If you run services at home you dont want to expose all your services to the internet, the attack surface is just too large, yet you may need to manage your services when you are not at home. Whist some services such as a website may need to be exposed, ideally behind a reverse proxy key services such as your VM hosts, docker hosts, firewalls and so on should never have there management interfaces exposed in this manner for this you need a VPN.

You could spin up your own wiregard and work that way but its just something else to manage and secure. The best option is to use a mesh VPN provider. Your main options are Tailscale and ZeroTier.

Honestly both do pretty much the same job and work in similar ways with a webui or management. Having used ZeroTier in the past it worked well enough however firewall traversal was not as reliable as Tailscale, the webui is also a bit dated (in a bad way not in a good way). Deployment of the client on the endpoint is also less of a pain with Tailscale simply run the script add the provided join code to your Tailscale and you are done.

ZeroTier also uses its own protocol, there is nothing fundamentally wrong with that but Tailscale uses the industry standard WireGuard protocol so its been tested in anger more that the custom protocol used by ZeroTier.

At the end of the day both achieve the same goal in a similar way, use whatever you prefer but i would recommend Tailscale.