Cross-location services, real-world examples?

Question

I currently have servers at 4 locations, and even though this is really just me hobbying around I'd like to know what the "real-world" way of doing this is.

Basically I have certain services that are only running on one location and should only be accessible by my own servers at other locations. Is the usual approach just using firewall rules to restrict access (Possibly paired with authentication)?

Another idea that came to mind was hooking all servers into a VPN network, but that really sounds like a recipe for disaster (Single point of failure, even though you can set-up a redundant VPN).

The services I'm primarily talking about are:

• Puppet
• MCollective
• Collectd

I've seen people suggest setting up a puppetmaster and MQ server per location, but my current budget doesn't have room to be hosting an instance at every location.

Edit: All locations are purely servers, and only 1 location is firewalled (As in LAN).

Answer 1

First of all: Why would VPN be any more prone to SPOF than connecting servers together over the internet? It's the same transport!

It's not easy to answer the rest of the question, as it depends on what you use and how you use it. Are these servers only facing the internet, or are they behind firewalls with users on a LAN? If so I suggest that you either look into hardware firewalls (one at each location, with a tunnel to the other 3 locations) or a managed IP-VPN service. The latter provides SLA levels that usually are higher than regular internet access, but will also cost you more.

If they are internet-facing (like a coloed server) with no other networks, then why not just use simple ssh tunnels or similar to ensure encrypted communication between the servers.