I like it - nice and simple, but targets a large (and likely) foot gun
situation.
regards
Mark
Simon Riggs wrote:
>
>If a further pg_ctl mode, recover, were implemented, this would allow a
>fail safe mode for recovery.
>
>e.g. pg_ctl -D datadir recover
>
>pg_ctl could then check for the existence of a recovery.conf file and
>return an error if none were found. This mode would not then need to be
>passed through to the postmaster as an option, which could accidentally
>be re-invoked later should a crash recovery occur (the main reason to
>avoid adding recovery.conf options to postgresql.conf in the first
>place).
>
>This mode would do nothing more than:
>- check for recovery.conf, if not found, return error
>- invoke a start normally, as if mode=start had been requested
>
>The doc for invoking recovery could then be changed to include this new
>mode, and the potential for error would be removed.
>
>This is a change requested for 8.0, to ensure that PITR doesn't fall
>into disrepute by novice users shooting themselves in the foot. It is a
>minor change, effecting only PITR, and only to the extent of a
>documentation change and a file existence check in pg_ctl. No server
>code would be changed.
>
>Alternative suggestions are welcome. Thoughts?
>
>
>
