Feedback from gitter:

clients will contact port 443
nginx will forward to controller (internal port), controller forwards to the Rails API server (different internal port)

perfect.. Just one comment: wht you write here should be integrated inside the documentation :-)

Also:

This is set in install-api

geo $external_client { ... }

but is actually used in install-controller:

proxy_set_header X-External-Client $external_client;

Both parts should be listed in install-controller, along with a better explanation of what it is used for and the failure mode (keep_services.accessible doesn't work) if it isn't configured correctly.