High availability configuration

The flat configuration hub remains the compatibility route. This page is the canonical source-checked field reference for its family, including nested tables and list rows.

Paths in the tables are relative to [ha]. Each row gives the serde type and source default or unset meaning. Check parsing and lease/store cross-field rules with gdsgate doctor --config <PATH> --json, then follow the high availability guide.

[ha]

Used by: Authority.

High availability for Authority: many instances behind one shared PostgreSQL store_url, with one audit write-leader at a time, since the linear audit chain needs one writer. Off by default. Every takeover advances a monotonic fencing token on the lease row; an ex-leader whose lease has since been stolen during a partition is refused at the chain-commit transaction itself, even before its own controller observes the loss.

Key	Type	Default	Purpose
enabled	bool	false	Master switch.
owner	string	""	This instance's lease owner id. Empty generates a per-process id. Set it explicitly for stable, observable leadership.
lease_ttl_secs	u64	15	Lease validity. A follower takes over this long after the leader stops renewing.
renew_secs	u64	5	How often the leader renews the lease, and how often a follower retries acquiring. Keep well below lease_ttl_secs so transient hiccups do not drop the lease.

[ha]
enabled        = true
owner          = "auth-eu-1"
lease_ttl_secs = 15
renew_secs     = 5

HA provides failover, not write scaling. Followers refuse issuance and switch only when they win the lease.