One machine, two access paths, and a workstation it talks to constantly. This is the map for anyone (including future-you) trying to remember why a request goes where it goes.
01
Getting to the server
Two doors into the same house — one public and narrow, one private and wide open.
Public traffic is forwarded to DMM-000 alone, on ports 80/443 only. A VPN connection instead joins the whole LAN, which is how RDP and the admin page are reached without ever exposing them publicly.
public internet path VPN / private path
02
Inside DMM-000: one request's trip
What actually happens between a browser hitting a URL and a page coming back.
Every public site shares this same chain. admin.desertmountaincorp.com skips the PIN step entirely and instead checks the caller's IP is inside the LAN or VPN range.
03
Dev ↔ server workflow
Everything moves through one SSH account, in both directions.
Code
Commit on either machine, push/pull through a shared bare repo.
DMM-STATION020: mysqldump → zip → scp → D:\Backups\<site>-db\ (14-day rotation)
Both travel over SSH as git-deploy — a dedicated, non-admin Windows account on DMM-000 with key-only login, scoped to C:\git-repos and the backup folders and nothing else on the machine.
04
Where each site actually lives
Site
Access
Live production
On DMM-000
demo
public · PIN
—
git + container
dmm (desertmm.com)
public · PIN
SiteGround
git + container
ylfboutique
public · PIN
SiteGround
git + container
rgs (r-gsales.com)
public · PIN
SiteGround
git only, container pending
pfc
internal only
DMM-STATION020
git + nightly DB dump
viewmyhealth
internal · PHI
SiteGround
git (no uploads/secrets) + nightly DB dump
rgs-tools
internal only
SiteGround
git + nightly DB dump
"Internal only" sites are listed by name on the admin page with no link and no PIN — reachable only if you already know the address, and only from the LAN or VPN.
05
Security calls made along the way
A years-old port-forward exposing DMM-STATION020's RDP directly to the internet was found and removed; RDP now only works over the VPN tunnel.
Public staging sites sit behind an 8-digit PIN with a 15-minute lockout after 5 wrong tries — enough to keep search engines and casual scanners out without asking clients to install anything.
admin.desertmountaincorp.com checks the caller's IP against the LAN and VPN ranges instead of using a PIN, since it lists every site's access code.
Nothing touching real patient records, financial transactions, or uploaded documents (viewmyhealth, pfc) ever gets committed to git — those go through the nightly database dump instead.
git-deploy is a purpose-built account with no admin rights, so a compromised key can reach the repos and backups and nothing else on the machine.