I didn't care about the AWS and zsh aspects of the article, but what vendor lock-in are you talking about and how exactly would an ansible playbook sort it?

All you need is any ubuntu vps - in fact any systemd distro if you ignore the "ufw" commands - and the 50 or so lines following "Wireguard Setup".

It doesn't get more simple than this.