The current system to set mediawiki in read-only mode requires one deploy to set it and another to leave it. While the current system is ok (being manually possible to set it by a configuration change), operations is shifting to a more automatic system.

One option would be to orchestrate that configuration directly from confd. Deploying now such change takes around ~2 minutes per change, increasing the visible user impact (while actual failover time tends to tale only 1-2 seconds).

Another, more complex option to implement in a scalable way and reliable way, but that would reduce down time is to automatically set it if a write fails because it is in read only mode or the master fails to respond at all. I know mediawiki can detect such a state because when it happens it can log such an error (but continues writing). I believe also some error handling is already implemented. By setting read only mode on master database read only mode, we would increase the agility of a server or datacenter failover steps (orchestration would set the servers automatically, which would itself notify mediawiki- with no deployments needed).

Of course, this should be setup in a way that this is not checked on every query, but that on error, it is set for all connections. The exact process can be discussed, this is why this is an RFC.