We have it open to the public, behind a load balancer URL filtering incomming connection, https proxied through cloudflare with a country filter in place