PADI Axelerant
padi.com Enterprise Architecture
v1.1 · 6 November 2026
Work in progress · Version 1.1, last updated 6 November 2026
Start here

Principles and quality targets

The rules the design follows, the quality targets it is measured against, and where each target is verified.

Architecture principles

Principle What it means in this build
Edge first Cloudflare is the only shared HTML cache. The URL carries country and language, so the same URL returns the same page to everyone and can be cached.
Serve stale rather than fail Stale-while-revalidate, stale-if-error, per-server last-good copies and circuit breakers keep pages up when the CMS or an API fails.
Trust only signed context The edge signs its country, region and language decision. The frontend ignores unsigned values.
Secrets stay on the server Browsers never hold service credentials or call PADI platform APIs directly.
Infrastructure as code where the platform allows CDK for AWS, Terraform for the Cloudflare zone and the Datadog monitoring of the website, Drupal and the finder, Ansible for finder hosts. Exceptions: Cloudflare certificates and bot settings, the edge's Datadog monitors (applied by script), the shared non-production network and the CI library release step.
One path to production Feature branch, then development, staging and production, with a manual approval for production. Branch names vary by repository.
Performance work must not change behaviour Performance changes must produce identical pages. Riskier changes ship behind switches that are off by default.
Telemetry in production only Development and staging send no telemetry. Datadog is the single tool.

Quality targets

Quality Target How it is met Verified by
Availability Finder APIs, website application and Drupal delivery API 99.9% over 30 days. Nested timeouts, managed OpenSearch, autoscaling groups Datadog SLOs
Latency search-api and locator-api p95 under 500 ms (search-api serves both the finder and website search), finder errors under 0.1%. search-api over OpenSearch Datadog SLOs
Lab Core Web Vitals LCP ≤ 2.5 s (3.0 s blog), CLS ≤ 0.1, TBT ≤ 200 ms. Partial prerendering, edge HTML cache, image renditions Lighthouse
Field Core Web Vitals p75 LCP ≤ 2.5 s, INP ≤ 200 ms, CLS ≤ 0.1. Same Datadog RUM
Capacity Website 20 page views per second. Finder 100 requests per second for 60 minutes, 150 peak, CPU and memory under 60%. Edge cache, load shedding, Acquia autoscaling; finder autoscaling groups Load tests
Content freshness A published change visible within 8 minutes. Tag purges to Varnish and Cloudflare, second purge after 6 minutes Change canaries
Finder data freshness A PADI Travel change searchable within 10 minutes; full rebuild within 10 minutes. Change data capture, single-writer indexer, alias swap Pipeline monitors
Resilience No single server or zone failure takes the finder down; point-in-time recovery of finder data. Hosts autoscale across 3 zones; Aurora 14-day recovery. Today 1 OpenSearch node and an Aurora writer; 3 OpenSearch nodes with a replica and an Aurora reader before launch Failure and restore tests
Security and privacy No personal data in telemetry. Least-privilege credentials. See Security
Localisability 21 languages, 3 content regions, 235 countries. Edge localisation Worker, Drupal Domain Access Routing test suite