Repository navigation
docs(diagrams): show how the design survives losing us-east-1 - #59
Merged
Merged
Conversation
Every AWS component sits in us-east-1, and the diagrams made it look as if losing that region lost the platform. It does not: ADR-0001 answered exactly that concern by making Azure an independent recovery domain, chosen over a second AWS region because it also survives losing the AWS account, which is the failure this project has actually suffered three times. The pages drew Azure as a side box and hid how recovery works. The full page now shows the recovery design the ADR decided: the durable layer's copies running straight into Azure (state replicas, the four production secrets, every production image by digest), dual-provider DNS with Azure DNS serving the same records as Route 53, the health-checked failover to the warm-standby AKS, and the recovery objectives and what each environment does when the region is lost. The economical page now shows that eco is single-region by design and comes back from its off-provider copies: Velero backups and state replicas in Azure Blob storage. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
12 tasks done
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changes
The two pages of
docs/assets/MicroTodoSuite infrastructure.drawionow draw how the design survives the loss ofus-east-1.Why
Every AWS component sits in
us-east-1, and the pages made it read as if losing that region lost the platform. That was the maintainer's concern, and ADR-0001 was written to answer it: point 5 of its context quotes it — "oneus-east-1outage takes everything down. As designed, it does." — and its decision, Option C, makes Azure an independent recovery domain.The ADR weighed a second AWS region (Option B) and rejected it: it survives a region loss but not the loss of the AWS account, which is the failure this project has actually had three times, and
us-east-2allows only five vCPUs in this account. So the design already survives the region loss. The diagrams hid it: Azure was a side box with no copies flowing into it, DNS lived only in Route 53, which the ADR names as the one thing that cannot live only in the account it must survive, and nothing said what happens to each environment.Tasks
No task register covers documentation in this repository; the work is microservice-app-docs#52, updated with what landed.
Neither box applies literally: nothing is ticked here.
How it is verified
Every element added is read from
docs/ADR-0001 Multicloud strategy.md, not inferred: the "What lives where" table (Blob containers holding Terraform state replicas and Velero backups ofeco; the ACR mirror; Key Vault with the four production secrets; the warm-standby AKS), the section "DNS cannot live only in the account it must survive" (option 1, the recommended one: both Route 53 and Azure DNS, the registrar delegating to both, records kept identical through Terraform), the Mode section (active-passive, active-active excluded until a replicated data store exists), and the Recovery objectives section (RPO and RTO as written).The geometry check run in the authoring session, not committed, reports no issue on either page. It found one on the first run — the new Route 53 label escaped the AWS Cloud group on the economical page — which was fixed before committing:
No Terraform, tfvars, or Kubernetes manifest changes here.
Risk and rollback
None to the running system. Revert the commit.
What this PR does not do
It does not change the design: a second AWS region would reverse part of ADR-0001 and needs an amendment, not a diagram. It does not implement anything the recovery domain needs — spec 009 US5, T118 to T141, carries that.
🤖 Generated with Claude Code