For three years our control plane ran happily in a single Mumbai region. It was simple, it was cheap, and it was fine right up until a fibre cut in June made it very much not fine.
This post walks through the migration: what we moved first, what we deliberately left behind, and the two assumptions in our failover design that turned out to be wrong the first time we tested them for real.
The short version — replicating state was the easy part. Getting DNS, session affinity and the billing reconciler to agree on which region was authoritative took four months longer than the database work.
