In that case, wireguard. I only occasionally need to access a service that’s not exposed to the internet, so I use ssh -L, but that would be quite inconvenient for your own use case.

I know tailscale exists but I’ve never used it, only tried wireguard on its own. Maybe there’s some huge benefit to using it but wireguard worked fine for me.