Sputnik webserver (HTTPS :6443). Always-on, systemd+wrapper. Watcher pair watches ~/prod/sputnik/src/sputnik/. Python venv sputnik. TLS certs at /etc/sputnik/tls/. Hardening: base4. LAN alias: sputnikshute-prod.internal (caddy-lan on ironclad terminates TLS). Cloudflare: sputnikshute.unbiasedrhino.cyou (VPS Caddy → Tailscale 100.64.0.61:6443).