yep

In my opinion it’s the best solution because there’s a really low attack surface plus it makes it easy to control which device has access to which services.

Not any in particular but mTLS is essentially just a reverse proxy (like nginx) asking a client for a certificate to be able to access the service behind it.

There are quite a few guides out there, so choose one for your reverse proxy of choice!

mTLS with a reverse proxy!