I am creating a static website with a SSG. This is intended to be hosted in-house at first; only potentially later in the cloud. The customer uses Entra Id, and only specific user groups should be able to access the application.

I imagine that the web server (nginx, apache2, …?) checks if the user is logged in, redirects to the AAD sign-in page if not, and maintains the session of the user.

• First, I thought about nginx, but it seems like this is only available in the paid version, nginx plus.
• Secondly, another answer here redirected to https://github.com/oauth2-proxy/oauth2-proxy. This seems nice, but I would prefer something packaged, which makes updates easier.
• Third, Apache with https://github.com/OpenIDC/mod_auth_openidc might be an option. The documentation is not really detailed and does not look like plug & play either.

I just want to have a professional authentication system in front of a simple, static web app. How can I implement that in an easy, maintainable way?