I've got this zany idea of getting a backup service running on a NAT box behind HAProxy as well as the front-end with it's own dedicated IPs.

I don't really want to rely on rsync, but I probably will have to to ensure data propagation properly- however, I don't really want to do that for SSL certificates for various reasons. I'm thinking possibly DNS challenge, or being really, really lazy and just letting either box submit it's certbot requests and waiting for the luck of the draw renew them every other day or so.

Thoughts? Implementations on your side?