196dd7b78e
KC-5: Consolidate calendar access into CalendarStore.shared so Today, Calendar, Onboarding, and Settings share one permission state and event cache. requestAccess() debounces and reads authoritative status; turning on "Show Calendar Events" while unauthorized now prompts. New Settings → Data → Calendar row shows Connected/Connect/Denied. KC-6: Add calendar-event notifications. CalendarStore.upcomingEventNotifs snapshots visible events (next 7 days); NotificationManager schedules at start time plus each event alarm (all-day at 9am), capped at ~20 to stay under iOS's 64-notification limit. Wired into reschedule(). Log KC-5 and KC-6 in ISSUES.md. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
489 lines
9.3 KiB
Markdown
489 lines
9.3 KiB
Markdown
# Sanctum Auto FailOver with Uptime Kuma
|
|
|
|
# Omada Dual-WAN Monitoring Architecture
|
|
## Airtel + Canal+ with Uptime Kuma
|
|
|
|
---
|
|
|
|
# Network Layout
|
|
|
|
| Device | IP | Purpose |
|
|
|--------------|----------------------|----------------------------|
|
|
| Kuma-Canal | 10.10.1.50 | Monitor Canal+ |
|
|
| Kuma-Airtel | 10.10.1.51 | Monitor Airtel |
|
|
| Omada Gateway| 10.10.1.1 | Policy Routing |
|
|
| Rackpeek | 10.10.1.70:18080 | Rack/services dashboard |
|
|
|
|
Rackpeek services list: <http://10.10.1.70:18080/services/list>
|
|
|
|
---
|
|
|
|
# Proxy Hosts / Services
|
|
|
|
Reverse-proxy hosts published via Rackpeek. All `Public` access, all `Online` as of last sync.
|
|
Service names are the proxy source (`.sanctum` suffix omitted). Entries marked `?` are inferred
|
|
from the port or still need confirmation.
|
|
|
|
| Service | Destination | SSL | Access | Status | Created |
|
|
|------------------------|------------------------|--------------------|--------|--------|-------------------------------|
|
|
| ? | http://10.10.1.78:8181 | Custom Certificate | Public | Online | Nov 20, 2025 at 3:47:23 AM |
|
|
| Uptime Kuma (Airtel) | http://10.10.1.51:3001 | Custom Certificate | Public | Online | Nov 25, 2025 at 12:18:08 AM |
|
|
| ? | http://10.10.1.6:8181 | Custom Certificate | Public | Online | Nov 20, 2025 at 3:48:33 AM |
|
|
| Backup | http://10.10.1.11:8007 | Custom Certificate | Public | Online | Dec 4, 2025 at 1:09:02 PM |
|
|
| Bazarr | http://10.10.1.70:6767 | Custom Certificate | Public | Online | Nov 25, 2025 at 2:54:35 AM |
|
|
| ? | http://10.10.1.21:8181 | Custom Certificate | Public | Online | Nov 20, 2025 at 3:49:44 AM |
|
|
| Uptime Kuma (Canal+) | http://10.10.1.50:3001 | Custom Certificate | Public | Online | Nov 25, 2025 at 12:16:37 AM |
|
|
| ? | http://10.10.1.21:80 | Custom Certificate | Public | Online | Nov 20, 2025 at 3:51:05 AM |
|
|
| ? | http://10.10.1.20:80 | Custom Certificate | Public | Online | Nov 20, 2025 at 3:51:50 AM |
|
|
| Synology DSM ? | http://10.10.1.20:5000 | Custom Certificate | Public | Online | Nov 25, 2025 at 1:19:01 AM |
|
|
| ? | http://10.10.1.7:8080 | Custom Certificate | Public | Online | Nov 20, 2025 at 3:53:28 AM |
|
|
| ? | http://10.10.1.70:3030 | Custom Certificate | Public | Online | Nov 20, 2025 at 3:56:57 AM |
|
|
| Homarr | http://10.10.1.20:7575 | Custom Certificate | Public | Online | Dec 4, 2025 at 1:05:58 PM |
