Bastion
A public front door for machines that don’t have one.
A bastion is a host deliberately reachable from the internet, standing in front of machines that deliberately aren’t. Everything private talks to the bastion, and the bastion is the only thing exposed, which makes it the only thing you have to defend properly.
It’s how the machines in my basement end up serving anything at all. They sit on a home connection, behind a router that isn’t going to forward ports on their behalf, so they reach out to a small cloud server over Wireguard and that server fronts them. From outside, the service looks like it lives on the bastion. It’s actually in the basement, and the connection was made from the inside out.