The alert that crossed the water¶

Before the move, the message that told Golem Trust its own infrastructure was on fire had to leave the continent to arrive. Outbound alerts and notifications went through Fastmail’s SMTP relay, smtp.fastmail.com, on an app-specific password, and the internal relay, mail.golems.internal, carried what stayed inside. Fastmail is an Australian company with its servers in Philadelphia, St. Louis and Amsterdam. It is in the graph on purpose, because the exercise is to know where each dependency sits and choose it deliberately. The scraps for this layer say: the nervous system of a provider has no business running through a country nobody chose for the job.

What the relay carries¶

This is the operational signal: the vault’s health, the log pipeline’s alerts, the certificate-expiry warnings, the pager’s overflow to email. Email is the third channel: Slack carries the first word of an alert, PagerDuty pages the on-call, and the pager’s SMS escalation ran through Fastmail’s SMS API, so two American companies stand ahead of the relay and one behind the pager, and the relay is the leg that moved. The signal is low in volume and high in consequence, because it is the layer that tells a human something has gone wrong, and a relay that is slow, blocked or gone on the wrong morning is a fire nobody hears about until the smoke reaches them.

A European relay, or none at all¶

Two changes, in order. Most of the signal never needed to leave the building, so it moved to the internal relay, mail.golems.internal, which is Golem Trust’s own and reaches Golem Trust’s own people. What has to arrive at a human off the network, Dr Crucible’s personal inbox at three in the morning, goes through a European provider, mailbox.org of Berlin, on its own servers. Dr Crucible, on call more nights than is strictly fair, has strong views on being told of a fire in Helsinki by way of Philadelphia. The app password at an Australian company became a relay it either owns outright or rents inside Europe.

Fire reported from Berlin¶

   before                              after

   internal alerts ─┐                  internal alerts ──► mail.golems.internal (own)
                    ├─► Fastmail (US, NL)    │
   off-network ─────┘                  off-network ──────► mailbox.org (Berlin)

The operational signal that stays inside kept on its own relay, the little that has to reach a human off the network moved to a European provider, and the transatlantic hop taken out of the one message a provider cannot afford to lose.

What could go wrong?

• mailbox.org suspends the account, and the off-network alerts change to another European relay within the day, while the internal signal never touched it.

• The internal relay is where the fire is, and the alert about it cannot get out, and the off-network path exists for exactly that, on a different provider on different infrastructure.

• An app password at the old provider is left active after the move, a quiet outbound account nobody is watching any more.

Tiffany Aching sends word across the Chalk by shepherds, who lose the exact words and keep the meaning, and have never once needed a relay in another country to do it.