That's close to my current solution, but trying to reduce my on-prem attack surface.