Shared-store HA

Every lattice-dhcpd process is identical. Lease state is a row in Postgres. You do not pair nodes, share a UDP socket, or run OMAPI.

What “shared-store” means

• Discover may land on dhcp-a; Request on dhcp-b. The Request is committed even if this node did not send the Offer.
• Server-identifier mismatch is ignored on purpose so a VIP / anycast does not NAK a valid Request.
• Adding a node: new LATTICE_NODE_NAME, same DSN, add to the UDP VIP. Relays do not change. Runbooks.

What is not HA

• A single Postgres writer. Use managed failover or Patroni. dhcpd /readyz is 503 while the writer is gone — the VIP should pull the node.
• The operator console. Run two lattice-api behind HTTP if you want; they are stateless aside from Postgres.
• DNS. The worker retries; a down BIND delays A/PTR, not Ack.

VIP

Health-check HTTP /readyz, not UDP/67. See VIP. Drain: remove from VIP first, then stop the unit. Do not delete leases.

Lab proof: dhcptest sends Discover to :6767 and Request to :6768.