You can sidestep the cloud stuff if you've got a static IP and wireguard.

I have so far failed at setting up wireguard in my home, much less making it work with HASS.

Can you share some pointers?

https://github.com/anderspitman/awesome-tunneling