Perform the three steps to get Crowd to be ready to proxy, and accessible only via localhost.

prep_crowd_proxy.sh

# we'll only have IPv4 addresses to look for
sed -i -e 's/UTF-8/UTF-8 -Djava.net.preferIPv4Stack=true/' crowd/apache-tomcat/bin/setenv.sh

# block anyone not on localhost IP
sed -i -e '/<Context>/ a\
    <Valve className="org.apache.catalina.valves.RemoteAddrValve" allow="127\\.0\\.0\\.1" />' crowd/apache-tomcat/conf/context.xml

# make sure Tomcat knows it's behind a proxy.
# UPDATE THIS FOR YOUR ATLASSIAN SUITE SERVER HOSTNAME
sed -i -e 's/<Connector/<Connector proxyHost="atlassian.example.com" proxyPort="443" scheme="https"/' crowd/apache-tomcat/conf/server.xml