Problems / Security, hard
A flash sale doubles traffic at 10 s. At 8 s, 6,000 req/s of bots start hitting the same API, which has two small replicas and nothing in front of it.
Free to open. Runs in your browser, no sign-up.
Success ≥ 98% for real users, block ≥ 95% of the bots, p99 ≤ 500 ms.
1,200 requests a second for 30 seconds: 90% reads, 10% writes.
What each component does in this design, and what calls it. The simulator mimics each one from these settings.
| Component | Its job here | Settings |
|---|---|---|
| Load balancerLoad balancer | Traffic enters here.Calls API.Layer 4 balancers route by IP and port; layer 7 balancers read HTTP and can route by path or header. | – |
| APIApp service | Load balancer forwards to it.Calls Redis cache (checked first), Postgres.Little's law: throughput ≈ concurrency ÷ latency. 200 slots at 50 ms serve about 4,000 req/s. | 2 replicas × 150 slots · timeout 1.0 s |
| Redis cacheCache | API checks it first for reads.An in-memory cache like Redis usually answers in well under a millisecond inside one region. | 95% hit rate |
| PostgresSQL database | API reads it when Redis cache misses. API calls it for writes.Postgres runs one process per connection, which is why poolers like PgBouncer sit in front of busy databases. | 8 vCPU · 60 connections |
Try it first. Open one hint at a time if you get stuck.
Two problems: attackers share capacity with users, and there is not enough capacity for the sale anyway.
Stop the bots at the edge first, then size the API for twice the traffic.
Bot management in front, then more replicas.
Put a security layer with bot management in front ("add bot management"), then scale the API for the spike.