Globally distributed
Glassbreak runs as two always-on boxes today — one on AWS (us-east-1), one on Scaleway (fr-par) — each a Docker Compose stack of Caddy, a Node API, and its own in-box PostgreSQL, with Microsoft Azure planned as the third. Each box owns its registrar, DNS, edge, and compute, and the two stay in sync by native Postgres streaming replication.
Most "multi-cloud" or "multi-region" platforms share something: a single registrar, a single DNS provider, a single identity provider, a single database. When that one shared thing fails, the whole thing is down. Glassbreak is the system you reach for when your primary platform is the outage — so it has to be independent of yours, and independent of itself.
Each card pairs the failure mode a layer typically hides with the concrete mechanism Glassbreak uses to break the dependency. Grouped by where in the stack the layer sits.
A single registrar locking, suspending, or transferring your domain takes the whole brand offline — and you cannot get into your account because the password-reset email goes to a mailbox that fronts off the same DNS.
glassbreak.io, glassbreak.cloud, and glass-break.com are registered with separate registrars. A single registrar suspending one name does not affect the other two.
A bad DNS push (or a control-plane outage at one provider) blackholes traffic for the TTL. Most platforms accept this as "rare but acceptable" because moving DNS providers takes weeks.
Fastly fronts glassbreak.io with health-checked failover across both compute verticals. The other two surfaces (glassbreak.cloud, glass-break.com) point directly at the vertical they belong to — if Fastly itself has a bad day, those two still serve.
CDN outages are short but catastrophic — you lose every customer simultaneously and there is no failover because everything fronts the same edge.
Fastly is the primary surface for glassbreak.io. If Fastly is degraded, the .cloud and .com surfaces remain reachable directly against their origin verticals. Customers with the highest residency or independence requirements can simply bookmark the direct-vertical URL and bypass the edge entirely.
Round-robin or random per-request routing across independent databases gives you read-your-writes inconsistencies — you POST to one origin, your next GET hits another, the row has not propagated yet, you see a 404.
There is one primary writer at a time. Caddy forwards writes to the current primary, so every write lands in one authoritative Postgres and streams to the standby — no split-brain. Fastly health-checks both boxes and fails glassbreak.io over to a healthy origin; the direct .cloud / .com doors always reach their own box.
A regional outage at your single cloud provider, or a control-plane incident that takes out the API gateway, takes you down. "Multi-region" inside one provider does not save you when the control plane is what failed.
AWS (us-east-1) and Scaleway (fr-par) each run an always-on box — a Docker Compose stack of Caddy, the same Node/Hono API image, and its own in-box Postgres — deployed independently. Microsoft Azure is planned as the third box. A whole-provider outage removes one box; the other continues serving.
Single-IdP architectures fall over when the IdP does. Glassbreak is the system you reach for when your IdP is the outage — it cannot itself depend on one.
Argon2id passwords + TOTP / WebAuthn / recovery codes are validated on each box against its own Postgres. No central auth service. JWTs are signed with EdDSA (Ed25519) under a per-box kid, and each box trusts the others' public keys, so a token issued by AWS validates on Scaleway and vice versa — the user does not see the box switch.
Multi-region compute that shares a single database is not multi-cloud — it is a single database with extra latency. When that DB goes, everything goes.
Each box runs its own in-box PostgreSQL, colocated with its compute (us-east-1 on AWS, fr-par on Scaleway). One box is the primary/writer (currently AWS), the other a hot standby; they are kept in sync by native Postgres streaming replication with automatic failover, so there is no single database whose loss takes everything down.
Cross-cloud reads add latency and egress cost, and inherit the failure modes of both clouds. Most platforms accept the cost rather than keep data local to each box.
Each box keeps its data on provider block storage colocated with its compute — AWS block storage in us-east-1, Scaleway block storage in fr-par — backing that box's Postgres volume. Getting bytes to the peer is native Postgres streaming replication, not a cross-cloud copy on the request path.
An application-level sync layer that re-implements replication over HTTP drifts, loops, and adds an integrity story you have to trust. Synchronous cross-cloud replication instead couples failure: a slow peer takes the request path with it.
Cross-box consistency is native PostgreSQL streaming replication, managed by Patroni with a small etcd arbiter for quorum. One box is the primary/writer, the other a hot standby; Caddy forwards writes to the current primary, and Patroni handles automatic failover. Replication traffic runs over a Rosenpass-secured post-quantum WireGuard mesh. Sub-second replication lag in the steady state.
Operators cannot diagnose a vertical they cannot see. End-users cannot file a useful bug report when they do not know which vertical they reached.
Every API response includes the platform and environment it ran on. A footer indicator (off by default — opt-in to avoid a per-page-load API call on the homepage) makes the active vertical visible to end-users. /api/public/status exposes the same fields for scripted probes.
Distribution is not free. These principles are the trade-off choices that make the per-layer mechanisms above hang together instead of fight each other.
Each box owns its own registrar, DNS records, compute stack, and in-box Postgres. A provider or control-plane incident at one cloud takes out one box; the other keeps serving, and Patroni fails writes over automatically.
Both boxes run the same Node/Hono API image built from api/common and api/server. The shared business logic owns the abstraction, so the API contract is identical on every cloud even as the provider underneath changes.
There is a single primary/writer at a time. Caddy forwards writes to it, Postgres streams the change to the standby, and Patroni + etcd coordinate failover — so read-your-writes stays correct without two databases racing.
The .cloud and .com domains bypass Fastly entirely and reach their own box directly. Customers who need to prove a fully independent path during an audit or a real outage can use them.
Glassbreak relies on PostgreSQL streaming replication over a Rosenpass-secured post-quantum WireGuard mesh rather than an application-level HMAC sync layer — fewer moving parts, and the integrity story is Postgres's, not ours to re-invent.
Two clouds means one outage from "no redundancy". Microsoft Azure is planned as the third box so a single provider going dark cannot leave Glassbreak running on a single point of failure.
Enable the footer indicator (off by default) and the active vertical is shown on every page. Or hit /api/public/status directly on each surface to see which compute stack served the request.
Get product updates and security insights. No spam, unsubscribe anytime.
We respect your privacy. See our privacy policy.
