In my experience redundancy and simple/elegant are mutually exclusive. There are lots of threads on running redundant OH installations and I don’t think anyone has come up with a solution that I would find satisfying.
I and others recommend spending your time on a foolproof backup and restore procedure. Because you can’t have more than one OH instance connected to a hardware resource like the Razberry, and no Zwave device can belong to more than one primary controller, your redundancy can never provide automatic failover. You will always have some manual/semiautomated steps to move the controller from the old failed primary OH to the backup. And once you have that then you have to weigh whether that will take as much or more effort than restoring your primary from backup in the first place.