Technology · Discipline

Zero-inbound network exposure

No host in my estate accepts an inbound connection. Everything arrives through authenticated tunnels or a private mesh, and every public surface is fronted by TLS and rate limits.

Auth and access planeOutbound tunnels and a private meshMutual TLS on the LAN
Outbound only
main estate
business event intake
social integrations
The estate · a private mesh inside operator and host-to-host access
  • 0inbound connections from the internet
  • 3outbound tunnels, one per purpose
  • 1public component in front of a vendor platform: a small edge Worker

Outbound tunnels, one per purpose

Auth and access plane holds my estate to one rule I set early: no service accepts an inbound connection from the internet. Everything public arrives through outbound-only tunnels, one per purpose, separating the main estate, business event intake and the social-platform integrations, so trouble on one surface stays there and I can cut any one surface without touching the others.

Where a hosted service needs a public name, NGINX terminates TLS behind the tunnel, and TLS termination, rate limits and security headers sit in that one front layer. Where a vendor platform such as Microsoft Copilot Studio needs a public endpoint, it reaches the tools through an edge Worker. Helix exposes its voice endpoint through a tunnel behind an access policy that answers authenticated callers and refuses anonymous ones.

A hosted service with a public name
Internet
anyone
Tunnel, outbound only
no open port
NGINX front layer
TLS, HSTS, headers, rate limit per endpoint
Service
A vendor platform's endpoint
Vendor platform
discovery probe and calls
Edge Worker
token or rotating key
Private tunnel
tool calls only
Tools

Commercial AI platforms and my own agents reach the estate on my terms. The tunnels, mesh and edge runtime are third-party infrastructure; the exposure design, the per-purpose separation and the edge components are mine.

Doors the social integrations keep shut

FAFOHive applies the rule to my X, Facebook and Reddit integrations. Their backends are reached only through a tunnel, behind an edge bearer check and an origin header the proxy requires. The timers that wake the X scheduler call a control endpoint that accepts only loopback peers with their own credential, and the proxy blocks that path from outside as well. The Reddit integration has no TCP port at all and is reached through a private Unix socket.

Social backends
X scheduler control
Reddit integration
an anonymous request travels this far and stops
edge bearer check and origin headerproxy, loopback peers onlyno TCP port

A service that needs no listener gets none.

GPU workstations under certificates

Inference Fabric brings LAN GPU workstations under control with no standing shell access: SSH bootstraps a host once, and every later command goes over mutual TLS with my private certificate authority.

SSH
Mutual TLS, private CA