

Nice explanation =). I am not OP but I am curious about one point: you seem to have the reverse proxy on your homeserver, not on the VPS.
Is wireguard enough then to tunnel HTTPS traffic to your reverse proxy? Or do you need a more sophiscated tunnel (e.g. ngrok, boringproxy).
P.S. I actually assumed that your VPN entry point is a VPS with a public, static IP. Therefore I understood that your were talking about two servers: the home server with the reverse proxy and a VPS as wireguard entry point. Please correct if this is wrong.
From what I read, using anything but Synapse requires to compromise on features/compatibility. I know this is not the dev’s fault, it’s from the way the Matrix spec evolve. Do you know of any resource regarding the current features/compatibility of tuwunel/conduwuit? I am particularly curious about: