Wireguard is the thing I would use. The fact that non other than Linus Torvalds called wireguard "a piece of art" may or may not be a selling factor.

It is small, lightweight, reliable and does what it is meant to do. It uses existing, trusted network tech in the right ways and due to the low complexity you reading the source code is an realistic option.