VPN is the right solution here. Each app shouldn’t have to develop its own remote access method when a generic solution already exists.

It would be an issue if you’re stuck behind double NAT, but I think tailscale can help with that.