Served by Caddy on 10.60.1.20. If you can read this from outside, the whole path works: datacenter gateway, pfSense virtual IP, port forward, filter rule, and this reverse proxy.