Cloudflare zero trust also works for this, nice if you already use them for DNS and proxy. You install cloudflared tunnel, expose select ports as a service in zero trust, then whitelist email addresses that can log in to zero trust and when they a one time password to log in when they try it. When logged in you get a page showing the services available as clickable links.

Vibe coded a python script to configure Cloudflare, it just looks on docker annotations so I can select which containers to expose.