +467,11 @@ log ""
 log "═══════════════════════════════════════════════════════════════"
 log " HA cluster initialised."
 log ""
-log "  crm_mon -1                         — cluster status"
+log "  crm_mon -1                               — cluster status"
-log "  iscsiadm -m discovery -t st -p ${VIP}  — verify iSCSI target"
+log "  iscsiadm -m discovery -t st -p ${VIP}       — verify iSCSI (storage net)"
-log "  showmount -e ${VIP}                    — verify NFS exports"
+log "  iscsiadm -m discovery -t st -p ${VIP_LAN}   — verify iSCSI (LAN)"
+log "  showmount -e ${VIP}                          — verify NFS exports (storage net)"
+log "  showmount -e ${VIP_LAN}                      — verify NFS exports (LAN)"
 log ""
 log "  To enable STONITH (after deploying fence SSH key):"
 log "    1. Fill in VMID_NODE1 / VMID_NODE2 in cluster-enable-stonith.sh"

variables.nix

@@ -119,7 +119,8 @@
   haStoragePrefixLength = 29; # cluster subnet prefix length (/29)
   haServer1ClientIp = "192.168.5.228"; # storage-client IP, node 1 (vmbr2 / ens20)
   haServer2ClientIp = "192.168.5.227"; # storage-client IP, node 2 (vmbr2 / ens20)
-  haServerVip = "192.168.5.229"; # floating VIP on vmbr2 (Pacemaker IPaddr2)
+  haServerVip = "192.168.5.229"; # storage-client floating VIP on vmbr2 (Pacemaker IPaddr2 vip-storage)
+  haServerLanVip = "192.168.2.229"; # LAN floating VIP on vmbr0 (Pacemaker IPaddr2 vip-lan) — LAN iSCSI/NFS access
   dockerStorageIp = "192.168.5.225"; # docker CT storage-client IP (vmbr2 / eth1)
   serverStorageIp = "192.168.5.226"; # server VM storage-client IP (vmbr2 / ens19)
   haClientCidr = "192.168.5.0/24"; # storage-client subnet — internal to pve1 only