Never expose the IP of your primary database or money-site application server in public DNS `A` records! Even if you don't use Cloudflare, you should put 2–3 cheap disposable $3/mo KVM VPS nodes in front of your real offshore backend connected over an encrypted **WireGuard** private mesh (`10.99.0.0/24`). ```nginx # Fronting Edge VPS (/etc/nginx/conf.d/edge.conf) proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=STATIC:100m inactive=24h max_size=5g; server { listen 443 ssl http2; server_name your-money-site.com; location / { proxy_pass http://10.99.0.10:8080; # Over encrypted WireGuard tunnel to Swiss/Iceland backend proxy_set_header Host $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_hide_header X-Powered-By; proxy_hide_header Server; } } ``` If a fronting node ever gets DDoS'd or receives a nuisance complaint, you spin up a new $3 edge node in 60 seconds while your backend database in Iceland/Switzerland never goes offline for a single millisecond.