Active/Passive NODE question

That is a great solution. However... you noted:

 

 

Doesn't offer the capability of manual resume after failure, or true designation of a "primary" and "secondary" instance (sometimes required for db applications)...

 

That is, in fact, the situation we're talking about, even though I hadn't mentioned it above. When a node fails, a DBA will check the failed node, verify its health, ensure there are no collision transactions, turn on replication again, and verify everything is healthy. We want to then "enable" the node again, but not take traffic. Ideally, the fewer times we "flip flop" the better.

 

 

The real question here is of solution "elegance", I guess.