high-availability

Designing for 99.99% uptime allows only 52.56 minutes of downtime per year, requiring multi-AZ deployment, active-active redundancy, and automatic failover. Eliminate every single point of failure across servers, databases, and load balancers, and automate failover since manual recovery cannot meet sub-hour RTO targets.

For components in series, multiply their availabilities (three 99.9% components yield 99.7%). For parallel redundant components, subtract the product of failure rates from one: two 90% components in failover configuration yield 99% availability.

Active-passive keeps a backup region idle with asynchronous replication, giving RPO of minutes to hours and manual failover. Active-active serves traffic from both regions with synchronous replication, achieving zero RPO and automatic failover in seconds, at significantly higher cost.

PostgreSQL automatic failover uses tools like Patroni, which detects primary failure via a consensus store such as Consul or etcd, promotes a replica to primary, and updates the proxy layer to route traffic. Typical failover completes in under 30 seconds.

RPO defines maximum acceptable data loss, such as one hour of transactions, while RTO defines maximum acceptable recovery time, such as four hours of downtime. These two targets drive backup frequency, replication mode, and failover automation choices.

Use graceful degradation when a dependency fails but core functionality can continue, such as serving read-only mode from a replica when the primary database is down. Feature toggles let you disable non-critical features like recommendations while keeping checkout and login operational.