I’m not a fan of VPNs for cases like this, but that is a personal preference. I’m using a TLS client certificate with my nginx as load balancer which works very well for me. I have installed that certificate on every PC and my Android device. Let’s Encrypt also works, but for every self hosted service a client certificate is required