In this case it really is easy. It's just wireguard with some NAT negotiation sauce and convenient auth layer.

You're doing the Dropbox rsync comment.