That's sensible, thanks.

What if the inside of the network is further segregated, and the Prometheus instance does not have access to all endpoints. Can I use the push gateway as a "proxy", or is a direct route required.

Sorry for the stupid questions. Now it's getting entirely academic of course :)

Edit: just re-read your post and saw the proxy note. Time to read the documentation again. This setup should make for a good blog post.