Thanks for the feedback. I'll definitely add a docs page to explain failure modes. That's a really good idea. I'll briefly answer your questions here as well.

Thanks for the feedback. I'll definitely add a docs page to explain failure modes. That's a really good idea. I'll briefly answer your questions here as well. > Is there any indication on the replicas that they are read-only? No, Litestream runs as a separate process so it can't control whether the application writes to the SQLite database. That being said, you can set up your replicas to pass "mode=ro" in the DSN to SQLite to ensure they can't issue writes. SQLite also has a "PRAGMA query_only" to check if that flag is enabled. > Is there and plan for failover/promotion? There's no failover/promotion. Litestream was originally for continuously replicating a single node to S3 to ensure durability. The idea was that many VPS providers have decent reliability so you can achieve high uptime (e.g. 99.9%) with a single node and still have a fallback in case it fails catastrophically. If you have higher uptime requirements then Litestream may not work for you but there's a large class of applications where that works well. Recovery is just a matter of calling the "litestream restore" command so you can automate it pretty easily. > What happens if I accidentally write to a read-only replica? Will the error be detectable immediately, or will I need to do some sort of exercise to discover it? If you accidentally write to the replica then it will corrupt the replica. Litestream will not automatically detect it, however, you'll start getting errors from SQLite saying that your database is corrupt—usually pretty quickly. > Is it even possible by SQLite semantics, or will I get locking timeouts if I try to write while the process is running? Yes, SQLite works well in a multi-process environment and that's how Litestream interacts with it. Litestream occasionally obtains brief write locks so you should set the "busy_timeout" in your application so that it doesn't get an error when it tries to obtain a write lock at the same time. > Can I use permissions to help? You could probably run your application and Litestream as different users and adjust permissions accordingly. It's probably easier to set the "mode=ro" though. Also, I'll note that I'm working on some future tooling for SQLite replication that acts more as a database-as-a-service that makes the administrative part more straightforward (e.g. any node can write, no need to worry about configuring read-only databases, etc).