I've put a little thought into clustering for both performance and availability. I'm wondering if we can shard by upstream group instead of by ip. Here is an example where you have 2 ep servers:

```
upstream ep-group-0 {
  server ep0:9001 fail_timeout=0;
  server ep1:9001 backup;
}

upstream ep-group-1 {
  server ep1:9001 fail_timeout=0;
  server ep0:9001 backup;
}
```

An example with 3:

```
upstream ep-group-0 {
  server ep0:9001 fail_timeout=0;
  server ep1:9001 backup;
}

upstream ep-group-1 {
  server ep1:9001 fail_timeout=0;
  server ep2:9001 backup;
}

upstream ep-group-2 {
  server ep2:9001 fail_timeout=0;
  server ep0:9001 backup;
}
```

etc... What I *think* this would do is have all requests route to a deterministic "main" etherpad server, then if it goes down, the failover should be deterministic. `fail_timeout=0` *should* ensure that even if the "main" ep server comes back up, users aren't dumped back to the available one and once again lose a session, so we have some grace time to schedule maintenance to recover and bounce the nginx server.

In this current situation, if a server drops, 50% of the etherpad content items can't be edited until we bring it back up. Hard to tell if my proposed solution is really much better, actually.

Just a thought.