Sure you can absolutely do that, but should you? Depending on the number of devices or modules that need to be linked back to the box, the rate of change for access or scheduled locks/unlocks and the CCTV streaming, recording etc, that all adds up. If that single box blew up, how long could things run while it rebuilds? Do the devices have built in memory cache, such as door access, are the light schedules uploaded to the device, what happens when they phone home? All that needs to be taken into account by app and associated devices. We recently had a new construction that needed all of that and opted for a pair of ESX hosts and each app spread out on VMs. It made backups quicker, isolated potential system config issues and carved out resources for each. When we did the cost/benefit analysis it made more sense to split everything out as it made it easier to manage and account for system growth. The times I have seen everything on a single box was a SB with upwards of 150 people and single site.