[mcsniff]

Tailscale, and Headscale to fit your on-prem request.

I still run my own WireGuard server at home for getting on my internal LAN, but Tailscale for side projects is great.