Or Netbird, both work very well and Netbird can be completely self hosted; Tailscale requires Headscale AFAIK.

I have indeed seen that XO-CE script. But is it true that you have to delete and recreate the container, rather than just doing apt update? AFAIK XO_CE is just a debian VM.