nforwardauth - simple and minimalist forward auth service intended for use with reverse proxies (Traefik, Caddy, etc). added basic auth and logout support
I started to do it the VPS - Wireguard - Home way recently. The advantage is that you do not need to expose an inbound port at home.
The penalty was borderline race incident. I like to think the stewards are more lenient when there is no damage.