Consumer site is the only public entry point now. .120 is the gateway -- all SDK traffic, all browser traffic, all uploads come through here. Coordinator, artifact server, workers are all internal. Customers don't see the topology. Shouldn't have to.
This was always the plan but until the SDK existed there was no reason to enforce it. Now there is. One host, one TLS cert, one set of rate limits. The cluster behind it can be one machine or 20 and nobody outside knows or cares.