Skip to content

chore(vercel): run functions in fra1, next to Upstash - #261

Merged
holkexyz merged 2 commits into
mainfrom
holke/vercel-region-fra1
Oct 29, 2026
Merged

holkexyz merged 2 commits into
mainfrom
holke/vercel-region-fra1

Conversation

@svc-agent

@svc-agent svc-agent commented Oct 29, 2026 •

Copy link
Copy Markdown
Collaborator

Hotfix to main: run Vercel functions in fra1 (Frankfurt), next to the Upstash database (eu-central-1). Already on staging (3430f27). After merge, main and staging hold identical files.

Why

Functions ran in Vercel's default iad1 (Washington DC), so every Redis call crossed the Atlantic. Measured on production after #260:

  • One Upstash round trip is ~85 ms: /api/auth/session (four Redis calls in a row) has a median of 542 ms; an endpoint without Redis takes 185 ms.
  • Redis is on the hot path of every signed-in request: the session cookie lookup, the OAuth request lock (fix(auth): OAuth request lock, and keep sessions through transient restore failures (TECH-807) #260, taken twice per proxied call and serialising one user's parallel requests), the session store and rate limits.
  • A burst of 12 parallel signed-in reads of your own records took up to 6.3 s (7.5 s for the burst). The same burst of public reads, which skip the session, took 0.5 s.
  • Production responses show x-vercel-id: fra1::iad1::…: requests enter Vercel in Frankfurt, run in Washington DC, and call Redis back in Frankfurt.

Our infrastructure is in Europe; only Bluesky services (plc.directory, the Bluesky AppView and bsky.network PDSes) are in the US, and calls to those get slower from Frankfurt.

Change

  • vercel.json: "regions": ["fra1"]. No region was set anywhere before (no vercel.json, no preferredRegion).
  • AGENTS.md: the region and why, in §19, and the file map.

Review (three subagents: Vercel config, outbound latency, region-bound side effects)

  • Config: regions in vercel.json covers every function, including src/proxy.ts, which runs as a Node lambda in the function region. The deployment API shows regions: ["fra1"] on staging (the previous staging deployment showed iad1). Nothing else about the deployment changed. The project's dashboard default was still iad1; it is now fra1 too, so both agree.
  • Upstreams in the EU: certified.one (PDS + OAuth server), the group service and the indexer, so those calls get faster as well. Staging's Upstash database is also in eu-central-1.
  • Slower now: calls to US-hosted Bluesky services (plc.directory, public.api.bsky.app, *.host.bsky.network PDSes, Resend). The noticeable case is profile resolution for many Bluesky-hosted identities on a cold cache (/api/resolve-dids, up to about +0.6 to 1.3 s), plus uncached handle lookups in page metadata. Caching is the follow-up; don't give those routes a preferredRegion, because they also use Redis.
  • No issues: rate limiting (client IP comes from the edge), allowlists, OAuth/DPoP, CSP and caches (the per-region data cache warms up once). The privacy policy already says "primarily within the European Union".

Testing

  • Staging: x-vercel-id: fra1::fra1::… on /api/auth/session. Pages, public xrpc reads and the well-known endpoints all answer normally.
  • After merge: repeat the production measurement signed in. Redis calls should drop to a few ms and the 12-read burst to about a second.

🤖 Generated with Claude Code

Summary by CodeRabbit

  • Documentation
    • Updated deployment guidance to explain how regional hosting is configured and how services stay aligned with their data infrastructure.
    • No changes to app features or user-facing behavior.

RetriggerView in GreptileConfidence Score: 5/5

This PR appears safe to merge.

Summary

Sets Vercel functions to fra1 and documents why they should stay near Redis.

  • Vercel functions now run in Frankfurt near Redis.

Reviews (1) · Last reviewed commit: "docs(agents): record the dashboard regio..." · Reviewed by Greptile

Functions ran in Vercel's default iad1 while the Upstash database is in
eu-central-1, so every Redis call crossed the Atlantic (~85 ms, measured
on production). Redis is on the hot path of every signed-in request: the
session cookie lookup, the OAuth request lock (TECH-807, which takes the
lock twice per proxied call and serialises one user's parallel requests),
the session store and the rate limits. On production a burst of 12
parallel same-session reads took up to 6.3 s; the same burst of public
reads, which skip the session, took 0.5 s.

Pin all functions to fra1 (Frankfurt), the same region as the database and
the rest of our infrastructure.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@vercel

vercel Bot commented Oct 29, 2026 •

Copy link
Copy Markdown
Contributor

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
certified-app Ready Ready Preview Oct 29, 2026 2:01pm UTC

Request Review

@coderabbitai

coderabbitai Bot commented Oct 29, 2026 •

Copy link
Copy Markdown

Review in Change Stack →

No actionable comments were generated in the recent review.

Recent review info
Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: defaults
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 2085beba-6f79-42da-91fc-e57ca2dbd2d2
Commits

Reviewing files that changed from the base of the PR and between 17b3a70 and 70d2656.

Files selected for processing: 2
  • AGENTS.md
  • vercel.json

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

Walkthrough

The Vercel configuration sets the function region to fra1. AGENTS.md documents this setting and advises keeping Redis-backed services in eu-central-1.

Changes: Function region configuration

Layer / File(s) Summary
Configure and document the function region
vercel.json, AGENTS.md
vercel.json sets the function region to fra1. AGENTS.md documents the region, Redis placement, and the preferredRegion guidance.

Priority: Normal

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Suggested reviewers: holkeb

Merge Risk: Minimal · up to 70d26

No actionable merge-blocking risk was found in this configuration-only change.

Pre-merge checks: Passed 5
Check name Status Explanation
Description Check Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check Passed The title clearly and concisely describes the main change: configuring Vercel functions to run in fra1 near Upstash.
Docstring Coverage Passed No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check Passed Check skipped because no linked issues were found for this pull request.
Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

Finishing Touches
🧪 Generate unit tests (beta)
  • Commit to this branch
  • Create a new PR
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

…he EU

Review follow-up to 3430f27. The project's dashboard default function region was still iad1 (vercel.json overrides it per deployment); it is now fra1 too, so AGENTS.md says to keep both in step. Also records that staging's Upstash database is in eu-central-1 as well, and which upstreams are EU-hosted.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@holkexyz
holkexyz marked this pull request as ready for review October 29, 2026 14:02
@holkexyz
holkexyz merged commit f663cc5 into main Oct 29, 2026
8 checks passed
@holkexyz
holkexyz deleted the holke/vercel-region-fra1 branch October 29, 2026 14:06
svc-agent pushed a commit that referenced this pull request Oct 29, 2026
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
svc-agent pushed a commit that referenced this pull request Oct 29, 2026
…p data runs (TECH-813)

Upstash, Inc. hosts certified.app's Redis database (production and
staging, AWS eu-central-1 / Frankfurt). It holds personal data: sign-in
sessions (cookie -> DID mapping, OAuth tokens and DPoP keys), short-lived
OAuth state and unlocked app-password sessions, and rate-limit counters
keyed by IP address or DID. The policy's processor list (section 8) didn't
name it.

- Section 8: add Upstash, Inc. (sign-in session, authentication and
  rate-limiting data, hosted in Frankfurt, Germany).
- Section 6: say that certified.app's server functions (fra1 since #261)
  and its session data are in Frankfurt; the section only described the
  certified.one PDS infrastructure.
- Last updated: October 29, 2026.

Transfers outside the EU stay covered by section 6's SCC paragraph. The
wording needs legal review before it ships.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

This branch was successfully deployed

1 active deployment
Preview — 70d2656e Deployed Oct 29, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants