Raising the checkpoint_timeout limit

Hi,

is there any reason for the rather arbitrary and low checkpoint_timeout
limit? Obviously it's not not appropriate to have a 10h timeout on all
that many systems. But if the reaction to a server crashing is going to
be a failover to one of several standbys anyway, setting the timeout to
a high value, can make sense.

A high timeout has the advantage that the total amount of full page
writes reduces and, especially if the whole system fits into s_b, that
the total amount of writes to disk is drastically reduced.

I'm not sure what'd actually be a good upper limit. I'd be inclined to
even go to as high as a week or so. A lot of our settings have
upper/lower limits that aren't a good idea in general.

I'm also wondering if it'd not make sense to raise the default timeout
to 15min or so. The upper ceiling for that really is recovery time, and
that has really shrunk rather drastically due to faster cpus and
architectural improvements in postgres (bgwriter, separate
checkpointer/bgwriter, restartpoints, ...).

Greetings,

Andres Freund