If you are not on the warpath with Webauthn I can highly recommend PocketID. It’s just so damn convenient. But note that the arrs don’t come with a good solution for oidc login. But you can use something like tinyauth or an auth forwarder in your reverse proxy.