I second this. Wireguard, openvpn, various docker containers offering these, I’ve been through with them.
The regular openvpn or wireguard tools are good if you only need a dumb von, but if you want some kind of special routing or overlay network, tailscale has just been so easy.
I selfhost it completely too, using a headscale control server.