Comment by pizzalife

I don't agree that tunneling everything through some external facing proxy is "TLS certificates for internal services done right".