Internet
                            |
              +-------------+-------------+
              |         VeciGate          |
              |  :80→9000  :443→9001      |
              |  :23235→22 :8080→8080     |
              +-------------+-------------+
                            |
                     koopa 192.168.100.95
                            |
     +----------------------+----------------------+
     |                      |                      |
  systemd                Caddy                  other
  :80 → 9000            :9000 HTTP              sshd :22
  :443 → 9001           :9001 HTTPS             tor  :8080
     |                      |
     +----------+-----------+
                |
        +-------+--------+
        |                |
   :9010 merchant   :9011 exchange
   (nginx TLS)      (httpd TCP)
        |                |
   unix sock        postgres/secmods