@jtk what're your thoughts on having a hidden primary? Is that a common occurrence in the wild?
I'm thinking of adding some secondaries (off net, not managed by me as well), so in case my systems go down, updates can still be pushed via this "hidden" primary to everywhere as well.