proxy seems available in general, must just be local to workers because only one of my sites going thru ZT tunnel with identity access rules is affected