|
|
| ? | http://10.10.1.70:9080 | Custom Certificate | Public | Online | Nov 21, 2025 at 2:37:33 AM |
|
|
| ? | http://10.10.1.70:8181 | Custom Certificate | Public | Online | Nov 21, 2025 at 2:41:13 AM |
|
|
| ? | http://10.10.1.21:3002 | Custom Certificate | Public | Online | Nov 21, 2025 at 2:43:06 AM |
|
|
| ? | http://10.10.1.70:8080 | Custom Certificate | Public | Online | Nov 21, 2025 at 2:43:56 AM |
|
|
| ? | http://10.10.1.7:8181 | Custom Certificate | Public | Online | Nov 21, 2025 at 2:45:03 AM |
|
|
| ? | http://10.10.1.7:8281 | HTTP Only | Public | Online | Nov 25, 2025 at 12:07:57 AM |
|
|
| Uptime Kuma | http://10.10.1.20:3001 | Custom Certificate | Public | Online | Nov 21, 2025 at 2:50:20 AM |
|
|
| ? | http://10.10.1.70:6246 | HTTP Only | Public | Online | Nov 24, 2025 at 1:33:47 PM |
|
|
| Netdata | http://10.10.1.20:19999| Custom Certificate | Public | Online | Nov 30, 2025 at 10:25:35 PM |
|
|
| ? | http://10.10.1.21:18789| Custom Certificate | Public | Online | Feb 18, 2026 at 7:30:40 PM |
|
|
| Overseerr/Jellyseerr ? | http://10.10.1.70:5055 | Custom Certificate | Public | Online | Nov 21, 2025 at 2:51:13 AM |
|
|
| ? | http://10.10.1.70:8212 | Custom Certificate | Public | Online | Nov 25, 2025 at 2:00:57 AM |
|
|
| Plex | http://10.10.1.70:32400| HTTP Only | Public | Online | Nov 25, 2025 at 3:04:23 AM |
|
|
| Portainer | http://10.10.1.70:9000 | Custom Certificate | Public | Online | Nov 21, 2025 at 2:52:39 AM |
|
|
| Prowlarr | http://10.10.1.70:9696 | Custom Certificate | Public | Online | Nov 21, 2025 at 2:53:47 AM |
|
|
| Proxmox VE | http://10.10.1.44:8006 | Custom Certificate | Public | Online | Nov 21, 2025 at 2:54:29 AM |
|
|
| Nginx Proxy Manager | http://10.10.1.5:81 | Custom Certificate | Public | Online | Nov 21, 2025 at 2:55:02 AM |
|
|
| ? | http://10.10.1.10:7655 | Custom Certificate | Public | Online | Nov 21, 2025 at 2:56:01 AM |
|
|
| ? | http://10.10.1.70:8888 | Custom Certificate | Public | Online | Nov 21, 2025 at 2:56:35 AM |
|
|
| Radarr | http://10.10.1.70:7878 | Custom Certificate | Public | Online | Nov 21, 2025 at 2:57:22 AM |
|
|
| ? | http://10.10.1.5:8181 | Custom Certificate | Public | Online | Nov 21, 2025 at 2:58:12 AM |
|
|
| ? | http://10.10.1.13:80 | Custom Certificate | Public | Online | Nov 21, 2025 at 3:00:30 AM |
|
|
| ? | http://10.10.1.78:80 | Custom Certificate | Public | Online | Nov 21, 2025 at 3:01:36 AM |
|
|
| Sonarr | http://10.10.1.70:8989 | Custom Certificate | Public | Online | Nov 21, 2025 at 3:02:24 AM |
|
|
| ? | http://10.10.1.20:8888 | Custom Certificate | Public | Online | Nov 21, 2025 at 3:03:28 AM |
|
|
| ? | http://10.10.1.21:8888 | Custom Certificate | Public | Online | Nov 21, 2025 at 3:04:31 AM |
|
|
| ? | http://10.10.1.21:8080 | Custom Certificate | Public | Online | Dec 4, 2025 at 1:03:19 PM |
|
|
| ? | http://10.10.1.70:7476 | HTTP Only | Public | Online | Feb 6, 2026 at 7:53:14 PM |
|
|
| ? | http://10.10.1.20:9412 | Custom Certificate | Public | Online | Nov 25, 2025 at 1:16:55 AM |
|
|
|
|
---
|
|
|
|
# Objective
|
|
|
|
Detect ISP failures while maintaining Internet connectivity.
