Summary

  • RIPE NCC’s 28 October technical plan replaces an architecture built around two nearby data centres and a stretched Layer 2 network with two autonomous Western European sites.
  • The proposed design runs active-active within each centre and active-standby across them. Migration is expected to finish in the second half of 2028; the slides report no completed failover test.

A second data centre is a comforting phrase until the first one falls over and pulls its neighbour with it. At RIPE 93, RIPE NCC CTO Sjoerd Wolthers put the awkward wiring on the screen. The official slides describe today’s two locations as close together, joined by a stretched Layer 2 architecture. The replacement plan calls for two full centres in Western Europe that operate independently.

That is a change in the unit of failure. The present design was efficient when the sites behaved as one network. It now carries aging hardware, link speeds nearing limits, storage and backup constraints, and a virtualization platform that locks RIPE NCC to a vendor. Wolthers also points to a less stable geopolitical and regulatory environment, dependence on large external providers and rising cloud costs. The registry wants core services on infrastructure it controls.

The new drawing is unusually specific for a public promise of “resilience.” Each centre would have N+1 redundancy and an active-active setup inside its own walls. Between the two, RIPE NCC proposes active-standby, explicitly to manage latency over distance. Rented high-speed circuits would carry encrypted traffic between sites. The network design separates the sites and application tiers; a global service load balancer would move traffic between regions when needed. Full IPv6 support is specified for core services.

Compute and storage get named too. RIPE NCC proposes Proxmox virtualization and CEPH clusters that are independent in each data centre, plus an S3-compatible object store. Its backup slide specifies encrypted, immutable copies and a third location. These choices make the plan testable: one can ask whether a failed centre leaves its peer able to serve the registry and whether a damaged storage cluster can be restored without borrowing the same failed dependency.

The slides do not name the two facilities, a provider, a migration order or recovery times for the RIPE Database, RPKI and other core services. They also do not report a failover drill on the proposed architecture. Wolthers places design, procurement, installation and service migration ahead, with completion expected in the second half of 2028. A diagram is a contract with future engineering work, not evidence that the new boundary already holds.

The RIPE 93 session makes the institutional bet visible. RIPE NCC is trading the convenience of one stretched local network for the operational burden of two autonomous ones. Members already have a budget story for the renewal; this presentation supplies the architecture on which that spending is meant to stand. When the first service moves, the useful question will be brutally simple: can either centre keep the ledger available while the other is gone?

Sources: RIPE 93 official presentation and recording and Wolthers’s original slides.