This is what I'm getting at. Also just saw the issue pertaining to HIPAA, which probably requires the same thing.
Apps deployed on Empire apparently are only available inside the VPC unless a domain name is added, it doesn't actually work like that (when I deployed the Empire stack all boxes had public IPs and a security group allowing ingress from the internet 😓), but the idea is a good one I think.
Oh, and thanks. Knowing you're behind it I'm sure Convox will be great. I'm looking forward to watching it develop and using it myself.