Why ports are not published, how to give a service an HTTPS domain, and which proxy headers your app must trust.