Thanks for reading and for your question.

You are totally right: because you reach the backend as you come from the internet, you have to be open to the internet, i.e. ingress=all.