We often get asked this question. The answer is simple - the orchestrator backend for Digger does not necessarily need to be publicly accessible, but it does need to interact with GitHub to trigger CI jobs. So basically, whether you choose to self-host Digger or use the managed Digger Cloud
