Random planning notes for myself:
cronjob do every n minutes:
* take a mongodb and redis dump, place into jschan's dir, make a btrfs snapshot
* btrfs send it over to the other server(s)
* can delete old snapshots once everyone else has them
when need to switch over:
* drop whatever state we might have, and create a writable subvol from the last snapshot
* restore redis & mongodb
* start jschan
* from this point this node can replicate to the other servers
active master selection:
* raft protocol (but complicated to implement and ready made implementations are either way too barebones to use or overly bloated...)
* alternate: gossip protocol (when something changes, just broadcast it to everyone, conflict resolution based on timestamps)
* this should run on all nodes (servers & proxies, not just servers) (with 2 nodes it's a bit hard to tell if you disconnected from the net or the other node died)
* when a server starts: attempt to get master node status from the distributed store, if it fails assume we're offline and don't start (could also ping some outside service with better than garage level SLA for extra sanity check, like 8.8.8.8)
* for proxies this is less important (at worst we'll try to communicate with a dead server vs. if multiple servers start, that can get chaotic)
* while active send out a hearbeat every say 1 minute
* if no heartbeat received from the active server for say 5 minutes, another server can take over
* sanity check: we shouldn't take over if we got offline (see first point). so probably all node should send a heartbeat, and only switch if we seen a heartbeat recently, but not from the active server. can sanity check internet connection here too
* how to select next active server? with only 2 servers the solution is trivial, but with more? you don't want to accidentally start two servers. handling this would probably require raft
Is there an easier way to do this? It feels like a minefield to implement from scratch with all the stupid edge cases. But worst case I just destroy an altchan, so what can go wrong?
Also since it's not like trashchan gets 1938 posts every second, it's possible to just trigger the sync after each post to decrease the window where data loss can occur (but it's still need some cooldown/whatever, so someone flooding the site with posts wouldn't case even more load on the server than there is already).