There's also an apache module (https://github.com/pingidentity/mod_auth_openidc https://github.com/pingidentity/mod_auth_openidc) and some Lua you can plug into

There's also an apache module (https://github.com/pingidentity/mod_auth_openidc https://github.com/pingidentity/mod_auth_openidc) and some Lua you can plug into nginx (https://github.com/pingidentity/lua-resty-openidc https://github.com/pingidentity/lua-resty-openidc) if you are going the reverse proxy approach.