If you don’t trust Tailscale there’s like 3 different FOSS self-hosted alternatives. Setting one up is actually not that much more complex than setting a reverse proxy and you control the tunnelling network end to end.