Pangolin would have been a better direct fit than Authentik. It does come with an embedded idP nowadays but can also use Authentik. Another tool to keep an eye on is Netbird which is like a tailscale like mesh but has proxy support for whatever app you want to share with or without authentication.