Re: [ADMIN] avoiding split brain with repmgr

- A mechanism to fence failed nodes, since "failed" really means "unknown". Without fencing there's a significant probability of split-brain. Pacemaker has a meatware fencing plugin which can be used on its own, or as a backup to automated fencing mechanisms.

- At least three nodes to establish quorum. Otherwise there's a risk that each half of a partition will try to fence the other, thinking the other half has failed.

- A non-trivial consensus protocol, one that's been mathematically studied and reviewed. Like encryption, this is a notoriously difficult problem and not the place for casually designed solutions.

and for cross-datacenter failover: http://clusterlabs.org/doc/en-US/Pacemaker/1.1/html/Pacemaker_Explained/ch15.html

https://aphyr.com/tags/jepsen is a good read on database consistency generally.