WireGuard

try wg-easy. it’s on the docker hub and it makes setting up a wireguard tunnel incredibly easy (as in, press the add button). The initial docker configuration process was a bit annoying to me since I had no prior experience, but most of the issues were down to the dns settings, which I eventually figured out.

• caddy can do that with basicauth: https://caddyserver.com/docs/caddyfile/directives/basicauth
• nginx can 100% do that because it has plugins for everything
• apache can probably do something like that

most reverse proxies have SSO tooling that you can set up pretty easily

But honestly, have you considered just using wireguard for these cases? It’s much more secure if you just want a bunch of stuff hidden from the rest of the world

yeah I can see why they don’t want invidious having access to their platform

you can convert really any computer into a little router using the help of an ethernet card. I’m planning to do exactly that for my homeserver

so it’s pretty much like SSHDs nowadays, or like read caching?