In pgPool-II 3.7.5 configuration pgpool.conf, is recovery_user a role or a system user?

Question

I'm having trouble configuing pgPool-II 3.7.5 for online recovery. In pgpool.conf, there is a parameter called recovery_user along with a recovery_password that are somehow used to run recovery_1st_stage_command.

The pgPool docs say of recovery_user:

Specifies the PostgreSQL user name to perform online recovery.

To me, this indicates very clearly that recovery_user is the name of a PostgreSQL user (role in the database). However, in a previous version of the docs, it also says

You need to setup ssh so that recovery_user can login from the primary to the standby without being asked for a password.

which clearly indicates that recovery_user should be a system user. Granted this is documentation from pretty different versions but it's hard for me to believe that the implementation of this feature changed in that way.

Which is it, is recovery_user a database role or a server user?

Bonus: Please explain how pgPool-II orchestrates running recovery_1st_stage_command

Answer 1

I don't use pgpool, but it must be the OS user who runs the database server. It cannot be a user within the PostgreSQL database, as a failed database cannot accept connections until after it has been recovered.

Answer 2

I can verify that recovery_user is not a system user, it is a database role! pgPool uses a protocol called PCP to run scripts on its managed nodes and PCP connects through the database, running custom installed pgpool functions that run the recovery script. These functions are installed by installing the system package (apt, yum, whatever) for pgpool-II-extensions and then running CREATE EXTENSION pgpool_recovery; in your database.

Unfortunately there seems to be a problem with pgPool actually executing the pgpool_recovery function via PCP but that's for a new question.