Add nginx/apache with client certificate authentication in front of this and most of those concerns go away. Plus this way you don't have to worry about expos

Add nginx/apache with client certificate authentication in front of this and most of those concerns go away. Plus this way you don't have to worry about exposing the port but you need to distribute your client keys before hand.