Fully optional edge layer — Cloudflare, or a self-hosted reverse proxy (Caddy, nginx, Traefik). Islandr terminates TLS itself (dummy cert until an admin uploads one, hot-swapped at runtime) and can be reached directly with no proxy of any kind in front of it (ADR-0015).