Which solution - Cloud or Private?

[mak]

I think I have a fairly typical single user scenario - I want to be able to access both my NAS and also remote desktop into a desktop from off-site.

My present configuration is a router with DDNS, forwarding a port to a Raspberry Pi which is running OpenVPN. My clients are authorised through certificates.

I like the idea of having a 2FA solution, however my reading has led me to the understanding that adding username/password to my OpenVPN would be using them as an alternative to the certificate rather than in addition to (not desirable), and to get 2FA with a OTP token I would need to use the OpenVPN Cloud offering (which I'm not sure can be run with a Synology NAS as one end of the tunnel?).

I'd welcome any advice on whether I'm using the best approach or whether there's a better way to do this. There is lots of information on how to do things but not a great deal of information that I've found on how to assess pros and cons of the approaches to a newcomer to VPN.

Cheers.