Wireguard, as only a handful of people need access to the services, I manage it manually - and not with Tailscale or something similar.

With that my server looks nothing like a server from the outside, as I’m exposing nothing - Wireguard doesn’t even show up in a port scan