Which you'd then promptly put in front of a proxy as you want to handle things like certificates, authentication etc in a different way.

Exactly this