The fleet

The practice runs on a handful of small servers, split into internal zones and a DMZ with no router between them. The zones meet only inside two deliberately multi-homed boxes, the door and the monitor. The way in is one silent VPN socket, with SSH riding inside it. The way out is one NAT chokepoint that logs DNS, with an IDS on the wire. Every box reports to a SIEM, which pages rare events to a phone. The design follows three rules. Only the door answers the internet, and only on its VPN port. The workspace has no route to the internet except through the chokepoint. The account used for daily work has no administrative rights on any of the servers.