This is where architecture gets really interesting! Let's design this systematically:
PHASE 1: Understand the load.
1M concurrent users does not equal 1M requests per second.
Active users might make 1-10 requests per minute each. But spikes, rush hour, and flash events matter.
Assumptions: Average 10 requests per minute per user. Peak 100 requests per minute per user (10x). Peak load equals 100M requests per minute equals 1.6M requests per second.
PHASE 2: Architecture layers.
User goes to CDN (static content), goes to Load Balancer (L7 LB), goes to API Servers (auto-scale), goes to Cache (Redis), goes to DB (sharded).
PHASE 3: Key design decisions.
DATABASE DESIGN: Sharding (split data across servers), Read replicas (scale reads independently), Connection pooling (don't exhaust connections).
CACHING STRATEGY: CDN for static content, Application cache (Redis) for hot data, Database cache (built-in query cache).
RATE LIMITING: Per-IP limits (prevent abuse), Per-user limits (fairness), Token bucket algorithm (smooth limiting).
Want me to design any specific component in detail?