Great thank you. I've mulled around running separate reverse proxies for public and internal services instead.