Comment by preisschild

> Use a central reverse proxy/load balancer for termination.

If you do that anyways, you could also use something like oidc authN/authZ on the reverse proxy level and just expose it to the internet.

You dont even need to self host the oidc idp, you can use Google/Github or even something like ATProto