Case study · HealthcareStudi kasus · Kesehatan
Main server room down? Hospital services keep running.Ruang server utama mati? Layanan rumah sakit tetap berjalan.
How a hospital in Indonesia moved from a single server to a two-site design that can recover from a data center failure within hours.Bagaimana sebuah rumah sakit di Indonesia beralih dari satu server tunggal ke desain dua lokasi yang mampu pulih dari kegagalan data center dalam hitungan jam.
Summary for managementRingkasan untuk manajemen
- Before: every hospital system depended on one server. If it failed, services stopped until it was repaired.
- Now: a second site (DRC) holds copies of all systems, refreshed every 3 hours.
- If the main data center fails: the network switches to the DRC automatically, and services return within 1–2 hours.
- Status: the recovery procedure has been tested. No real incident has required it so far.
- Regulation: supports the technical requirements of Permenkes 24/2022 on medical records (backup, periodic copies, SOPs, confidentiality, integrity, availability) and the Personal Data Protection Law (UU 27/2022).
- Sebelum: seluruh sistem rumah sakit bergantung pada satu server. Jika server itu rusak, layanan berhenti sampai diperbaiki.
- Sekarang: lokasi kedua (DRC) menyimpan salinan semua sistem, diperbarui setiap 3 jam.
- Jika data center utama gagal: jaringan otomatis beralih ke DRC, dan layanan kembali dalam 1–2 jam.
- Status: prosedur pemulihan sudah diuji. Sejauh ini belum ada insiden nyata yang memerlukannya.
- Regulasi: mendukung ketentuan teknis Permenkes 24/2022 tentang Rekam Medis (cadangan data, backup periodik, SOP, kerahasiaan, integritas, ketersediaan) dan UU Pelindungan Data Pribadi (UU 27/2022).
The challengeTantangan
The hospital was growing, but its infrastructure had two single points of failure.Rumah sakit terus berkembang, tetapi infrastrukturnya memiliki dua titik kegagalan tunggal.
All applications ran on a single host. Any hardware fault or maintenance window meant downtime for the whole hospital.Semua aplikasi berjalan di satu host. Setiap kerusakan perangkat keras atau jadwal pemeliharaan berarti seluruh rumah sakit berhenti.
Many home-grade unmanaged switches across buildings, with no central visibility. Problems were hard to trace and one loop could disrupt everything.Banyak switch unmanaged kelas rumahan di berbagai gedung, tanpa visibilitas terpusat. Masalah sulit dilacak, dan satu loop bisa mengganggu seluruh jaringan.
What happens when the data center failsApa yang terjadi saat data center gagal
Normal operationOperasi normal
- All buildings have uplinks to both sites. Traffic goes through the DC core, the active VRRP gateway.
- VMs are backed up from the DC to the DRC every 3 hours.
- DHCP and DNS run on both sites.
- Setiap gedung terhubung ke kedua lokasi. Trafik lewat core DC, yaitu gateway VRRP yang aktif.
- VM di-backup dari DC ke DRC setiap 3 jam.
- DHCP dan DNS berjalan di kedua lokasi.
Data center downData center mati
- VRRP moves the gateway to the DRC core automatically. Buildings stay connected.
- DHCP and DNS keep answering from the DRC.
- The admin restores VMs from Proxmox Backup Server on the DRC Proxmox VE host. Services resume within 1–2 hours.
- VRRP otomatis memindahkan gateway ke core DRC. Gedung tetap terhubung.
- DHCP dan DNS tetap melayani dari DRC.
- Admin me-restore VM dari Proxmox Backup Server ke host Proxmox VE di DRC. Layanan kembali dalam 1–2 jam.
The solution, layer by layerSolusi, lapis demi lapis
Compute and data protectionCompute dan proteksi data
- DC: Proxmox VE hyperconverged cluster with high availability. If one node fails, its VMs restart automatically on the remaining nodes.
- DRC, in a separate building: Proxmox VE host plus Proxmox Backup Server, receiving VM backups every 3 hours.
- DC: cluster hyperconverged Proxmox VE dengan high availability. Jika satu node gagal, VM-nya otomatis dijalankan ulang di node lain.
