---
title: "Möbius: Shopify’s Unified Edge"
description: "Shopify had more than six traffic paths for its core, services, PII-restricted systems, and mTLS-authenticated APIs, making platform-wide features harder to deploy and traffic behavior harder to observe. Möbius and Shopify Front End (SFE) were designed together: Möbius terminates TCP and TLS near clients and forwards requests to SFE, while SFE routes them from regional clusters to application clusters. SFE uses nginx deployments with custom Lua and a centralized API fed by Kubernetes controllers, enabling routing and active/active or active/passive load balancing without DNS TTL delays. Möbius automates edge domain configuration, DNS ownership validation, and certificate acquisition through vendor APIs, so application owners generally only need to change DNS. The unified design standardizes edge protection and observability, supports future edge capabilities, and leaves exceptions for services whose dependencies could create crash loops."
---

# Möbius: Shopify’s Unified Edge

[Shopify](https://yomu.fyi/company/shopify) · 2023-10-18 · Apr 20, 2022

**Type:** Problem & solution

## Summary

Shopify had more than six traffic paths for its core, services, PII-restricted systems, and mTLS-authenticated APIs, making platform-wide features harder to deploy and traffic behavior harder to observe. Möbius and Shopify Front End (SFE) were designed together: Möbius terminates TCP and TLS near clients and forwards requests to SFE, while SFE routes them from regional clusters to application clusters. SFE uses nginx deployments with custom Lua and a centralized API fed by Kubernetes controllers, enabling routing and active/active or active/passive load balancing without DNS TTL delays. Möbius automates edge domain configuration, DNS ownership validation, and certificate acquisition through vendor APIs, so application owners generally only need to change DNS. The unified design standardizes edge protection and observability, supports future edge capabilities, and leaves exceptions for services whose dependencies could create crash loops.

## Context

Shopify had more than six distinct traffic paths, including GenPop and PII-restricted Core and applications, plus publicly accessible mTLS APIs. This meant new features either had to be limited to selected paths or implemented repeatedly, while differing paths blurred observability and increased the time needed to diagnose issues and onboard team members.

## Approach / What changed

Shopify built Möbius as a unified edge and Shopify Front End as its routing layer. Möbius terminates client TCP and TLS, filters traffic, and forwards requests to regional SFE clusters. SFE routes traffic to application clusters using nginx, custom Lua, and a centralized API connected to Kubernetes controllers. Domain configuration, DNS validation, and certificate issuance at the edge are automated through vendor APIs, with application owners completing migration through a DNS change.

## Takeaways

- SFE keeps application-to-cluster mappings through a centralized API receiving requests from Kubernetes controllers in application clusters, and supports active/active or active/passive service balancing.
- Routing-layer load balancing enables near-instantaneous traffic changes because it does not depend on DNS TTL or client-side routing decisions.
- Application edge onboarding automates domain ownership DNS challenges and certificate issuance; migration still requires application owners to make a DNS change.

**Tags:** [Architecture](https://yomu.fyi/topic/architecture), [Kubernetes](https://yomu.fyi/topic/kubernetes), [Observability](https://yomu.fyi/topic/observability), [Reliability](https://yomu.fyi/topic/reliability)

- Source: [Shopify](https://shopify.engineering/mobius-shopify-unified-edge)
- Source URL: https://shopify.engineering/mobius-shopify-unified-edge
- Ingested by Yomu: 2026-08-30T15:26:49.172Z

[Read original post](https://shopify.engineering/mobius-shopify-unified-edge)