Agree on Wireguard. It is faster, more stable and most likely more secured than SSH. And it will work with any application (no per-application configuration required). Without a third party tunneling service, you will need to expose a port in any case (you can setup port-knocking if you want to).