i just use wireguard or tailscale, provision a subdomain with a custom ssl and resolve to a nat ip.