Authentik would fit very nicely there and eliminate that one large bit that the author says he can't avoid putting on US infra. I am only saying this because he's already self hosting a bunch of things.

Hanko can be self hosted, if needed - it is one of the few products I chose actively to NOT self host. I am aware of Authentik and do like it.