In this case it really is easy. It's just wireguard with some NAT negotiation sauce and convenient auth layer.