Section 6: Four Planes, Three Minutes - High-Level Architecture
Executive Summary: This section draws the whole machine on one board, as four planes with four different clocks. An edge plane decides in microseconds inside every request router; a distribution plane moves versioned snapshots to 30 PoPs in under a minute; a mirror/control plane holds verdicts and compiles them through safety gates; an acquisition plane spends the vendor's 120 requests per second and refreshes GeoIP. We run the 09:14:00 request from 203.0.113.42 to a fleet-wide deny at 09:17, run the 14:00 China rule to global enforcement at 14:14, then defend the boxes a weaker design would have drawn: no central validation service, no bloom tier, no Kafka, no second enforcement path.
The interviewer hands you the marker: "Show me the boxes — and show me how a listed IP actually gets blocked." That second clause is the design. Section 3 proved no box can sit between 5M requests per second and a 150-rps vendor, so the architecture is really a loop: decide locally now, learn asynchronously, enforce everywhere a minute later.
The Board: Four Planes
Say the split out loud before drawing anything: "Four planes, four clocks. The edge decides in microseconds and is fail-static — no availability number, because it makes no calls. Distribution moves data in seconds, the mirror and compiler in minutes, acquisition in hours to days, because 120 requests per second is all the vendor will give us."
| Component | Job | Key number |
|---|---|---|
| In-process IP filter | Answer allow/deny from the current snapshot inside the router; fail-static (D1) | ≤ 2 µs, zero network |
| Snapshot store + push/poll | Deliver signed snapshots and deltas to 30 PoPs | ≤ 60 s propagation |
| Verdict mirror | Authoritative store of per-IP/range verdicts with checked_at and TTL class (D5) | ~8M verdicts |
| Policy engine | Country/legal rules and manual overrides, with precedence over the vendor (D11) | overrides live ≤ 60 s |
| Compiler | Merge sources, enforce sanity gates, emit the versioned deny artifact (D10) | ±20% delta cap, 10-min canary |
| Crawl scheduler + vendor adapter | Spend the entire vendor budget by traffic rank × staleness (D7) | 120 req/s ≈ 10M checks/day |
| Observation intake | Receive the edges' batched, sampled reports of never-seen IPs | ~100s of events/s |
| GeoIP refresher | Pull licensed country ranges through the same compile gates (D2) | ~400K ranges, weekly |
Two structural points to make while the marker is still in your hand. First, the edge artifact is ≤ 10 MB — ~60K deny ranges at 0.7 MB plus ~5 MB of GeoIP — so "30 PoPs in 60 seconds" is a solved problem. Second, there is exactly one path from any rule source to an edge box: through the compiler. The vendor, legal, and a human override all converge on the same gated, versioned artifact; nothing writes to an edge except a signed snapshot.
Interviewer: "The mirror is just a cache of the vendor's database. Why does your diagram treat it as the system of record?"
You: "Because the vendor can only be re-read at 150 requests per second. A normal cache refills from its origin in minutes; refilling 8M verdicts competes with first-look traffic for a 10M-checks-per-day budget — days of degraded coverage. The rate limit turns the copy into the real archive, which is why Section 11 gives it backups and replicas most caches don't deserve."
Quick check before moving on:
Sign in to continue reading
The rest of this lesson is available with a free account. Signing in with Google or Microsoft is free.
Sign in to read the full lesson