XO behind proxy or exposed directly?