1. Run the server on a public host. Point DNS at it: an A/AAAA record for the admin host, and one for each frontend domain you'll create.
2. Open :80, :443 (required for ACME), the tunnel port :7000, and the TCP frontend range.
3. Start with SEIKAN_ACME_STAGING=true; once names resolve and tunnels work, switch to production and restart.
4. The systemd installer runs the server as an unprivileged user with CAP_NET_BIND_SERVICE and a hardened unit (ProtectSystem=strict, syscall filtering, namespace/address-family restrictions).

HTTP/2 on :443 is intentionally disabled (keeps websocket handling simple; little benefit given the single multiplexed tunnel).