(simplified): We employ a three-tier architecture in the public & private cloud environments:
webserver -> app server -> db server
When you ping the URL of your app, you get the webserver. When you curl to icanhazip.com from the CLI on the appnode, you get the IP of the appnode :)