Redundancy strategy for vouch

[torfbolt]

I have an architecture question:

The way I understand it from the github documentation and posts on attestant.io, I can use both redundant beacon nodes and redundant dirk signers using threshold signatures. But that still makes the vouch instance a single point of failure. If the machine running vouch goes down, there is no graceful failover.

Or am I misunderstanding something in the redundancy article? Would it be valid to just run multiple opportunistic vouch instances with the same accounts and rely on dirk to filter out the excess signature requests? I tried this with a test account and while it works, it generates lots of errors and warnings for both vouch and dirk.

Or can I somehow configure multiple vouch instances to talk to each other and figure out the mutually best attestation / proposal for a given account and only request signing on that one?

[mcdee]

Vouch is currently designed as a single-instance system, with the recommendation for redundancy being an active-passive setup. Although this would commonly be a manual failover, Vouch is designed to start quickly and so failover with minimal downtime.

We are investigating allowing multiple instances to run at the same time in an active-active configuration, and expect to have an early release of this function within the first half of this year.