Use Tailscale, for the most part it’s pretty transparent. As long as all the magic DNS stuff is setup correctly, I can access all my internal services by name and it just works.