oh yeah, you could also use wireguard and host it on a VPS only accessible over wireguard