i just use wireguard directly... setting it up on a VPS there is a nice script https://github.com/angristan/wireguard-install

this makes it really easy to set up, at least on ubuntu server, and you can run it to get new client configs, and by default it shows a QR code so you can hook up your mobile devices with QR scanners on them

i usually then modify my SSH configuration to listen only on the wireguard address and then no more endless logs of people trying to hax, because they have to have an allowed WG public key to even connect at all