Thanks for laying the groundwork here. We’re new to datadog, and your setup helps us see how it might be configured within fly.
One thing you should check: I think your app config results in the agent being publicly reachable on port 8126. I’m not actually sure how to lock this down (related feature request). Sorry I couldn’t DM this.