Cluster and HA gate

ngz_iot_cluster is an explicit readiness and routing gate. It does not claim a transparent distributed broker. nginz-iotd owns local term and frontier state; PostgreSQL fencing and the external orchestrator own active–standby movement.

Configuration shape

stream {
  server {
    iot_cluster on;
    iot_cluster_node_id node-a;
    iot_cluster_role active;
    iot_cluster_require_term on;
    iot_cluster_generation 12;
    iot_cluster_writer_term 7;
    iot_cluster_route_gate node_ready=on shard_ready=on owns_current_writer_term=on;
    iot_cluster_route_proof replay_frontier_valid=on ring_generation_valid=on required_gates_valid=on controlled_drain=off stale_active_rejected=off;
    iot_cluster_routing_map_digest sha256:abc123;
  }
}

Enabled listeners fail closed when the complete route proof is false. Proof inputs include writer-term ownership, replay-frontier validity, ring generation, required gates, controlled drain, node/shard readiness, and stale-active rejection.

Honest HA boundary

Enterprise supports one externally fenced active node and one standby for the same workload. It does not support active-active writers, transparent shard scale-out, or consensus owned by nginx.

The configured term is a proposal. PostgreSQL lease ownership is the authority.

See Fenced active–standby for fencing providers, failover order, and why Kubernetes liveness is not a route switch.