It sounds to me that for your specific use case, the tailscale free option would be a better match. You can self host it if you would like, using headscale (involves a little more work though). It’s basically like an orchestrator for wireguard tunnels.

I’m running tailscale on quite a few of my systems. I’ve configured the Grants (like advanced ACL’s) to allow for only specific services available from certain hosts while other hosts can act as exit nodes like a VPN egress. I’ve found it very useful for connecting families networks up so that I can assist with remote troubleshooting help and I’ve used it to reach back into my own network while traveling.