Multiplayer Collaborative Canvas  ·  View 17 of 23  ·  Operations

Deployment

One write region per document, three zones inside it, and a paired region that is honest about what it loses.

Editable source SVG draw.io All views
Azure — West Europe (document home) Edge Front Door + WAF anycast Private Link no public data path AKS — zones a, b, c Session host pool memory-optimised Admission pool Control-plane pool Checkpoint & verify jobs Data services — zone-redundant Cosmos DB op log, strong PostgreSQL metadata, HA Redis capability cache Blob RA-GZRS checkpoints, assets Managed real-time Web PubSub viewer groups Azure — North Europe (paired) Warm standby Session hosts scaled to minimum Admission Replicated state Cosmos replica async, 5 s lag Blob secondary PostgreSQL replica Entra ID Key Vault HSM customer keys Azure Monitor + Grafana GitHub Actions build, deploy async replication fenced append Deployment — Home Region, Paired Region, Zone Redundancy Interface / broker Security / platform Application we own Data store External / third party batch synchronous One write region per document, pinned by residency policy. Failover is a declared operation with a 5 s loss window, not an automatic active-active merge. v 1.0 · owner Platform Architecture · date 2026-10

Decisions

  • A document has one home region. Active-active editing would mean two sequencers, which is the one thing the architecture forbids — so cross-region is a migration with an announced pause, not a merge (ADR-16).
  • Every data service is zone-redundant, because the common failure is a zone and not a region, and a zone loss must cost a re-host rather than a failover.
  • No public data path: Private Link between the session tier and every store, and customer-managed keys in Key Vault HSM on the enterprise tier (ADR-15).

Numbers

  • Cross-region replication lag ≤ 5 s (RPO); regional failover RTO 15 minutes with the loss window declared to users.
  • Session hosts are memory-optimised; an idle document holds no compute at all.
  • Stated assumptions, sized for 300,000 concurrent connections at peak.

Risks

  • The paired region is warm, not active. A regional failover is rehearsed rather than continuous, which means the first real one is the first full-scale test — the standard argument for scheduled failover drills.
◀  Two Planes Under Load All views Observability  ▶
Solution Architecture v1.0 · Microsoft Azure · Platform Architecture · 2026-1017-deployment-architecture