Wireguard on a $15 Raspberry Pi Zero works as well[1], for those who don't have AppleTVs.

1. Or OpenVPN on your router. It's probably to gove yourself a tunnel to your home-network you can use from your phone or laptop from anywhere in the world. Avoid default ports if you can.

Tailscale is wireguard, just with outsourced admin.

I'm getting paid to develop and operate network infrastructure, I don't want to have a second job doing it without compensation.

The only admin work I ever do is generating a new config when I get or replace a peer device. I imagine this is inescapable even on Tailscale? Are there specific, recurring tasks that you think would cause it to rise to the level of a second job, rather than a once-and-done 5 minute install?

The fact you have to state avoid default ports if you can kinda really highlights why this is not the best idea right?