Palomar: Group Moving

Groups can be moved between backends via either doveadm cluster group move or moves initiated by the Cluster Controller.

Both methods work by updating the user group fields in GeoDB:

• alt_backend_id is set to the destination backend
• moving is set to non-empty value

This is followed by (automatically) accessing any user in the group, which starts the actual moving in the source backend. This means any kind of a mail user access, such as mail delivery, IMAP login or doveadm access. It is the source backend's responsibility to finish the move.

While a group is moving, its users are first forwarded to the source backend. The source backend tracks in its LocalDB which users have already been moved to destination. If the logging in user is already moved, the login is rejected with a referral to the destination backend.

Once the group is fully moved, the user group is updated in GeoDB:

• backend_id is set to the destination backend
• alt_backend_id is set to a new backend
• moving is cleared

After this the users start logging in directly to the destination backend. Due to race conditions and GeoDB caches it's still possible that some proxies forward the connection to the source backend. The source backend remembers for up to 1 hour that the group move happened, and will reject the logins with referral to the destination backend.

If the source backend is marked offline/standby before the move is finished, the next user access immediately marks the move as finished. Because all proxies know the destination backend (alt_backend_id), this can be done safely even if multiple proxies do it simultaneously.