Infrastructure — Cheat Sheet

Load Balancers

// Layer 4 (TCP/UDP) — AWS Network Load Balancer (NLB)
// Routes based on: destination IP + port + protocol
// Does NOT read HTTP headers, paths, or cookies
// Use cases: non-HTTP protocols (gRPC, WebSocket raw, gaming, IoT),
//            ultra-low latency, millions of concurrent connections
// Connection: client ↔ NLB ↔ backend (TCP passthrough)

// Layer 7 (HTTP/HTTPS) — AWS Application Load Balancer (ALB)
// Reads: URL path, Host header, HTTP method, cookies, query params
// Use cases: microservices routing, A/B testing, auth offload, WebSocket
// Routing rules example:

// Nginx L7 load balancer config:
upstream api_servers {
  least_conn;                     // least-connections algorithm
  server 10.0.1.1:8080 weight=3; // gets 3x more traffic
  server 10.0.1.2:8080 weight=1;
  server 10.0.1.3:8080 backup;   // only used if others are down
}

server {
  listen 443 ssl;
  location /api/     { proxy_pass http://api_servers; }
  location /static/  { proxy_pass http://cdn_servers; }  // content-aware routing
}

Reverse Proxy

// Forward Proxy (client-side):
// Client ──▶ [Forward Proxy] ──▶ Internet
// Use cases:
//   - Corporate internet filtering (block social media, log traffic)
//   - Anonymisation (hide client IP from servers)
//   - VPN/tunnelling (bypass geo-restrictions)
// Server sees: proxy's IP, not client's IP

// Reverse Proxy (server-side):
// Client ──▶ [Reverse Proxy] ──▶ Backend Server(s)
// Use cases:
//   - SSL termination
//   - Load balancing (Nginx upstream)
//   - Caching static content
//   - Rate limiting and security
//   - Serve multiple apps on one IP (virtual hosts)
// Client sees: proxy's domain (aicancode.org), not backend's internal IP (10.0.1.5)

// Virtual hosting (multiple apps, one IP/port):
// nginx:
server { server_name api.aicancode.org;  proxy_pass http://api_backend; }
server { server_name www.aicancode.org;  proxy_pass http://nextjs_backend; }

CDN (Content Delivery Network)

// CDN request flow:
// 1. User in Mumbai requests: https://aicancode.org/logo.png
// 2. DNS query for aicancode.org → CDN GeoDNS returns Mumbai PoP IP (e.g. 104.18.x.x)
// 3. Browser connects to Mumbai PoP
// 4. PoP checks cache: HIT → serve immediately (~5ms)
//                      MISS → fetch from origin (e.g. Vercel/AWS), cache, serve
//
// Cache key: typically scheme + host + path + (optionally) query string
// X-Cache: HIT / MISS / REFRESH_HIT in response headers

// CloudFront distribution (Terraform):
resource "aws_cloudfront_distribution" "cdn" {
  origin {
    domain_name = "api.aicancode.org"
    origin_id   = "api-origin"
  }
  default_cache_behavior {
    allowed_methods        = ["GET", "HEAD"]
    cached_methods         = ["GET", "HEAD"]
    viewer_protocol_policy = "redirect-to-https"
    cache_policy_id        = aws_cloudfront_cache_policy.default.id
  }
  price_class = "PriceClass_200"  // all PoPs except South America
  enabled     = true
}

API Gateway

// API Gateway cross-cutting concerns:
//
// Client Request ──▶ API Gateway ──▶ Backend Service
//
// What the gateway handles:
// ┌──────────────────────────────────────────────────────────┐
// │ 1. SSL Termination     — decrypt HTTPS, forward HTTP     │
// │ 2. Authentication      — validate JWT / API key / OAuth  │
// │ 3. Authorisation       — check scopes / roles            │
// │ 4. Rate Limiting       — 100 req/min per API key         │
// │ 5. Request Routing     — /api/courses → course-service   │
// │                          /api/users   → user-service     │
// │ 6. Protocol Translation— REST → gRPC (grpc-gateway)      │
// │ 7. Request Transform   — add headers, rewrite paths      │
// │ 8. Response Aggregation— fan out to N services, merge    │
// │ 9. Caching             — cache GET responses at edge     │
// │ 10. Observability      — unified access logs, metrics    │
// └──────────────────────────────────────────────────────────┘

Service Mesh

// Kubernetes pod with Istio sidecar injection:
// (injection is automatic when namespace is labelled)
kubectl label namespace production istio-injection=enabled

// Resulting pod has 2 containers:
// ┌─────────────────────────────────────────────────────┐
// │ Pod: course-service-7f9b4d5-xk2p8                  │
// │  ┌──────────────────┐  ┌──────────────────────────┐ │
// │  │  course-service  │  │  istio-proxy (Envoy)     │ │
// │  │  :8080           │  │  :15001 (outbound)       │ │
// │  │  (app code)      │  │  :15006 (inbound)        │ │
// │  └──────────────────┘  └──────────────────────────┘ │
// └─────────────────────────────────────────────────────┘
// iptables rules redirect all traffic through Envoy transparently:
// Outbound: app → Envoy :15001 → (encrypt mTLS) → destination Envoy
// Inbound:  source Envoy → (decrypt mTLS) → Envoy :15006 → app :8080