Summary

  • A 40-kilometre site move reduced one flood exposure, then exposed storage latency and a slow recovery path.
  • The planned 99.99% availability target depends on independent sites, separate networks and tested service recovery; the programme aims to finish migration by the end of 2028.

RIPE NCC moved one data centre from Amsterdam to Nieuwveen, roughly 40 kilometres away. The move addressed a flood risk. The storage design, tuned for two nearby sites, then met a different physical fact: distance adds latency. Performance fell, and services became unavailable.

That is the useful part of Sjoerd Wolthers’s RIPE 93 account. A second dot on a map did not create a second recovery system. The old arrangement spread one network across both data centres, with roughly one set of equipment for each function at each site. It was efficient and could fail over quickly while the centres were close. The move stretched the design beyond the distance its storage could tolerate.

The current workaround makes the asymmetry plain. Both storage environments sit in one data centre; the other holds a backup. If the primary site fails, RIPE NCC must recover from equipment at the other site while the primary equipment is gone. Wolthers said that would take a significant time and was an unacceptable risk. A backup can preserve data while leaving a service unavailable for the very interval that matters.

There is a second dependency to remove. A supplier installed and managed the virtualisation environment, which was VMware-based. Extending it became sharply more expensive, and the organisation had no alternative within that same setup. The programme aims to change platforms and reduce vendor lock-in. The old bargain—less maintenance in exchange for one managed stack—became costly when the bill for staying rose and the exit path narrowed.

The proposed design has two full data centres, double equipment at each and a separate network for each site. Systems would run actively within a centre and in active-standby mode across the two. A separate witness location would hold backup material and help decide which centre leads; it is not a third full data centre. Workloads with short recovery-point requirements would get fast local storage, while longer-interval workloads could synchronise across sites.

Wolthers set 99.99% as the availability level the new setup should support. That is a design target; the session reports no measured result against it. The programme was still in high-level design. It aimed to migrate services and decommission the current centres by the end of 2028, under pressure from equipment reaching end of life or support in late 2027 and 2028.

The cloud story is narrower than “bring everything home.” Wolthers described the footprint as limited: cloud services mainly support Internet measurement and public data, while identity and exit management are more sensitive and need a fallback. In the Q&A, managing director Hans Petter Holen tied the harder control question to serving 72 states and relying on governments, hardware and network suppliers that RIPE NCC cannot command outright.

The open facts that would change the resilience verdict are the final second-site location and jurisdiction, the selected vendors and subcontractors, and measured recovery gates for each service.

Sources