I am setting up a tiny, static website for a company. I am also building a rather complex and highly customized webapp for this same company. The webapp will only be used by the staff of the company while the website will be open to the public.
My initial plan was to host the website on a basic web hosting service, such as GoDaddy and then run the webapp (which is built using Django on Ubuntu) on a VPS provider. I was going to have
www.website.com point to the static website, and then have
webapp.website.com point to the VPS webapp.
This got me thinking: is there any reason (from a security perspective) why I shouldn't just run both the website and the webapp on the VPS? I guess I was thinking that having the webapp on its own on the VPS added an extra layer of security (namely: security by obscurity).