I believe Tailscale has 2FA? Headscale is an open source implementation: https://github.com/juanfont/headscale