This is great and I’m glad somebody else is able to articulate so much of my operating assumptions. I try to encode a lot of this into tools. About a year ago I made a tool to help with these entrypoints, not just for better configuration, but I’ve found lots of patterns and best practices in designing containers as 12FA style appliances.

https://github.com/progrium/entrykit