> it's a pain because of NAT/port forwarding

Tailscale or zerotier. It's a solved problem. You don't need to use a vps at all.