Either way I'm happy with a wide variety of products doing the job, it avoids lock-in.

Personally I use apache as I have very few users (internal facing stuff), it has a nice simple mod_auth_openidc config which remains the same from one year to the next

I do have to recompile ws_tunnel though as I proxy a broken product I proxy which doesn't accept the correct standard for camel-capped "WebSocket" -- my "fix" script runs

sed -i 's/WebSocket/websocket/g' ./modules/proxy/mod_proxy_wstunnel.c

and recompiles