Hi Matthews,
Best practice from security and high-availability perspective is to have multiple servers for each layer. So you would have multiple Web servers, multiple API servers, and multiple database servers. As Chris pointed out, all these servers should be within the same LAN.
Of course, such best practice may be overkill for your situation. If you don't need high-availability then you can get away with a single server. But from a security standpoint, it's generally a good idea to at least have the database server separate from the Web server.
Again, just to clarify, none of what I said is requirement of PowerServer. You asked what is "advisable" so I am just outlining some best practices I have seen.
Best regards,
Armeen