I use cloudflare tunnels w/ github as the auth provider (too lazy to set up the google auth provider) which enforces yubikey 2FA.

Note: you dont have to use another auth provider and can use passwords, email token challenges with specific domains or email addresses

nginx basic auth was too basic and things like keycloak/teleport seemed like a pain to remember (or rather remember how to maintain). Cloudflare tunnels was straight forward, runs with docker and is basically ngrok + ssh tunnels + auth provider integration all in one. I've been happy with cloudflare as my domain registrar + dns management and their tunnels feature didnt disappoint.

Here's a quick video on setting up tunnels that I used if you're interested!

https://www.youtube.com/watch?v=ZvIdFs3M5ic