Operator Guide
Server Overview
Choose the deployment model deliberately, understand which copies protect which failures, and know what MP-OPT can and cannot recover.
Two supported deployment models
Choose the deployment that matches the risk
Both models require an external recovery copy. HA adds availability, dependencies, and commissioning duties.
Standalone
One VPS serves the application and PostgreSQL
- Simpler to deploy and operate
- Host failure requires a restore or rebuild
- External snapshot is the disaster-recovery path
VPS A
Either node may hold the lease
VPS B
Recent accepted recovery point
- Survives one VPS loss after qualified failover
- Requires witness, load balancer, replication, and alerts
- Still requires an independent external snapshot
| Model | Protects against | Operator obligations |
|---|---|---|
| Standalone | Application mistakes and VPS loss when a verified portable recovery snapshot exists. | Export fresh snapshots and keep the private recovery identity off the VPS. |
| Symmetric two-node HA | Loss of either VPS, with automatic or planned ownership transfer. | Maintain Cloudflare witness/routing, monitor replication, certify the pair, and retain an independent recovery snapshot. |
Recovery objectives
- Ordinary-write replication target: a complete encrypted peer copy at least every five minutes.
- Ordinary-write RPO: changes after the latest accepted complete copy may be lost.
- Critical operations: publisher credentials, public links, and deletion peer confirmation do not report success until the standby verifies their exact database marker.
- Automatic failover threshold: two minutes without the holder, followed by local promotion, direct-TLS health, and DNS routing checks.
- Witness outage: reads remain possible on the last holder, but writes fail closed to prevent split brain.
Three independent resilience layers
Availability, recent redundancy, and disaster recovery solve different problems and must not be treated as interchangeable.
1. Live service
The holder serves requests. In HA, either VPS may hold the writer lease.
2. Peer recovery point
A recent accepted complete bundle supports failover after one VPS is lost.
3. External recovery copy
An independently encrypted and verified snapshot protects against both VPSs, corruption, and operator mistakes.
Two different kinds of snapshots
Schedule-history snapshots are created when a desktop schedule is published. They restore one event's schedule through the web History tab.
Recovery snapshots are encrypted operator archives created through mp-opt. They can contain the PostgreSQL database, configuration and shared secrets and are used for infrastructure recovery.
Continue
- Install a standalone server safely.
- Understand the HA design before ordering or configuring the second VPS.
- Establish recoverable snapshots before admitting important data.
- Commission the standalone server before adding HA or important data.