A restrained description of the public web layer: HTTPS termination, path handling, static content and the routing boundary behind it.
The public surface is served over standard HTTPS with a regular certificate and a small static site. That keeps the host externally legible and avoids the appearance of a bare, unfinished endpoint.
The normal site remains public, while a less obvious path can be handled differently. This keeps public content and non-public request handling separated at the web-server layer.
The site is intentionally light on moving parts. Changes can be verified with ordinary Nginx and certificate checks, and the static assets are simple enough to replace without dragging in a build chain.