It works! Served over TLS via cert-manager + Let's Encrypt.