The following bug has been logged on the website:
Bug reference: 15331
Logged by: Phil Endecott
Email address: spam_from_pgsql_lists@chezphil.org
PostgreSQL version: 9.6.10
Operating system: Debian Stretch
Description:
When a standby server is promoted it renames recovery.conf to
recovery.done.
That will not be possible if that file is owned by root or otherwise has the
wrong permissions. It's unusual for a program to modify its own
configuration files like this.
It would be great if PostgreSQL could check that the permissions are
suitable when it starts, and emit a warning if not. Currently it only fails
when asked to promote, with this log message:
FATAL: could not open file "recovery.conf": Permission denied
(Note that it only says "could not open", not "could not rename".)
This means that promotion fails, and for me even after fixing the
permissions the system was in an odd state that took some work to fix.
Failover is hard to get right; emitting a warning earlier in this case would
mean one less thing to go wrong.