Regions
Each company lives in one home region, its own TessariDB deployment; a server reads the other regions' directories and redirects a request for their companies there.
Each region is its own TessariDB deployment, and a company's identity data stays
in its home region's store, in the namespace oauth_<REGION>. At start a server
records its PUBLIC_URL in its region's directory, beside the region's
companies.
A server given PEERS reads every other region's directory every five seconds.
A request for a company another region serves is answered with
307 Temporary Redirect to the same path and query at that region's
PUBLIC_URL, so the method and body are sent again there; it is never proxied.
- A region that does not answer keeps the companies it last named.
- A company no region serves is
404. - The admin console is not redirected.
Configuration
Each variable starts with TESSARIDB_OAUTH_.
| Variable | Meaning |
|---|---|
REGION | this server's region; its companies are in oauth_<REGION> |
PEERS | the other regions, region=host:port comma-separated, each its own TessariDB store |
PEER_USER, PEER_PASSWORD | the account each other region's store holds for reading its directory; required with PEERS |
PEER_AUTHORITY | the PEM the other regions' certificates must lead to; without it only loopback stores are reached |
The account a server reads another region with is declared in that region's
store and reaches its directory only. For a region us:
DEFINE USER oauth_peer ON oauth_us.directory ROLE viewer PASSWORD '<password>';