I recently created https://github.com/gnur/tobab that looks similar to your needs.

It's an identity aware proxy that uses google as an identity provider (but more could be added).

I built it mainly out of frustration on how complicated the 2.x release of traefik has become.

Like this but a plugin? https://github.com/thomseddon/traefik-forward-auth

I'm planning to release this as a plugin :)

Sign me up for an easy to use 2FA layer I can put in front of services.

I’ve been toying with Azure OpenID Connect w/ Cloudflare Workers. Not local to the datacenter but you could probably do something similar elsewhere?