@yagmoth555 I appreciate the various suggestions. Unfortunately, the application's vendor has mandated use of a DMZ and a domain-joined server. If I'm to be able to propose any sort of alternate configuration I will have to do so with the force of clear evidence that the current setup is 1) unnecessarily dangerous, and 2) an alternate solution will work just as well. Unfortunately I can't propose adding a 2nd server due to budget.

@Twisty is it for public access or for employes ? as a vpn server can be like a free sophos firewall atm, without adding cost

but if it's for public access, I think you will have to secure it the most you can, as your vendor put you at risk unfortunately.

@yagmoth555 Yeah, it's for public access.

@Twisty ok, well it's like a vendor did to me for a customer, I finished to put the server on lan with a simple port 443 redirection from the router, like a home server, but we used rule in the firewall to block unwanted country block, I told you there. I wasnt in a position to tell no for the customer, as it was an adhoc customer, but it's a complicated situation to handle, you could ask to make a double form-authentification too in worst case too

be sure to have explained your worry to the vendor with your boss cc, to leave a trace.