An aphlict server has 2 ports, a client port and an admin port.
Currently the client port, 22280, uses https even behind the caching layer, so TLS is terminated at the backend by envoy.
The admin port, 22281, though still uses http between ATS and backend.
The last time we checked this was an issue of adding 2 envoy services on the same machine. This may or may not be true anymore.
Question is if we care and still want everything to be https-only even internally.
This could be a security risk when running Phabricator in one DC and Aphlict in another.
patch https://gerrit.wikimedia.org/r/c/operations/puppet/+/616917 was once uploaded for this.