Doing it safely is pretty simple.

Install Tailscale at both ends. Done.

It's a fully encrypted mesh VPN.

If you need access without the TS client on the other end, that takes a little more work. Then you need to enable the Funnel option.