I'm a recent graduate working on the web development team at a medical clinic. Our small IT department supports internal patient-record systems, HR tools, appointment scheduling, and on-site hardware. The applications are mostly legacy vanilla PHP running on Apache with FastCGI. At the moment, the main server is essentially an i9 gaming PC handling roughly 16 requests per second and peaks of about 400 concurrent users.
These systems support critical business processes and need to operate continuously, so we're considering moving to an HP ProLiant server. My initial design is a three-node Proxmox cluster consisting of the new server, the existing server, and a small witness node. The main PHP applications would run in VMs, while MySQL would run in LXC containers. I was also considering ZFS pools on both primary nodes with continuous replication, plus an Nginx reverse proxy for routing services.
I'll be working with our hardware and networking staff, but I'd appreciate a practical review before anything is deployed. What major operational, security, compliance, and disaster-recovery risks should we consider in a 24/7 clinic environment? Also, is asynchronous ZFS replication suitable for near-real-time MySQL failover, or would we need a different database or storage architecture?
3 Answers
This should be treated as a healthcare infrastructure project, not just a server upgrade. A home-lab or web-development background is useful, but it does not replace experience with database high availability, clinical-system operations, compliance, and recovery planning. Bring in an experienced healthcare infrastructure consultant, VAR, or managed provider, and make sure the design is reviewed and tested before it handles real patient data.
Backups and recovery need to be designed before failover. Use tested automatic backups, immutable and off-site copies, documented restore procedures, and regular disaster-recovery exercises. Also plan for access controls, audit logging, encryption, network segmentation, patching, vulnerability management, monitoring, alerting, maintenance windows, and documented ownership. High availability protects against some hardware failures; it does not protect against corruption, ransomware, operator mistakes, or a facility-wide outage.
I would have management explicitly rank data correctness, availability, recovery time, and performance. If they require continuous service with no maintenance window and almost no data loss, the budget and operational staffing need to reflect that.
ZFS replication is asynchronous. If replication runs every minute, a host failure can lose all database writes made since the last successful replication. Proxmox HA may restart a VM elsewhere, but it cannot restore transactions that were never copied. Define the required recovery-point objective first. If near-zero data loss is mandatory, use a database-native HA design or genuinely synchronous storage replication that has been properly tested for the workload.
As a lab or tabletop exercise, the proposal is a good learning opportunity. I would not deploy it directly into production without experienced oversight, especially when an outage could affect patient care.