app-pub backend

Served from private subnet 10.0.20.146 — reachable only via WAF.