Need a better solution for Captive Portal

Hi there. We recently setup a TP-Link EAP330 wireless access point. We selected this one because it's one of the few WAPs we found that did RADIUS authentication with the built-in captive portal. However, we now know that it only uses the PAP authentication method instead of MS-CHAP, so users are unable to change an expired password when logging in through the captive portal.

I think we can work around this by hosting our own captive portal that the WAP would just redirect to? I've done some searching but most of what I found are captive portals that are provided as a service. Does anyone know of something we could selfhost, that will support RADIUS authentication with MS-CHAP and changing passwords?

Or maybe some sort of password management portal? Again, it must be self hosted.