route-health: use vpn_status from InfluxDB for faster failure detection

router/route-health.sh

@@ -21,15 +21,21 @@ DOWN_THRESHOLD=2
 SHOW=
 [ "$1" = "--show" ] && SHOW=1
 
-# --- Query InfluxDB for packet loss ---
+# --- Query InfluxDB for packet loss and VPN status ---
 HEALTH_DATA=$(mktemp)
-trap 'rm -f "$HEALTH_DATA"' EXIT
+VPN_DATA=$(mktemp)
+trap 'rm -f "$HEALTH_DATA" "$VPN_DATA"' EXIT
 
 response=$(curl -sG "$INFLUXDB_URL" \
     --data-urlencode "db=$INFLUXDB_DB" \
     --data-urlencode "q=SELECT last(percent_packet_loss) FROM ping WHERE time > now() - 3m GROUP BY gateway" \
     --max-time 5 2>/dev/null)
 
+vpn_response=$(curl -sG "$INFLUXDB_URL" \
+    --data-urlencode "db=$INFLUXDB_DB" \
+    --data-urlencode "q=SELECT last(connected) FROM vpn_status WHERE time > now() - 1m GROUP BY gateway" \
+    --max-time 5 2>/dev/null)
+
 if [ -z "$response" ] ; then
     log "ERROR: Failed to query InfluxDB"
     exit 1
@@ -38,6 +44,7 @@ fi
 # Parse JSON → "gateway packet_loss" lines
 epm -y assure jq || fatal "jq is required"
 echo "$response" | jq -r '.results[0].series[]? | "\(.tags.gateway) \(.values[0][1])"' > "$HEALTH_DATA"
+echo "$vpn_response" | jq -r '.results[0].series[]? | "\(.tags.gateway) \(.values[0][1])"' > "$VPN_DATA" 2>/dev/null
 
 if [ ! -s "$HEALTH_DATA" ] ; then
     log "ERROR: No health data from InfluxDB"
@@ -47,15 +54,28 @@ fi
 if [ -n "$SHOW" ] ; then
     log "InfluxDB data (last 3m):"
     sed 's/^/  /' "$HEALTH_DATA"
+    if [ -s "$VPN_DATA" ] ; then
+        log "VPN status (last 1m):"
+        sed 's/^/  /' "$VPN_DATA"
+    fi
     echo
 fi
 
 # Get health status for a monitor tag
 # Usage: get_health TAG
 # Returns: healthy, degraded, dead
+# Checks both packet loss (ping) and VPN tunnel status
 get_health()
 {
     local tag="$1"
+
+    # Check VPN status first — if tunnel is down, immediately dead
+    local vpn=$(grep "^${tag} " "$VPN_DATA" 2>/dev/null | awk '{print $2}')
+    if [ "$vpn" = "0" ] ; then
+        echo "dead"
+        return
+    fi
+
     local loss=$(grep "^${tag} " "$HEALTH_DATA" | awk '{print $2}')
 
     if [ -z "$loss" ] ; then
@@ -105,7 +125,9 @@ eval_group_health()
         local st=$(get_health "$tag")
         local loss=$(grep "^${tag} " "$HEALTH_DATA" | awk '{print $2}')
         local ld="${loss:-no_data}%" ; [ -z "$loss" ] && ld="no_data"
-        group_detail="${group_detail:+$group_detail, }$tag=$ld($st)"
+        local vpn=$(grep "^${tag} " "$VPN_DATA" 2>/dev/null | awk '{print $2}')
+        local vpn_mark="" ; [ "$vpn" = "0" ] && vpn_mark=",vpn=DOWN"
+        group_detail="${group_detail:+$group_detail, }$tag=$ld($st$vpn_mark)"
         [ "$st" = "healthy" ] && any_healthy=1
         [ "$st" != "dead" ] && all_dead=""
     done < "$gwdir/gateway"