Isn’t this what Craigslist does with their geographical regions? They all store in the same “eventual consistency” DB, but IIRC each city gets its own server in a datacentre in that city.

I’ve even built websites the same, with a public login portal distinct on its own subdomain (and even server) than the staff/admin portal. Why? To separate concerns and enhance security without having to make the backend code that much more complex. And to keep everything performant, the backend DB is on yet another separate system, accessible only by the primary systems to keep its own security simple(r) than it normally would have to be.

I thought this was an old, well-established thing.

Still, a great write-up. I like how you’ve laid out your reasoning.