I want to setup a way to access my mobile home office subnet (behind cellular which doesn't allow incoming) and two other subnets sites and some mobile devices which come and go.
There's a third party open source server, too: https://github.com/juanfont/headscale
(I just use the free hosted backend, obviously you trust them to do the key exchange)
----
The managed backend/NAT broker is free up to 50 machines, or you can run the open source server yourself.
It's a bit boring but in a situation like yours the most straightforward way would be to set up WireGuard gateways at each of your sites and have them talk to each other and the mobile devices.