DNN newbie here, with a question web server security in a content staging scenario:

We are designing a DNN system for a customer, they want a "staging" web server on their internal network, and a "production" web server in a DMZ that is visible to the Internet. Every night, the production server will be refreshed with whatever is in the staging server. Now, we can't use DNN Enterprise's staging system because none of the third-party modules we're using support it. So, we're attempting to roll our own content staging process with file system compares and database compares.

I imagined a batch file or Powershell script that would run every night, it would stop IIS, update files on the production system with Robocopy or xcopy, update database schema and contents with some tool yet to be determined, then restart IIS.

So far, so good. But here's the deal: in the process of turning on enough services/roles/etc on the production server to allow RPC and file access, it seems like we're adding a lot of potential vulnerabilities to the production server. Am I overreacting? Is this sort of design/process common practice?