Survive a region loss with multi-region and DR
Continues from the last build: Rung 10 made the read path consistent and every write idempotent, but the primary database, the write path, and the code allocator still live in one region, a regional outage is a full outage.
Rung 10 closed the correctness gaps: reads are consistent, writes are idempotent, retries are safe.
What you'll build
A second region serves live read traffic today, not idle DR capacity, a documented RTO/RPO with the mechanism that meets it, a rehearsed failover runbook, and a short-code allocator that cannot collide across regions even mid-partition.
See how we teach, before you sign up
You don't just get code dumped on you. Every starter file and every solution is explained line-by-line, in plain English. Here's one real file from this project:
# ADR-011: Multi-Region Topology for <service> ## Context <What broke, or could break, that makes one region not enough. Cite a real incident or a stated SLA.> ## Decision drivers - <What matters most: read availability, write availability, cost, team size?> ## Options considered ### Option A: Active-passive <Pros / cons> ### Option B: Active-active <Pros / cons> ### Option C: Hybrid (active-active reads, active-passive writes) <Pros / cons> ## Decision <Which option, and why, in one paragraph.> ## RTO / RPO targets - Read RTO: <number, mechanism> - Write RTO: <number, mechanism> - RPO: <number, mechanism> ## Consequences <What this costs, what it doesn't solve, what the next rung has to pick up.>
Reading this file
## Decision driversForce yourself to rank what matters before comparing options, not after.### Option C: Hybrid (active-active reads, active-passive writes)The third option is usually the right default for read-heavy services like this one.## RTO / RPO targetsEvery DR ADR must land here with real numbers, not adjectives.- Read RTO: <number, mechanism>A number with no mechanism next to it is a wish, not a target.
Fill this in for milestone 1's decision.
That's 1 of 8 explained code blocks in this single project.
The build, milestone by milestone
- 1
Choose the topology and set RTO/RPO targets
4 guided stepsA DR design without a stated RTO and RPO is a hope, not a plan. Whoever pages at 3am needs to know exactly what 'recovered' means and how much data might be missing, before the incident, not during it.
- 2
Replicate the database across regions and budget the lag
4 guided stepsCross-region replication is always asynchronous at these distances (a round trip between US regions alone is 60-80ms; synchronous replication would add that to every write). The only real question is how far behind the standby gets, and what that costs.
- 3
Build DNS-based failover and rehearse it
4 guided stepsA failover mechanism nobody has run is a hypothesis. The only way to know the 5-minute write RTO is real is to time an actual promotion, not read about one.
- 4
Eliminate cross-region short-code collisions
4 guided stepsThis is the one correctness hazard the hybrid topology introduces: if Region B ever accepts a write (a promoted write path, or a brief active-active window during migration), it must not be able to hand out a code Region A already owns.
- 5
Build the two-region capacity and cost plan
4 guided stepsThe ADR's claim of 'roughly 1.6 to 1.8x cost' needs a receipt. A capacity plan the finance conversation can't survive gets the whole rung re-litigated later.
What's inside when you start
You'll walk away with
This is portfolio-grade. Build it free.
Sign up to unlock every milestone step-by-step, the code skeletons, full reference solutions, and checkable tasks, with your progress saved as you build.
Start building