Prevent master to fall back to master after failure

I'm using keepalived to setup a virtual ip that points to a master server. When a failover happens it should point the virtual ip to the backup, and the IP should stay there until I manually enable (fix) the master.

The reason this is important is that I'm running mysql replication on the servers and writes should only be on the master. When I failover I promote the slave to master.

The master server:

  global_defs {
    ! this is who emails will go to on alerts
     notification_email {
           [email protected]
     ! add a few more email addresses here if you would like
   }
   notification_email_from [email protected] 

   ! I use the local machine to relay mail
   smtp_server 127.0.0.1
   smtp_connect_timeout 30

   ! each load balancer should have a different ID
   ! this will be used in SMTP alerts, so you should make
   ! each router easily identifiable
    lvs_id APP1         
} 

vrrp_instance APP1 {
         interface eth0
         state EQUAL
         virtual_router_id 61
         priority 999
    nopreempt
         virtual_ipaddress {
             217.x.x.129
         }

    smtp_alert
}

Backup server:

 global_defs {
   ! this is who emails will go to on alerts
   notification_email {
       [email protected]
   ! add a few more email addresses here if you would like
  }
  notification_email_from [email protected] 

  ! I use the local machine to relay mail
  smtp_server 127.0.0.1
  smtp_connect_timeout 30

  ! each load balancer should have a different ID
  ! this will be used in SMTP alerts, so you should make
  ! each router easily identifiable
   lvs_id APP2           
   } 

vrrp_instance APP2 {
    interface eth0
    state EQUAL
    virtual_router_id 61   
  priority 100            
    virtual_ipaddress {
        217.xx.xx.129
    }

notify_master "/etc/keepalived/notify.sh del app2"
notify_backup "/etc/keepalived/notify.sh add app2"
notify_fault "/etc/keepalived/notify.sh add app2”
smtp_alert
}