Comment by LorenDB

My personal choice for something like this would be Tailscale/Headscale. Runs over Wireguard and handles a ton of niceties like DNS for connected nodes automatically.