Multi-Region-Failover mit einem WireGuard-Mesh

# 01 Wähle drei unabhängige Ausfall-Domänen

Different countries, ideally different transit mixes. Amsterdam, Ashburn and Singapore is the classic triangle. Three is the minimum for quorum — two gives you a split-brain problem rather than redundancy.

# 02 Baue das Mesh

Each node gets a stable private address. Every node peers with every other node; with three nodes that is three tunnels.

# node A — /etc/wireguard/mesh.conf
[Interface]
Address = 10.10.0.1/24
ListenPort = 51821
PrivateKey = <A private>

[Peer]                       # node B
PublicKey = <B public>
Endpoint = b.example.net:51821
AllowedIPs = 10.10.0.2/32
PersistentKeepalive = 25

[Peer]                       # node C
PublicKey = <C public>
Endpoint = c.example.net:51821
AllowedIPs = 10.10.0.3/32
PersistentKeepalive = 25

# 03 Binde Dienste nur an das Mesh

The database, the cache and the internal API should listen on 10.10.0.x, never on the public address. This removes an entire class of exposure without a single firewall rule.

# 04 Replizieren Sie die Datenbank angemessen

Synchronous replication across regions is impractical — a 160 ms round trip becomes the floor for every write. Use asynchronous replication across regions and know your recovery point objective.

# 05 Health-Check auf DNS-Ebene

Short TTLs plus health-checked failover records, or anycast if your regions support it. Then run a failure drill: kill a region deliberately, on a weekday, while you are watching.