Some Dan comments on x-site configuration:

I'd rather move the list of backup sites to the global configuration as backup configuration templates, so individual cache configurations could only pick one or more of those global sites (but maybe with a different config). Then the protobuf metadata cache would just back up to all the globally defined backup sites, with the template config. And I think having a single "offline" status for the backup site across all caches would also be an improvement.

We also need to allow a site to be offline at startup, currently a site can only be disabled in the configuration, and I’m not sure what’s the relationship between a site’s “enabled” status and it’s “online” status. We may also want to allow a site to become online automatically, without the administrator’s intervention (with or without starting a cross-site state transfer).