---
id: platform-network
area: platform
level: 3
title: "Artefact — Network layout and remote access"
claim: "A private mesh and SSH everywhere · services bound to loopback · and one public listener at the edge terminating TLS for the sites that are allowed to be seen."
confidence: running
period: "2020–"
tech: [Tailscale, SSH, Caddy, DNS, Termux]
metrics: [{label: "public listeners per service", value: 1}]
artefacts: []
public: true
last_verified: 2026-10-26
tags: [platform, networking, security, artefact]
---

# Artefact — Network layout and remote access

**Status: stub.** The topology diagram lands in Phase 7 with addresses and hostnames redacted.

## What the artefact is

The layout: hosts on a private mesh for remote access, SSH on every machine, a phone used as a terminal, and an edge host that terminates TLS and proxies to loopback-bound services. New services bind to loopback by default; making something public is an explicit edge change, not a side effect of starting a container.

## What it proves

Security posture chosen rather than inherited: no service is reachable because it happened to bind to all interfaces, and there is exactly one place where the outside world meets the estate.

## When it is delivered

Phase 7. Internal addressing, hostnames and public DNS names are excluded from publication by the redaction pass.