Right now I'm solving this by having two separate ingress controllers in one cluster - one for private stuff only available over a vpn, and one only available over public ips.
How's this working out? What kinda alternatives are there with a single cluster?
Cool, now drop the CLAs and we're good.