Tailscale or Netbird is a good approach. They both have a SaaS control plane where you can sign devices up, and you'll connect to your home server via its VPN-internal IP.
Note that headscale or netbird cannot be hosted via Cloudflare Tunnels, as they require websockets support and/or UDP for STUN. You may just wanna rent a VPS for that.
For hosting a website publicly, you may employ reverse proxies on the Tailscale/Netbird nodes like my setup