Protecting internal web apps without a VPN

An identity-aware proxy can put a browser login boundary in front of a web application. Pomerium documents this clientless access model.

Treat it as an application boundary: verify that the backend cannot be reached directly, and decide separately how administrators will access SSH or other non-web services.