If you can use Wireguard that is probably a good solution but I would still prefer to have a cloud proxy in front of it because my network can not handle all the attacks and wouldn’t even notice some of them if you use just Wireguard.

I use CF Tunnels firstly because of all the protections and traffic analysis it does, and secondly, because even DDNS wouldn’t work on my network.