A 2-node Proxmox cluster needs a third vote. Without one, losing either node takes the cluster's quorum with it. The usual answer is a QDevice (corosync-qnetd) on some third box, but there's no package for OpenWrt. Your router is already always on and sits next to both nodes, so I packaged qnetd for it.
Repo: https://github.com/jrparks/corosync-qdevice-openwrt
What you get
- corosync-qnetd 3.0.4 plus its runtime libraries (NSS 3.98, NSPR 4.35), as .ipk packages for OpenWrt 23.05 (musl).
- Only qnetd itself: no corosync cluster engine, no knet, no libqb. About 1.7 MB to download, about 4.5 MB installed, and 12–16 MB of RAM while idle.
- corosync-qnetd-setup creates the NSS certificate database, adds a firewall rule that only lets your PVE nodes reach TCP 5403, fixes the Dropbear sftp-server path that pvecm needs, and starts the service under procd.
- A certutil wrapper that falls back to OpenSSL 3 -legacy, so pvecm qdevice setup doesn't fail with PKCS#12 errors on PVE 8/9.
- Releases are built by GitHub Actions for four targets, each with a SHA256 checksum file:
- glinet-aarch64: GL.iNet Flint / Beryl AX (aarch64_cortex-a53_neon-vfpv4)
- mediatek-filogic: Flint 2 / GL-MT6000
- armsr-armv8: generic ARM64, Raspberry Pi 4
- x86-64
Install
opkg update && opkg install openssh-sftp-server
opkg install --nodeps --force-reinstall libnspr_*.ipk libnss_*.ipk corosync-qnetd_*.ipk corosync-nss-tools_*.ipk
corosync-qnetd-setup <pve-node1-ip> <pve-node2-ip>
Then on one PVE node:
pvecm qdevice setup <router-ip>
pvecm status # Flags: Quorate Qdevice, Total votes: 3
Running in production on a GL.iNet GL-BE6500 as the qdevice for a 2-node PVE cluster. Today one node went down and the remaining node stayed quorate thanks to the router's vote.
Gotchas
- Firmware upgrades: packages installed with opkg are wiped by sysupgrade. Add the qnetd binaries, the libraries and /etc/corosync/qnetd/nssdb/ to /etc/sysupgrade.conf. Keeping the nssdb means the cluster certificates survive, so you don't have to re-run pvecm qdevice setup.
- Reinstalling over an existing install: removing corosync-nss-tools deletes the 5403 firewall rule, and the install step doesn't add it back. After a forced reinstall, re-add the rule or re-run corosync-qnetd-setup with your node IPs.
Bug reports and other targets welcome. BSD-3-Clause.
Repo: https://github.com/jrparks/corosync-qdevice-openwrt
What you get
- corosync-qnetd 3.0.4 plus its runtime libraries (NSS 3.98, NSPR 4.35), as .ipk packages for OpenWrt 23.05 (musl).
- Only qnetd itself: no corosync cluster engine, no knet, no libqb. About 1.7 MB to download, about 4.5 MB installed, and 12–16 MB of RAM while idle.
- corosync-qnetd-setup creates the NSS certificate database, adds a firewall rule that only lets your PVE nodes reach TCP 5403, fixes the Dropbear sftp-server path that pvecm needs, and starts the service under procd.
- A certutil wrapper that falls back to OpenSSL 3 -legacy, so pvecm qdevice setup doesn't fail with PKCS#12 errors on PVE 8/9.
- Releases are built by GitHub Actions for four targets, each with a SHA256 checksum file:
- glinet-aarch64: GL.iNet Flint / Beryl AX (aarch64_cortex-a53_neon-vfpv4)
- mediatek-filogic: Flint 2 / GL-MT6000
- armsr-armv8: generic ARM64, Raspberry Pi 4
- x86-64
Install
opkg update && opkg install openssh-sftp-server
opkg install --nodeps --force-reinstall libnspr_*.ipk libnss_*.ipk corosync-qnetd_*.ipk corosync-nss-tools_*.ipk
corosync-qnetd-setup <pve-node1-ip> <pve-node2-ip>
Then on one PVE node:
pvecm qdevice setup <router-ip>
pvecm status # Flags: Quorate Qdevice, Total votes: 3
Running in production on a GL.iNet GL-BE6500 as the qdevice for a 2-node PVE cluster. Today one node went down and the remaining node stayed quorate thanks to the router's vote.
Gotchas
- Firmware upgrades: packages installed with opkg are wiped by sysupgrade. Add the qnetd binaries, the libraries and /etc/corosync/qnetd/nssdb/ to /etc/sysupgrade.conf. Keeping the nssdb means the cluster certificates survive, so you don't have to re-run pvecm qdevice setup.
- Reinstalling over an existing install: removing corosync-nss-tools deletes the 5403 firewall rule, and the install step doesn't add it back. After a forced reinstall, re-add the rule or re-run corosync-qnetd-setup with your node IPs.
Bug reports and other targets welcome. BSD-3-Clause.
