for the private networking problem, openziti (apache 2.0) is now integrated with Nix:
github.com/rochecompaan/openziti-nix
if your focus is trying it rather than distributing consistent versions to many folks, you can also use the ziti-edge-tunnel binary, define a systemd service and add identities (a given app or device can belong to (n) OpenZiti overlays via (n) different identities).