Troubleshooting & FAQ

Symptom	Likely cause	Fix
403 on heartbeat	Wrong allowed IP or hostname	Update allowed IPs; set `BALCTL_HOSTNAME`
401 unknown credential	Used member UUID instead of enrollment secret	Re-enroll; use 48-char secret from modal
No HAProxy on card	No config / unit not detected	Install or ensure `/etc/haproxy/haproxy.cfg` exists
Drain buttons missing	No admin socket	Run admin socket recipe
Backup shows · D1 not · R2	R2 not bound when backup ran	Fix Worker binding; run new backup
Auto-failover didn’t run	Only one member, auto off, or no healthy standby	Add standby; enable auto; check readiness
DNS didn’t update	DNS not connected, private IP in heartbeat, label unset	Connect provider; use public IPv4; set label
Let’s Encrypt recipe greyed out	No Cloudflare or no failover FQDN	Complete DNS setup first

Support bundle: If contacting support, include the pool name, member hostname, journalctl excerpt, screenshot of member health badge.

Appendix — Plan gating (for operators)