This, but plain Wireguard instead of Tailscale. This assumes you have a public IP. But you can't do true self-hosting without one.

Tailscale IS Wireguard. With all the reasonable management added. You can selfhost the control part via Headscale. Plain Wireguard can be a hassle for most - that bore Netbird, WG-Easy, Netmaker... out of those Tailscale got it the most right.