I see now!
To prevent random bots from being able to wake up your machines I’d say remove public IP addresses from that machine and work with a Flycast IP (make sure to have a services section!) since it can wake your machine on HTTP.
Its gonna be really easy if it’s a Fly machine calling a Flycast IP because our networking Just Works 
but if you need to call that machine from your Not-on-Flyio server you’d probably want to connect it to Fly using Wireguard which is easy and also Just Works .
Here’s an example of a customer who needed just that: Automatically start and stop internal services