IMO a simpler flow literally would be a wireguard tunnel on an internet routable IP address, far far far simpler