|
|
|
|
Requirements:
|
|
|
|
```
|
|
10.10.1.50 must always test through Canal+
|
|
10.10.1.51 must always test through Airtel
|
|
|
|
If Canal+ fails:
|
|
.50 fails
|
|
If Airtel fails:
|
|
.51 fails
|
|
|
|
Internet remains available through surviving ISP.
|
|
```
|
|
|
|
---
|
|
|
|
# Omada Configuration
|
|
|
|
## Load Balancing
|
|
|
|
Navigate:
|
|
|
|
```
|
|
Settings
|
|
→ Wired Networks
|
|
→ Internet
|
|
```
|
|
|
|
Configure:
|
|
|
|
```
|
|
Load Balancing: Enabled
|
|
|
|
WAN Weight:
|
|
Airtel = 2
|
|
Canal+ = 1
|
|
|
|
Application Optimized Routing:
|
|
Disabled
|
|
|
|
Link Backup:
|
|
Disabled
|
|
```
|
|
|
|
---
|
|
|
|
# Create IP Groups
|
|
|
|
Navigate:
|
|
|
|
```
|
|
Settings
|
|
→ Profiles
|
|
→ Groups
|
|
→ IP Group
|
|
```
|
|
|
|
---
|
|
|
|
## IP Group 1
|
|
|
|
Name:
|
|
|
|
```
|
|
Canal-Monitor
|
|
```
|
|
|
|
Type:
|
|
|
|
```
|
|
IP Address
|
|
```
|
|
|
|
Members:
|
|
|
|
```
|
|
10.10.1.50/32
|
|
```
|
|
|
|
Description:
|
|
|
|
```
|
|
Canal+ Monitoring Host
|
|
```
|
|
|
|
---
|
|
|
|
## IP Group 2
|
|
|
|
Name:
|
|
|
|
```
|
|
Airtel-Monitor
|
|
```
|
|
|
|
Type:
|
|
|
|
```
|
|
IP Address
|
|
```
|
|
|
|
Members:
|
|
|
|
```
|
|
10.10.1.51/32
|
|
```
|
|
|
|
Description:
|
|
|
|
```
|
|
Airtel Monitoring Host
|
|
```
|
|
|
|
---
|
|
|
|
# IMPORTANT
|
|
|
|
Correct:
|
|
|
|
```
|
|
10.10.1.50/32
|
|
10.10.1.51/32
|
|
```
|
|
|
|
Wrong:
|
|
|
|
```
|
|
10.10.1.50/24
|
|
10.10.1.51/24
|
|
```
|
|
|
|
A /24 includes the entire subnet.
|
|
|
|
A /32 includes only the specified host.
