One small server, many live demos — a mirror-first deploy contract with zero inbound ports.
The business site's live demos need a real backend somewhere, and that somewhere is deliberately boring: one small Hetzner VPS running many Docker containers, with Cloudflare Tunnel as the only door. The box dials out to the edge; nothing on the internet can dial in — no open ports, SSH included.
The operating rule is the mirror is the source of truth. Every file on the box exists as deploy/<absolute-path> in a private repo; changes are authored in the mirror, shipped over the tunnel, and the box is only ever a deploy target. Nobody edits the box directly, so the box is always rebuildable from the repo.
Two hard lessons are baked into the contract. Every published container port is loopback-bound — a bare host:container port punches through the firewall no matter what the firewall says, so the firewall is never load-bearing. And every change ends with an acceptance suite that reports its own count — the number lives in the script's output, never in prose that can drift — which must also pass after a cold reboot with no human help — a demo that only works until the next restart isn't deployed, it's balanced.
Secrets live only on the box, root-owned, outside the repo. Adding a new demo is three declarative blocks: a compose service, a tunnel ingress rule, a DNS route. The first tenant is the Confirmation Outlook live demo.