A serious production on a single machine
One entry point, a disciplined edge, and a trade that should be stated before it is discovered
A single machine can host a real production stack, provided the edge is treated as an architecture rather than a pile of containers. This paper describes the shape in the abstract: exactly one public entry point, a filtering layer behind it, application servers that never see the internet, a management plane that is not reachable from a public interface, and an update ritual that can be rehearsed. It names no products on purpose — the principle is the transferable part, and the configuration is the part worth keeping quiet. It ends with the limits of a one-machine trade, and with what changes when the system outgrows it and the edge moves onto dedicated equipment.