|
|
|
|
---
|
|
|
|
# Create Policy Routes
|
|
|
|
Navigate:
|
|
|
|
```
|
|
Settings
|
|
→ Transmission
|
|
→ Routing
|
|
→ Policy Routing
|
|
```
|
|
|
|
---
|
|
|
|
# Rule 1 - Canal Monitor
|
|
|
|
Name:
|
|
|
|
```
|
|
Canal-Kuma
|
|
```
|
|
|
|
Status:
|
|
|
|
```
|
|
Enabled
|
|
```
|
|
|
|
Protocols:
|
|
|
|
```
|
|
All
|
|
```
|
|
|
|
WAN:
|
|
|
|
```
|
|
Canal+
|
|
```
|
|
|
|
Use the other WAN port if current WAN is down:
|
|
|
|
```
|
|
Disabled
|
|
```
|
|
|
|
Source Type:
|
|
|
|
```
|
|
IP Group
|
|
```
|
|
|
|
Source:
|
|
|
|
```
|
|
Canal-Monitor
|
|
```
|
|
|
|
Destination Type:
|
|
|
|
```
|
|
IP Group
|
|
```
|
|
|
|
Destination:
|
|
|
|
```
|
|
IPGroup_Any
|
|
```
|
|
|
|
---
|
|
|
|
# Rule 2 - Airtel Monitor
|
|
|
|
Name:
|
|
|
|
```
|
|
Airtel-Kuma
|
|
```
|
|
|
|
Status:
|
|
|
|
```
|
|
Enabled
|
|
```
|
|
|
|
Protocols:
|
|
|
|
```
|
|
All
|
|
```
|
|
|
|
WAN:
|
|
|
|
```
|
|
Airtel
|
|
```
|
|
|
|
Use the other WAN port if current WAN is down:
|
|
|
|
```
|
|
Disabled
|
|
```
|
|
|
|
Source Type:
|
|
|
|
```
|
|
IP Group
|
|
```
|
|
|
|
Source:
|
|
|
|
```
|
|
Airtel-Monitor
|
|
```
|
|
|
|
Destination Type:
|
|
|
|
```
|
|
IP Group
|
|
```
|
|
|
|
Destination:
|
|
|
|
```
|
|
IPGroup_Any
|
|
```
|
|
|
|
---
|
|
|
|
# Why Failover Is Disabled
|
|
|
|
Correct:
|
|
|
|
```
|
|
Airtel fails
|
|
↓
|
|
10.10.1.51 loses Internet
|
|
↓
|
|
Kuma reports DOWN
|
|
```
|
|
|
|
Wrong:
|
|
|
|
```
|
|
Airtel fails
|
|
↓
|
|
Traffic silently moves to Canal+
|
|
↓
|
|
Kuma stays UP
|
|
↓
|
|
Failure hidden
|
|
```
|
|
|
|
Monitoring hosts must fail with their assigned ISP.
|
|
|
|
---
|
|
|
|
# Uptime Kuma Configuration
|
|
|
|
## Kuma-Canal
|
|
|
|
Host:
|
|
|
|
```
|
|
10.10.1.50
|
|
```
|
|
|
|
Monitor:
|
|
|
|
```
|
|
1.1.1.1
|
|
8.8.8.8
|
|
```
|
|
|
|
Traffic forced through Canal+.
|
|
|
|
---
|
|
|
|
## Kuma-Airtel
|
|
|
|
Host:
|
|
|
|
```
|
|
10.10.1.51
|
|
```
|
|
|
|
Monitor:
|
|
|
|
```
|
|
1.1.1.1
|
|
8.8.8.8
|
|
```
|
|
|
|
Traffic forced through Airtel.
|
|
|
|
---
|
|
|
|
# Validation Tests
|
|
|
|
## Test Canal+
|
|
|
|
Disconnect Canal+.
|
|
|
|
Expected:
|
|
|
|
```
|
|
10.10.1.50 → DOWN
|
|
10.10.1.51 → UP
|
|
Internet → UP
|
|
```
|
|
|
|
Reconnect Canal+.
|
|
|
|
Expected:
|
|
|
|
```
|
|
10.10.1.50 → UP
|
|
10.10.1.51 → UP
|
|
```
|
|
|
|
---
|
|
|
|
## Test Airtel
|
|
|
|
Disconnect Airtel.
|
|
|
|
Expected:
|
|
|
|
```
|
|
10.10.1.51 → DOWN
|
|
10.10.1.50 → UP
|
|
Internet → UP
|
|
```
|
|
|
|
Reconnect Airtel.
|
|
|
|
Expected:
|
|
|
|
```
|
|
10.10.1.51 → UP
|
|
10.10.1.50 → UP
|
|
```
|
|
|
|
---
|
|
|
|
# Troubleshooting
|
|
|
|
If both monitors fail together:
|
|
|
|
Check:
|
|
|
|
```
|
|
IP Groups are /32
|
|
```
|
|
|
|
Check:
|
|
|
|
```
|
|
Destination = IPGroup_Any
|
|
```
|
|
|
|
Check:
|
|
|
|
```
|
|
Use other WAN if down = Disabled
|
|
```
|
|
|
|
Check:
|
|
|
|
```
|
|
Application Optimized Routing = Disabled
|
|
```
|
|
|
|
These four settings are responsible for most routing issues in this design.
|