Consider incorporating Identity Aware Proxy down the line

[Stephen-ONeil]

Since the (non-API) portions of this project are intended to be accessible only by internal users, and the application may every integrate with AD for SSO down the line, it will likely make sense to go one step further and slap an IAP along the network path for incoming requests.

This video might be a good starting point.

This is low-ish priority for now, might be worth waiting to see if the AD SSO pans out first.