Out of curiosity why the complex networking setup instead of, say, tailscale. What kind of flexibility does it give you that makes up for the infrastructure?
Even if you'd make an exception for Tailscale, that'd require settonv up and exposing an OIDC provider under a public domain with TLS, which comes with its own complexities.
I actually greatly simplified my infrastructure in the blog... there's a LOT going on behind those network switches. it took quite a bit of effort for me to be able to say "I'm comfortable exposing my servers to the internet".
none of this stuff uses the cloud at all. if johnthenerd.com resolves, everything will work just fine. and in case I lose internet access, I even have split-horizon DNS set up. in theory, everything I host would still be functional without me even noticing I just lost internet!