That would be a very bad decision security-wise. The witness node should be running on an unknown server, so it can not be attacked by someone. The seed node is public and should always be running on an own server.

You just need to run a simple node (no account history needed) on a different machine and open the configured UDP port (default is 2001). If you are using docker, you need to EXPOSE the port in the Dockerfile.

You can use the seed node as backup witness (before running security related updates on your main witness server, just switch your signing key to that of the backup node, so you can still produce blocks while updating your main server).