Everything on one box

A modern small server is absurdly capable. Four gigabytes of RAM and a couple of cores will comfortably carry a database, a web application, a reverse proxy and several background workers, for a user count in the low thousands.

Where it stops

Not at load, usually. It stops at the first thing you cannot restart without an outage, and at the first time two services want the same port.

The second one is worth planning for early. Decide what owns 443 before anything does, and put everything else behind it.