My solution is to use Rathole. I rent a wildly cheap (2 core, 4GB memory) VPS and basically just run Traefik there. Then I use Rathole to make some services hosted on my desktop available to Traefik.
I like this solution better than Wireguard for my application. It reduces attack surface to services you’ve explicitly set up, rather than a full data layer trunk between your machine and a potential malicious actor.