Tailscale is incredibly simple to set up, and just worked when I connected a Google Cloud VPC+subnets. One problem though: There's no way for a server to maintain an auth token for more than three months. You have to manually renew it.