Problems / Security, medium
1,500 req/s of real users. At 15 s a 20,000 req/s flood hits for 15 s. Nothing stands in front of the load balancer.
Unlock it once for 15 credits; everything inside it is free (runs, changes, Submit, results, hints). Sign in with Google to start; new accounts get free credits.
Keep success ≥ 98%, block ≥ 95% of the attack and keep the database out of it. Add DDoS protection, a WAF and bot management in front.
1,500 requests a second for 45 seconds: 90% reads, 10% writes.
What each component does in this design, and what calls it. The simulator mimics each one from these settings.
| Component | Its job here | Settings |
|---|---|---|
| Load balancerLoad balancer | Traffic enters here.Calls API.Layer 4 balancers route by IP and port; layer 7 balancers read HTTP and can route by path or header. | – |
| APIApp service | Load balancer forwards to it.Calls Postgres.Little's law: throughput ≈ concurrency ÷ latency. 200 slots at 50 ms serve about 4,000 req/s. | 4 replicas × 200 slots · timeout 2.0 s |
| PostgresSQL database | API calls it.Postgres runs one process per connection, which is why poolers like PgBouncer sit in front of busy databases. | 4 vCPU · 60 connections |