MTLS is great protection, but the use case must support it. For example, if you want your app to support registration for new accounts or if you have a lot of people you want to have access, that might make mTLS unwieldy to manage.

I host apps behind Traefik reverse proxy, using the d.rymcg.tech framework. It make it easy to protect your apps behind HTTP basic auth, Oauth2, or mTLS(or any combination).