ADR-020: Multi-Region Deployment

Status

Proposed

Context

BlocMarket operates from a single region (UK). As the platform expands to serve EU customers, latency and data sovereignty requirements may necessitate multi-region deployment.

Decision

Adopt an active-passive architecture with Cloudflare CDN and Workers as the first phase, deferring full active-active replication until EU traffic justifies the cost and complexity.

Options Considered

Option 1: Single Region with CDN (Cloudflare)

Keep all infrastructure in UK (eu-west-2). Use Cloudflare CDN for static assets and Workers for edge API caching.

Latency:

• UK users: 10-30ms (existing)
• EU users: 40-80ms (acceptable for most operations)
• Cloudflare Workers can cache read-heavy API responses at edge, reducing perceived latency to 5-15ms

Data Sovereignty: All data remains in UK. GDPR compliant via UK adequacy decision.

Cost: Minimal uplift. Cloudflare Pro plan ($20/mo) plus Workers ($5/1M requests).

Pros: Zero architectural change, fastest to implement (1-2 weeks), lowest cost.

Cons: API writes still hit UK (40-80ms for EU users), no failover if UK region goes down.

Option 2: Active-Passive (Primary UK, Standby EU)

Primary infrastructure in eu-west-2 (UK). Standby replica in eu-central-1 (Frankfurt). DNS failover via Cloudflare.

Database Replication:

• PostgreSQL logical replication from primary to standby
• Replication lag: typically < 1 second
• Event store replicates naturally (append-only events)
• Conflict resolution strategy needed for failback

Cost: ~$250-500/mo additional.

Pros: Disaster recovery, EU read replicas, moderate complexity.

Cons: Writes still go to UK, failover requires manual promotion, replication lag during failover.

Option 3: Active-Active (Both Regions Serving Traffic)

Both eu-west-2 and eu-central-1 serve live traffic. Users routed to nearest region via GeoDNS.

Database Replication:

• PostgreSQL bidirectional logical replication or multi-master (BDR)
• Conflict resolution required for concurrent writes
• Event sourcing helps (immutable events, conflicts only on projections)

Cost: ~$900-1900/mo additional.

Pros: Best latency, zero-downtime failover, geographic redundancy.

Cons: Significant engineering effort (2-4 months), data consistency complexity, double infrastructure cost.

Option 4: Edge Computing (Cloudflare Workers)

Deploy API logic to Cloudflare Workers. Use D1/Durable Objects for state at edge. Only financial transactions hit origin.

Cost: ~$50-150/mo additional.

Pros: Best latency for read-heavy workloads, leverages existing Cloudflare investment.

Cons: Workers runtime limitations, state management complexity, vendor lock-in.

Recommended Approach

Phase 1 (Immediate): Option 1 — Single Region + CDN

1. Configure Cloudflare cache rules for /api/properties/* endpoints
2. Deploy Workers script for property search with KV cache
3. Add Cache-Control headers to read-only API responses
4. Monitor latency improvements via existing observability stack

Phase 2 (Quarter 2): Option 2 — Read Replicas

1. Provision eu-central-1 PostgreSQL read replica
2. Configure Cloudflare Workers to route reads to nearest replica
3. Implement connection routing in bloc-db read_replica module
4. Document cross-border data flow in DPIA
5. Test failover procedure quarterly

Phase 3 (Quarter 3-4): Evaluate Option 3

Re-evaluate active-active if EU traffic exceeds 30% of total and latency SLA requirements tighten. Decision based on:

• EU user growth metrics
• Payment latency requirements from EU payment providers
• Regulatory developments (EU adequacy decision renewal)
• Revenue from EU operations justifying cost

Consequences

Positive

• EU users see immediate improvement through CDN (Phase 1)
• Progressive approach avoids over-engineering
• Each phase is independently valuable and reversible
• Event sourcing (event_store table) simplifies future replication

Negative

• Phase 1 write latency for EU users remains 40-80ms
• Active-passive adds operational complexity
• Active-active is deferred, not eliminated
• Cross-border replication requires ongoing GDPR compliance monitoring

Risks

• UK-EU adequacy decision could be challenged (mitigate by keeping Phase 2 data in Frankfurt)
• Cloudflare outage affects all phases (mitigate with multi-CDN strategy in future)
• Replication lag during failover could cause lost events (mitigate with event sourcing)

References

• GDPR Articles 44-49: International data transfers
• UK-EU Adequacy Decision (28 June 2021)
• ADR-006: PostGIS and spatial queries
• Event sourcing foundation (event_store migration 20260613000003)