ApsaraDB RDS:Preparations for creating a disaster recovery instance

Network connectivity solutions

Choose a connectivity method based on where your source database is hosted:

If your source instance supports public network access, use an Internet NAT gateway to connect it to the VPC of the destination instance. The steps below describe how to configure an Internet NAT gateway for the destination RDS instance.

If the source instance does not support public network access, use a CEN instance instead. For more information, see Establish network connectivity by configuring a CEN instance.

Configure an Internet NAT gateway for the destination instance

1. Log on to the ApsaraDB RDS console and go to the Instances page. In the top navigation bar, select the region of the RDS instance. Find the instance and click its ID.

2. In the left navigation pane, click Database Connection. On the Database Connection page, note the VPC and vSwitch of the destination instance. Hover over the VPC ID to view the vSwitch ID.

   

3. Click the VPC ID to go to the VPC console.

4. Go to the Resource Management tab. In the Access to Internet section, hover over Internet NAT Gateway and click Create Now.

   

5. Configure the Internet NAT gateway and click Buy Now.

   Configuration	Description
   Billing method	The default is Pay-As-You-Go. For billing details, see NAT Gateway billing.
   Instance name	Enter a name for the gateway. The name must be 2–128 characters, start with a letter or a Chinese character, and can contain digits, underscores (_), and hyphens (-).
   Region	Select the region of the destination RDS instance.
   Resource group	Select the resource group to which the VPC belongs. For more information, see What is Resource Group?.
   Network and zone	Select the VPC and vSwitch of the destination RDS instance.
   Network type	Select Internet NAT Gateway.
   EIP	Select an elastic IP address (EIP). If you don't have one, see Purchase an Internet NAT gateway and an EIP in unified access mode.

6. On the Confirm page, review the configuration and click Activate Now.

Step 1: Create a synchronization account

A synchronization account is a database account on the source instance that the disaster recovery service uses to replicate data. Create one with the following steps.

1. Connect to the source PostgreSQL instance and create the synchronization account. The following example creates an account named replicatoraccount.

   CREATE ROLE replicatoraccount CREATEROLE REPLICATION LOGIN PASSWORD 'your_password';

2. Grant the pg_monitor permission to the account.

   GRANT pg_monitor TO replicatoraccount;

3. Verify that the account has the required permissions by connecting to the source instance with replicatoraccount and running the following steps.

   1. Create a test account with the REPLICATION permission.

      CREATE USER testreplicator WITH REPLICATION;

      If the error must be superuser to create replication users is returned, connect to the source instance with an account that has the SUPERUSER permission and grant SUPERUSER to replicatoraccount:

      ALTER USER replicatoraccount WITH SUPERUSER;

   2. Delete the test account.

      DROP USER IF EXISTS testreplicator;

Step 2: Configure the ECS security group

Add an inbound rule to allow the Internet NAT gateway to connect to the source PostgreSQL database.

1. Log on to the ECS console.

2. In the left navigation pane, choose Instances & Images > Instances.

3. In the top navigation bar, select the region.

4. Find the source ECS instance and click its ID.

5. On the Security Groups tab, click the name of the security group.

6. On the Security Group Details page, go to the Rules section on the Inbound tab and click Add Rule. Add the following rules.

   Protocol type	Port range	Authorization object
   All ICMP (IPv4)	Source: -1/-1 / Destination: -1/-1	The EIP of the Internet NAT gateway created for the destination RDS instance. View the EIP on the Associated EIPs tab of the gateway.
   TCP	The port of the self-managed PostgreSQL database. Run netstat -a | grep PGSQL to find the port.	The same EIP as above.

Step 3: Configure the pg_hba.conf file

The following steps use PostgreSQL 13 on CentOS 7 as an example.

The pg_hba.conf file controls which hosts can connect to PostgreSQL and the authentication method each host must use. Add entries to allow the Internet NAT gateway to connect to the source database using the synchronization account.

1. Log on to the ECS instance where the self-managed PostgreSQL database is deployed. For more information, see Remotely connect to an ECS instance.

2. Find the location of the pg_hba.conf file. Switch to the root user before running this command.

   find / -name pg_hba.conf

   Sample output:

   /var/lib/pgsql/13/data/pg_hba.conf

3. Go to the directory containing the file.

   cd /var/lib/pgsql/13/data/

4. Edit pg_hba.conf and add the following lines at the end of the file.

   Placeholder	Description
   replicatoraccount	The synchronization account created in Step 1.
   121.XX.XX.XX	The EIP of the Internet NAT gateway created for the destination RDS instance. View it on the Associated EIPs tab of the gateway.

   host  all          replicatoraccount  121.XX.XX.XX/32  md5
   host  replication  replicatoraccount  121.XX.XX.XX/32  md5

   Replace the placeholders with actual values:

5. Connect to the source PostgreSQL instance and reload the configuration.

   SELECT pg_reload_conf();

   Expected output:

   pg_reload_conf
   ----------------
    t
   (1 row)

Step 4: Configure the postgresql.conf file

For instructions, see Configure the postgresql.conf file.

Step 5: Configure the server firewall

For instructions, see Configure the server firewall.