Why I Prefer a Separate Edge Layer Over Hiding Routing in the App
The trade-off between fewer containers and clearer network responsibility.
nginx
NodePort Was a Validation Step, Not the Whole Networking Story
How I think about the later web-app NodePort in the context of a production edge design.
Exact Route Allowlists Are Safer Than Bypassing Authentication for /v1
A broad path prefix can expose future endpoints that did not exist when the exception was created.
Rate Limiting Is Not Authentication
The public machine API uses request throttling as abuse resistance while retaining Bearer validation as the real identity check.
Port 80 Appears Twice, but the Responsibilities Are Different
Distinguishing an Nginx listener from the web application service contract even when both use port 80.
Why Nginx Was Its Own Voiceware Application
The operational value of separating edge/proxy concerns from the application container.