The Stack Map — Where Everything You Learned Plugs In

Final lesson, big picture. Where every piece of this quest sits in a real solo-dev stack.

The layered stack (outside → inside)

Layer	What it does	Quest reference
1. Network perimeter	Limit who can even reach the listening port	Track 3 (bind addresses), Track 4 (Tailscale)
2. Edge defenses	WAF, fail2ban, rate limits, geo-blocks	Track 6 (rate limiting, blacklist)
3. Per-request auth gate	PIN middleware (or passkey, or OAuth)	Track 5 (PIN), Track 10 (passkey/OAuth)
4. Session management	Cookies, expiry, revocation	Track 5 + Track 7 (killswitch)
5. Authorization checks	"This authenticated user can do this"	Track 2 (AuthN vs AuthZ)
6. Data-at-rest encryption	Defense if all of 1–5 fail	Track 10 (this lesson)
7. Visibility & response	Dashboard, audit, killswitch	Track 8, Track 7
8. Secret hygiene	Keep credentials away from LLMs and repos	Track 9

The right subset for you

You don't need every layer. You need the layers that match your threat model:

Solo-internal app, Tailscale, low stakes: Layers 1, 3 (PIN), 4, 7. Skip the rest.
Solo with partner sharing: Add layer 5 (per-user authZ), layer 8 (everyone uses placeholders).
Public-internet exposure: Add layer 2 (WAF, rate limits), upgrade layer 3 (passkeys), layer 6 (encrypt sensitive fields).
Paying users: Layer 3 → hosted IdP, layer 7 → real audit retention, formal incident-response runbook.

What you now know

Why "I'm nobody" is the dangerous mindset.
The exact difference between authentication and authorization.
Why 0.0.0.0 is the most consequential line in your config.
Tailscale's strengths and the lost-phone window it leaves.
How to build a 100-line PIN layer that's actually defensible.
Why bcrypt + lockout makes 4-digit PINs survive contact with the internet.
How to revoke everything in 15 seconds when it matters.
How to make security visible with a dashboard you'll actually look at.
Why your AI editor is the biggest secrets-leak surface in your dev loop.
When PIN stops being enough and what to add next.

Exercise

For each of your apps, write down which of the 8 stack layers you currently have, and which you've deliberately chosen to skip. The exercise is the explicit list — gaps you've named are gaps you can defend; gaps you haven't named are bugs waiting to happen. Schedule the highest-priority gap as next week's work.