> We proxy traffic from edge servers to containers through a global WireGuard mesh.
I am more interested in the mesh. Do you have more details on that? Specifically why this architecture was chosen, what kind of latency does WireGuard add, etc.
I am more interested in the mesh. Do you have more details on that? Specifically why this architecture was chosen, what kind of latency does WireGuard add, etc.
We picked it because it's really simple to manage, and we wanted to ensure traffic between datacenters was always encrypted. We have a little tool called "flywire" that keeps wireguard peer configs updated from Consul. Once we accept a connection from a user, we pick a target VM, and then connect them over the wireguard mesh.
For our purposes, it basically doesn't add any noticeable latency. I think when we tested we say something on the order of 0.1ms of added latency over wireguard, but I don't quite remember. It's never been the source of latency problems when we do have them, at least!
P.S: I’ve built a service using Fly and can’t recommend it enough!