Lovely write up! Personally, I just settled on Tailscale so I don’t have to manage WireGuard and iptables myself.

For a while I also thought that regular SSH tunnels would be enough but they kept failing occasionally even with autossh.

Oh and I got bitten by Docker default MTU settings when trying to add everything to the same Swarm cluster.