I've started playing around with Tailscale [1], which is based on WireGuard. Free to use for a single user, and I've tried it out on Raspberry Pi, Linux x86_64, Windows and Android. Seems to work well, except there appears to be some issue with accessing Windows via the secure IP (neither ping nor Remote Desktop appear to get through the Windows firewall, despite having a specific firewall rule for Tailscale) [2]. Can SSH into e.g. Linux hosts using PuTTY from Windows without issues.

[1] https://tailscale.com/

[2] https://github.com/tailscale/tailscale/issues/854

Pivpn is beginner-friendly and you can always branch off from there.

https://www.pivpn.io

the idea is that your hetzner server acts as a gateway and you can communicate with your pi through the virtual private network, therefore removing any need to access through public ip.