Have you ever used Tailscale? Just installing it on each device (and logging in with an account you already own) is the only thing you have to do to create a tunnel. You enable HTTPS certificates requires clicking on two links and enabling a switch.

Caddy (a webserver which, surely, the OP of this article must be using, if he’s serious about keeping things simple) comes with Tailscale support built-in, so you get your automatic HTTPS (ACME) with one line of configuration (adding `machinename.tailnet-name.ts.net` in the Caddyfile).

For fun, here’s the full configuration file for a server which serves a “what is my IP” service over HTTPS, only served when you are connected to your VPN:

    server1.cat-crocodile.ts.net {
      templates
      respond "{{.RemoteIP}}"
    }

(I should probably show how to remote proxy, to stay relevant with the article’s point, but I wanted to show off my Go-template-fu.)

Do you think installing software, clicking on a few links + a button (switch) on a website, and writing one line of configuration is unreasonable or complex?