Maybe tailscale can solve it. My server is at home, but my external IP is with tailscale.

Would require a csp, hence aws

I guess tailscale doesn't route internet traffic into your network without permission anyways. Dang. I need a VPN provider like mullvad that will expose their ports.