TLS: design in São Paulo (GRU) · T-01

Runbook T-01 for TLS in São Paulo (GRU). Marker xserv-t-3aca4deb484f. This page covers design for LATAM operators, not a worldwide average.

TLS: Why it matters on this continent

Design for TLS on letter T starts in São Paulo (GRU). Runbook t-01 keeps a single owner, a written rollback, and a traffic split that can be reversed without a global freeze. Neighbors in Santiago only take overflow after the local pool fails a health window.

TLS: How XServ runs it day to day

Probes for TLS (t-02) leave Santiago every 15s toward Bogotá. XServ pages the named owner if loss or RTT crosses the letter budget. A probe never shares a queue with bulk transfers, so a saturated WAN does not hide a dead PoP.

TLS: What operators should measure

Policy for TLS is versioned as t-03. Operators measure error rate, p95 from Bogotá, and time-to-rollback — not a worldwide average. Changes land in Bogotá first, then Miami, with a hold if either region regresses.

TLS rollback T-06

Rollback for t-06 is a documented command, not a hope. Transit is billed as backup while TLS prefers peering in Santiago. If cost spikes, the runbook cuts overflow to Bogotá before touching customer prefixes.

TLS peering T-07

Peering for TLS (t-07) prefers the IX fabric that already carries last-mile ISPs in Bogotá. Session counts and prefix limits are on the same page as the Miami backup path.

TLS cache T-08

Cache rules for TLS on t-08 keep language-correct objects near Miami. São Paulo is a sibling cache, not an origin. TTLs are short enough that a bad asset does not live through a weekend.

TLS headers T-09

Headers for t-09 carry the letter, the region (GRU) and a request id. TLS debugging in São Paulo should not require a packet capture in Santiago first.