Appreciate the post, OP. If you're concerned about privacy long-term, consider using a no-logs VPN service along with wireguard on your VPS. Also, for NAT traversal, enable the persistent keepalive setting in your config - like keepalive 25 - that helps a lot in tricky network scenarios.