How to draw a single server production structure: reverse agents, applications, databases and port boundaries

Single servers also need architecture. They don't mix everything.

Small websites use a server. The question is not about the number of machines, but whether reverse agents, applications, databases and backups have a clear boundary. root The database directly exposes the public network, code and user uploads to the same directory, and the first failure becomes a complete search. A structure does not draw a cloud manufacturer icon. It is sufficient to guide deployment if you can answer the request from where it goes, who runs each process, where the data is left, where the backup goes, and what level of failure will see it.

Draw a request chain from the portal to the public network.

The typical path is:DNS Point the domain name to the server public network IP Firewall only. 80/443 And controlled. SSH,Caddy Receive HTTP/HTTPS, the request is retransmitted to the application of the listening loop address, e. g. 127.0.0.1:3000. The database only receives network connections within the home machine or container and does not require exposure to ports such as 5432,2,306.

Internet -> 80/443 -> Caddy -> 127.0.0.1:3000 -> Application
                                      |-> Database
                                      |-> Uploaded files

This chain directly helps to get the wrong number: the domain name is not first looked. DNS, certificates and 4 xx Let's see. Caddy 502 Then look at the upstream port and application status, and the data error ends up in the database and the business log.

Each component has only the necessary privileges.

Caddy, applications and databases are used separately by the users of the dedicated system. The application code directory is read-only, with only write permissions for logs, uploads, and temporary directories. sudo Management services, but routine processes are not based on deployment accounts or root Long-term operation. Environmental documents by root or a dedicated user to read. Permissions are limited to the minimum. .env Put it in a public static directory, and do not print the complete environment variable to the start-up log. /opt/myapp/releases, /var/lib/myapp/uploads, /var/backups/myapp And not all the files. /root/app.

Dissociation of persistent data from re-established documents

Codes, dependencies, and build products should be regenerated from a warehouse or mirror; databases, user uploads and keys are not allowed. Permanent data are marked with different colours and each writing backup and restoration method is given. The container roll is not a backup, and a cloud snapshot is not a substitute for applying a consistent backup. The logs can be regenerated, but a failure survey requires a cycle to be maintained.

The port watch is more useful than the "opened firewall"

The actual port may differ, but the principle is that there are few open entrances and that the internal address is clear. ss -lntp Check the bug results and not just look at the configuration file.

The main risk to single machines must be accepted in advance.

For low-flow content stations, this risk can be backed up off-site, self-started, monitored, and manual control can be restored clearly. If the operation already requires high-capacity overboard, the single server should not be packaged into a fail-safe program. Write the recovery target before going online: how long can the data be lost, how long can it stop, and who will do the recovery. The answer determines the frequency of backup and whether a second machine is needed, rather than buying complex clusters first.

The completion criteria for this piece.

You should get four simple records: request chain, process and user table, port watch, persistent data and backup table. The next entry starts moving applications from temporary terminals. systemd Services, which allows it to start, limit access and leave a searchable log.