API Gateway Platform · View 16 of 21 · Operations
Decisions
- Both regions serve continuously behind one anycast VIP. An active–passive design would leave the failover path untested until the day it matters.
- Each region is sized for the whole global load at burst, which makes a 120 s evacuation a capacity decision already taken rather than one taken during an incident.
- Three zones per region: two serve, one is headroom for losing a zone without client-visible degradation.
Numbers
- Steady state 120,000 requests/s globally, 40,000 requests/s per region, 5× burst for 120 s from standing headroom (assumptions).
- 2,000,000 concurrent TLS connections globally — the figure that makes connection count, not request rate, the autoscaling signal (ADR-15).
Cost
- Two regions each able to carry 100% of load is roughly 2.4× the compute of a single-region design once headroom is counted. ask.md requires that price to be reported so the availability target can be renegotiated against it.
