We are digital librarians. Among us are represented the various reasons to keep data -- legal requirements, competitive requirements, uncertainty of permanence of cloud services, distaste for transmitting your data externally (e.g. government or corporate espionage), cultural and familial archivists, internet collapse preppers, and people who do it themselves so they're sure it's done right. Everyone has their reasons for curating the data they have decided to keep (either forever or For A Damn Long Time (tm) ). Along the way we have sought out like-minded individuals to exchange strategies, war stories, and cautionary tales of failures.
I'd do directly Wireguard (this is what Tailscale uses but it's clear and controllable instead of more automagical). Openvpn or even directly openssh (of course configured with pubkeys) would be similar (run everything on non-standard ports to keep things quieter, and a non-standard user if applicable).
You can do local encryption there too, with LUKS, zfs, ecryptfs or even rclone (actually you can do it locally with rclone so the remote never sees cleartext).