This is a valid solution - open everything up to the public internet, but gate everything on the domain behind authn (with the application performing authz only

This is a valid solution - open everything up to the public internet, but gate everything on the domain behind authn (with the application performing authz only if authn is successful). Proxies can also handle the authn part and ensure the app isn't touched without authn, see: https://teams.cloudflare.com/ https://teams.cloudflare.com/