Create Linux 2FA configuration instructions

Greetings. I'm trying to set up Google Authenticator style (TOTP) authentication on Ubuntu 16.04 LTS. There are many article on this, but some are out of date, contain errors, or don't have exactly the details I'm looking for. [login to view URL] is probably the closest example. I'm looking for step-by-step instructions to get a new Digital Ocean Ubuntu 16.04 server to this state: - When logging in via SSH with a key/certificate, no 2FA is required - When logging in via SSH or console with only a password (no key/certificate), 2FA is required - Be careful - some misconfigurations can allow users to login with no password I will be using Digital Ocean droplets, so if you want to spin one up to test on an identical server, include the cost of Digital Ocean in your bid. I can provide you my public key for testing. Many Freelancers try to respond as quickly as they can to posted projects without actually reading the project. Those Freelancers that think it is a race usually don't actually know how to do a project. Show me that you aren't one of those by making the first word of your response "stegosaurus." Then I will know you are a detail-oriented person who competes ethically and is actually interested in the project. I look forward to working with you.