Bind daemon to local Pacemaker node identity

daemon/server.py

@@ -20,6 +20,7 @@ registry = None
 pacemaker_resource_id = None
 pacemaker_peer_uid = None
 pacemaker_peer_gid = None
+pacemaker_node_name = None
 
 PROTOCOL_VERSION = 1
 
@@ -68,6 +69,38 @@ def load_pacemaker_resource_binding(
     return resource_id
 
 
+def load_pacemaker_node_name(environ=None):
+    """
+    Load the Pacemaker node represented by this daemon instance.
+
+    The daemon is local to one PostgreSQL instance. This identity is not
+    used for routing; it is used to validate promotion and demotion context.
+    """
+    if environ is None:
+        environ = os.environ
+
+    raw_node_name = environ.get("PACEMAKER_NODE_NAME")
+
+    if raw_node_name is None:
+        raise RegistryError(
+            "PACEMAKER_NODE_NAME is not configured"
+        )
+
+    node_name = raw_node_name.strip().lower()
+
+    if not node_name:
+        raise RegistryError(
+            "PACEMAKER_NODE_NAME is empty"
+        )
+
+    if any(char.isspace() for char in node_name):
+        raise RegistryError(
+            "PACEMAKER_NODE_NAME must not contain whitespace"
+        )
+
+    return node_name
+
+
 def load_pacemaker_peer_authorization(
     environ=None,
 ):
@@ -163,6 +196,7 @@ def handle_request(
             "pacemaker_resource": (
                 pacemaker_resource_id
             ),
+            "pacemaker_node": pacemaker_node_name,
         })
 
     if action == "registry.list":
@@ -171,6 +205,7 @@ def handle_request(
             "pacemaker_resource": (
                 pacemaker_resource_id
             ),
+            "pacemaker_node": pacemaker_node_name,
             "resources": registry.list_resources(),
         })
 
@@ -263,6 +298,7 @@ def serve():
     global pacemaker_resource_id
     global pacemaker_peer_uid
     global pacemaker_peer_gid
+    global pacemaker_node_name
 
     registry = Registry()
     pacemaker_resource_id = (
@@ -272,6 +308,7 @@ def serve():
         pacemaker_peer_uid,
         pacemaker_peer_gid,
     ) = load_pacemaker_peer_authorization()
+    pacemaker_node_name = load_pacemaker_node_name()
 
     socket_directory = os.path.dirname(
         SOCKET_PATH
@@ -321,6 +358,12 @@ def serve():
         flush=True,
     )
 
+    print(
+        "Pacemaker node identity: "
+        + pacemaker_node_name,
+        flush=True,
+    )
+
     try:
         while True:
             conn, _ = server_socket.accept()