INTERNET
Public traffic, including this page you're reading right now.
HYPERVISOR FIREWALL
First gate. Restricts the control-plane IP to a short allowlist; leaves the web IP open on the ports it needs to serve sites.
HOST FIREWALL
Second gate, running on the VM itself. Separate firewall zones for the two IPs — the control-plane zone stays source-restricted, the web zone stays open to the world.
CONTROL-PLANE IP
Dedicated IP, one job: MCP over HTTPS. App-level allowlist plus OAuth/bearer auth. Nothing else is ever allowed to bind a port here.
WEB IP
Dedicated IP, one job: nginx serving every public site. Per-site Linux users, per-site docroots, SELinux-isolated.
These two IPs never share a listening port — the control plane and public sites are physically separated, not just logically.
Why split like this?
- A bug or misconfiguration in a public site's nginx vhost can't expose the control-plane endpoint — they're not even on the same address.
- The control-plane allowlist can stay tight (a handful of entries) without ever needing to account for public web traffic.
- Each layer fails closed independently: if one firewall layer were misconfigured, the other two still hold.