With regards to the back end of IPB, if someone needs to access my community for some reason can't go wrong with the API or a custom back end. The main issue for me with letting ANYONE into my server, whether it be ssh, the website, a game server, is security. I tend to use things like an API or control panel for them to manage the data they need to manage. Bonus points if the panel/api has really detailed permissions that can be applied for almost/all routes.