Guess that is why there isn't an easy go to solution yet. But it's well needed.
Check out https://github.com/psviderski/uncloud I'm building. Multi-machine deployments and a private WireGuard network spanning locations (even behind a NAT) are its core capabilities.