Postgres archive_command has no timeout; a hung wal-push stops WAL archiving #226

Problem

The Postgres archive_command Onebox installs (/opt/onebox/backup/onebox-wal-g wal-push %p) has no time limit. When one upload stalls, archiving stops for good: Postgres waits on that command and retries the same segment, and WAL accumulates in pg_wal until the disk fills. The off-site recovery point falls behind for the whole stall, so the backup's 5-minute target is silently missed.

What happened

Goal production, 2026-10-24. A catalog refresh wrote WAL faster than the archiver uploaded it to Hetzner object storage (hel1), and pg_wal grew to 37 GB with about 2,250 segments marked .ready. While that backlog drained, wal-g wal-push hung twice:

• at 23:07 UTC on 000000020000005B000000DF, for 7 minutes;
• at 23:47 UTC on 000000020000006200000067, for more than 6 minutes;
• in each case pg_stat_archiver.last_archived_time stopped advancing while failed_count stayed 0, and the wal-g process produced no further log output;
• killing the wal-g process let the archiver retry the segment, and uploads resumed straight away.

Postgres shares the host disk with the application, so an unnoticed hang ends with the database unable to write. Because failed_count stays 0, a check on archive failures does not catch it.

Proposal

• Bound each wal-push in the wrapper, for example with timeout or wal-g's own upload timeout, so a stalled upload fails and Postgres retries it.
• Have ob backup status and ob doctor report archive lag: the age of last_archived_time and the .ready backlog, not only failures.

Related

ob plan also refuses a live release whose onebox.snapshot.yml is still onebox.run/v1alpha1 ("snapshot unusable: schema_identity_unsupported"). That blocks the first deploy after a project moves to v1alpha2. Goal worked around it by editing the snapshot's apiVersion line on the host. The 2026-10-04 decision record says the two schemas differ only by identity when there is no execution block, so loading such a snapshot as v1alpha2 would remove the need for that edit.