I use something very similar to your system, but people who know better will tell you that your admin functions should be at a distinct app at admin.example.com

I use something very similar to your system, but people who know better will tell you that your admin functions should be at a distinct app at admin.example.com, which you'd make only accessible to people VPNing into a gateway box which does nothing but VPN. You can secure them normally after that, independently of the service proper. This prevents a variety of attacks, such as leaving as XSS anywhere in your application, from causing you to lose th le admin console.