We stood up a regional ECN edge for PolitiCap at bangkok.thailand.politicap.eu: a small Go binary that serves a filtered HTML wire, sits behind our public load balancer for TLS termination, and keeps identity on the apex site. This is how that infrastructure fits 3DN’s managed hosting model—and why the split matters.
What problem this solves
PolitiCap’s human-facing product lives on politicap.eu: sign-up, account, wallet (DutchBud dibs as virtual credits), and trading. Regional markets, though, need a lighter footprint—something an operator can run as a downlink without cloning WordPress multisite or the full API stack.
The Bangkok node is that pattern in production shape:
- A public hostname in the
{city}.{country}.politicap.euconvention - TLS at the edge load balancer (when the certificate is in place)
- A single ECN node binary for the HTML wire and market API surface
- Server-imposed content policy on the hub export—not browser-side filters
- Redis as the normal cache plane for feed and article payloads
Architecture in brief
Visitors resolve the regional name and hit the public front. The load balancer terminates SSL and routes by Host header to the ECN process—not to the general web tier that serves the main PolitiCap WordPress site. The node pulls a sanitized feed from the hub content API, caches it, and renders simple list and article pages.
Account actions deliberately leave the edge:
- Sign up / log in / my account deep-link to the apex
- OIDC and Authentik stay central
- The wire stays read-mostly and policy-bound
That separation is the point of digital sovereignty for multi-region product design: you can host a regional surface without scattering identity and ledger state.
Server-imposed content policy
Desk articles originate on the hub CMS. Before anything reaches a regional node, the hub export applies policy keyed to the node (hostname / tenant):
- Deny desks that must not appear on a given wire (for example satire or dox-style desks)
- Allow only the house desk when a region needs a tight allowlist
- Optional language allowlists
The edge may narrow further. It must never widen. That rule is what makes the design suitable for partners who care about speech constraints: the unfiltered firehose is simply not on the node.
Exports are ordinary JSON (feed + per-article HTML). The node binary turns them into a public HTML wire at / and /a/{id}, with Redis TTLs so a brief hub blip does not blank the page.
How the binary fits the ECN package
The same Go binary that runs the hub market API ships as the regional package. Configuration turns on:
- Uplink — hub base URL and node API key
- Redis — shared fleet cache service, dedicated logical database for the edge
- Edge HTML — title, tenant label, default language, apex URLs for signup and login
Operators get a handshake against the hub, catalog pull for tickers when needed, and the content endpoints for the wire. Documentation for standing a node up lives under PolitiCap’s technical guide Plant your ECN.
Load balancer as web proxy
From the public internet, the regional name points at the same edge address as other 3DN family sites. The load balancer is the web proxy:
- Match
Host: bangkok.thailand.politicap.eu - Forward plain HTTP to the ECN process health-checked on its listen port
- Set forwarded proto/host headers so the app sees the public name
That keeps certificate management and DDoS-facing listeners on the shared edge, while the regional binary stays a small unit of compute you can place with a customer or regional rack.
TLS for multi-label names (city.country.domain) is intentionally separate from a one-level wildcard on the apex—certificate rollout for this hostname can follow once DNS secondaries and issuance path are aligned. Routing does not wait on that.
What we verified
- Hub handshake marks the Bangkok downlink online
- Content policy returns the expected allow/deny set for the tenant
- Sanitized feed contains only allowed desks
- HTML home and article pages render from cache after the first pull
- Load balancer backend health checks the node and serves the Host-based route
Why this matters for 3DN
3DN’s managed hosting story is not only “run WordPress.” It is also shipping production patterns for multi-region products in the 3DN family—PolitiCap markets, identity, and policy boundaries included. A regional ECN edge is reusable engineering: one binary, one policy plane, one cache habit, apex for accounts.
If you run infrastructure that must stay sovereign while still linking into a central product, this is the shape we will keep extending: more cities, same package, same rules.
Related: Plant your ECN · PolitiCap · 3DN
Leave a Reply