Since you aren’t behind CGNAT you can go full self-hosted! Don’t bother with Tailscale or Cloudflare Tunnel or other VPN services that connect through third parties if you can help it.

Here’s something to get you started with setting up a wire guard server on your NUC. github.com/Nyr/wireguard-install