>> What I'm pondering here is that is the cluster able to keep the >> postmasters synchronized at all times so that the database won't get >> corrupted. > > Keep all the $PGDATA in the shared disk. That would minimize data loss > (Of course, there is still a risk of data loss -- the postmasters are > not aware of each other and they don't share each other's buffers, etc.)
It would be much better to have the cluster software only run one postmaster at a time, starting up the secondary if the primary fails. That's the usual practice with shared storage.
This was my original intention. I'm still quite hesitant to trust the fencing devices ability to quarantee that only one postmaster at a time is running, because of the disastrous possibility of corrupting the whole database.
Maybe I'm just better off using the more simple (crude?) method of drbd + heartbeat?