updated to externalize certs + proxy config