The identity provider requirement has always creeped me out. Have you tried headscale? How was it?