I run mine on a separate server in containers (using Podman). For architecture, the server just connects directly to each agent, using my VPN network