docs: add Sanctum dual-WAN failover + Uptime Kuma runbook

Omada policy-routing setup that pins each monitoring host to a specific
ISP (Canal+/Airtel) so Uptime Kuma surfaces per-link failures instead of
masking them behind WAN failover.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Sanctum-Auto-FailOver-Uptime-Kuma.md

@@ -0,0 +1,432 @@
+# Sanctum Auto FailOver with Uptime Kuma
+
+# Omada Dual-WAN Monitoring Architecture
+## Airtel + Canal+ with Uptime Kuma
+
+---
+
+# Network Layout
+
+| Device       | IP         | Purpose         |
+|--------------|------------|-----------------|
+| Kuma-Canal   | 10.10.1.50 | Monitor Canal+  |
+| Kuma-Airtel  | 10.10.1.51 | Monitor Airtel  |
+| Omada Gateway| 10.10.1.1  | Policy Routing  |
+
+---
+
+# Objective
+
+Detect ISP failures while maintaining Internet connectivity.
+
+Requirements:
+
+```
+10.10.1.50 must always test through Canal+
+10.10.1.51 must always test through Airtel
+
+If Canal+ fails:
+    .50 fails
+If Airtel fails:
+    .51 fails
+
+Internet remains available through surviving ISP.
+```
+
+---
+
+# Omada Configuration
+
+## Load Balancing
+
+Navigate:
+
+```
+Settings
+  → Wired Networks
+    → Internet
+```
+
+Configure:
+
+```
+Load Balancing: Enabled
+
+WAN Weight:
+    Airtel = 2
+    Canal+ = 1
+
+Application Optimized Routing:
+    Disabled
+
+Link Backup:
+    Disabled
+```
+
+---
+
+# Create IP Groups
+
+Navigate:
+
+```
+Settings
+  → Profiles
+    → Groups
+    → IP Group
+```
+
+---
+
+## IP Group 1
+
+Name:
+
+```
+Canal-Monitor
+```
+
+Type:
+
+```
+IP Address
+```
+
+Members:
+
+```
+10.10.1.50/32
+```
+
+Description:
+
+```
+Canal+ Monitoring Host
+```
+
+---
+
+## IP Group 2
+
+Name:
+
+```
+Airtel-Monitor
+```
+
+Type:
+
+```
+IP Address
+```
+
+Members:
+
+```
+10.10.1.51/32
+```
+
+Description:
+
+```
+Airtel Monitoring Host
+```
+
+---
+
+# IMPORTANT
+
+Correct:
+
+```
+10.10.1.50/32
+10.10.1.51/32
+```
+
+Wrong:
+
+```
+10.10.1.50/24
+10.10.1.51/24
+```
+
+A /24 includes the entire subnet.
+
+A /32 includes only the specified host.
+
+---
+
+# Create Policy Routes
+
+Navigate:
+
+```
+Settings
+  → Transmission
+    → Routing
+      → Policy Routing
+```
+
+---
+
+# Rule 1 - Canal Monitor
+
+Name:
+
+```
+Canal-Kuma
+```
+
+Status:
+
+```
+Enabled
+```
+
+Protocols:
+
+```
+All
+```
+
+WAN:
+
+```
+Canal+
+```
+
+Use the other WAN port if current WAN is down:
+
+```
+Disabled
+```
+
+Source Type:
+
+```
+IP Group
+```
+
+Source:
+
+```
+Canal-Monitor
+```
+
+Destination Type:
+
+```
+IP Group
+```
+
+Destination:
+
+```
+IPGroup_Any
+```
+
+---
+
+# Rule 2 - Airtel Monitor
+
+Name:
+
+```
+Airtel-Kuma
+```
+
+Status:
+
+```
+Enabled
+```
+
+Protocols:
+
+```
+All
+```
+
+WAN:
+
+```
+Airtel
+```
+
+Use the other WAN port if current WAN is down:
+
+```
+Disabled
+```
+
+Source Type:
+
+```
+IP Group
+```
+
+Source:
+
+```
+Airtel-Monitor
+```
+
+Destination Type:
+
+```
+IP Group
+```
+
+Destination:
+
+```
+IPGroup_Any
+```
+
+---
+
+# Why Failover Is Disabled
+
+Correct:
+
+```
+Airtel fails
+↓
+10.10.1.51 loses Internet
+↓
+Kuma reports DOWN
+```
+
+Wrong:
+
+```
+Airtel fails
+↓
+Traffic silently moves to Canal+
+↓
+Kuma stays UP
+↓
+Failure hidden
+```
+
+Monitoring hosts must fail with their assigned ISP.
+
+---
+
+# Uptime Kuma Configuration
+
+## Kuma-Canal
+
+Host:
+
+```
+10.10.1.50
+```
+
+Monitor:
+
+```
+1.1.1.1
+8.8.8.8
+```
+
+Traffic forced through Canal+.
+
+---
+
+## Kuma-Airtel
+
+Host:
+
+```
+10.10.1.51
+```
+
+Monitor:
+
+```
+1.1.1.1
+8.8.8.8
+```
+
+Traffic forced through Airtel.
+
+---
+
+# Validation Tests
+
+## Test Canal+
+
+Disconnect Canal+.
+
+Expected:
+
+```
+10.10.1.50 → DOWN
+10.10.1.51 → UP
+Internet   → UP
+```
+
+Reconnect Canal+.
+
+Expected:
+
+```
+10.10.1.50 → UP
+10.10.1.51 → UP
+```
+
+---
+
+## Test Airtel
+
+Disconnect Airtel.
+
+Expected:
+
+```
+10.10.1.51 → DOWN
+10.10.1.50 → UP
+Internet   → UP
+```
+
+Reconnect Airtel.
+
+Expected:
+
+```
+10.10.1.51 → UP
+10.10.1.50 → UP
+```
+
+---
+
+# Troubleshooting
+
+If both monitors fail together:
+
+Check:
+
+```
+IP Groups are /32
+```
+
+Check:
+
+```
+Destination = IPGroup_Any
+```
+
+Check:
+
+```
+Use other WAN if down = Disabled
+```
+
+Check:
+
+```
+Application Optimized Routing = Disabled
+```
+
+These four settings are responsible for most routing issues in this design.