The front door

Between the open internet and everything this act has toured stands a short stack of guardians, each one a box on the wall, each one a job that used to be done badly by whatever server happened to be in front. Saturday’s last light is a good time to meet them. In order.

First, the load balancerConcept · lights on your mapload balancerThe component receiving incoming requests and spreading them across the identical instances behind it, checking which are healthy, skipping the sick, folding in the new. The reason thirty machines look like one calm address., which Thursday’s review discussed as an idea and the wall draws as a box: the greeter that makes thirty tracking instances look like one unhurried address. Its heartbeat checks are the machinery of boring machine death, and on Sunday it will fold new machines into rotation as fast as the rules Sam wrote can birth them.

Beside it, the API gatewayConcept · lights on your mapAPI gatewayThe smart front door for APIs: reads each request, routes it to the right service, and handles the threshold chores, validating tokens, enforcing rate limits, logging arrivals. is the smart door for the APIs themselves: it reads each arriving request, routes registration asks to registration and tracking asks to tracking, and does the threshold chores while it is there. Checking Case’s token from Act I. Enforcing the rate limit that 429’d the over-refresher. One box on the wall, and half of Act I’s machinery lives inside it.

The family name, and the guard

Both of those belong to one family. Any intermediary that forwards requests on another’s behalf is a proxyConcept · lights on your mapproxyAny intermediary forwarding requests on another’s behalf. The classic forward proxy stands in front of clients, speaking to the world so they do not have to., and one that stands in front of servers, receiving the world’s requests and passing them inward, is a reverse proxyConcept · lights on your mapreverse proxyAn intermediary standing in front of servers, receiving outside requests and forwarding them inward. Load balancers and API gateways are specialised reverse proxies.. Balancer and gateway are both reverse proxies with specialities, which is why engineers wave at that whole region of the wall and just say the proxy layer.

And beneath all of it, oldest and bluntest, the firewallConcept · lights on your mapfirewallThe network guard enforcing rules about what traffic may pass at all: web traffic to the front door, yes; connections from the internet to the database, never. enforces the rules of what may knock at all. Web traffic to the front door: yes. The internet directly to the registrations database: never, from anywhere, under any flag. The reason the database with the standby twin has never once appeared in an Act I diagram of things Case could reach is this guard, and the Act IV audit will read its rules line by line.

Doors, guards, greeters. One last pair of ideas closes the tour, and it explains the whole multiplication trick.