Adding on to this: you can host your own Tailscale-compatible server with Headscale, if you want to be totally independent.
I’m going to dig into Headscale with Authelia for OIDC, that’s pretty close to what I was imagining, found this tutorial [0] (wow posted just 4 days ago). Thanks ya’ll.