DR Best Practices

DR region must run restores before you need them. These rules turn DR from a slide deck into tested recovery capability.

How to Use This List

• Apply during annual architecture review and SOC2 prep.
• Score each item after DR game day pass/fail.
• Pair with DR Basics tier registry.
• Legal/compliance reviews retention and comms sections.

A - Planning

• Document RPO/RTO per service tier with executive sign-off. No implicit acceptance of data loss.
• Separate HA (AZ/node) from DR (region) in architecture diagrams. Different tools and RTO.
• DR region meets data residency requirements. Jurisdiction approved before replicating PII.
• Runbook names who declares disaster. IC authority documented.
• Customer comms templates pre-approved by legal. No improvised data-loss promises.

B - Technical Posture

• Cross-region WAL archive or managed cross-region backup. Primary region loss does not lose only copy.
• Warm cross-region async replica or restorable DR stanza. Cold backup-only for tier 2+ only.
• DR region ran successful restore or promote in last 12 months. Evidence archived.
• Independent Patroni/etcd scope per region for self-hosted. Avoid split-brain across WAN.
• Immutable backup copy (S3 Object Lock, WORM). Ransomware cannot delete only backup.

C - Operations

• Annual DR game day with DNS and app smoke test. Not only psql on DR host.
• Quarterly cross-region lag review against RPO tier. Alert on p99 replay lag.
• DR fail-back procedure documented. Exercise does not leave DR as accidental primary.
• Break-glass credentials stored securely for DR promote. Accessible during region outage.
• Postmortem after any real DR or failed game day. Track RTO gap to remediation.

D - Measurement

• Log DR_GAME_DAY_RTO and compare to tier registry. Leadership sees measured not theoretical RTO.
• Track data divergence at promotion time. Honest RPO reporting.
• Status page playbook linked from PagerDuty. Comms latency measured.
• Backup verify pulls from DR region copy. Local primary copy is not enough.
• Audit trail: who promoted, when, which backup ID. Compliance evidence.

E - Cost and Scope

• Right-size DR instance; document scale-up procedure. Cold DR cost control with runbook to upscale.
• Tier 2+ may use backup-only DR with longer RTO. Do not over-build analytics to tier-0 DR cost.
• Review cloud DR features vs Patroni self-hosted yearly. Avoid paying for both unintentionally.
• Exclude non-critical databases from tier-0 DR spend. Explicit scope boundary.

FAQs

Minimum viable DR?

Off-site WAL + monthly restore to DR VPC + written runbook + annual tabletop.

Replica vs backup DR?

Replica for RTO; backup for ransomware and logical corruption. Tier-0 needs both.

How is DR different from PITR?

PITR rewinds time; DR survives region loss. Complementary.

Multi-cloud DR?

Possible via logical replication or object storage neutral backups; higher operational cost.

Who owns DR budget?

Infrastructure + product jointly; tier registry drives spend.

Related

• DR Basics - RPO/RTO framework
• Cross-Region Replicas - warm DR
• DR Game Days - exercise calendar
• Backup Best Practices - off-site copies

Stack versions: This page was written for PostgreSQL 18.4 (stable 18, maintenance 17), pgvector 0.8+, PgBouncer 1.x, Patroni 3.x, and PostGIS 3.5+.