What is built, what is not, what we want.

Built and tested (AWS)

• Clusters: create, delete and add a replica. Every cluster has at least a primary and a replica, in different zones.
• Online disk grow, by hand or by policy, without taking the database down.
• Private access: no public addresses on databases; per-cluster credentials; no shared superuser over the network.
• A DNS name for each cluster that follows the primary, and a boot check that stops a machine from starting PostgreSQL in a role it no longer has.
• Planned switchover with zero loss, which minor-version upgrades use.
• Minor-version upgrades for quorum clusters, by adding machines from a newer image and retiring the old ones last; undone by itself if anything fails before the first retirement. Tested on AWS under a continuous writer with no acknowledged write lost. See how it works.
• Self-electing quorum clusters (three members, Raft): the cluster picks its own primary and fails over without a central server; a primary that loses the majority stops itself. Tested against the AWS chaos suite with no acknowledged write lost. A member can be replaced by hand.
• A cluster of a primary and two replicas, which keeps three copies of the data and stays synchronous through the loss of a replica (the loss of one replica does not block writes). Tested on the AWS suite with no acknowledged write lost. Up to six replicas can be added; the third onward do not vote.
• Metrics and logs to VictoriaMetrics and VictoriaLogs, and a status page.
• Operations that survive failures: retries, rollback, abort and resume for long operations.

Not built yet

• Backups and point-in-time recovery. This is the largest gap. Until it exists, prty does not protect you from deleting your own data.
• Encrypted connections (TLS) between clients and databases.
• Minor-version upgrades for clusters of more than three data members, or that check the database’s locale against the new operating system’s C library first.
• Replacing a non-voting replica of a cluster with more than two replicas.
• Alerting that tells a person a cluster is degraded.
• Any cloud but AWS. Other providers exist in the code for development and as experiments; they do not offer the features above, and we do not offer them.
• Automatic recovery from losing two members. See reliability.

What we want to achieve

In the order we think matters. No dates: a date we would miss is a promise we should not make.

• Backups and point-in-time recovery, tested by restoring them.
• Scaling replicas up and down, and, once that is solid by hand, letting the system do it.
• TLS for every connection.
• Smaller footprint: measure and cap how much memory and CPU our agents and the machine image take from your database. This is at an early investigation stage.
• Other clouds, only after the above, and only with the reliability of each cloud worked out the way this page does for AWS.