That's one option. The larger problem to solve is the sheer volume of legacy apps that people are afraid to touch due to "they're working, don't touch it!" or

That's one option. The larger problem to solve is the sheer volume of legacy apps that people are afraid to touch due to "they're working, don't touch it!" or their source, team, etc aren't available anymore. Putting authN/Z, IP restrictions, etc in front without modifying them is powerful. Then you can do the same for IoT devices in seconds.