Architecture Rules¶
- Public exposure should stay minimal and intentional.
- VPN-only admin surfaces should remain explicit.
- Service ownership boundaries should remain obvious.
- State persistence must be inspectable.
- Cleverness is guilty until proven useful.
Those rules exist because the project has already demonstrated what happens when a shell/systemd stack gets too clever without guardrails.