It doesn't always have to be complicated. Chances are It'll probably feel more like grunt work than rocket science.
Look up Disaster Recovery Metrics. You set an RTO (recovery time objective -- how long it takes to recover) and RPO (how much history is lost when recovering) based on what's needed for your project and feasible to implement.
Feasibility of disaster recovery strategy = Cost to implement strategy + Cost of losing data back to the strategy RPO + Cost of losing business during strategy RTO < Cost to business of riding out probable disaster
Pick the fastest/cheapest feasible strategy, implement it. Then once your ass is covered, pick the one with the greatest expected value and implement that. If you wait until you can design and are given resources to implement a 5-nines available strategy with sub-milisecond RTO and RPO (which seems to be a popular tendency of developers), disaster will strike before it happens.
And, y'know, because it would be really cool if I managed to ;-)
1. IBM mainframes.
2. HP NonStop systems.
3. OpenVMS clusters on SMP machines.
Give them the prices of systems and rare labor for each. Then, show them the price of a three to four 9's solution with Linux that has three to four less 0's. Mention how many extra bonuses, err business investments, they could make with such savings. At this point, they might treat you like an idiot for not buying the cheaper route. Maybe even enthusiastic about your business savvy approach. ;)
We have much the same stack at Reverb.com and I focus more on creating a disaster recovery plan than tackling a mirror of our infra. I'm focusing on bringing up our stack in another region of AWS if we would ever need to rather than mirroring everything.
Sometimes a mitigation plan is far more useful than building in excessively complicated redundancy.
Are you suggesting to have a slave ready to become master in the 2nd datacenter? If that's the case, my main area of uncertainty is: if you promote a slave to master in a 2nd datacenter and that new master accepts writes, you then have a brutal problem of propagating writes to the old master when he comes back online.
The whole thing may exceed my capability right now but I think having a disaster recovery is far better than a mirror now that I think through it.
I'm not saying something off-the-shelf will work or out of the box. Just seems like there would be a clear path for admins or developers of such software to integrate it with... something [1]... that did that.
[1] Example: http://sector.sourceforge.net/
Unless you're a bank, you run asynchronous with watchdog scripts and accept the very very small risk that you lose a few transactions within the ~100ms window of async latency.
It's all risk analysis. For most of us, hours of downtime is riskier than losing a tiny sliver of data for a small number of customers.
My system is dynamic, but once a user is allocated to a node it is easy to replicate their data over the network. The key was I designed the system with easy replication in mind - flat files rather than databases, etc.
https://news.ycombinator.com/item?id=10822904
EDIT to add: Good work on Unison btw.
I think the real key to creating a simple and low cost reliable system is to have this in mind when you design your application. I could have used a database just as easily as a flat file approach, but this would have made things much more complicated to replicate between the nodes.
"I think the real key to creating a simple and low cost reliable system is to have this in mind when you design your application. I could have used a database just as easily as a flat file approach, but this would have made things much more complicated to replicate between the nodes."
...is a great point. It echos the comments and thinking of Bernstein in his paper on lessons learned from Qmail.
http://cr.yp.to/qmail/qmailsec-20071101.pdf
Particularly, section 4.5 "Reusing the filesystem."