I like to leave ssh over tor hidden service on remote boxes. It’s pretty resilient and can serve as emergency access for when something happens to the VPN. Not a great primary access method because of the latency.