VPN gateway — see /auth/ for Keycloak admin.