Tailscale is also ridiculously easy to use for this purpose. The serve and Funnel features make secure self hosting really easy from your tailnet (one can easily provision certificates for nodes using Let’s Encrypt from the CLI: tailscale.com/blog/reintroducing-serve-funnel