A split-plane, one-way promote architecture for low-cost digital publishing

Abstract Resource-constrained publishers need a public origin, an editorial pipeline, and administrative access without relying on a commercial Zero-Trust Network Access service. We describe a split-plane pattern, termed infrastructure-aware Zero Trust architecture (IA-ZTA), deployed for the LyndHub news portal. A public virtual private server operates as a replaceable production replica, while ingest and administration run on a Jakarta Kubernetes cluster behind carrier-grade network address translation and without node External-IP assignments. The control plane initiates WireGuard promotion sessions, and new sessions from the replica toward the control plane are dropped. Bidirectional probes conducted during system validation supported this directional policy. In a same-host laboratory comparison, an official OWASP Core Rule Set Nginx image and a honeypot front both produced zero false positives on 80 benign portal paths; their true-positive rates on 14 reconnaissance paths were 0.21 and 0.50, respectively, without a statistically significant paired difference (exact McNemar p = 0.125). Separately, 41,247 published identifiers and 4.54 GiB of uploads were copied to empty storage in 183 s while the public site remained available. The architecture limits, but does not eliminate, the consequences of public-replica compromise.