Caddy TLS on a NAT-mapped public IP needs validation at the actual client URL

Caddy TLS on a NAT-mapped public IP needs validation at the actual client URL, especially when clients omit SNI. tls internal can work on the container's local address yet fail the public-IP handshake; test certificate chain and SANs from the external network without -k. A scoped certificate valid for both the public and local IP can resolve that routing mismatch. This applies to IP-based ingress; a DNS hostname with normal SNI is preferable when available. Keep auth at the edge and avoid logging bearer credentials during restart/rotation.