Setting Up Automatic Failover for 1C-Bitrix

The primary database server went down at 3 AM. The on-call engineer is unavailable. Without automatic failover, the site stays down until morning. With properly configured failover, traffic switches to the replica in 30–60 seconds, and users notice nothing. We configure failover turnkey, covering all layers — from the database to Bitrix configuration. In 2–3 days, your cluster achieves production-grade fault tolerance. We work with companies handling from 10,000 visitors per day — more than 50 projects over the past 5 years. Estimate the savings: downtime for a high-traffic site can be costly. Failover pays for itself in a single incident.

Components of Automatic Failover

Automatic failover for Bitrix consists of three independent layers that must work in concert:

If the DB failover is not accompanied by an application config update, Bitrix will output connection errors.

Why Patroni Is the Standard for PostgreSQL Failover

Patroni is the de facto standard for automatic PostgreSQL failover. Architecture: a Patroni agent on each node, etcd/Consul as DCS (distributed configuration store), HAProxy or pgBouncer in front of the cluster.

Patroni monitors node health and, if the primary becomes unavailable, conducts an election for a new leader via DCS. The replica with the smallest lag (lowest LSN lag) becomes the new primary. The entire process takes 10–30 seconds.

Critical for Bitrix: the application connects to the DB not directly to the server IP but through HAProxy or via a virtual IP (VIP) managed by Patroni:

# /bitrix/.settings.php — подключение через HAProxy dsn => 'pgsql:host=haproxy.internal;port=5432;dbname=bitrix', 

HAProxy checks the Patroni REST API (http://patroni-node:8008/master) and routes traffic only to the current primary.

Comparison of Patroni and Orchestrator:

MySQL Failover via Orchestrator

For MySQL-based Bitrix installations, the analogue of Patroni is Orchestrator. It tracks the replication topology, detects the master failure, and automatically promotes the most up-to-date replica. After promotion, Orchestrator calls a hook script that updates DNS or notifies HAProxy.

What to Do with Bitrix Cache After Failover?

After failover, the new primary is a former read-replica. Before the failover, Bitrix might have been configured for read/write splitting:

// /bitrix/.settings.php 'connections' => [ 'default' => [ 'host' => 'primary.db', 'port' => '5432', // ... write-соединение ], 'replica' => [ 'host' => 'replica.db', 'port' => '5432', 'readonly' => true, // ... read-соединение ], ], 

After the failover, the replica became the primary — the replica string should no longer be used for read-only connections (it now accepts writes as well). HAProxy with Patroni API health checks handles this automatically: both ports (write 5432, read 5433) are checked separately.

For memcached/Redis, there are no cache issues. For file cache, we invalidate via BXClearCache(true) or through the admin panel. Our setup includes a post-failover hook that does this automatically.

Another issue is uncommitted transactions at the time of the primary crash. WAL replication guarantees the application of all written transactions on the replica, but transactions that were in the primary's memory at the moment of the crash are lost. This is normal behavior for synchronous/asynchronous replication with losses measured in seconds.

Monitoring State

# Patroni — current leader curl http://patroni-node1:8008/cluster | jq '.members[] | {name, role, lag}' # Replication lag (PostgreSQL) SELECT client_addr, pg_wal_lsn_diff(sent_lsn, replay_lsn) AS lag_bytes FROM pg_stat_replication; 

Alert: if lag_bytes > 50MB, replication is falling behind, increasing the risk of data loss during failover.

Steps for Configuring Failover for Bitrix

1. Audit the current replication scheme and infrastructure.
2. Install and configure Patroni (PostgreSQL) or Orchestrator (MySQL) with DCS (etcd/Consul).
3. Configure HAProxy with health checks via the Patroni REST API.
4. Change Bitrix connection via HAProxy (not directly to the DB IP).
5. Write a post-failover hook script for cache invalidation and notification.
6. Set up replication lag monitoring with an alert when the threshold is exceeded.
7. Test failover on a load testbed with failure simulation.
8. Document and train the on-call team.

#!/bin/bash # post_failover.sh # Clear Bitrix file cache bx-site /path/to/site bx:clear_cache --full # Notify via Telegram or Slack curl -X POST -H 'Content-Type: application/json' -d '{"text":"Failover completed"}' https://hooks.slack.com/...