Any reverse proxy

The rule is the same for Caddy, nginx, ngrok or anything else: terminate TLS wherever you like, proxy to the board’s loopback port, and pass the public origin to Frizz.

  press R, choose Something else

  Origin  https://whatever-that-proxy-serves

Frizz checks that a request’s Host matches the origin it was given, so the value has to be the exact origin a browser sees — scheme included, no trailing slash.

Caddy

A two-line Caddyfile, which gets its own certificate:

board.example.com {
  reverse_proxy 127.0.0.1:9393
}

What the proxy has to carry

• WebSocket upgrades. The board’s live feed and its terminals are WebSockets. A proxy that does not forward Upgrade serves the page and then goes silent.
• Server-sent events, unbuffered. The event stream never ends, so a proxy that buffers responses shows a board that never updates. In nginx that is proxy_buffering off.
• The original Host. Frizz judges the origin from it. A proxy that rewrites it to 127.0.0.1 makes every request look local and skips the access gate.

That last one is the whole security boundary. If your proxy cannot preserve the Host, do not put the board on the internet behind it.