Two. Run one in warm/hot standby, optionally with synchronous commits if you want (nearly) guaranteed zero data loss, and can tolerate the increased write latency.

Technically you’ll need a third server to perform the failover, but it doesn’t need to be nearly as big, as it’s just watching heartbeats and issuing commands.

Server failures are rare. Its still usually going to be cheaper to have physical servers even with spare capacity for failures.

I think these days it's more: were do we find the grey old unix guy who confidently will host your db for you on bare metal.