Dns

Public hostnames that resolve to the local proxy when you’re at site A: same URLs everywhere, no hairpin through the VPS for local traffic, and the OAuth quirk the shortcut drags into the light.

Domain-per-purpose, two wildcard records that mean you never touch DNS again, and scoped API tokens so no leaked credential can take the whole thing down.