From: Tom Lane <tgl@sss.pgh.pa.us>
To: Stephen Frost <sfrost@snowman.net>
cc: Magnus Hagander <magnus@hagander.net>,
        Jehan-Guillaume de Rorthais <jgdr@dalibo.com>,
        Robert Haas <robertmhaas@gmail.com>,
        Thomas Munro <thomas.munro@gmail.com>,
        "pgsql-hackers@postgresql.org" <pgsql-hackers@postgresql.org>
Subject: Re: when the startup process doesn't
In-reply-to: <20210420185150.GL20766@tamriel.snowman.net>
References: 
 <CA+TgmoaHQrgDFOBwgY16XCoMtXxsrVGFB2jNCvb7-ubuEe1MGg@mail.gmail.com>
 <CA+hUKGKg6_h=p03vA9_+05RAJGDDJ4R0u29f5UEhfg7bZTcSog@mail.gmail.com>
 <465221.1618879471@sss.pgh.pa.us>
 <CA+TgmoaSELPiPqNcfNG_TyDe6=VVzfyh+YvhB6-GGsWoo=jc8Q@mail.gmail.com>
 <CABUevEwc_oP=kf6CYxNGM3KLMRBe3YBhM8+qu0oBbY_x89ifHw@mail.gmail.com>
 <20210420171720.56599607@firost>
 <CABUevEyTBiiDvjdKo5h=gj6W1uL6i4jOOV4nur0YZsuKvKRVXw@mail.gmail.com>
 <631849.1618942988@sss.pgh.pa.us>
 <20210420185150.GL20766@tamriel.snowman.net>
Comments: In-reply-to Stephen Frost <sfrost@snowman.net>
	message dated "Tue, 20 Apr 2021 14:51:50 -0400"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <633336.1618945018.1@sss.pgh.pa.us>
Date: Tue, 20 Apr 2021 14:56:58 -0400
Message-ID: <633337.1618945018@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/633337.1618945018%40sss.pgh.pa.us>
Precedence: bulk

Stephen Frost <sfrost@snowman.net> writes:
> Yeah, being able to pick up on this remotely seems like it'd be quite
> nice.  I'm not really thrilled with the idea, but the best I've got
> offhand for this would be a new role that's "pg_recovery_login" where an
> admin can GRANT that role to the roles they'd like to be able to use to
> login during the recovery process and then, for those roles, we write
> out flat files to allow authentication without access to pg_authid,

We got rid of those flat files for good and sufficient reasons.  I really
really don't want to go back to having such.

I wonder though whether we really need authentication here.  pg_ping
already exposes whether the database is up, to anyone who can reach the
postmaster port at all.  Would it be so horrible if the "can't accept
connections" error message included a detail about "recovery is X%
done"?

			regards, tom lane