Use supervisord to run everything (except postfix).  Expose ssh.  No longer allow connections to MariaDB from all interfaces.