Keep the origin direct
The hostname resolves to the node that serves it. Fewer intermediaries make certificate renewal and failure diagnosis easier to understand.
Small systems are easier to inspect.
Three practices guide this public surface.
Carry only local assets
Typography, icons, and styles live with the pages. A browser does not need to contact an analytics service, font host, or advertising network.
Fail as one surface
Known and unknown routes share the same visual language. Missing pages are ordinary ledger gaps, not a separate default-server screen.