If you are running multiple self-hosted services on a single Proxmox node, leaving them on a default flat network (vmbr0) is a massive security vulnerability. If one container is compromised, the attacker gains lateral movement across your entire infrastructure.
A Hub-and-Spoke architecture solves this. The "Hub" container acts as the strict central router and reverse proxy. The "Spoke" containers hold your actual applications. Spokes cannot talk to the physical network directly—all traffic must pass through the Hub, where it is inspected, filtered, and logged.
Here is a high-level look at the architecture we are building:
[ Internet / Physical LAN ]
│
