A dedicated public hosting island for client websites + mail, separate from internal apps.
- Fastpanel server gets its own public static IP (different from HAProxy VIP)
- Public websites and mail ports terminate on Fastpanel
- Internal apps (docs, passwords, management portals) remain behind HAProxy
- Panel UI restricted (VPN / allowlist)
- Mail ports only as required
- Separate VLAN/DMZ rules in pfSense
- VM sizing
- DMZ VLAN + firewall rules
- Backups and restore procedure
- Upgrade cadence