- DRC, di gedung terpisah: host Proxmox VE dan Proxmox Backup Server, menerima backup VM setiap 3 jam.
NetworkJaringan
- Unmanaged switches replaced by a structured H3C network: a core switch at the DC and at the DRC, with managed access switches in the buildings.
- Every building has uplinks to both cores.
- The two cores form a VRRP pair, so the gateway moves to the DRC automatically if the DC fails.
- Switch unmanaged diganti jaringan H3C yang terstruktur: core switch di DC dan di DRC, dengan access switch terkelola di gedung-gedung.
- Setiap gedung memiliki uplink ke kedua core.
- Kedua core membentuk pasangan VRRP, sehingga gateway otomatis pindah ke DRC jika DC gagal.
Core network servicesLayanan jaringan inti
- Windows Server DHCP failover and DNS replication across the DC and DRC. Devices keep getting addresses and names resolved during a failover.
- DHCP failover dan replikasi DNS Windows Server antara DC dan DRC. Perangkat tetap mendapat alamat IP dan resolusi nama saat failover.
SecurityKeamanan
- Hillstone firewall at the DC for north-south traffic between the hospital and the internet.
- WatchGuard Endpoint Security Elite on every server and endpoint.
- Firewall Hillstone di DC untuk trafik north-south antara rumah sakit dan internet.
- WatchGuard Endpoint Security Elite di seluruh server dan endpoint.
ResultsHasil
At most 3 hours of data to re-enter after a total DC loss.Paling banyak 3 jam data yang perlu diinput ulang jika DC hilang total.
From DC failure to services running again at the DRC.Dari DC gagal hingga layanan kembali berjalan di DRC.
The failover and restore procedure has been tested.Prosedur failover dan restore sudah diuji.
For transparency: no real incident has triggered the DRC so far. The figures above come from the design and from testing.Demi transparansi: sejauh ini belum ada insiden nyata yang mengaktifkan DRC. Angka di atas berasal dari desain dan pengujian.
Regulatory alignmentKepatuhan regulasi
The design meets the technical side of these Indonesian regulations. Full compliance also needs organizational measures: policies, SOPs and access rights set by hospital management.Desain ini memenuhi sisi teknis dari regulasi Indonesia berikut. Kepatuhan penuh tetap membutuhkan langkah organisasi: kebijakan, SOP, dan pengaturan hak akses oleh pimpinan rumah sakit.
The DRC sits in a separate building on the same campus. Pasal 20 (5) a asks for backups at a place different from the facility's location, so an additional off-site copy is recommended, for example syncing Proxmox Backup Server to an off-site location or certified cloud storage. This also protects against campus-wide events such as fire or flood.DRC berada di gedung terpisah dalam kampus yang sama. Pasal 20 (5) a meminta cadangan data diletakkan di tempat yang berbeda dari lokasi fasyankes, sehingga direkomendasikan satu salinan tambahan di luar lokasi, misalnya sinkronisasi Proxmox Backup Server ke lokasi lain atau cloud storage yang tersertifikasi. Langkah ini juga melindungi dari kejadian yang melanda seluruh kampus, seperti kebakaran atau banjir.
Sources: official texts ofSumber: teks resmi Permenkes No. 24 Tahun 2022 tentang Rekam Medis anddan UU No. 27 Tahun 2022 tentang Pelindungan Data Pribadi. This is a technical mapping, not legal advice.Ini pemetaan teknis, bukan nasihat hukum.
Is your hospital one server away from a shutdown?Apakah rumah sakit Anda hanya bergantung pada satu server?
In a free 30-minute consultation we review your current setup, your single points of failure, and realistic RPO/RTO targets for your budget.Dalam konsultasi gratis 30 menit, kita tinjau kondisi saat ini, titik kegagalan tunggal, dan target RPO/RTO yang realistis sesuai anggaran Anda.
Customer identity and identifying details are withheld for confidentiality.Identitas pelanggan dan detail yang dapat mengidentifikasinya tidak dicantumkan demi kerahasiaan.