Multi-Region Azure Web Apps with Front Door: A Practical DR Drill
2026-06-14Built a dual-region Flask deployment (Sweden + Korea) behind Azure Front Door, then ran three failover drills. Here's what RTO actually looked like.
Writing
Blog
Long-form notes on Azure architecture, AKS at scale, networking, FinOps, and practical Generative AI. Most posts come straight from drills and enterprise engagements.
-
-
Hub-and-Spoke at Scale: When to Add Another Hub
2026-06-13A hub is a regional resource. The interesting question isn't "do I need a hub?" — it's "when do I need a second one in the same region?"
-
Azure Firewall SNAT: From Single PIP to NAT Gateway
2026-06-13SNAT exhaustion is the silent killer of egress-heavy workloads. Here's the three-step escalation ladder before you give up and split the hub.
-
Application Gateway WAF v2: Knowing When You've Hit the Ceiling
2026-06-12AppGW v2 scales to 125 instances. That's not a hard wall — it's a signal to add Front Door above and shard.
-
OIDC Federated Credentials for GitHub Actions: Killing Long-Lived Secrets
2026-06-11Stop pasting client secrets into GitHub. Federated credentials let GitHub Actions log in to Azure with a short-lived OIDC token.
-
Region-Tagging Your App: Letting App Service Tell You Where It's Running
2026-06-10App Service auto-injects REGION_NAME. With three lines of Python your DR app proudly displays "Korea Central" during failover, no manual config.
-
Failover RTO Reality: Why Standard Front Door Has a 5-Minute Floor
2026-06-09If your DR plan says "sub-minute RTO" and you're on Front Door Standard, the math doesn't add up. Here's why — and what to pay for if you need better.
-
Cost-Optimizing Azure DNS: The Private Resolver Trap
2026-06-08Azure DNS itself is cheap. Azure DNS Private Resolver is not. Knowing the difference saves $130/month per accidentally-provisioned endpoint.
-
Private Endpoints in Hub-and-Spoke: Per-Spoke or Centralized?
2026-06-06Where you put the private endpoint determines who can reach the PaaS service. There's a Microsoft-recommended pattern, and it's not "all in the hub."
-
AKS Egress Patterns: UDR Through Firewall vs Managed NAT vs ALB
2026-06-05AKS gives you four ways to handle outbound traffic. Picking wrong means SNAT exhaustion, mystery 5xxs, or a $300/month firewall you didn't need.
-
Postgres Flex with Entra-Only Auth: Eliminating the Built-In Admin
2026-06-03Azure Database for PostgreSQL Flexible Server lets you disable password auth entirely. Here's how to bootstrap with Entra ID only.
-
Azure Managed Redis vs Cache for Redis: When to Switch
2026-06-01Two Redis products in the Azure portal. They look similar. They are very different. Here's the migration trigger list.
-
CAF Naming Convention in Practice: A Cheat Sheet From a Real Project
2026-05-30Microsoft publishes the Cloud Adoption Framework naming guide. Here's how it actually looks when you apply it to a working multi-region project.
-
Pre-Writing Your Teardown Script: The Discipline That Saves Your Bill
2026-05-28The most expensive habit in personal Azure labs isn't picking the wrong SKU. It's forgetting to clean up. One simple discipline fixes it.
-
Azure IoT Hub at Scale: Message Routing Without the Spaghetti
2026-05-24At 10,000 devices you can read every message. At 10 million you can't — you route. Here's the routing pattern that stays sane past a billion messages a day.
-
Zonal, Zone-Redundant, Region-Paired: A Plain-English Tour of Azure HA
2026-05-21Three terms get blurred constantly: zonal, zone-redundant, and region-paired. Each gives you a different SLA at a different cost.
-
Cosmos DB Multi-Region Writes: Strong Consistency or Bust?
2026-05-18Multi-region writes give you global low latency — but the consistency level you pick changes everything about what your app sees.
-
Azure OpenAI: When PTU Beats Pay-as-You-Go (and When It Doesn't)
2026-05-15Provisioned Throughput Units guarantee latency. Pay-as-you-go is flexible and cheap. Picking the wrong one wastes either money or SLAs.
-
Service Bus vs Event Grid vs Event Hubs: One Sentence Each
2026-05-12Three messaging products. They overlap in marketing and almost never overlap in good architectures. Here's the boundary.
-
Blob Storage Tiering: Hot, Cool, Cold, Archive — and the Lifecycle Policy That Pays for Itself
2026-05-1050% of enterprise blob storage spend is data that nobody reads. A correct lifecycle policy collapses that line item.
-
Container Apps vs AKS: When to Pick Which (and Why I Pick Container Apps More Often Now)
2026-05-07AKS gives you every knob. Container Apps gives you the right defaults. Two years in, the right defaults are usually what you want.
-
Application Insights Distributed Tracing: Following One Request Across Six Services
2026-05-04Distributed tracing turns 'which microservice broke?' from a war room into a five-second click. The setup is shorter than you think.
-
Key Vault: Why You Should Migrate Off Access Policies This Quarter
2026-04-30Key Vault's access policy model is legacy. RBAC is the path forward. The migration is small, and the security upside is large.
-
Reaching VMs Privately: Bastion vs JIT vs Private-Endpoint Jumpbox
2026-04-26Three legitimate ways to RDP/SSH a private VM in Azure. Each trades cost for ergonomics for blast radius.