Jump server Phase 1 — TLS proof-of-concept. Reverse proxy rules land in Phase 2.