BGP is usually where I tap out because I never got that far in my Cisco courses.
I had to do the wireguard tunnel because I moved to a place with CG-NAT.
And then I just routed all relevant ports to the virtual ip with iptables so it dNATs or whatever.
I did this all because I didn't want to mess with nginx reverse (real) proxy, and prefer letting the network layer handle networking.