The real question here I suppose is whether the fly-proxy has a consistent static IP or DNS that could be used here? If not, is there an alternative method that could work here?
The proxy will always connect to your app via its 172.19.x.x address. You could trust that whole subnet. Nothing else can talk to it but our own hosts.